{"name":"io.github.alex13slem/openproject","slug":"alex13slem-openproject","title":"OpenProject","description":"Manage OpenProject projects, work packages, files, relations, boards, users, and notifications.","url":"https://mcp.market/server/alex13slem-openproject","rating":null,"grade":"B","score":71,"certified":false,"status":"active","category":"other","tags":[],"presence":{"score":18,"stars":0,"forks":1,"downloads_week":35,"last_push_at":"2026-07-14T19:35:59.000Z","license":"MIT"},"uptime":null,"claimed":false,"transport":"npm","callable_via_gateway":false,"default_price_micros":0,"repository":"https://github.com/alex13slem/openproject-codex-plugin","website":null,"version":"0.5.0","remotes":[],"packages":[{"registryType":"npm","registryBaseUrl":"https://registry.npmjs.org","identifier":"openproject-codex-plugin","version":"0.5.0","transport":{"type":"stdio"},"environmentVariables":[{"description":"Root URL of the OpenProject instance","isRequired":true,"format":"string","name":"OPENPROJECT_URL"},{"description":"OpenProject API token","isRequired":true,"format":"string","isSecret":true,"name":"OPENPROJECT_API_TOKEN"},{"description":"Default page size from 1 to 100","format":"string","default":"25","name":"OPENPROJECT_PAGE_SIZE"},{"description":"Request timeout in milliseconds from 1000 to 300000","format":"string","default":"30000","name":"OPENPROJECT_TIMEOUT_MS"},{"description":"API-token authentication mode: basic for broad compatibility or bearer for OpenProject 17.2+","format":"string","default":"basic","name":"OPENPROJECT_AUTH_MODE"},{"description":"Platform-separated directories from which attachment files may be read; defaults to the process working directory","format":"string","name":"OPENPROJECT_ALLOWED_UPLOAD_DIRS"}]}],"tools":[{"name":"add_work_package_comment","description":"Append a Markdown comment to one work package and return the activity plus work-package URL. Use for progress notes or follow-ups, not field changes; this creates a permanent activity and can notify subscribed users.","write_action":false,"price_micros":0,"input_schema":null},{"name":"add_work_package_watcher","description":"Subscribe a user as a watcher of one work package so OpenProject can notify them about changes. Use only for an explicit subscription request; adding an existing watcher is idempotent.","write_action":false,"price_micros":0,"input_schema":null},{"name":"count_projects","description":"Return only the total number of projects matching native OpenProject filters. Use instead of list_projects when no project records are needed; this is read-only and minimizes response size.","write_action":false,"price_micros":0,"input_schema":null},{"name":"count_work_packages","description":"Return only the total number of work packages matching native filters and an optional project. Use instead of search_work_packages when no task records are needed; all filters are combined with AND.","write_action":false,"price_micros":0,"input_schema":null},{"name":"create_project","description":"Create a project or subproject immediately. Use only after confirming a new project is wanted; parentId creates it below an existing project. Requires add-project permission and is not idempotent.","write_action":true,"price_micros":0,"input_schema":null},{"name":"create_work_package","description":"Create a work package and return the created resource plus browser URL. Use only for a new task in a resolved project; this writes immediately and may notify interested users unless notify is false. Omit typeId to select the project's Task type or first available type.","write_action":true,"price_micros":0,"input_schema":null},{"name":"create_work_package_relation","description":"Create a directed typed relation from one work package to another, such as blocks, precedes, duplicates, or relates. Use after verifying both IDs and existing relations; this writes immediately and duplicate validity is enforced by OpenProject.","write_action":true,"price_micros":0,"input_schema":null},{"name":"delete_project","description":"Permanently schedule deletion of a project by numeric ID. Use only after get_project verifies an explicit deletion target. OpenProject archives it immediately and deletes it asynchronously; this destructive action cannot be undone through this server.","write_action":true,"price_micros":0,"input_schema":null},{"name":"delete_work_package","description":"Permanently delete one work package by ID. Use only for an explicit deletion request after verifying the target with get_work_package; this is destructive and cannot be undone through this server.","write_action":true,"price_micros":0,"input_schema":null},{"name":"delete_work_package_attachment","description":"Permanently delete one attachment by attachment ID. Use only after list_work_package_attachments verifies the file and ID; this is destructive and does not delete the work package.","write_action":true,"price_micros":0,"input_schema":null},{"name":"delete_work_package_relation","description":"Permanently delete one relation without deleting either work package. Use only after list_work_package_relations confirms the relation ID; this destructive change removes the dependency or association.","write_action":true,"price_micros":0,"input_schema":null},{"name":"get_board","description":"Get one OpenProject board by grid ID, including its widget and column configuration. Use when the board ID is already known; use list_boards for project discovery or list_board_lanes for cards.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_current_user","description":"Return the current OpenProject user authenticated by the API token. Use to identify 'me' or verify credentials; unlike list_users, this does not require global user-management permission.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_notification","description":"Get one in-app notification by ID with actor, project, activity, and related-resource links. Use after list_notifications when full context for a known notification is required; it remains unread.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_openproject_api","description":"Read an OpenProject API v3 endpoint not covered by a focused tool. Use only as a read-only escape hatch after checking the typed tools. The path must be relative under /api/v3; absolute URLs, other origins, writes, and filesystem access are rejected.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_project","description":"Get one complete project by numeric ID or identifier. Use when the target is already known and full project fields or links are needed; use list_projects for discovery. This is read-only.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_user","description":"Get one OpenProject user by numeric ID. Use when the ID is already known; use list_available_assignees for assignment choices and list_users for administrator-level discovery.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_work_package","description":"Get the complete HAL+JSON representation of one work package by numeric ID. Use after search when full descriptions, links, custom fields, or lockVersion are required; this performs no write.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_work_package_attachment","description":"Download one verified attachment from a work package. Use after listing attachments. Text files return readable text; binary files return an embedded base64 MCP resource. The call fails before or during transfer if maxBytes is exceeded and does not write to disk.","write_action":false,"price_micros":0,"input_schema":null},{"name":"get_work_package_relation","description":"Get one relation by relation ID, including its from/to links, type, description, and lag. Use after listing relations when complete details for a known relation are needed.","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_available_assignees","description":"List users permitted as assignees for exactly one project or work package. Use this before assignment when the global user list is unavailable; provide projectId or workPackageId, never both. This is read-only.","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_board_lanes","description":"Resolve one board's work-package query widgets into lanes with card summaries and pagination metadata. Use after list_boards identifies a board; pageSize limits cards per lane. This is read-only and does not move cards.","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_boards","description":"List paginated Kanban-style boards scoped to one project ID or identifier. Use to discover board grid IDs; use get_board for configuration or list_board_lanes for cards. This read-only call may return no boards when the module is disabled.","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_notifications","description":"List paginated in-app notifications for the authenticated user, optionally unread only. Use for inbox triage; this leaves read state unchanged. Use get_notification for one item's details and mark tools only after review.","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_project_versions","description":"List version or milestone IDs globally or for one project. Use before assigning a work package to a version; projectId returns only versions available in that project. This is read-only.","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_projects","description":"List visible projects with native filters, sorting, and pagination. Use this to discover project IDs or identifiers; use get_project when the target is already known and count_projects when only a total is needed.","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_users","description":"List or search the global OpenProject user directory with native filters and pagination. Use for administrator-level discovery; for ordinary task assignment prefer list_available_assignees because OpenProject may restrict this endpoint to user managers. This is read-only.","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_work_package_activities","description":"List paginated comments and field-change history for one work package. Use for audit context or conversation history; use get_work_package for current state and add_work_package_comment to append a new note. This is read-only.","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_work_package_attachments","description":"List metadata for files attached directly to a work package. Use before get_work_package_attachment to verify the attachment ID and size; no file content is downloaded.","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_work_package_relations","description":"List all typed relations involving one work package, including direction and lag. Use to inspect dependencies or duplicates before creating or deleting a relation; this is read-only.","write_action":false,"price_micros":0,"input_schema":null},{"name":"list_work_package_watchers","description":"List current watchers of one work package. Use before adding or removing a watcher to verify membership and user IDs; this does not change subscriptions.","write_action":false,"price_micros":0,"input_schema":null},{"name":"mark_all_notifications_read","description":"Mark every visible in-app notification as read for the authenticated user. Use only for an explicit clear-inbox request; this bulk state change is idempotent and does not modify related work packages.","write_action":false,"price_micros":0,"input_schema":null},{"name":"mark_notification_read","description":"Mark one in-app notification as read for the authenticated user. Use after the notification has been reviewed; this changes inbox state but not the related project resource.","write_action":false,"price_micros":0,"input_schema":null},{"name":"remove_work_package_watcher","description":"Unsubscribe a user from one work package's watchers. Use only after verifying workPackageId and userId; this changes notification behavior but does not delete the user or work package.","write_action":true,"price_micros":0,"input_schema":null},{"name":"search_work_packages","description":"Search visible work packages with focused fields plus optional native filters, sorting, and pagination. Use this for discovery or lists; use get_work_package for the complete resource once an ID is known and count_work_packages for totals only.","write_action":false,"price_micros":0,"input_schema":null},{"name":"update_project","description":"Patch only the supplied fields on an existing project. Use for renaming, description, visibility, activation, or archival changes; omitted fields are preserved. Requires project administration permission.","write_action":true,"price_micros":0,"input_schema":null},{"name":"update_work_package","description":"Update only the supplied fields on an existing work package and return its browser URL. The tool fetches the current lockVersion first to prevent stale overwrites; null clears supported optional links. It writes immediately and may notify users unless notify is false.","write_action":true,"price_micros":0,"input_schema":null},{"name":"upload_work_package_attachment","description":"Read one explicit allowlisted local file and upload it to a work package. Use only when the user identified both the file and target task. Paths must be under OPENPROJECT_ALLOWED_UPLOAD_DIRS (default: current working directory). The call rejects files above maxBytes, sends bytes only to the configured OpenProject origin, creates a permanent attachment, and never modifies the local file.","write_action":true,"price_micros":0,"input_schema":null}],"scan":{"score":71,"grade":"B","scanned_at":"2026-09-25T21:46:00.133Z","report":{"scannerVersion":"0.1.9","scannedAt":"2026-09-25T21:46:00.129Z","components":{"code":{"score":20,"max":25,"notes":["2 source files scanned"]},"reliability":{"score":-1,"max":20,"notes":["no gateway calls yet and no remote to probe"]},"poisoning":{"score":-1,"max":15,"notes":["tools not inspected (local package is not executed); not counted"]},"auth":{"score":6,"max":15,"notes":["static API keys via environment variables"]},"maintenance":{"score":12,"max":15,"notes":["last push 73 days ago"]},"identity":{"score":8,"max":10,"notes":["registry namespace matches repository owner","GitHub account older than a year"]}},"findings":[{"id":"exec.eval","severity":"medium","component":"code","title":"eval / new Function used","evidence":"dist/openproject-mcp.js: …eCode, sch); const makeValidate = new Function(`${names_1.default.self}`, `${names_1.de…"}],"inputs":{"packages":[{"registryType":"npm","identifier":"openproject-codex-plugin","version":"0.5.0","found":true,"license":"MIT","hasInstallScripts":false,"dependencyCount":2,"publishedAt":"2026-07-14T18:52:42.244Z","repositoryUrl":"git+https://github.com/alex13slem/openproject-codex-plugin.git","weeklyDownloads":35}],"repo":{"found":true,"owner":"alex13slem","repo":"openproject-codex-plugin","archived":false,"pushedAt":"2026-07-14T19:35:59Z","stars":0,"forks":1,"openIssues":6,"ownerType":"User","ownerAvatarUrl":"https://avatars.githubusercontent.com/u/104124319?v=4","ownerCreatedAt":"2022-04-21T06:05:07Z","license":"MIT"},"icon":{"url":"https://avatars.githubusercontent.com/u/104124319?v=4&s=128","source":"github"},"presence":{"stars":0,"forks":1,"downloadsWeek":35,"license":"MIT","lastPushAt":"2026-07-14T19:35:59.000Z","score":18}}}},"grade_history":[],"reviews":[]}