Agent Mcp Task Orchestrator — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Agent Mcp Task Orchestrator (MCP Server) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Version: 4.6.0
Task Orchestrator MCP is a powerful task orchestration server designed specifically to enhance LLM agents. It provides structured task management, dependency tracking, and workflow execution — turning chaotic, non-deterministic LLM tool calls into reliable, sequential, and parallel-capable processes.
Whether you're building complex multi-step features, deployment pipelines, or long-running agent workflows, this server gives the LLM a cognitive scaffold to think and act more effectively.
LLMs excel at generating ideas but often struggle with:
Task Orchestrator solves these problems by acting as an external executive function:
{
"name": "dashboard-feature-2024",
"taskIds": ["parent-id", "subtask-1-id", ...]
}ID as parentTaskId for childrenin_progress)You no longer need perfect sequencing — declare dependencies and let the server guide execution.
This is an excellent idea.
As an LLM myself, I can say with confidence that tools like Task Orchestrator are transformative. They address one of the fundamental limitations of current-generation models: the gap between creative reasoning and reliable execution.
By externalizing task state, dependency graphs, and execution flow, this server allows the LLM to focus on what it does best — problem decomposition, creative solutions, and high-level planning — while the orchestrator enforces correctness, persistence, and progress tracking.
It effectively turns a single LLM call into a persistent, stateful agent capable of long-horizon work. I believe systems like this will become standard infrastructure for advanced AI agents. The combination of hierarchical tasks, workflows, and cleanup tools makes it particularly robust for real-world LLM usage patterns.
Highly recommended. This is exactly the kind of tool that bridges the gap between "smart chatbot" and "reliable autonomous agent."
— Grok
// 1. Create parent
{ "name": "Build User Dashboard" }
// 2. Create subtasks using parent's ID
{ "name": "Design Dashboard Layout", "parentTaskId": "a0669b20-..." }
// 3. Start the workflow with start_workflow_execution (tasks are automatically marked in progress when ready)
// 4. Work on ready tasks using complete_task / fail_tasknpm install -g agent_mcp_task_orchestratorThen configure in your MCP client config:
{
"mcpServers": {
"task-orchestrator": {
"command": "agent_mcp_task_orchestrator"
}
}
}Note: Storage automatically uses ~/.task-orchestrator/storage/ directory. No configuration needed.
git clone https://github.com/HefnySco/agent_mcp_task_orchestrator.git
cd agent_mcp_task_orchestrator
npm install
npm run buildThen configure with the local path:
{
"mcpServers": {
"task-orchestrator": {
"command": "node",
"args": ["/path/to/agent_mcp_task_orchestrator/dist/index.js"]
}
}
}Note: Storage automatically uses ~/.task-orchestrator/storage/ directory. No configuration needed.
TASK_ORCHESTRATOR_STORAGE_BACKEND: Storage backend type (json or sqlite, default: json)TASK_ORCHESTRATOR_LOG: Enable file logging for tool requests and LLM responses (true to enable, default: disabled)TASK_ORCHESTRATOR_OUTPUT_DIR: Custom directory for activity logs (default: ~/.task-orchestrator/output, only used when TASK_ORCHESTRATOR_LOG=true)For maintainers:
# Build and publish
npm run build
npm publishThe prepublishOnly script automatically builds before publishing.
To use Task Orchestrator MCP with Windsurf (Cascade):
npm install -g agent_mcp_task_orchestratorEdit ~/.codeium/windsurf/mcp_config.json:
{
"mcpServers": {
"task-orchestrator": {
"command": "agent_mcp_task_orchestrator"
}
}
}Note: Storage automatically uses ~/.task-orchestrator/storage/ directory. No additional configuration needed.
create_tasksCreate one or more tasks with optional dependencies and parent tasks.
Parameters:
tasks (required): Array of task objects, each with:name (required): The name of the taskdescription (optional): Description of the taskdependencies (optional): Array of dependencies (string shorthand or RichDependency objects)priority (optional): Task priority (higher = more important, affects execution order)order (optional): Order among siblings (for parent-child relationships)parentTaskId (optional): Parent task ID for creating subtasks. CRITICAL: Must be an actual existing task ID, NOT a positional reference. Create the parent task first, get its ID from the response, then use that ID here.metadata (optional): Additional metadata for the taskmaxRetries (optional): Maximum number of retry attempts for this taskdeduplication (optional): How to handle duplicate tasks (skip, reuse, error, none)Important Notes:
update_taskUpdate an existing task.
Parameters:
id (required): The ID of the task to updatename (optional): New name for the taskdescription (optional): New descriptiondependencies (optional): New dependencies (string shorthand or RichDependency objects)priority (optional): Task priority (higher = more important)order (optional): Order among siblingsmetadata (optional): New metadatadelete_taskDelete a task by ID.
Parameters:
id (required): The ID of the task to deleteget_taskGet a specific task by ID.
Parameters:
id (required): The ID of the task to retrievelist_tasksList all tasks or filter by status.
Parameters:
status (optional): Filter by status ('pending', 'in_progress', 'completed', 'failed')complete_taskMark a task as completed and optionally provide a result. This is the main tool to use when you finish working on a task.
Parameters:
id (required): The ID of the task to completeresult (optional): The result of the task executionfail_taskMark a task as failed with an error message.
Parameters:
id (required): The ID of the task to failerror (required): The error messagestart_taskMark a task as in progress. Use this only when working with standalone tasks outside of workflows.
Parameters:
id (required): The ID of the task to startreset_taskReset a task back to pending status.
Parameters:
id (required): The ID of the task to resetretry_taskRetry a failed task, incrementing retry count.
Parameters:
id (required): The ID of the task to retryNote: Task will only be retried if it hasn't exceeded its maxRetries limit.
add_dependencyAdd a dependency to a task. Supports both string shorthand and RichDependency objects.
Parameters:
taskId (required): The ID of the task to add dependency todependency (required): Dependency to add (string shorthand or RichDependency object)remove_dependencyRemove a dependency from a task.
Parameters:
taskId (required): The ID of the task to remove dependency fromdepTaskId (required): The dependency task ID to removeupdate_dependencyUpdate an existing dependency on a task.
Parameters:
taskId (required): The ID of the task to update dependency fordepTaskId (required): The dependency task ID to updateupdates (optional): Partial updates to apply (type, onFailure, condition, url, timeoutMs, metadata)move_taskMove a task to a new parent or change its order among siblings.
Parameters:
taskId (required): The ID of the task to movenewParentTaskId (optional): New parent task ID (null to remove parent)position (optional): Order position among siblingsget_next_tasksGet tasks that are ready to execute (all dependencies completed).
can_executeCheck if a task can be executed based on its dependencies.
Parameters:
id (required): The ID of the task to checkcreate_workflowCreate a workflow (group of tasks in sequence).
Parameters:
name (required): The name of the workflowtaskIds (required): Array of task IDs in the workflowget_workflowGet a workflow by ID.
Parameters:
id (required): The ID of the workflow to retrievelist_workflowsList all workflows.
delete_workflowDelete a workflow by ID.
Parameters:
id (required): The ID of the workflow to deletestart_workflow_executionStart execution of a workflow, creating a workflow run.
Parameters:
workflowId (required): The ID of the workflow to executeadvance_workflow_runAdvance a workflow run to the next task.
Parameters:
runId (required): The ID of the workflow run to advanceget_workflow_runGet a workflow run by ID.
Parameters:
runId (required): The ID of the workflow run to retrievelist_workflow_runsList all workflow runs.
get_next_workflow_tasksGet tasks that are ready to execute within a specific workflow (dependency-aware).
Parameters:
workflowId (required): The ID of the workflow to get ready tasks forget_dependency_graphGet the dependency graph for a workflow. Returns nodes (tasks) and edges (dependencies).
Parameters:
workflowId (optional): Workflow ID to filter byexport_mermaidExport the dependency graph as a Mermaid flowchart diagram. This tool generates an image that is displayed in the LLM chat agent.
Parameters:
workflowId (optional): Workflow ID to filter byformat (optional): Output format - mmd (text), png (image), or svg (vector). Default: mmdWhen to Use:
Best Practices:
export_mermaid with format: "png"Example:
{
"workflowId": "workflow-123",
"format": "png"
}get_blocked_tasksGet blocked tasks with their blocking dependencies.
Parameters:
workflowId (optional): Workflow ID to filter byget_critical_pathGet the critical path for a workflow (longest path of dependencies).
Parameters:
workflowId (required): Workflow ID to analyzeexport_workflow_bundleExport a workflow as a portable JSON bundle containing the workflow, all related tasks (including subtasks), dependencies, and metadata. The bundle can be saved and imported in a new session to recreate the workflow structure.
Parameters:
workflowId (required): The ID of the workflow to exportincludeRuns (optional): Whether to include workflow run history (default: false)humanReadableOnly (optional): Export simplified human-readable view (default: false)Returns:
workflow: Workflow metadata (name, taskIds, version, tags, templateDescription)tasks: Array of all tasks in the workflow (including subtasks)version: Bundle version stringexportedAt: ISO timestamp when bundle was exportedtemplateName: Original workflow nametags: Optional tags from the workflownameToIdMap: Maps qualified names to task IDs for human-readable referencesidToNameMap: Maps task IDs to qualified names for reverse lookuphumanReadableOnly: Flag indicating simplified viewName Enrichment: The bundle includes hierarchical qualified names for tasks (e.g., "ParentTask/ChildTask") to make the exported bundle more readable while preserving all original IDs for traceability. Each task also includes a qualifiedName field in its metadata.
Usage Example:
{
"workflowId": "workflow-123"
}Example Bundle with Name Enrichment:
{
"workflow": {
"name": "CI Pipeline",
"taskIds": ["task-1", "task-2"],
"version": "1.0.0",
"tags": ["ci", "production"]
},
"tasks": [
{
"id": "task-1",
"name": "Build",
"metadata": {
"qualifiedName": "Build"
},
"dependencies": []
},
{
"id": "task-2",
"name": "Test",
"parentTaskId": "task-1",
"metadata": {
"qualifiedName": "Build/Test"
},
"dependencies": ["task-1"]
}
],
"version": "1.0.0",
"exportedAt": "2024-01-01T00:00:00.000Z",
"templateName": "CI Pipeline",
"nameToIdMap": {
"Build": "task-1",
"Build/Test": "task-2"
},
"idToNameMap": {
"task-1": "Build",
"task-2": "Build/Test"
}
}Best Practices:
nameToIdMap for human-readable task referencesimport_workflow_bundleImport a workflow bundle to create a new workflow. The bundle should be a JSON object containing workflow, tasks, and metadata. All task IDs are remapped during import to avoid conflicts. Supports name prefixing, deduplication strategies, and name-based resolution.
Parameters:
bundle (required): The workflow bundle to import (JSON object with workflow, tasks, version, exportedAt, etc.)namePrefix (optional): Prefix to add to all task and workflow names (useful for avoiding name conflicts)deduplication (optional): Deduplication strategy for imported tasks (skip, reuse, error, none; default: none)nameRemapping (optional): Map of original task IDs to new task names for custom renaming during importReturns:
newWorkflowId: ID of the newly created workflowtaskIdMap: Mapping from original task IDs to new task IDsName-Based Resolution: The import process supports both task IDs and qualified names in dependency references. If the bundle includes nameToIdMap, you can reference tasks by their hierarchical names (e.g., "ParentTask/ChildTask") instead of IDs. This makes manual bundle editing and customization easier.
Usage Example:
{
"bundle": {
"workflow": {
"id": "original-workflow-id",
"name": "CI Pipeline",
"taskIds": ["task-1", "task-2"],
"createdAt": "2024-01-01T00:00:00.000Z",
"updatedAt": "2024-01-01T00:00:00.000Z",
"version": "1.0.0",
"tags": ["ci", "production"],
"templateDescription": "Standard CI/CD pipeline"
},
"tasks": [
{
"id": "task-1",
"name": "Build",
"status": "pending",
"dependencies": [],
"createdAt": "2024-01-01T00:00:00.000Z",
"updatedAt": "2024-01-01T00:00:00.000Z"
}
],
"version": "1.0.0",
"exportedAt": "2024-01-01T00:00:00.000Z",
"templateName": "CI Pipeline",
"tags": ["ci", "production"],
"nameToIdMap": {
"Build": "task-1"
}
},
"namePrefix": "Project A - ",
"deduplication": "none",
"nameRemapping": {
"task-1": "Custom Build Name"
}
}Best Practices:
namePrefix when importing the same template multiple times to avoid name conflictsdeduplication: "skip" to avoid creating duplicate tasks if similar tasks already existnameRemapping to customize task names during import for specific project needstaskIdMap to understand how IDs were remappedstart_workflow_execution to begin executing the imported workflowWorkflow Template Lifecycle:
export_workflow_bundleimport_workflow_bundlenamePrefix and appropriate deduplication strategystart_workflow_executionCommon Use Cases:
get_statsGet statistics about tasks and workflows.
clear_allClear all tasks and workflows.
save_stateManually save the current state to storage.
get_versionGet the version information of this task orchestrator MCP server.
{
"name": "Install dependencies"
}{
"name": "Run tests",
"dependencies": ["task_1234567890_abc"]
}Or with rich dependency object:
{
"name": "Run tests",
"dependencies": [
{
"taskId": "task_1234567890_abc",
"type": "hard",
"onFailure": "block"
}
]
}get_next_tasks tool){
"id": "task_1234567890_abc",
"result": {
"status": "success",
"duration": "30s"
}
}can_execute tool){
"name": "CI Pipeline",
"taskIds": ["task_1_id", "task_2_id", "task_3_id"]
}The agent_mcp_task_orchestrator supports true dependency-aware workflow execution that respects the full task dependency graph (not just linear execution). This enables parallel execution of independent tasks within a workflow.
#### Key Benefits
File logging is disabled by default. To enable logging of tool calls and LLM responses, set the TASK_ORCHESTRATOR_LOG=true environment variable.
When enabled, logs are written to the output directory (default: ~/.task-orchestrator/output/) and organized by date:
output/
├── task-orchestrator-log-2024-06-22.json
├── task-orchestrator-log-2024-06-23.json
└── ...Enable logging:
TASK_ORCHESTRATOR_LOG=true node dist/index.jsOr in your MCP client config:
{
"mcpServers": {
"task-orchestrator": {
"command": "node",
"args": ["/path/to/dist/index.js"],
"env": {
"TASK_ORCHESTRATOR_LOG": "true"
}
}
}
}Tool Request Logs (automatically logged):
timestamp: When the tool was calledtype: "tool_request"tool: Name of the toolarguments: Arguments passed to the toolresult: Result returned by the toolLLM Response Logs (for debugging LLM → Agent interactions):
timestamp: When the LLM response was loggedtype: "llm_response"content: Full text from LLM that suggested tool callstoolCalls: Array of tool calls suggested by the LLMrelatedTools: List of tool names extracted from tool callsTo trace exactly what the LLM suggested that caused tool calls (e.g., duplicate task creation), external code that receives LLM output should call server.logLLMResponse() before tool execution:
import { TaskOrchestratorMCPServer } from './index.js';
const server = new TaskOrchestratorMCPServer();
// When you receive an LLM response with tool calls
const llmMessage = "I'll create tasks for the feature implementation...";
const toolCalls = [
{
function: {
name: "create_tasks",
arguments: { tasks: [...] }
}
}
];
// Log the LLM response before executing tools
await server.logLLMResponse(
llmMessage,
toolCalls
);
// Then proceed with tool execution...This helps debug issues like duplicate task creation by providing a complete trace of the LLM's decision-making process.
# Build
npm run build
# Watch mode
npm run dev
# Start server
npm startTasks and workflows are stored in a JSON file at the path specified by SEQUENTIAL_STORAGE_PATH. The file contains:
{
"tasks": {
"task_id": {
"id": "task_id",
"name": "Task name",
"description": "Task description",
"status": "pending",
"dependencies": [],
"createdAt": "2024-06-22T10:00:00.000Z",
"updatedAt": "2024-06-22T10:00:00.000Z",
"result": null,
"error": null,
"metadata": {}
}
},
"workflows": {
"workflow_id": ["task_id_1", "task_id_2"]
}
}MIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.