Todoist Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Todoist Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A Model Context Protocol (MCP) server for Todoist, hosted on Cloudflare Workers. Lets any AI assistant (Claude, GPT, Gemini, etc.) read and manage your Todoist tasks.
Built against the Todoist unified API v1 (https://api.todoist.com/api/v1). The older REST v2 / Sync v9 APIs are deprecated.Telegram message
↓
Your bot
↓
LLM (Claude / GPT / Gemini / etc.)
↓ calls tools via MCP JSON-RPC
This Worker ←→ Todoist APIThe Worker exposes a single POST / endpoint that speaks MCP JSON-RPC. Your bot connects to it and the LLM can call any of the 6 tools to read/write tasks.
You use Todoist's task/subtask hierarchy to simulate projects:
| Todoist concept | Your meaning |
|---|---|
| Top-level task (no parent) | "Project" — e.g. Create telegram assistant bot |
| Subtask (has parent_id) | Actual step — e.g. Set up todoist MCP |
| Top-level task (standalone) | Simple task — e.g. Mop the floor |
This matters for the AI: when you say "add a task to my Telegram bot project", the AI should find the parent task ID first, then call add_task with that parent_id.
| Tool | What it does |
|---|---|
get_tasks | List all tasks, optionally filtered. Use mode=tree to see subtasks nested under their parent. |
add_task | Create a top-level task or subtask (pass parent_id to nest it). |
update_task | Edit title, description, due date, priority, or labels. |
complete_task | Mark a task done. |
delete_task | Delete a task (and all its subtasks). |
move_task | Move a subtask under a different parent (different "project"), or promote to top-level. |
1 = Normal (default)2 = Medium3 = High4 = UrgentThe filter parameter accepts Todoist filter query syntax (e.g. "today", "overdue", "@work & p1"). When set, it takes precedence over mode/parent_id/label and returns a flat list.
npm installGet your Todoist token from todoist.com/app/settings/integrations/developer.
# Your Todoist API token
npx wrangler secret put TODOIST_API_TOKEN
# A shared secret your bot sends to authenticate to this Worker.
# Generate a long random string, e.g.: openssl rand -hex 32
npx wrangler secret put MCP_SECRETWhy MCP_SECRET? The Worker is on the public internet. Without this gate, anyone who finds the URL could read, edit, and delete your entire Todoist. Your bot must send it as Authorization: Bearer <MCP_SECRET> on every request.npm run deployYour endpoint: https://todoist-mcp.<your-subdomain>.workers.dev
# Put both secrets in .dev.vars (already gitignored):
# TODOIST_API_TOKEN=your_token_here
# MCP_SECRET=pick_a_long_random_string_here
npm run dev
# → http://localhost:8787See ai-system-prompt.md for the system prompt block to add to your Telegram bot so the AI knows how to use these tools correctly.
Every request needs the Authorization: Bearer <MCP_SECRET> header.
POST https://todoist-mcp.<your-subdomain>.workers.dev
Authorization: Bearer <your MCP_SECRET>
Content-Type: application/json
{
"jsonrpc": "2.0",
"id": 1,
"method": "tools/call",
"params": {
"name": "add_task",
"arguments": {
"content": "Set up todoist MCP",
"parent_id": "12345678",
"due_string": "tomorrow",
"priority": 3
}
}
}{ "jsonrpc": "2.0", "id": 1, "method": "tools/list", "params": {} }~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.