Mcp Todo — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Mcp Todo (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A Model Context Protocol (MCP) server that uses Git as the backend for a collaborative todo system. Users interact via Claude Desktop or Claude Code, and changes sync through Git, leveraging Git's permission system and version control for team collaboration.
Claude Desktop ←→ MCP Server (Node.js) ←→ Local Git Repo ←→ Remote Git (GitHub/GitLab)Web Browser (Svelte) ←→ API Server (Express) ←→ MCP Server (Node.js) ←→ Local Git Repo ←→ Remote GitTelegram User ←→ Telegram Bot API ←→ TodoBot (Node.js) ←→ MCP Server (stdio) ←→ Local Git Repo ←→ Remote GitThe system provides three interfaces:
git clone https://github.com/yourusername/our_todo.git
cd our_todonpm installnpm run buildmkdir ~/my-todos
cd ~/my-todos
git init
git commit --allow-empty -m "Initial commit"
# Optional: Add remote repository
git remote add origin https://github.com/yourusername/my-todos.git
git push -u origin mainNote: The system will automatically create the directory structure on first use. If you have an existing todos.json file, it will be automatically migrated to the new directory structure with a backup created.
Add the following configuration to:
~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows).claude/config.json in your project directory{
"mcpServers": {
"git-todo": {
"command": "node",
"args": ["/absolute/path/to/our_todo/dist/index.js"],
"env": {
"TODO_REPO_PATH": "/Users/you/my-todos",
"TODO_REPO_URL": "https://github.com/you/my-todos.git",
"GIT_USER_NAME": "Your Name",
"GIT_USER_EMAIL": "[email protected]",
"AUTO_SYNC": "true",
"SYNC_INTERVAL_SECONDS": "300"
}
}
}
}Note: Replace /absolute/path/to/our_todo with the actual path to this repository on your system, and update the environment variables with your specific configuration.
If you've already configured the MCP server in Claude Desktop, you can easily add it to Claude Code by running:
claude mcp add-from-claude-desktopThis will automatically copy the configuration from your Claude Desktop setup to Claude Code.
The kanban board provides a visual interface for managing todos with drag-and-drop functionality, inline filtering, and real-time statistics.
The kanban board consists of two components:
.env file:cp .env.example .env
# Edit .env with your TODO_REPO_PATH and Git credentials# Terminal 1: Start backend
./start-backend.sh
# Terminal 2: Start frontend
./start-frontend.shThen open http://localhost:31415 in your browser.
Note: The startup scripts will use default values if environment variables are not set, but it's recommended to configure .env with your actual repository path.
See QUICKSTART.md for detailed instructions and troubleshooting.
# Install backend dependencies (if not already done)
npm install
# Install frontend dependencies
cd web
npm install
cd ..npm run buildOption A: Create a .env file (Recommended)
Create a .env file in the project root with your configuration:
cp .env.example .env
# Edit .env with your valuesExample .env file:
# Path to your Git repository for storing todos
TODO_REPO_PATH=/Users/you/my-todos
# Optional: Remote Git repository URL for syncing
TODO_REPO_URL=https://github.com/you/my-todos.git
# Git user configuration
GIT_USER_NAME=Your Name
[email protected]
# Optional: Auto-sync configuration
AUTO_SYNC=false
SYNC_INTERVAL_SECONDS=300
# API server configuration
PORT=3001
CORS_ORIGIN=http://localhost:5173
NODE_ENV=developmentOption B: Export environment variables manually
export TODO_REPO_PATH="/Users/you/my-todos"
export TODO_REPO_URL="https://github.com/you/my-todos.git"
export GIT_USER_NAME="Your Name"
export GIT_USER_EMAIL="[email protected]"# If using .env file, it will be loaded automatically
npm run start:apicd web
npm run devhttp://localhost:31415The API server uses the same environment variables as Claude Desktop/Claude Code:
TODO_REPO_PATH: Path to local Git repository (default: ~/my-todos)TODO_REPO_URL: Remote Git repository URL (optional)GIT_USER_NAME: Git user name for commitsGIT_USER_EMAIL: Git user email for commitsPORT: API server port (default: 3001)CORS_ORIGIN: CORS origin for web frontend (default: http://localhost:31415)NODE_ENV: Environment mode (development/production)The Telegram bot can be deployed using Docker for improved reliability and easier management. Docker provides automatic restarts, isolated environments, and simplified deployment.
Quick Start:
# 1. Create environment file
cp .env.telegram.example .env.telegram
# 2. Edit with your configuration
nano .env.telegram
# 3. Build and start
docker build -f Dockerfile.telegram -t todo-telegram-bot:latest .
docker compose -f docker-compose.telegram.yml up -d
# 4. View logs
docker logs -f todo-telegram-botFor detailed Docker deployment instructions, troubleshooting, and production setup, see Docker Deployment Guide.
For development with auto-reload:
# Terminal 1: Start API server in watch mode
npm run dev:api
# Terminal 2: Start web frontend in dev mode
cd web
npm run dev# Build backend
npm run build
# Build frontend
cd web
npm run build
cd ..# Start API server
npm run start:api
# In another terminal, preview the built frontend
cd web
npm run previewKanban Board Screenshot
The API server connects to the same Git repository as your Claude Desktop/Claude Code MCP server. This means:
Simply ensure both the MCP server (Claude Desktop config) and the API server use the same TODO_REPO_PATH.
TODO_REPO_PATH: Path to local Git repository (default: ~/my-todos)TODO_REPO_URL: Remote Git repository URL (optional)GIT_USER_NAME: Git user name for commitsGIT_USER_EMAIL: Git user email for commitsAUTO_SYNC: Enable automatic sync (true/false, default: false)SYNC_INTERVAL_SECONDS: Sync interval in seconds (default: 300)You can interact with your todos in two ways:
Once configured, you can use natural language commands in Claude:
text: Todo description (required)project: Project name (required)status: todo, in-progress, blocked, donepriority: low, medium, high, urgenttags: Array of tagsassignee: User assigned to the tododueDate: Due date in ISO 8601 formatdescription: Detailed descriptiondependencies: Array of todo IDs this depends onsubtasks: Array of subtaskscomments: Array of commentsTodos are stored in a directory structure for better scalability, artifact support, and reduced merge conflicts:
todos/
├── tasks/ # Primary storage
│ ├── {task-id}/
│ │ ├── task.json # Todo metadata
│ │ ├── README.md # Long descriptions (>300 chars)
│ │ └── artifacts/ # Attached files (future)
│ └── {task-id-2}/
│ └── task.json
├── by-project/ # Symlink views
│ ├── work/
│ │ └── {task-id} → ../../tasks/{task-id}/
│ └── personal/
│ └── {task-id} → ../../tasks/{task-id}/
├── by-status/
│ ├── todo/ → ../../tasks/{task-id}/
│ ├── in-progress/
│ ├── blocked/
│ └── done/
├── by-priority/
│ ├── urgent/
│ ├── high/
│ ├── medium/
│ └── low/
├── by-tag/
│ └── {tag}/ → ../../tasks/{task-id}/
└── by-assignee/
└── {user}/ → ../../tasks/{task-id}/Each task.json file contains:
{
"id": "uuid",
"text": "Task description",
"status": "todo",
"priority": "medium",
"project": "work",
"tags": ["backend", "urgent"],
"assignee": "user-id",
"createdBy": "user-id",
"createdAt": "ISO8601",
"modifiedAt": "ISO8601",
"dueDate": "ISO8601",
"completedAt": "ISO8601",
"dependencies": ["todo-id"],
"subtasks": [{"id": "uuid", "text": "Subtask", "completed": false}],
"comments": [{"id": "uuid", "user": "user-id", "text": "Comment", "timestamp": "ISO8601"}],
"fieldTimestamps": {
"text": "ISO8601",
"status": "ISO8601"
}
}If you have an existing todos.json file, it will be automatically migrated to the directory structure on first use:
todos.json.backupThe system uses a Last-Write-Wins (LWW) strategy at the field level:
fieldTimestampstask.json level, not globallymodifiedAt field# All tests
npm test
# Unit tests only
npm run test:unit
# Integration tests
npm run test:integration
# Test coverage
npm run test:coverage
# Watch mode
npm run test:watch/our_todo/
├── src/
│ ├── index.ts # MCP server entry point
│ ├── server/
│ │ └── MCPServer.ts # MCP tool handlers
│ ├── api/ # API server for web interface
│ │ ├── server.ts # Express server
│ │ ├── mcpClient.ts # MCP client for stdio communication
│ │ └── routes/
│ │ └── todos.ts # Todo REST API endpoints
│ ├── git/
│ │ ├── GitManager.ts # Git operations
│ │ ├── ConflictResolver.ts # LWW merge logic
│ │ └── SyncManager.ts # Sync coordination
│ ├── data/
│ │ ├── TodoRepository.ts # Todo CRUD operations
│ │ ├── DirectoryManager.ts # Task directory operations
│ │ └── SymlinkManager.ts # Symlink view management
│ └── types/
│ └── Todo.ts # Todo types and validation
├── web/ # Svelte 5 web frontend
│ ├── src/
│ │ ├── lib/
│ │ │ ├── components/ # Svelte components
│ │ │ │ ├── KanbanBoard.svelte
│ │ │ │ ├── KanbanColumn.svelte
│ │ │ │ ├── TodoCard.svelte
│ │ │ │ └── FilterBar.svelte
│ │ │ ├── stores/ # Svelte stores
│ │ │ │ └── todos.svelte.ts
│ │ │ └── types/ # TypeScript types
│ │ │ └── Todo.ts
│ │ ├── App.svelte # Main app component
│ │ └── main.ts # App entry point
│ ├── package.json
│ └── vite.config.ts # Vite configuration
├── tests/
│ ├── unit/ # Unit tests
│ ├── integration/ # Integration tests
│ └── performance/ # Performance benchmarks
├── docs/
│ ├── adr/ # Architecture Decision Records
│ └── releases/ # Release notes
└── dist/ # Compiled JavaScript
Example todo repository structure (~/my-todos/):
todos/
├── tasks/
│ └── {task-id}/
│ ├── task.json
│ ├── README.md (optional)
│ └── artifacts/ (future)
├── by-project/
├── by-status/
├── by-priority/
├── by-tag/
└── by-assignee/Current test coverage: ~94%
API Server not connecting to MCP server
npm run builddist/index.js existsWeb frontend can't connect to API
web/vite.config.tsPort already in use
PORT=3002 npm run start:apiCORS_ORIGIN=http://localhost:31415lsof -ti:3001 | xargs killTodos not syncing between interfaces
TODO_REPO_PATHIf sync fails:
cd ~/my-todos && git pullEnsure the MCP server has read/write access to:
MCP Server (Claude Desktop)
API Server
NODE_ENV=development for detailed loggingComprehensive documentation is available in the docs/ directory:
MIT
Built with:
For issues and questions, please open an issue on GitHub.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.