# @perforce/p4plan-mcp P4 Plan MCP (Model Context Protocol) Server - **Type:** MCP server - **Trust:** 85/100 (A), scored on the package rubric - **Verification:** verified (build provenance) - **Version:** 2026.3.1 - **Author:** Perforce Software, Inc. - **License:** MIT - **npm:** @perforce/p4plan-mcp - **Source:** https://github.com/perforce/p4plan-mcp - **Compatible clients:** claude-code, cursor, copilot, gemini (basis: transport) ## Trust 85/100 (A), scored on the package rubric - Publisher verified: no - Build provenance: verified attestation - npm trusted publishing (OIDC): yes - Install scripts: nothing suspicious found - Prompt-injection scan: not run - Obfuscation scan: not run - Evidence age: 0 days ## Security scan - **Status:** clean - **Scanned:** 2026-09-24T22:21:01.037Z - **Version scanned:** 2026.3.1 - **CVEs:** none found by OSV at scan time ## Tools 28 declared. Statically extracted from the shipped source — a floor on the surface, not a census. - `list_projects` — List all active projects the current user is a member of. Returns project IDs and names backlogID (needed for backlog operations) and qaID (needed for bug opera - `get_project` — Get a project's configuration and section IDs. Returns backlogID (needed for backlog operations) and qaID (needed for bug operations). The project ID itself is - `read_skill` — Read a P4 Plan skill document. Skills provide detailed syntax and usage guides. - `commit_to_sprint` — Commit a backlog task or bug to a sprint for execution. - `uncommit_from_sprint` — Remove a backlog task or bug from its sprint, returning it to the backlog. The task is not deleted — only the sprint association is removed. - `get_comments` — Get all comments on a task or item. Returns comment text, author, and timestamp for each comment. - `post_comment` — Post a comment on a task or item. Use for posting questions, acceptance criteria, blockers, or general discussion. Comment text is sanitized HTML — call read_sk - `get_attachments` — List all attachments on a task. Returns attachment details including path, size, and whether it is the cover image. Use download_attachment to retrieve the actu - `download_attachment` — Download and return the actual content of an attachment file. Use get_attachments first to find available paths. - `delete_attachment` — Delete an attachment from a task. Use get_attachments first to find the attachment path. - `set_cover_image` — Set or unset the cover image for a task. The attachment must be an image that is already attached to the task. - `update_comment` — Edit the text of an existing comment. Get comment IDs from get_comments first. Comment text is sanitized HTML — call read_skill with skillName="comment-html-for - `delete_comment` — Delete a comment from a task. This action cannot be undone. Get comment IDs from get_comments first. - `get_tasks` — Get full details of one or more items by ID (max 20). Works for BacklogTask, ScheduledTask, Bug, Sprint, and Release. Returns status, assignments, workflow stat - `search_tasks` - `create_item` — Create a new item in P4 Plan. Supports creating BacklogTask, Bug, ScheduledTask, Sprint, Release, or SprintTask. The "type" parameter determines which item is c - `complete_task` — Mark a task as completed. Works for any task type (BacklogTask, ScheduledTask, Bug). - `start_task` — Mark a task as in-progress. Works for any task type (BacklogTask, ScheduledTask, Bug). - `update_item` — Update one or more properties on any P4 Plan item: BacklogTask, Bug, ScheduledTask, Sprint, or Release. Automatically detects the item type and applies the corr - `get_custom_columns` — Get custom column definitions for a project. Returns column IDs, names, types, and drop-list options. Call this before set_custom_field to discover available co - `get_custom_fields` — Get custom field values set on a task. Returns all custom fields with their current values. - `set_custom_field` — Set a custom field value on a task. Get column IDs from get_custom_columns first. For drop lists, pass the option ID (not the display label). Pass empty string - `get_workflows` — Get all workflows defined in a project, including their statuses. Use this to find workflow status IDs for setting workflowStatusId on tasks. - `get_my_tasks` — Get all tasks assigned to the current user across all projects (their To Do List). Returns tasks, bugs, and scheduled items the user is responsible for. - `link_items` — Create a link between two items (internal) or from an item to a URL (external). For internal links provide toItemId; for external links provide url instead. Use - `unlink_items` — Remove a link between two items (internal) or from an item to a URL (external). For internal links provide toItemId; for external links provide url instead. - `get_current_user` — Get information about the currently authenticated user, including their name, emailAddress, and userLink (paste verbatim as the href when constructing @mentions - `list_project_users` — List all members of a project. Returns user IDs, names, and userLinks. Use the IDs with update_item (assignedTo) to assign work, and userLink as the href when c ## Install **Verdict: install** — No blocking findings and no open coverage gaps — safe to install as configured. **Config** (claude-code): ```json "{\n \"mcpServers\": {\n \"p4plan\": {\n \"command\": \"npx\",\n \"args\": [\n \"-y\",\n \"@perforce/p4plan-mcp\"\n ],\n \"env\": {\n \"P4PLAN_API_AUTH_TOKEN\": \"\"\n }\n }\n }\n}" ``` **Credentials it will ask for** (names only — Forge never holds a value): - `P4PLAN_API_AUTH_TOKEN` — P4plan API Auth Token (required) Placeholders only. Forge never holds, brokers, or transmits a credential value — replace each in your own config file. Do not send a value back to Forge; no Forge endpoint accepts one. - This entry needs 1 credential (1 required). The generated config carries placeholders, so it will fail in the editor rather than at runtime if they are left unset. ## Blast radius Extensive blast radius — deletes data; holds an api key. - Floor 53, ceiling 53 (tier: extensive) - This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score. ## Machine-readable views of this entry - Signed JSON: https://forgeregistry.com/api/v1/packages/%40perforce%2Fp4plan-mcp - Install plan: https://forgeregistry.com/api/v1/packages/%40perforce%2Fp4plan-mcp/install-plan - Alternatives: https://forgeregistry.com/api/v1/alternatives/%40perforce%2Fp4plan-mcp - HTML page: https://forgeregistry.com/registry/%40perforce%2Fp4plan-mcp - MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan` ## About this document Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.