A file-based task manager operated through an MCP server, enabling agents to create, search, and manage tasks with git versioning and hybrid semantic+keyword search.
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.
Install from
M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
Picomatch has a ReDoS vulnerability via extglob quantifiers
simple-git is vulnerable to Remote Code Execution
Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching
yaml is vulnerable to Stack Overflow via deeply nested YAML collections
process.env. You'll be asked to provide them before it can run.ALLOW_INSECURE_HTTPAPI_KEY— Yes Bearer token for MCP authenticationDISABLE_EMBEDDINGGIT_TOKEN— No GitHub PAT for private repos (fine-grained PAT with Contents read/write)GIT_USER_EMAIL— Yes Git commit author emailGIT_USER_NAME— Yes Git commit author namePORT— No Server port (default: 8181)SERVER_URLTASKS_DIR— Yes Path to the tasks directoryTASKS_REPO_URL— No Git remote URL (clones on first start)TRUST_PROXY_HOPS[](https://m8ven.ai/mcp/dlhck-task-fabric-1lypxz)