# net.tasklite/mcp

Build a full backend from Claude Code — boards, data, REST APIs — plus a ready-made admin UI

- **Type:** MCP server
- **Trust:** 30/100 (D), scored on the content rubric
- **Verification:** community-indexed — nobody has claimed this listing
- **Version:** 0.5.1
- **Author:** net.tasklite
- **License:** Unknown
- **Endpoints:** streamable-http https://mcp.tasklite.net/mcp
- **Source:** https://tasklite.net/claude
- **Endpoint health:** reachable (last checked 2026-09-23T21:47:45.610Z, 5 samples) — uptime is not a security property and is not part of the trust score
- **Compatible clients:** claude-code, cursor, copilot, chatgpt, gemini (basis: transport)

## Trust

30/100 (D), scored on the content rubric
- Publisher verified: no
- Install scripts: suspicious script found
- Prompt-injection scan: findings present
- Obfuscation scan: clean
- Evidence age: 0 days

## Security scan

- **Status:** warnings
- **Scanned:** 2026-09-23T21:47:45.610Z
- **Version scanned:** live
- **CVEs:** no coverage — this entry has no package coordinates to query OSV against, so "no known CVEs" is NOT asserted for it.
**Findings**
- injection-shaped content (warning) in the `configure_external_access` tool: Exfiltration-shaped instruction
- injection-shaped content (warning) in the `request_file_upload` tool: Exfiltration-shaped instruction
- injection-shaped content (note) in the `request_file_upload` tool: Links to undeclared domain: app.tasklite.net
- injection-shaped content (note) in the `create_automation` tool: Links to undeclared domain: api.frankfurter.app

## Tools

48 declared. Observed from a live `tools/list` probe.
- `list_organizations` — List the organizations the authenticated user belongs to. Use the returned id as organizationId in other tools.
- `configure_external_access` — Read or change how EXTERNAL users (people who sign up to your app through TaskLite auth) get into an organization. They have two ways in, and both obey the poli
- `list_projects` — List projects in an organization. The API returns 50 per page, an organization with more than that needs page 2 and beyond, so check the returned total before a
- `list_boards` — List the boards inside a project, id, name, description. Every other board tool needs a boardId, and this is the only way to discover one without being handed a
- `create_project` — Create a project (a business process container). Boards with data live inside projects.
- `create_board` — Create a board (a data table) inside a project. Add typed columns with create_column afterwards. kind: "tasks" (default) also gives the board the built-in task 
- `create_column` — Add a typed column to a board. Valid types: text, rich_text, number, status, date, datetime, duration, people, checkbox, dropdown, label, priority, link, email,
- `get_board_schema` — Get a board with its full column schema (ids, names, types, settings). Call this before creating items with cells.
- `update_board` — Rename a board or change its description. Structure (columns) is changed with update_column / delete_column / reorder_columns.
- `delete_board` — Delete a board with every item on it. Destructive and not undoable, confirm with the user first, and prefer delete_column when only part of the model is wrong.
- `delete_project` — Delete a project with every board, column and row inside it. Destructive: confirm with the user first, and name the project in the confirmation. The project goe
- `update_column` — Change a column after the fact: rename it, change its type (e.g. number -> currency), replace settings (dropdown options), or set isRequired / isHidden. A type 
- `delete_column` — Delete a column and every value stored in it. Destructive, confirm with the user first. Use update_column when the column is right but its name, type or options
- `reorder_columns` — Set the display order of a board's columns. Pass every column id in the wanted order (get_board_schema lists them).
- `export_project` — The whole project as JSON, boards, columns with settings, items with their cells keyed by column id. For migrations, backups and reading a system back. Items ar
- `query_items` — List items (rows) of a board, including their cell values. Returns all items unless limit/page are given (the API defaults to 50 per page when unpaged, so the t
- `create_item` — Create an item (row) with all of its data in one call. cells maps columnId -> value (use get_board_schema for column ids); every cell is saved with the row. Use
- `update_item` — Update item fields (title, description, status, priority, dueDate, tags).
- `set_cell` — Set a single cell value on an item by columnId.
- `delete_item` — Delete an item. Destructive, confirm with the user before calling.
- `list_comments` — List the comments (the correspondence thread) on an item, oldest first. Each comment includes its author and any @mentions. Needs projectId and itemId (get item
- `add_comment` — Post a comment on an item's thread. To notify people, pass their user ids in mentionedUserIds (each also appears as an @mention). attachmentIds references alrea
- `update_comment` — Edit the text of an existing comment. Only the author can edit their comment. Needs projectId, itemId and the commentId.
- `delete_comment` — Delete a comment from an item thread. Destructive, confirm with the user before calling. Needs projectId, itemId and the commentId.
- `request_file_upload` — Create a link that puts files onto an item from outside TaskLite: the customer's photos, a signed contract, a logo, a build zip. Returns an address like https:/
- `list_uploaded_files` — The files attached to an item, including everything that came in through a request_file_upload link, each with a download URL that is signed and short lived (mi
- `revoke_upload_link` — Close an upload link before it expires, so the address stops accepting files. The files already uploaded stay on the item. Use it as soon as the material is in,
- `create_app` — Create an app, a named API surface over the boards of a project, for an external frontend. Then add endpoints and an API key.
- `push_status` — Whether an app can send push notifications to phones, and how many devices are registered. Push goes out through the customer's OWN Firebase project, so it has 
- `send_test_push` — Send one real push notification to the given app users, to prove the chain works before an automation depends on it. Confirm with the user first: this reaches a
- `publish_app` — Publish an app, required before its API endpoints accept external calls.
- `create_app_endpoint` — Expose a board as a REST endpoint of an app: /apps/{appSlug}/api/{slug}. exposedColumns limits which columns are readable/writable. rowLevelSecurity.enabled mak
- `list_app_endpoints` — List an app's REST endpoints, slug, board, allowed methods, and how many columns each exposes. An endpoint exposing 0 columns is broken: it returns only item me
- `update_app_endpoint` — Change an existing endpoint, most often to set exposedColumns on one that was created without them. Get the endpoint id from list_app_endpoints and the column i
- `create_app_api_key` — Create an API key for an app. SECURITY: the key must live server-side only (env var, Next.js API routes), never in browser code. If the app has its own users, t
- `build_backend` — Build a whole backend in one call from a spec you compose: the project, its boards, their typed columns (including relations between the boards), optional sampl
- `create_automation` — Create an automation on a board: when something happens, do something. The most useful action here is http_request, which calls an external API and writes the a
- `update_automation` — Change an existing automation: its actions, conditions, trigger config or name, or switch it off with isActive false. Fields left out stay as they are; actions 
- `list_automations` — List the automations on a board, so you can see what already runs before adding another.
- `list_apps` — List the apps in the organization, id, slug, status. Call this first when you need an app id: the slug (app-xxxxxx) is what shows up in URLs and in generated co
- …and 8 more

## Install

**Verdict: do-not-install** — Do not install: 2 injection-shaped patterns found in this entry's own text — it may try to steer the model that loads it.
**Blocking**
- 2 injection-shaped patterns found in this entry's own text — it may try to steer the model that loads it. — tool:configure_external_access: Exfiltration-shaped instruction · tool:request_file_upload: Exfiltration-shaped instruction
**Cautions** (coverage gaps and advisories — never blocking)
- No CVE coverage: this entry has no npm/PyPI coordinates to query OSV against, so "no known vulnerabilities" is not a claim that can be made about it.
- No publisher has proved control of this listing; it is indexed, not vouched for.
**Client configuration withheld.** Client configs are withheld because this entry has a blocking finding. Show the warnings below to the person installing it.
If they have seen the findings and still want to proceed, request the plan again with acknowledge_warnings=true.

## Blast radius

Extensive to critical — no credential declaration found, from the publisher, the upstream registry, or the README. Known so far: deletes data; 7 privileged tools.
- Floor 38, ceiling 62 (tier: unknown)
- `unknown` means the floor and ceiling land in different bands — not measured enough to name one. It does not mean low.
- This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score.

## Machine-readable views of this entry

- Signed JSON: https://forgeregistry.com/api/v1/packages/net.tasklite%2Fmcp
- Install plan: https://forgeregistry.com/api/v1/packages/net.tasklite%2Fmcp/install-plan
- Alternatives: https://forgeregistry.com/api/v1/alternatives/net.tasklite%2Fmcp
- HTML page: https://forgeregistry.com/registry/net.tasklite%2Fmcp
- MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan`

## About this document

Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.