← Back to search

@shichao402/vikunja-mcp

GitHub Actions Scanned 22d ago

A Vikunja MCP server for stdio and npx usage.

B
75 / 100

Versions

0.5.1latest
May 23, 2026
0.5.0
May 22, 2026
0.4.0
May 20, 2026
0.3.1
May 20, 2026
0.3.0
Apr 22, 2026
+ show 5 moreshow less
0.2.1
Apr 17, 2026
0.2.0
Apr 16, 2026
0.1.2
Apr 16, 2026
0.1.1
Apr 16, 2026
0.1.0
Apr 16, 2026
PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 19

vikunja_get_server_info
annotations: none low

Get public information about the configured Vikunja instance, including version and enabled settings. No auth token is required.

vikunja_get_current_user
annotations: none low

Get the authenticated Vikunja user profile and settings for the configured credentials.

vikunja_list_projects
annotations: none low

List projects visible to the authenticated Vikunja user.

vikunja_get_project
annotations: none low

Get a single project by ID.

project_id number
vikunja_create_project
annotations: none low

Create a new Vikunja project.

title string position number description string is_archived boolean is_favorite boolean
vikunja_update_project
annotations: none low

Update an existing Vikunja project.

title string position number project_id number description string is_archived boolean is_favorite boolean
vikunja_delete_project
annotations: none low

Delete a project by ID.

project_id number
vikunja_list_tasks
annotations: none low

List tasks across all accessible projects, with optional search, filtering, sorting, and expansions.

vikunja_get_task
annotations: none low

Get a single task by ID.

task_id number
vikunja_create_task
annotations: none low

Create a task inside a project.

done boolean title string position number priority number project_id number description string is_favorite boolean
vikunja_update_task
annotations: none low

Update an existing task with PATCH-style semantics. By default only the fields you pass are changed; every other field keeps its current value (the MCP server reads the task first and merges your input on top). Set `_replace: true` to opt out and use Vikunja's native full-replacement behavior, which resets every unspecified field to its type default.

done boolean title string task_id number position number priority number description string is_favorite boolean
vikunja_delete_task
annotations: none low

Delete a task by ID.

task_id number
vikunja_list_labels
annotations: none low

List labels visible to the authenticated user.

vikunja_create_label
annotations: none low

Create a new label.

title string description string
vikunja_list_task_labels
annotations: none low

List labels attached to a task.

task_id number
vikunja_add_label_to_task
annotations: none low

Attach an existing label to a task.

task_id number label_id number
vikunja_remove_label_from_task
annotations: none low

Remove a label from a task.

task_id number label_id number
vikunja_list_task_comments
annotations: none low

List comments on a task.

task_id number
vikunja_create_task_comment
annotations: none low

Create a comment on a task.

comment string task_id number

Permissions 2

network medium
Server uses network capabilities via: fetch()
env_vars low
Server uses env_vars capabilities via: process.env

Scan Findings 51

low
Tool 'vikunja_get_server_info' has no annotations annotation_checker · 100%
low
Tool 'vikunja_get_current_user' has no annotations annotation_checker · 100%
low
Tool 'vikunja_list_projects' has no annotations annotation_checker · 100%
low
Tool 'vikunja_get_project' has no annotations annotation_checker · 100%
low
Tool 'vikunja_create_project' has no annotations annotation_checker · 100%
low
Tool 'vikunja_update_project' has no annotations annotation_checker · 100%
low
Tool 'vikunja_delete_project' has no annotations annotation_checker · 100%
low
Tool 'vikunja_list_tasks' has no annotations annotation_checker · 100%
low
Tool 'vikunja_get_task' has no annotations annotation_checker · 100%
low
Tool 'vikunja_create_task' has no annotations annotation_checker · 100%
low
Tool 'vikunja_update_task' has no annotations annotation_checker · 100%
low
Tool 'vikunja_delete_task' has no annotations annotation_checker · 100%
low
Tool 'vikunja_list_labels' has no annotations annotation_checker · 100%
low
Tool 'vikunja_create_label' has no annotations annotation_checker · 100%
low
Tool 'vikunja_list_task_labels' has no annotations annotation_checker · 100%
low
Tool 'vikunja_add_label_to_task' has no annotations annotation_checker · 100%
low
Tool 'vikunja_remove_label_from_task' has no annotations annotation_checker · 100%
low
Tool 'vikunja_list_task_comments' has no annotations annotation_checker · 100%
low
Tool 'vikunja_create_task_comment' has no annotations annotation_checker · 100%
medium
OAuth implementation without PKCE auth_checker · 75%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Buffer.from base64 in shichao402-vikunja-mcp-f477aa6/src/vikunja-client.ts:339 entropy_analyzer · 75%
info
package.json metadata manifest_parser · 100%
info
Tool: vikunja_get_server_info manifest_parser · 85%
info
Tool: vikunja_get_current_user manifest_parser · 85%
info
Tool: vikunja_list_projects manifest_parser · 85%
info
Tool: vikunja_get_project manifest_parser · 85%
info
Tool: vikunja_create_project manifest_parser · 85%
info
Tool: vikunja_update_project manifest_parser · 85%
info
Tool: vikunja_delete_project manifest_parser · 85%
info
Tool: vikunja_list_tasks manifest_parser · 85%
info
Tool: vikunja_get_task manifest_parser · 85%
info
Tool: vikunja_create_task manifest_parser · 85%
info
Tool: vikunja_update_task manifest_parser · 85%
info
Tool: vikunja_delete_task manifest_parser · 85%
info
Tool: vikunja_list_labels manifest_parser · 85%
info
Tool: vikunja_create_label manifest_parser · 85%
info
Tool: vikunja_list_task_labels manifest_parser · 85%
info
Tool: vikunja_add_label_to_task manifest_parser · 85%
info
Tool: vikunja_remove_label_from_task manifest_parser · 85%
info
Tool: vikunja_list_task_comments manifest_parser · 85%
info
Tool: vikunja_create_task_comment manifest_parser · 85%
info
Transport: stdio manifest_parser · 90%
info
Required env vars (9) manifest_parser · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 70%
low
Permission: env_vars access detected permission_analyzer · 90%
info
SBOM generated: 94 components sbom_generator · 100%
high
Hardcoded Password found in shichao402-vikunja-mcp-f477aa6/README.md secret_scanner · 65%
high
Hardcoded Password found in shichao402-vikunja-mcp-f477aa6/README.zh-CN.md secret_scanner · 65%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%