# com.donebear/donebear Local-first task manager: create, edit, and complete tasks, projects, and checklists via MCP. - **Type:** MCP server - **Trust:** 60/100 (B), scored on the content rubric - **Verification:** community-indexed — nobody has claimed this listing - **Version:** 1.0.0 - **Author:** com.donebear - **License:** Unknown - **Endpoints:** streamable-http https://mcp.donebear.com/mcp - **Source:** https://mcp.donebear.com/mcp - **Endpoint health:** reachable (last checked 2026-09-26T16:46:01.494Z, 5 samples) — uptime is not a security property and is not part of the trust score - **Compatible clients:** claude-code, cursor, copilot, chatgpt, gemini (basis: transport) ## Trust 60/100 (B), scored on the content rubric - Publisher verified: no - Install scripts: nothing suspicious found - Prompt-injection scan: clean - Obfuscation scan: clean - Evidence age: 0 days ## Security scan - **Status:** clean - **Scanned:** 2026-09-26T16:46:01.494Z - **Version scanned:** live - **CVEs:** no coverage — this entry has no package coordinates to query OSV against, so "no known CVEs" is NOT asserted for it. **Findings** - injection-shaped content (note) in the `attachment` tool: Imperative addressed to the AI model ## Tools 15 declared. Observed from a live `tools/list` probe. - `guide` — Read Done Bear's guide for one topic: what the data means, how it relates to the rest of the product, and how to use it well. Load a topic before doing that kin - `get_context` — Get a snapshot of the current workspace: task counts per view, recent open tasks, and every project, label, team and member. This is the tool that answers what - `task_list` — List tasks in the workspace, most recently updated first. Completed tasks are ordered by completion time, newest first. Filter by view (inbox, today, upcoming, - `task_show` — Get full details for a single task: its fields, labels and checklist items, by workspace-scoped task number. Add `include` for the parts that cost extra reads: - `task_add` — Create a new task. The `when` parameter controls which GTD view it appears in: today (default), inbox, upcoming, anytime, or someday. A new task lands in Today - `task_edit` — Update fields on one task (`task`) or on several at once (`tasks`, max 50). Only the provided fields are changed; omitted fields are left untouched. To remove a - `task_done` — Mark a task as complete, or several at once with `tasks` (max 50). They move to the Logbook view. A set of 50 is undone one task_reopen call at a time, so confi - `task_reopen` — Reopen a completed task, or several at once with `tasks` (max 50). Each returns to its previous view. - `task_archive` — Archive a task, or several at once with `tasks` (max 50). They move to the Trash view, out of every working list, and stay readable there (task_list `view: "tra - `project` — Create or change a project. `action: "add"` creates one (name required). `action: "edit"` updates the named project: only the fields given change, and an empty - `search` — Search tasks across the workspace. Ranked lexical search over title and description: exact and prefix matches rank first, then word-boundary, substring, and fuz - `checklist` — Change the checklist on a task. `action: "add"` appends items, unchecked, after the existing ones: pass every title for a multi-item list in one call (`titles` - `comment` — Write on a task's comment thread. `action: "add"` posts a comment, attributed to the connected user and visible to everyone in the workspace, so write it as a m - `attachment` — Add a file to a task or remove one. `action: "add"` fetches the given HTTPS `url`: the server downloads it, verifies its size and type, and stores it, so the mo - `label_create` — Create a new label in the workspace and return its id. Only creates the label: to put it on a task, pass it to task_add `labels` or task_edit `add_labels` after ## Install **Verdict: review** — Installable, but 2 things to check first: No CVE coverage: this entry has no npm/PyPI coordinates to query OSV against, so "no known vulnerabilities" is not a claim that can be made about it. **Cautions** (coverage gaps and advisories — never blocking) - No CVE coverage: this entry has no npm/PyPI coordinates to query OSV against, so "no known vulnerabilities" is not a claim that can be made about it. - No publisher has proved control of this listing; it is indexed, not vouched for. **Config** (claude-code): ```json "{\n \"mcpServers\": {\n \"donebear\": {\n \"type\": \"http\",\n \"url\": \"https://mcp.donebear.com/mcp\"\n }\n }\n}" ``` ## Blast radius Moderate to extensive — no credential declaration found, from the publisher, the upstream registry, or the README. Known so far: mutates data; runs on someone else's infrastructure. - Floor 26, ceiling 50 (tier: unknown) - `unknown` means the floor and ceiling land in different bands — not measured enough to name one. It does not mean low. - This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score. ## Machine-readable views of this entry - Signed JSON: https://forgeregistry.com/api/v1/packages/com.donebear%2Fdonebear - Install plan: https://forgeregistry.com/api/v1/packages/com.donebear%2Fdonebear/install-plan - Alternatives: https://forgeregistry.com/api/v1/alternatives/com.donebear%2Fdonebear - HTML page: https://forgeregistry.com/registry/com.donebear%2Fdonebear - MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan` ## About this document Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.