# tracker-mcp MCP server for Yandex Tracker API v3 — full coverage (187 tools): issues, queues, boards, sprints, projects, goals, bulk ops, admin catalogs - **Type:** MCP server - **Trust:** 85/100 (A), scored on the package rubric - **Verification:** verified (build provenance) - **Version:** 1.2.0 - **Author:** io.github.sdamarketing - **License:** MIT - **npm:** tracker-mcp - **Source:** https://github.com/sdamarketing/tracker_mcp - **Compatible clients:** claude-code, cursor, copilot, gemini (basis: transport) ## Trust 85/100 (A), scored on the package rubric - Publisher verified: no - Build provenance: verified attestation - npm trusted publishing (OIDC): yes - Install scripts: nothing suspicious found - Prompt-injection scan: not run - Obfuscation scan: not run - Evidence age: 1 day ## Security scan - **Status:** clean - **Scanned:** 2026-10-15T21:24:27.009Z - **Version scanned:** 1.2.0 - **CVEs:** none found by OSV at scan time ## Tools 40 declared. Statically extracted from the shipped source — a floor on the surface, not a census. - `list_issue_attachments` — List files attached to an issue and its comments. - `upload_issue_attachment` — Attach a local file to an issue. Max file size is 1024 Mbit. - `get_issue_attachment` — Get metadata of one attached file (name, size, mime type). - `download_issue_attachment` — Download attachment content: images come back as image content (visible in chat), - `get_attachment_thumbnail` — Download the preview thumbnail of an attached image (image content). - `download_entity_attachment` — Download an attachment of a project/portfolio/goal. Content path for entities is - `upload_temp_attachment` — Upload a temporary file (not yet attached anywhere). Returns a temp id usable once - `delete_issue_attachment` — Delete an attached file from an issue. - `create_board` — Create a new task board (via the liveBoards API; the legacy POST /boards ignores - `get_boards` — List all issue boards of the organization. - `get_board` — Get board parameters by id, including its columns. - `get_board_columns` — List columns of a board. - `get_board_sprints` — List sprints of a board (agile boards only). - `get_boards_paginate` — List boards with relative pagination (for more than one page): pass the last - `update_board` — Update a board: name, backlog/sprints toggles, columns (with status mapping). - `delete_board` — Delete a board by id. - `get_board_column` — Get parameters of one board column. - `create_board_column` — Create a column on a board. version = current board version (If-Match lock; - `update_board_column` — Rename a board column or change its statuses (version = board version). - `delete_board_column` — Delete a board column (version = board version). - `get_sprint` — Get sprint parameters by id. - `create_sprint` — Create a sprint on a board (the board must have sprints enabled). - `update_sprint` — Rename a sprint, change dates or status (version = sprint version, If-Match lock). - `start_sprint` — Start a sprint (moves to in_progress; version = sprint version). - `archive_sprint` — Archive a finished sprint (version = sprint version). - `delete_sprint` — Delete a sprint by id. - `bulk_update_issues` — Bulk edit many issues at once (max 10000). Values use the issue edit format; - `bulk_move_issues` — Bulk move issues to another queue. Components, versions and projects are cleared by default. - `bulk_transition_issues` — Bulk move issues to a new status via a workflow transition. Get available transition - `get_bulk_operation_info` — Get status and progress of a bulk change operation by its id. - `get_checklist` — Get the checklist of an issue. - `add_checklist_item` — Add a checklist item to an issue. - `edit_checklist_item` — Edit a single checklist item. The Tracker API requires the full item list in the - `delete_checklist` — Delete the whole checklist of an issue. - `delete_checklist_item` — Delete a checklist item from an issue. - `add_comment` — Add a comment to an issue. Supports Yandex Flavored Markdown. - `get_issue_comments` — List comments of an issue. - `edit_comment` — Edit an existing comment text. - `get_issue_comment` — Get one comment of an issue by id (numeric id or longId). - `add_comment_reaction` — Add a reaction to a comment. ## Install **Verdict: install** — No blocking findings and no open coverage gaps — safe to install as configured. **Config** (claude-code): ```json "{\n \"mcpServers\": {\n \"tracker\": {\n \"command\": \"npx\",\n \"args\": [\n \"-y\",\n \"tracker-mcp\"\n ],\n \"env\": {\n \"TRACKER_TOKEN\": \"\",\n \"TRACKER_AUTH\": \"\"\n }\n }\n }\n}" ``` **Credentials it will ask for** (names only — Forge never holds a value): - `TRACKER_TOKEN` — Tracker Token (required) - `TRACKER_AUTH` — Tracker Auth (optional) Placeholders only. Forge never holds, brokers, or transmits a credential value — replace each in your own config file. Do not send a value back to Forge; no Forge endpoint accepts one. - This entry needs 2 credentials (1 required). The generated config carries placeholders, so it will fail in the editor rather than at runtime if they are left unset. ## Blast radius Extensive blast radius — deletes data; holds an api key. - Floor 59, ceiling 59 (tier: extensive) - This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score. ## Machine-readable views of this entry - Signed JSON: https://forgeregistry.com/api/v1/packages/tracker-mcp - Install plan: https://forgeregistry.com/api/v1/packages/tracker-mcp/install-plan - Alternatives: https://forgeregistry.com/api/v1/alternatives/tracker-mcp - HTML page: https://forgeregistry.com/registry/tracker-mcp - MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan` ## About this document Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.