Trellio Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Trellio Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<!-- mcp-name: io.github.scaratec/trellio-mcp -->
An MCP server that gives Claude Desktop, Claude Code, and Gemini CLI full access to the Trello API. Built on the trellio async client library and the official Python MCP SDK. Developed following the BDD Guidelines v1.8.0.
one composite get_board_overview tool
trello://board/{id} andtrello://card/{id} for rich context loading
summarize_board, create_sprint,daily_standup as workflow shortcuts
python -m trello_mcp auth opensthe browser, user clicks "Allow", token stored securely
translated into clear, actionable MCP error messages
network surface
| Category | Tools | Count |
|---|---|---|
| Discovery | list_boards, search | 2 |
| Boards | get_board_overview, create_board, get_board, update_board, delete_board | 5 |
| Lists | list_lists, create_list, update_list, archive_list | 4 |
| Cards | list_cards, create_card, get_card, update_card, archive_card, unarchive_card, delete_card, add_label_to_card, remove_label_from_card | 9 |
| Labels | list_board_labels, create_label, update_label, delete_label | 4 |
| Checklists | list_card_checklists, create_checklist, delete_checklist, create_check_item, update_check_item, delete_check_item | 6 |
| Comments | list_comments, add_comment, update_comment, delete_comment | 4 |
| Members | get_me, list_board_members, get_member | 3 |
| Attachments | list_attachments, create_attachment, get_attachment, upload_attachment, download_attachment, delete_attachment | 6 |
| Webhooks | list_webhooks, create_webhook, get_webhook, update_webhook, delete_webhook | 5 |
Card tools support pos (top/bottom), idLabels (comma-separated), due (ISO 8601), and dueComplete (true/false) on create and update.
(add http://localhost:8095 to Allowed Origins)
npx @smithery/cli install gupta/trellio-mcp --client claudeTo install globally so the trellio-mcp command is available in your PATH:
pipx install trellio-mcpAlternatively, you can run it on-the-fly without installing:
pipx run trellio-mcp(Note: If you use `pipx run`, your MCP client configuration must also use `pipx` as the command and `run trellio-mcp` as arguments.)
pip install trellio-mcpgit clone https://github.com/scaratec/trellio-mcp.git
cd trellio-mcp
python3 -m venv .venv
.venv/bin/pip install -e ".[dev]"Run the auth command on each machine to connect your Trello account:
If you installed globally (pipx install or pip install):
TRELLO_API_KEY=your_api_key trellio-mcp authIf using on-the-fly execution (pipx run):
TRELLO_API_KEY=your_api_key pipx run trellio-mcp authThis opens a browser where you authorize the app. The token is captured automatically and stored in ~/.config/trellio-mcp/credentials.json (permissions 0600).
After auth, no environment variables are needed — the server reads stored credentials on startup.
If no stored credentials are found, the server falls back to environment variables:
export TRELLO_API_KEY=your_api_key
export TRELLO_TOKEN=your_tokenAdd to ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):
{
"mcpServers": {
"trello": {
"command": "pipx",
"args": ["run", "trellio-mcp"]
}
}
}If using env var auth instead of stored credentials, add:
"env": {
"TRELLO_API_KEY": "your_api_key",
"TRELLO_TOKEN": "your_token"
}Add to ~/.claude/settings.json or project .claude/settings.json:
{
"mcpServers": {
"trello": {
"command": "pipx",
"args": ["run", "trellio-mcp"]
}
}
}Add to ~/.gemini/settings.json:
{
"mcpServers": {
"trello": {
"command": "pipx",
"args": ["run", "trellio-mcp"]
}
}
}MCP Client (Claude / Gemini)
│ stdio (JSON-RPC)
▼
trellio-mcp (FastMCP)
│ async/await
▼
trellio (httpx)
│ HTTPS
▼
Trello APIKey decisions (documented in docs/adr/):
| ADR | Decision |
|---|---|
| 001 | Python MCP SDK for language alignment with trellio |
| 002 | stdio transport — no network attack surface |
| 003 | Stored credentials with env var fallback |
| 004 | 1:1 tool mapping — one tool per trellio method |
| 005 | trellio as PyPI dependency (>=1.4.0) |
| 006 | Tools + Resources + Prompts as MCP capabilities |
| 007 | isError=true + structured error content |
The project uses BDD with behave, following the BDD Guidelines v1.8.0.
PYTHONPATH=src .venv/bin/python -m behave17 features passed, 0 failed, 0 skipped
163 scenarios passed, 0 failed, 0 skipped
970 steps passed, 0 failed, 0 skippedTest architecture:
AsyncMock(spec=TrellioClient) — mock at the clientboundary, not HTTP
(§2.3)
See Case Study for a detailed account of the BDD-driven development process.
trellio-mcp/
├── src/trello_mcp/
│ ├── __init__.py # Tool registration
│ ├── __main__.py # Entry point (server + auth)
│ ├── server.py # FastMCP instance + client mgmt
│ ├── auth.py # OAuth flow + credential storage
│ ├── errors.py # Error translation (ADR 007)
│ ├── tools/ # 10 modules, 48 tools
│ ├── resources.py # 2 resource templates
│ └── prompts.py # 3 prompts
├── features/ # 17 BDD feature files
│ └── steps/ # Step definitions
├── docs/
│ ├── adr/ # 7 Architecture Decision Records
│ ├── tool-design.md # Scenario-driven tool analysis
│ └── case-study-bdd-mcp-server.md
└── pyproject.tomluv build
twine upload dist/trellio_mcp-<version>*Namespace is gupta. Update the release after a new PyPI version:
npx @smithery/cli mcp publish "https://github.com/scaratec/trellio-mcp" -n gupta/trellio-mcpAlso update the pinned version in smithery.yaml commandFunction.
This project is licensed under the GNU General Public License v3.0 — see the LICENSE file for details.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.