← Back to search

@itm-platform/mcp-server

GitHub Actions Scanned 7d ago

MCP server for ITM Platform

npm
C
64.2 / 100

Versions

1.0.17latest
Jul 23, 2026
1.0.16
Jul 23, 2026
1.0.15
Jul 22, 2026
1.0.13
Jul 17, 2026
1.0.12
Jul 16, 2026
+ show 7 moreshow less
1.0.11
Jul 16, 2026
1.0.10
Jul 14, 2026
1.0.8
Jul 6, 2026
1.0.6
Jun 24, 2026
1.0.3
Jun 12, 2026
1.0.2
Jun 2, 2026
1.0.0
May 28, 2026
PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 47

create_project_progress
annotations: none low

Create a project-level progress (Seguimiento) entry: the project status report with report date,

projectId number percentage number reportDate string description string assessmentId number shortDescription string
update_project_progress
annotations: none low

Update an existing project-level progress (Seguimiento) entry; send only the fields to change.

projectId number percentage number progressId number reportDate string description string assessmentId number shortDescription string
search_projects
annotations: none low

Find projects by name, status, type, or date range. Returns id, name, status, progress, dates, managers. Filterable fields: name, statusLabel, customTypeLabel, startDate, endDate.

skip number sort string type string limit number query string dateTo string status string dateFrom string
get_project
annotations: none low

Get project details by ID with subcomponent counts. Budget can be included via include: ["budget"]. For tasks, risks, issues, purchases, and revenues use the dedicated tools: list_project_tasks, get_project_risks, get_project_issues, get_project_purchases, get_project_revenues.

include array projectId number
search_services
annotations: none low

Find services by name, status, type, or date range. Same query shape as search_projects but for services.

skip number sort string type string limit number query string dateTo string status string dateFrom string
get_service
annotations: none low

Get service details by ID with subcomponent counts. Budget can be included via include: ["budget"]. For activities, purchases, and revenues use the dedicated tools: list_service_activities, get_service_purchases, get_service_revenues.

include array serviceId number
list_service_activities
annotations: none low

List activities for a service with pagination. Returns { items, total, limit, skip, hasMore }. Default limit: 50, max: 200.

skip number limit number serviceId number
get_service_purchases
annotations: none low

Get purchase orders for a service with pagination. Returns { items, total, limit, skip, hasMore }. Default limit: 50, max: 200.

skip number limit number serviceId number
get_service_revenues
annotations: none low

Get revenue items for a service with pagination. Returns { items, total, limit, skip, hasMore }. Default limit: 50, max: 200.

skip number limit number serviceId number
list_task_progress
annotations: none low

List the progress (seguimiento/follow-up) history for a task, newest first. Task progress is a time-series of entries, not a single task field; this is why update_task rejects PercentComplete.

taskId number projectId number
get_project_progress
annotations: none low

Get the project progress report: expected curve, baseline curve, and follow-up history (date + percentage). includeEntries true adds the full Seguimiento entries (ProjectProgressId, assessment, descriptions) for update_project_progress.

projectId number includeEntries boolean
aggregate_portfolio
annotations: none low

Portfolio-level analytics: group projects by any field and compute metrics (count, avgProgress, totalBudget, totalActual). Uses DataMart aggregation -- no REST equivalent. Available groupBy fields: statusLabel, priorityLabel, methodology, customTypeLabel, isClosed, managers.name.

limit number filter record groupBy string metrics array
create_task_progress
annotations: none low

Report progress on a task by creating a new progress (seguimiento/follow-up) entry. This is the correct way to set a task\'s completion percentage: it triggers task status transitions (100% completes the task, dropping below 100% reopens it), parent task rollups, automatic project progress, events, and notifications. Discover assessmentId values with get_reference_data entity "assessments".

taskId number projectId number percentage number reportDate string description string assessmentId number shortDescription string
update_task_progress
annotations: none low

Update an existing task progress (seguimiento/follow-up) entry via PATCH; send only the fields to change. Find the progressId with list_task_progress.

taskId number projectId number percentage number progressId number reportDate string description string assessmentId number shortDescription string
query_datamart
annotations: none low

Run a custom query against ITM DataMart (MongoDB-backed). For advanced analysis beyond typed tools. Operations: - "components": list with filters. Params: where, project, sort, limit (max 200), skip - "component": single by ID. Params: id, project - "aggregateComponents": aggregation pipeline. Params: pipeline (must end with $limit, max 1000) Allowed filter operators: $eq, $ne, $in, $nin, $gt, $gte, $lt, $lte, $regex, $options, $exists, $not, $and, $or, $nor Allowed pipeline stages: $match, $project, $group, $sort, $limit, $skip, $unwind, $addFields, $set, $unset Banned: $lookup, $merge, $out, $function, $accumulator, $where, $facet Key fields: id, name, code, componentType, statusLabel, priorityLabel, percentComplete, startDate, endDate, methodology, managers, budgetTopDown, budgetActual, customFields (object keyed by field display name; see get_custom_fields). Projecting full embedded arrays (tasks: 1, risks: 1, etc.) is rejected as too large; use dot notation (e.g. "tasks.name": 1) or the subcomponent tools with limit/skip.${accountContextBlock}

id number skip number sort record limit number where record project record pipeline array operation enum
search_users
annotations: none low

Find team members by name or email. Returns userId, name, email, role. Uses v2 REST API (not DataMart).

limit number query string
get_user
annotations: none low

Get details for a single user by ID. Returns full user profile including roles, categories, and contact info.

userId number
get_project_risks
annotations: none low

Get risks for a project with pagination. Returns { items, total, limit, skip, hasMore }. Default limit: 50, max: 200.

skip number limit number projectId number
get_risk
annotations: none low

Get full detail of a single risk from v2 REST (source of truth).

riskId number projectId number
get_issue
annotations: none low

Get full detail of a single issue from v2 REST (source of truth).

issueId number projectId number
get_project_issues
annotations: none low

Get issues for a project with pagination. Returns { items, total, limit, skip, hasMore }. Default limit: 50, max: 200.

skip number limit number projectId number
get_reference_data
annotations: none low

Get reference IDs for statuses, types, priorities, risks, issues, purchases, revenues, and assessments.

entity enum
create_project
annotations: none low

Create a new project. Name and TypeId are required (entity "getprojecttypes").

Name string TypeId number EndDate string StatusId number StartDate string PriorityId number Description string InternalCode string ProjectStatusId number ProjectMethodTypeId number
create_task
annotations: none low

Create a regular task, milestone, or summary task. KindId: 1=Milestone, 2=Summary, 3/default=Task (not the TypeId).

Name string KindId number TypeId number Details string EndDate string ParentId number StatusId number StartDate string projectId number PriorityId number Description string TaskMembers string TaskManagers string
update_task
annotations: none low

Update task fields via PATCH; send only the fields to change.

Name string KindId number TypeId number taskId number Details string EndDate string ParentId number StatusId number StartDate string projectId number PriorityId number Description string TaskMembers string TaskManagers string
create_risk
annotations: none low

Log a new risk in a project. TypeId, StatusId, ImpactId, ProbabilityId, and LevelId are all required. Discover IDs with get_reference_data (entities "riskstatuses", "risktypes", "riskimpacts", "riskprobabilities", "risklevels"); localized Ids are normalized automatically.

Name string TypeId number LevelId number ImpactId number StatusId number projectId number Description string ProbabilityId number MitigationPlan string
create_issue
annotations: none low

Log a new issue in a project. Discover IDs with get_reference_data (entities "issuestatuses", "issuetypes"); localized Ids are normalized automatically.

Name string TypeId number StatusId number projectId number Resolution string Description string
update_project
annotations: none low

Update project fields via PATCH; send only the fields to change.

Name string EndDate string StatusId number StartDate string projectId number PriorityId number Description string ProjectStatusId number
update_risk
annotations: none low

Update risk fields; send only the fields to change. Discover IDs with get_reference_data (entities "riskstatuses", "risktypes", "riskimpacts", "riskprobabilities", "risklevels"); localized Ids are normalized automatically.

Name string TypeId number riskId number LevelId number ImpactId number StatusId number projectId number Description string ProbabilityId number MitigationPlan string ContingencyPlan string
update_issue
annotations: none low

Update issue fields via PATCH; send only the fields to change. Discover IDs with get_reference_data (entities "issuestatuses", "issuetypes"); localized Ids are normalized automatically.

Name string TypeId number issueId number StatusId number projectId number Resolution string Description string
create_service
annotations: none low

Create a new service. Name and TypeId are required; use get_reference_data with entity "servicetypes" to discover valid service type IDs.

Name string TypeId number EndDate string StatusId number StartDate string PriorityId number Description string InternalCode string ProjectStatusId number
update_service
annotations: none low

Update service fields via PATCH; send only the fields to change. Status IDs come from get_reference_data entity "projectstatuses".

Name string EndDate string StatusId number StartDate string serviceId number PriorityId number Description string ProjectStatusId number
create_activity
annotations: none low

Create a new activity in a service. Activities form a flat list (no milestones, summaries, or hierarchy).

Name string KindId number TypeId number Details string EndDate string ParentId number StatusId number StartDate string serviceId number PriorityId number Description string
update_activity
annotations: none low

Update activity fields via PATCH; send only the fields to change.

Name string KindId number TypeId number Details string EndDate string ParentId number StatusId number StartDate string serviceId number PriorityId number activityId number Description string
bulk_update_task_status
annotations: none low

Apply one status to many tasks of a project in one call (faster than looping update_task).

taskIds array statusId number projectId number statusName string projectMethodTypeId number
bulk_update_activity_status
annotations: none low

Apply one status to many activities of a service in a single call.

statusId number serviceId number statusName string activityIds array projectMethodTypeId number
log_time_entry
annotations: none low

Log actual worked hours on a task for one user and date. ITM Platform stores ONE total per

date string mode enum hours number taskId number userId number comment string minutes number projectId number
get_custom_fields
annotations: none low

Get the account's custom field definitions for an entity type: project, task, risk, issue, service, activity, purchase, or revenue. Returns Id, BaseId, Name, TypeId, TypeName (Text, Number, Percentage, Date, HTML, RYGList, DropDownList, List), Description, Required. VALUES live in DataMart under "customFields", keyed by the display Name exactly as returned here (case- and accent-sensitive, may contain trailing spaces). Query via query_datamart, e.g. project {"customFields": 1} or where {"customFields.<Name>": ...}. On multilingual accounts the key follows each component's language; fetch definitions per languageId to learn the variant names of the same BaseId. Dropdown values: get_custom_field_options.

entity enum languageId number
get_custom_field_options
annotations: none low

Get the selectable options of a dropdown custom field (RYGList, DropDownList, or List types), using the BaseId returned by get_custom_fields. Returns Id, BaseId, Text, Color (RYG lists), SortOrder, IsDefault. The option Text is the value stored in DataMart "customFields" for the component.

languageId number customFieldBaseId number
list_project_tasks
annotations: none low

List tasks for a project with pagination. Returns { items, total, limit, skip, hasMore }. Default limit: 50, max: 200.

skip number limit number projectId number
get_task
annotations: none low

Get full detail of a single task from v2 REST (source of truth, not affected by DataMart sync delay).

taskId number projectId number
search_tasks
annotations: none low

Search tasks across all projects in the account (DataMart). Filters combine with AND.

skip number limit number query string dateTo string status string assignee string category enum dateFrom string projectId number
get_task_effort
annotations: none low

Read task effort by assigned user and professional category: planned estimates, accepted actual

taskId number projectId number
update_task_effort
annotations: none low

Set planned effort for assigned users; never logs worked time or changes accepted effort or billing.

hours number taskId number userId number minutes number projectId number userEstimates array estimatedHours number estimatedMinutes number taskTotalEstimate object
get_project_budget
annotations: none low

Get budget summary for a project. Returns four budget objects: budgetTopDown (planned), budgetBottomUp (estimated), budgetPeriodEndClose (forecast), budgetActual (spent).

projectId number
get_project_purchases
annotations: none low

Get purchase orders for a project with pagination. Returns { items, total, limit, skip, hasMore }. Default limit: 50, max: 200.

skip number limit number projectId number
get_project_revenues
annotations: none low

Get revenue items for a project with pagination. Returns { items, total, limit, skip, hasMore }. Default limit: 50, max: 200.

skip number limit number projectId number

Permissions 4

network medium
Server uses network capabilities via: fetch()
filesystem low
Server uses filesystem capabilities via: fs sync ops
shell high
Server uses shell capabilities via: child_process, spawn()
env_vars low
Server uses env_vars capabilities via: process.env

Scan Findings 132

low
Tool 'create_project_progress' has no annotations annotation_checker · 100%
low
Tool 'update_project_progress' has no annotations annotation_checker · 100%
low
Tool 'search_projects' has no annotations annotation_checker · 100%
low
Tool 'get_project' has no annotations annotation_checker · 100%
low
Tool 'search_services' has no annotations annotation_checker · 100%
low
Tool 'get_service' has no annotations annotation_checker · 100%
low
Tool 'list_service_activities' has no annotations annotation_checker · 100%
low
Tool 'get_service_purchases' has no annotations annotation_checker · 100%
low
Tool 'get_service_revenues' has no annotations annotation_checker · 100%
low
Tool 'list_task_progress' has no annotations annotation_checker · 100%
low
Tool 'get_project_progress' has no annotations annotation_checker · 100%
low
Tool 'create_task_progress' has no annotations annotation_checker · 100%
low
Tool 'update_task_progress' has no annotations annotation_checker · 100%
low
Tool 'query_datamart' has no annotations annotation_checker · 100%
low
Tool 'search_users' has no annotations annotation_checker · 100%
low
Tool 'get_user' has no annotations annotation_checker · 100%
low
Tool 'get_project_risks' has no annotations annotation_checker · 100%
low
Tool 'get_risk' has no annotations annotation_checker · 100%
low
Tool 'get_issue' has no annotations annotation_checker · 100%
low
Tool 'get_project_issues' has no annotations annotation_checker · 100%
low
Tool 'get_reference_data' has no annotations annotation_checker · 100%
low
Tool 'create_project' has no annotations annotation_checker · 100%
low
Tool 'create_task' has no annotations annotation_checker · 100%
low
Tool 'update_task' has no annotations annotation_checker · 100%
low
Tool 'create_risk' has no annotations annotation_checker · 100%
low
Tool 'create_issue' has no annotations annotation_checker · 100%
low
Tool 'update_project' has no annotations annotation_checker · 100%
low
Tool 'update_risk' has no annotations annotation_checker · 100%
low
Tool 'update_issue' has no annotations annotation_checker · 100%
low
Tool 'create_service' has no annotations annotation_checker · 100%
low
Tool 'update_service' has no annotations annotation_checker · 100%
low
Tool 'create_activity' has no annotations annotation_checker · 100%
low
Tool 'update_activity' has no annotations annotation_checker · 100%
low
Tool 'bulk_update_task_status' has no annotations annotation_checker · 100%
low
Tool 'bulk_update_activity_status' has no annotations annotation_checker · 100%
low
Tool 'log_time_entry' has no annotations annotation_checker · 100%
low
Tool 'aggregate_portfolio' has no annotations annotation_checker · 100%
low
Tool 'get_custom_fields' has no annotations annotation_checker · 100%
low
Tool 'get_custom_field_options' has no annotations annotation_checker · 100%
low
Tool 'list_project_tasks' has no annotations annotation_checker · 100%
low
Tool 'get_task' has no annotations annotation_checker · 100%
low
Tool 'search_tasks' has no annotations annotation_checker · 100%
low
Tool 'get_task_effort' has no annotations annotation_checker · 100%
low
Tool 'update_task_effort' has no annotations annotation_checker · 100%
low
Tool 'get_project_budget' has no annotations annotation_checker · 100%
low
Tool 'get_project_purchases' has no annotations annotation_checker · 100%
low
Tool 'get_project_revenues' has no annotations annotation_checker · 100%
medium
OAuth implementation without PKCE auth_checker · 75%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Suspicious package name: react-dom dependency_analyzer · 60%
medium
Suspicious package name: react-markdown dependency_analyzer · 60%
medium
Vulnerable dependency: @modelcontextprotocol/sdk@1.12.0 (GHSA-345p-7cg4-v4c7) dependency_analyzer · 95%
medium
Vulnerable dependency: @modelcontextprotocol/sdk@1.12.0 (GHSA-8r9q-7v3j-jr4g) dependency_analyzer · 95%
medium
Vulnerable dependency: @modelcontextprotocol/sdk@1.12.0 (GHSA-w48q-cv73-mx4w) dependency_analyzer · 95%
medium
Vulnerable dependency: vitest@3.1.0 (GHSA-5xrq-8626-4rwp) dependency_analyzer · 95%
medium
Vulnerable dependency: postcss@8.4.38 (GHSA-6g55-p6wh-862q) dependency_analyzer · 95%
medium
Vulnerable dependency: postcss@8.4.38 (GHSA-fxqj-rqcc-2cmp) dependency_analyzer · 95%
medium
Vulnerable dependency: postcss@8.4.38 (GHSA-qx2v-qp2m-jg93) dependency_analyzer · 95%
medium
Vulnerable dependency: postcss@8.4.38 (GHSA-r28c-9q8g-f849) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.3.0 (GHSA-356w-63v5-8wf4) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.3.0 (GHSA-4r4m-qw57-chr8) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.3.0 (GHSA-4w7w-66w2-5vf9) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.3.0 (GHSA-64vr-g452-qvp3) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.3.0 (GHSA-859w-5945-r5v3) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.3.0 (GHSA-93m4-6634-74q7) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.3.0 (GHSA-9cwx-2883-4wfx) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.3.0 (GHSA-c27g-q93r-2cwf) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.3.0 (GHSA-fx2h-pf6j-xcff) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.3.0 (GHSA-g4jq-h2w9-997c) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.3.0 (GHSA-jqfw-vq24-v9c3) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.3.0 (GHSA-v6wh-96g9-6wx3) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.3.0 (GHSA-vg6x-rcgg-rjx6) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.3.0 (GHSA-x574-m823-4x7w) dependency_analyzer · 95%
medium
Vulnerable dependency: vite@5.3.0 (GHSA-xcj6-pq6g-qj4x) dependency_analyzer · 95%
medium
Vulnerable dependency: vitest@4.0.1 (GHSA-5xrq-8626-4rwp) dependency_analyzer · 95%
info
package.json metadata manifest_parser · 100%
info
Tool: create_project_progress manifest_parser · 85%
info
Tool: update_project_progress manifest_parser · 85%
info
Tool: search_projects manifest_parser · 85%
info
Tool: get_project manifest_parser · 85%
info
Tool: search_services manifest_parser · 85%
info
Tool: get_service manifest_parser · 85%
info
Tool: list_service_activities manifest_parser · 85%
info
Tool: get_service_purchases manifest_parser · 85%
info
Tool: get_service_revenues manifest_parser · 85%
info
Tool: list_task_progress manifest_parser · 85%
info
Tool: get_project_progress manifest_parser · 85%
info
Tool: create_task_progress manifest_parser · 85%
info
Tool: update_task_progress manifest_parser · 85%
info
Tool: query_datamart manifest_parser · 85%
info
Tool: search_users manifest_parser · 85%
info
Tool: get_user manifest_parser · 85%
info
Tool: get_project_risks manifest_parser · 85%
info
Tool: get_risk manifest_parser · 85%
info
Tool: get_issue manifest_parser · 85%
info
Tool: get_project_issues manifest_parser · 85%
info
Tool: get_reference_data manifest_parser · 85%
info
Tool: create_project manifest_parser · 85%
info
Tool: create_task manifest_parser · 85%
info
Tool: update_task manifest_parser · 85%
info
Tool: create_risk manifest_parser · 85%
info
Tool: create_issue manifest_parser · 85%
info
Tool: update_project manifest_parser · 85%
info
Tool: update_risk manifest_parser · 85%
info
Tool: update_issue manifest_parser · 85%
info
Tool: create_service manifest_parser · 85%
info
Tool: update_service manifest_parser · 85%
info
Tool: create_activity manifest_parser · 85%
info
Tool: update_activity manifest_parser · 85%
info
Tool: bulk_update_task_status manifest_parser · 85%
info
Tool: bulk_update_activity_status manifest_parser · 85%
info
Tool: log_time_entry manifest_parser · 85%
info
Tool: aggregate_portfolio manifest_parser · 85%
info
Tool: get_custom_fields manifest_parser · 85%
info
Tool: get_custom_field_options manifest_parser · 85%
info
Tool: list_project_tasks manifest_parser · 85%
info
Tool: get_task manifest_parser · 85%
info
Tool: search_tasks manifest_parser · 85%
info
Tool: get_task_effort manifest_parser · 85%
info
Tool: update_task_effort manifest_parser · 85%
info
Tool: get_project_budget manifest_parser · 85%
info
Tool: get_project_purchases manifest_parser · 85%
info
Tool: get_project_revenues manifest_parser · 85%
info
Transport: stdio manifest_parser · 90%
info
Required env vars (16) manifest_parser · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 70%
low
Permission: filesystem access detected permission_analyzer · 90%
high
Permission: shell access detected permission_analyzer · 95%
low
Permission: env_vars access detected permission_analyzer · 90%
info
SBOM generated: 588 components sbom_generator · 100%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%