Trello Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Trello Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Universal Model Context Protocol server for Trello. Works with any MCP-compatible client: Cursor, Claude Desktop, Gemini CLI, Codex, OpenCode, and others.
Read and update Kanban cards on allowlisted boards only. Credentials stay in environment variables; nothing is logged.
TRELLO_API_KEY and TRELLO_TOKEN in your MCP clientNo need to hunt for board ids on first install.
Set TRELLO_ALLOWED_BOARD_IDS in the MCP env and skip onboarding.
optionalDependencies (esbuild-style)npx -y @thadeu/trello-mcp works on any machine, any Node version (the launcher is trivial)binary per platform; the npx/trello-mcp launcher is plain CommonJS and runs on any Node version (even 14) — no fnm/nvm gymnastics.
| Variable | Required | Description |
|---|---|---|
TRELLO_API_KEY | yes | API key from Trello Power-Up admin |
TRELLO_TOKEN | yes | User token with read,write scope |
TRELLO_ALLOWED_BOARD_IDS | no | Comma-separated board ids. Optional — see Onboarding |
TRELLO_CONFIG_PATH | no | Override config file path (default: ~/.config/trello-mcp/config.json) |
Copy .env.example when developing locally. MCP clients pass these via env in server config.
npx -y @thadeu/trello-mcpOr install globally:
npm install -g @thadeu/trello-mcp@latestnpm automatically pulls the prebuilt binary for your platform (@thadeu/trello-mcp-<os>-<arch>) through optionalDependencies.
git clone https://github.com/thadeu/trello-mcp.git
cd trello-mcp/cli
go build -o trello-mcp .
./trello-mcp # runs the MCP server over stdioCross-compile every platform package (requires Go + Bun):
bun install
bun run build # → npm/<platform>/bin/trello-mcpWhen TRELLO_ALLOWED_BOARD_IDS is not set and no config file exists yet, the server starts in onboarding mode:
// ~/.config/trello-mcp/config.json
{
"allowedBoardIds": ["56c215abc7af5016b9bceadb"],
"updatedAt": "2026-06-23T23:00:00.000Z"
}TRELLO_ALLOWED_BOARD_IDS env var — always wins~/.config/trello-mcp/config.json)If the env var is set, the config file is ignored. Use the env var when you want explicit, portable MCP config. Use onboarding or the config file when you prefer zero board-id setup.
Typical first-run conversation:
You: Set up Trello for me
Agent: calls get_setup_status → onboarding_required: true
Agent: calls list_available_boards → [{ id, name, url }, ...]
Agent: asks which board(s) to use
You: AS DEV
Agent: calls select_allowed_boards → saves config, tools unlocked
You: List cards in QA
Agent: calls list_cards → worksSteps:
TRELLO_API_KEY and TRELLO_TOKENget_setup_status — check if onboarding is neededlist_available_boards — list boards from your Trello accountselect_allowed_boards — pass the chosen board idsIf credentials are in ~/.cursor/mcp.json, just run:
trello-mcp onboardCredential sources (in order): shell env → .env → ~/.config/trello-mcp/.env → ~/.cursor/mcp.json → interactive prompt.
Or export manually:
export TRELLO_API_KEY=your_key
export TRELLO_TOKEN=your_token
trello-mcp onboardFor ~/.config/trello-mcp/.env, use KEY=value or export KEY=value (both work).
Interactive prompt lists boards by number, id, or name. Re-run with --force to change the saved boards.
Trello URLs look like https://trello.com/b/Nh2gYTTn/as-dev.
| Value | Example | Works in config? |
|---|---|---|
| Board id | 56c215abc7af5016b9bceadb | yes |
| URL short code | Nh2gYTTn | no |
Onboarding returns the correct board id for each board. You do not need to copy it manually unless setting TRELLO_ALLOWED_BOARD_IDS by hand.
All clients use the same pattern: spawn trello-mcp (or npx) over stdio and inject env vars.
{
"mcpServers": {
"trello": {
"command": "npx",
"args": ["-y", "@thadeu/trello-mcp"],
"env": {
"TRELLO_API_KEY": "your_key",
"TRELLO_TOKEN": "your_token"
}
}
}
}Use "command": "trello-mcp" if installed globally.
{
"mcpServers": {
"trello": {
"command": "npx",
"args": ["-y", "@thadeu/trello-mcp"],
"env": {
"TRELLO_API_KEY": "your_key",
"TRELLO_TOKEN": "your_token",
"TRELLO_ALLOWED_BOARD_IDS": "56c215abc7af5016b9bceadb"
}
}
}
}Multiple boards: "board_id_1,board_id_2".
~/.cursor/mcp.json or project .cursor/mcp.json — use either config above.
~/Library/Application Support/Claude/claude_desktop_config.json (macOS):
{
"mcpServers": {
"trello": {
"command": "npx",
"args": ["-y", "@thadeu/trello-mcp"],
"env": {
"TRELLO_API_KEY": "your_key",
"TRELLO_TOKEN": "your_token"
}
}
}
}{
"mcpServers": {
"trello": {
"command": "trello-mcp",
"env": {
"TRELLO_API_KEY": "your_key",
"TRELLO_TOKEN": "your_token"
}
}
}
}Consult Gemini CLI MCP docs for the exact config file path on your platform.
{
"mcp": {
"trello": {
"type": "stdio",
"command": ["npx", "-y", "@thadeu/trello-mcp"],
"environment": {
"TRELLO_API_KEY": "your_key",
"TRELLO_TOKEN": "your_token"
}
}
}
}Adjust keys to match your client schema; the server binary and env vars stay the same.
| Tool | Description |
|---|---|
get_setup_status | Check whether board onboarding is required |
list_available_boards | All accessible boards (used during onboarding) |
select_allowed_boards | Save user-selected boards and unlock other tools |
| Tool | Description |
|---|---|
list_boards | Boards filtered by allowlist |
list_lists | Lists on a board |
list_cards | Cards on a board or list |
get_card | Single card details with attachments (PR links, files) |
list_attachments | Attachments on a card (GitHub PR links, URLs, uploads) |
list_card_members | Members assigned to a card (id, username, full name) |
create_card | New card in a list |
update_card | Update name, description, due date, labels, archive |
move_card | Move card to another list |
add_comment | Add comment to a card |
archive_card | Archive (close) a card |
add_attachment | Attach a URL or local file to a card |
TRELLO_TOKEN like a password; never commit it.TRELLO_ALLOWED_BOARD_IDS.no prebuilt binary for <platform>-<arch>npm did not install the platform package. Most common cause: installing with --no-optional / --omit=optional. Reinstall without it:
npm install -g @thadeu/trello-mcp # not --no-optionalSupported platforms are macOS and Linux on x64/arm64. The binary is native Go and does not depend on your Node version — old-Node errors like SyntaxError: Unexpected token '??=' (from the previous JS build) no longer apply.
The server is written in Go (cli/). The root npm package is a thin launcher plus build scripts (run with Bun).
cd cli && go run . # run the server over stdio
cd cli && go test ./... # tests
cd cli && go vet ./... # vet
bun run build # cross-compile all platforms → npm/<platform>/
bun run build:local # only the current platform
bun run inspector # build + MCP InspectorLayout:
cli/ Go MCP server (main, client, config, tools, onboard)
bin/trello-mcp.js launcher: resolves the platform binary and execs it
scripts/build-binaries.ts cross-compile + emit per-platform npm packages
npm/<os>-<arch>/ build output (gitignored): binary + package.jsonTag a version to cross-compile, publish, and create a GitHub release:
git tag v0.2.0
git push origin v0.2.0Workflow .github/workflows/release.yml:
bun run build)@thadeu/trello-mcp-<os>-<arch> package to npm@thadeu/trello-mcp (with matching optionalDependencies)Bump version in package.json and the optionalDependencies versions together (the build script fails if they drift).
@thadeu scopeNPM_TOKEN in GitHub → Settings → Secrets → ActionsMIT — Copyright (c) 2026 Thadeu Esteves. See LICENSE.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.