{
  "slug": "io-github-usekaneo-kaneo",
  "name": "io.github.usekaneo/kaneo",
  "title": "kaneo",
  "description": "Official MCP server for Kaneo: manage tasks, projects, and labels from Claude and other MCP clients",
  "version": "0.1.14",
  "publishedAt": "2026-10-25T19:40:47.127355Z",
  "updatedAt": "2026-10-25T19:40:47.127355Z",
  "repoUrl": "https://github.com/usekaneo/kaneo",
  "websiteUrl": null,
  "namespace": {
    "type": "github",
    "owner": "usekaneo"
  },
  "kind": "local",
  "packages": [
    {
      "registryType": "npm",
      "identifier": "@kaneo/mcp",
      "version": "0.1.14",
      "transport": "stdio",
      "runtimeHint": null
    }
  ],
  "remotes": [],
  "envVars": [
    {
      "name": "KANEO_API_URL",
      "isSecret": false,
      "isRequired": false,
      "description": "Base URL of your Kaneo API (defaults to http://localhost:1337)"
    },
    {
      "name": "KANEO_API_KEY",
      "isSecret": true,
      "isRequired": false,
      "description": "Kaneo API key for non-interactive auth; omit to use the interactive device flow"
    }
  ],
  "category": "productivity",
  "subcategory": "tasks",
  "company": "",
  "categoryAuto": true,
  "checks": [
    {
      "id": "source-linked",
      "label": "Source repository linked",
      "result": "pass",
      "detail": "https://github.com/usekaneo/kaneo"
    },
    {
      "id": "version-pinned",
      "label": "Version pinned",
      "result": "pass",
      "detail": "Every package has an explicit version"
    },
    {
      "id": "secrets-requested",
      "label": "Secrets requested",
      "result": "info",
      "detail": "Asks for 1 secret: KANEO_API_KEY"
    },
    {
      "id": "known-registry",
      "label": "Known package registry",
      "result": "pass",
      "detail": "All packages come from npm, PyPI, OCI, NuGet or MCPB"
    },
    {
      "id": "namespace",
      "label": "Namespace ownership",
      "result": "info",
      "detail": "Name verified via GitHub account usekaneo"
    },
    {
      "id": "meta-text",
      "label": "Registry text aimed at the AI",
      "result": "pass",
      "detail": "Description and settings contain no hidden characters or instructions to the AI"
    },
    {
      "id": "install-scripts",
      "label": "Install scripts",
      "result": "pass",
      "detail": "@kaneo/mcp@0.1.14 runs nothing at install"
    },
    {
      "id": "code-flags",
      "label": "Code red flags",
      "result": "pass",
      "detail": "Read 38 files in @kaneo/mcp@0.1.14: no obfuscation, encoded execution, credential reads or data-collection endpoints found"
    },
    {
      "id": "ai-text",
      "label": "Text aimed at the AI",
      "result": "pass",
      "detail": "No hidden characters or instructions to the AI in 38 files, including comments and the README"
    }
  ],
  "scannedAt": "2026-10-29",
  "level": "Scanned",
  "install": [
    {
      "label": "Claude Desktop (npm)",
      "kind": "claude_desktop_json",
      "text": "{\n  \"mcpServers\": {\n    \"kaneo\": {\n      \"command\": \"npx\",\n      \"args\": [\n        \"-y\",\n        \"@kaneo/mcp@0.1.14\"\n      ]\n    }\n  }\n}"
    }
  ],
  "curated": true,
  "stars": 9655,
  "archived": false,
  "pushedAt": "2026-10-28T22:08:52Z",
  "review": {
    "package": "@kaneo/mcp",
    "version": "0.1.14",
    "at": "2026-10-31",
    "files": 36,
    "lines": 1901,
    "verdict": "pass-with-notes",
    "summary": "Lets an AI assistant read and manage projects, tasks, comments, labels and time entries in your Kaneo project-management instance. It talks only to the Kaneo server you configure (localhost by default) and keeps its login token in your user config folder; there is no telemetry. Delete tools are always on and act immediately, and an optional installer can add it to your Cursor or Claude config.",
    "hosts": [
      {
        "host": "KANEO_API_URL (default http://localhost:1337; the user's Kaneo instance)",
        "when": "Only when a tool is called (the first call may trigger device login via /api/auth/device/code, /api/auth/device/token, /api/auth/get-session)",
        "sends": "Bearer token (KANEO_API_KEY or device-flow access token), client_id, and tool data: tasks, projects, comments, labels, time entries, search queries"
      },
      {
        "host": "System browser opened to the verification URL returned by the Kaneo server",
        "when": "Only during first-time device login (no API key and no valid cached token)",
        "sends": "Nothing from the process; it launches the browser via the 'open' package"
      }
    ],
    "env": [
      {
        "name": "KANEO_API_URL",
        "sent_to": "used as the API base URL"
      },
      {
        "name": "KANEO_API_KEY",
        "sent_to": "KANEO_API_URL (Authorization: Bearer)"
      },
      {
        "name": "KANEO_MCP_CLIENT_ID",
        "sent_to": "KANEO_API_URL device-flow endpoints (client_id, default 'kaneo-mcp')"
      },
      {
        "name": "XDG_CONFIG_HOME",
        "sent_to": "not sent; selects the credentials folder"
      },
      {
        "name": "APPDATA",
        "sent_to": "not sent; locates the Claude Desktop config during install"
      }
    ],
    "local": "Stores the device-flow access token as plain JSON at $XDG_CONFIG_HOME/kaneo-mcp/credentials.json (default ~/.config/kaneo-mcp/credentials.json, file 0600, dir 0700) and deletes it when invalid. The installer (runs only when the user starts it in a terminal, or via the 'install' subcommand) reads and rewrites MCP client configs: ~/.cursor/mcp.json, <project>/.cursor/mcp.json, Claude Desktop's claude_desktop_config.json, or a user-chosen absolute .json path. No file access reachable from tool input.",
    "exec": "No child_process or eval in package code. The 'open' dependency launches the system browser/URL handler with the verification URL returned by the configured Kaneo server.",
    "telemetry": "None. No analytics; contacts only the configured Kaneo server.",
    "tools": [
      "whoami",
      "list_workspaces",
      "list_projects",
      "get_project",
      "create_project",
      "update_project",
      "list_tasks",
      "get_task",
      "get_task_by_ticket_id",
      "create_task",
      "duplicate_task",
      "update_task",
      "move_task",
      "update_task_status",
      "list_task_comments",
      "create_task_comment",
      "update_task_comment",
      "delete_task_comment",
      "list_workspace_labels",
      "create_label",
      "attach_label_to_task",
      "detach_label_from_task",
      "create_task_relation",
      "get_task_relations",
      "delete_task_relation",
      "delete_label",
      "list_workspace_members",
      "search",
      "list_project_columns",
      "list_project_custom_fields",
      "get_task_custom_field_values",
      "set_task_custom_field_value",
      "delete_task",
      "update_task_assignee",
      "update_task_due_date",
      "list_task_time_entries",
      "get_time_entry",
      "create_time_entry",
      "update_time_entry",
      "list_task_activity",
      "list_notifications"
    ],
    "toolText": "clean",
    "deps": [
      "@modelcontextprotocol/sdk",
      "zod",
      "open",
      "prompts"
    ],
    "findings": [
      {
        "severity": "note",
        "at": "dist/tools/register.js:309-314,373-404,476-481",
        "what": "Destructive tools (delete_task, delete_task_comment, delete_label, delete_task_relation) run immediately with no confirmation, and there is no read-only switch; all 41 tools are always registered."
      },
      {
        "severity": "note",
        "at": "dist/auth/token-store.js:29-42",
        "what": "The device-flow access token is stored unencrypted on disk (~/.config/kaneo-mcp/credentials.json). The 0600 file mode has no effect on Windows."
      },
      {
        "severity": "info",
        "at": "dist/auth/auth-service.js:80-87",
        "what": "During device login the verification URL from the server response is passed to the 'open' package without checking that it is http(s). Trust is limited to the Kaneo server the user configured."
      },
      {
        "severity": "info",
        "at": "dist/server.js:10",
        "what": "Default API URL is plain http://localhost:1337; if KANEO_API_URL points at a remote http:// address, tokens travel unencrypted. TLS verification is not disabled anywhere."
      },
      {
        "severity": "info",
        "at": "dist/install/index.js:254-264",
        "what": "The installer rewrites existing MCP client config files (JSON re-serialised, mode set to 0600) to add an entry pointing at this package. It only runs when the user launches it from a terminal."
      },
      {
        "severity": "info",
        "at": "dist/auth/auth-service.js:64-76",
        "what": "A cached token is reused when validation returns 'unknown' (network error); fail-open by design to avoid repeated logins."
      },
      {
        "severity": "info",
        "at": "(package)",
        "what": "package.json was not part of the review set; the dependency list is inferred from imports ('open' and 'prompts' are well-known packages that fit browser launch and the CLI installer). Install scripts (if any) could not be checked."
      }
    ]
  },
  "health": {
    "score": 79,
    "parts": {
      "popularity": 0.7624091531816668,
      "activity": 0.6,
      "issues": 0.9102844638949672,
      "security": 1
    },
    "fail": 0,
    "warn": 0,
    "raw": {
      "stars": 9668,
      "forks": 924,
      "downloads": 1482,
      "hn": {
        "n": 2,
        "pts": 6,
        "t": [
          [
            "43484296",
            "Kaneo – An open source project management platform focused on simplicity",
            4,
            1,
            "2025-03-26"
          ],
          [
            "46981536",
            "Show HN: Kaneo – a project management tool which is not complicated",
            2,
            0,
            "2026-02-11"
          ]
        ]
      },
      "issuesOpen": 41,
      "issuesClosed": 416,
      "prsMerged": 1182,
      "commits90": 0,
      "release": "2026-10-26T20:29:37Z",
      "pushed": "2026-10-28T22:08:52Z",
      "growth": null,
      "growthDays": null,
      "archived": false
    },
    "at": "2026-10-31T07:35:52.424Z"
  }
}