# saga-mcp A Jira-like project tracker MCP server for AI agents. SQLite-backed, per-project scoped, with full hierarchy (Projects > Epics > Tasks > Subtasks), activity logging, and a dashboard — so LLMs never lose track. - **Type:** MCP server - **Trust:** 85/100 (A), scored on the package rubric - **Verification:** verified (build provenance) - **Version:** 1.17.1 - **Author:** spranab - **License:** MIT - **npm:** saga-mcp - **Source:** https://github.com/spranab/saga-mcp - **Compatible clients:** claude-code, cursor, copilot, gemini (basis: transport) ## Trust 85/100 (A), scored on the package rubric - Publisher verified: no - Build provenance: verified attestation - npm trusted publishing (OIDC): yes - Install scripts: nothing suspicious found - Prompt-injection scan: not run - Obfuscation scan: not run - Evidence age: 1 day ## Security scan - **Status:** clean - **Scanned:** 2026-09-26T01:30:32.413Z - **Version scanned:** 1.17.1 - **CVEs:** none found by OSV at scan time ## Tools 40 declared. Statically extracted from the shipped source — a floor on the surface, not a census. - `activity_log` — View the activity log showing what changed and when. Useful for understanding recent progress or reviewing what happened since the last session. - `tracker_session_diff` — What changed since a timestamp: counts by action and entity, plus the notable changes. Call it at the start of a session to catch up. - `task_batch_update` — Update multiple tasks at once. Useful for changing status of several tasks (e.g., mark 3 tasks as done) or reassigning tasks. - `comment_add` — Add a comment to a task. Comments create a chronological discussion thread — useful for leaving breadcrumbs across sessions. - `comment_list` — List comments on a task in chronological order. Comments removed with comment_delete are hidden by default; pass include_deleted to see them with their removal - `comment_delete` — Remove a comment (soft delete). The row is kept for the audit trail but hidden from comment_list and task_get. Use this to retract a comment that turned out to - `comment_restore` — Restore a comment previously removed with comment_delete. - `tracker_dashboard` — Full project overview in one call: project, epics with task counts, stats, blocked and overdue tasks, recent activity and notes. Best first call when starting w - `tracker_init` — Initialize the tracker for a project. If the database is empty, creates a project with the given name. If a project already exists, returns its info. - `epic_create` — Create an epic within a project. Epics group related tasks into a feature or workstream. - `epic_list` — List epics for a project with task counts and completion stats. Filter by status, priority or branch. Archived epics are hidden unless include_archived is set. - `epic_archive` — Archive or unarchive an epic. Archived epics and their tasks drop out of listings, the dashboard and search unless include_archived is set. For putting finished - `epic_update` — Update an epic. Pass only the fields you want to change. Set status to "cancelled" to soft-delete. Pass branch="current" to pin to the active branch, or empty s - `tracker_export` — Export a full project as nested JSON. Includes all epics, tasks, subtasks, comments, dependencies, and related notes. Useful for backup, migration, or sharing. - `tracker_import` — Import a project from JSON (matching tracker_export format). Creates all entities with new IDs and remaps references. Uses a transaction for atomicity. - `tracker_next` — What to work on next: one recommended task with the reason, its next unfinished subtask, alternatives, and — when nothing is actionable — what to unblock. Call - `note_save` — Create or update a note: decisions, context, progress, meetings, blockers, technical detail, releases. With id, updates; without, creates. - `note_list` — List notes with optional filters. Returns notes sorted by most recent first. - `note_search` — Search across note titles and content by keyword. - `note_delete` — Delete a note by ID. - `project_create` — Create a new project. Projects are the top-level container for all work. - `project_list` — List all projects with epic/task counts and completion percentages. Optionally filter by status. - `project_update` — Update a project. Pass only the fields you want to change. Set status to "archived" to soft-delete. - `tracker_search` — Search projects, epics, tasks and notes by keyword. Returns categorized previews — use task_get or note_list for full text. - `subtask_create` — Create subtasks (checklist items) for a task. Pass titles as an array — one string per subtask — and each becomes its own record. New subtasks are appended afte - `subtask_update` — Update a subtask title, status or position. depends_on sets what it waits on, blocks the inverse; both replace the set, [] clears. Starting or finishing one wit - `subtask_reorder` — Reorder a task subtask list. Pass IDs in the order you want; any omitted keep their relative order at the end. - `subtask_delete` — Delete one or more subtasks. Accepts a single ID or array of IDs. - `task_create` — Create a task within an epic. Tasks are the primary unit of work. - `task_list` — List tasks; without epic_id, across all epics. Includes subtask and dependency counts. - `task_reorder` — Set the order of an epic's tasks. Omitted IDs keep their relative order at the end. task_list then follows this arrangement by default. - `task_delete` — Remove a task (soft delete). Only 'todo' tasks — anything further along has history worth keeping. The row is kept and hidden from listings; task_restore brings - `task_restore` — Restore a task removed with task_delete. - `task_lock_description` — Lock or unlock a task's description. While locked, task_update refuses to change it — a guard against rewriting the spec when you meant to add a comment. Every - `task_get` — Get a single task with full details including all subtasks, related notes, comments, and dependencies. - `task_update` — Update a task; pass only fields to change. Completing it while subtasks are unfinished is refused unless force is set. - `template_create` — Create a reusable set of tasks that can be instantiated into any epic. {variable} placeholders are filled in on apply. - `template_list` — List task templates. Pass include_tasks to see what each one actually creates. - `template_apply` — Apply a template to create tasks in an epic. Replaces {variable} placeholders with provided values. - `template_update` — Edit a template in place. Only the fields you pass change; tasks replace the whole list. ## Install **Verdict: install** — No blocking findings and no open coverage gaps — safe to install as configured. **Config** (claude-code): ```json "{\n \"mcpServers\": {\n \"saga\": {\n \"command\": \"npx\",\n \"args\": [\n \"-y\",\n \"saga-mcp\"\n ]\n }\n }\n}" ``` ## Blast radius Extensive to critical — no credential declaration found, from the publisher, the upstream registry, or the README. Known so far: deletes data; runs on your machine. - Floor 39, ceiling 63 (tier: unknown) - `unknown` means the floor and ceiling land in different bands — not measured enough to name one. It does not mean low. - This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score. ## Machine-readable views of this entry - Signed JSON: https://forgeregistry.com/api/v1/packages/saga-mcp - Install plan: https://forgeregistry.com/api/v1/packages/saga-mcp/install-plan - Alternatives: https://forgeregistry.com/api/v1/alternatives/saga-mcp - HTML page: https://forgeregistry.com/registry/saga-mcp - MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan` ## About this document Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.