Taiga Remote MCP Server (ens-ray-nguyen/taiga-mcp-remote) is an MCP server listed on the M8ven Trust Index. It scores 54 out of 100, grade D. It declares 50 tools. No publisher has claimed this listing.

Back to MCP Trust IndexM8ven
D
Caution
54/100

Taiga Remote MCP Server

A remote MCP server for Taiga project management that enables multiple users to connect simultaneously with their own Taiga accounts via OAuth 2.1, providing access to Taiga resources through the Model Context Protocol.

→ ens-ray-nguyen/taiga-mcp-remote· listed on glama

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

ens-ray-nguyen

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

Glamanot scored here

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
⚠️
Known vulnerabilities in dependencies: 18 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
✅
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
🔐
You'll be asked for 2 credentials: TAIGA_BOOTSTRAP_TOKEN, TAIGA_PASSWORD
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// tools this server exposes50 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

taiga_auth_status

Check the current authentication status and session info

taiga_get_current_user

Get the profile of the currently authenticated Taiga user

taiga_login

Returns current session info. New sessions can be created either through the MCP OAuth flow or via POST /auth/login for legacy manual tokens.

taiga_logout

Logout and invalidate the current session token

taiga_list_epics

List epics for a project

taiga_get_epic

Get details of an epic by ID

taiga_get_epic_userstories

Get user stories associated with an epic

taiga_create_epic

Create a new epic in a project

taiga_export_project

Export an entire project as a JSON dump and save to a local file

taiga_import_project

Import a project from a JSON dump file previously exported with taiga_export_project

taiga_get_project_timeline

Get the activity feed for a project (recent events and changes)

taiga_get_user_timeline

Get the activity feed for a specific user

taiga_list_issues

List issues with filters by status, type, severity, priority, or assignee

taiga_get_issue

Get details of an issue by ID or by ref number

taiga_create_issue

Create a new issue in a project

taiga_update_issue

Update an issue. Must include version for optimistic concurrency control.

taiga_get_issue_history

Get the change history and comments for an issue

taiga_list_members

List all members of a project with their roles

taiga_get_user

Get the profile of a Taiga user by ID

taiga_get_user_stats

Get activity statistics for a Taiga user

taiga_list_projects

List all Taiga projects accessible to the current user

taiga_get_project

Get project details by ID or slug

taiga_get_project_stats

Get overall statistics for a project (total US, tasks, issues, points)

taiga_get_project_issues_stats

Get issues statistics breakdown by type, status, priority, severity for a project

taiga_search

Search across user stories, tasks, issues, and wiki pages in a project

taiga_resolve

Resolve a project slug and ref number to internal IDs

taiga_list_userstory_statuses

List all user story status options for a project

taiga_list_task_statuses

List all task status options for a project

taiga_list_issue_statuses

List all issue status options for a project

taiga_list_issue_types

List all issue type options for a project (Bug, Question, Enhancement, etc.)

taiga_list_priorities

List all priority options for a project

taiga_list_severities

List all severity options for a project

taiga_list_sprints

List sprints (milestones) for a project

taiga_get_sprint

Get details of a sprint by ID

taiga_get_sprint_stats

Get burndown statistics for a sprint

taiga_create_sprint

Create a new sprint in a project

taiga_update_sprint

Update sprint details (name, dates, closed status)

taiga_list_tasks

List tasks with filters by project, sprint, user story, status, or assignee

taiga_get_task

Get details of a task by ID or by ref number

taiga_create_task

Create a new task in a project

taiga_update_task

Update a task. Must include version for optimistic concurrency control.

taiga_get_task_history

Get the change history and comments for a task

taiga_list_userstories

List user stories with filters. Use milestone__isnull=true for backlog items.

taiga_get_userstory

Get details of a user story by ID or by ref number within a project

taiga_create_userstory

Create a new user story in a project

taiga_update_userstory

Update a user story. Must include version for optimistic concurrency control.

taiga_move_userstory_to_sprint

Move one or more user stories to a sprint

taiga_get_userstory_history

Get the change history and comments for a user story

taiga_list_wiki_pages

List all wiki pages in a project

taiga_get_wiki_page

Get details of a wiki page by ID or by slug within a project

// known CVEs in dependencies18 high12 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.10.0GHSA-345p-7cg4-v4c7

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

high@modelcontextprotocol/sdk@1.10.0GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.10.0GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

highaxios@1.7.0GHSA-35jp-ww65-95wh

axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

highaxios@1.7.0GHSA-3g43-6gmg-66jw

axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
configCORS_ORIGINSAllowed CORS origins for browser-based clients. Use to allow all, or a comma-separated list: https://app1.com,https://app2.com.
configMCP_SERVER_URLWhen deployed on Render, the server automatically uses Render's default public URL (RENDER_EXTERNAL_URL) as if you did not set MCP_SERVER_URL manually.
configOAUTH_ACCESS_TOKEN_TTL3600 OAuth access token lifetime in seconds. Refresh tokens remain usable until SESSION_TTL is reached.
configSESSION_TTL86400 How long (in seconds) a user session stays valid after login. 86400 = 24 hours. After expiry the user must log in again.
configTAIGA_BASE_URLfor example https://taiga.example.com/api/v1
🔐 secretTAIGA_BOOTSTRAP_TOKENA fixed UUID you generate once. This becomes the permanent Bearer token for the bootstrap session. Generate with: node -e "console.log(require('crypto').randomUUID())"
configTAIGA_CACHE_TTL300 How long (in seconds) to cache static lookups — project members, issue types, statuses, priorities. Reduces repeated API calls. 300 = 5 minutes.
configTAIGA_MAX_RETRIES3 Number of retry attempts on transient network errors before giving up.
🔐 secretTAIGA_PASSWORD(Bootstrap only) Password of the Taiga service account. Leave empty for multi-user deployments.
configTAIGA_REQUEST_TIMEOUT30000 Per-request timeout in milliseconds when calling the Taiga API. 30000 = 30 seconds.
configTAIGA_TOKEN_REFRESH_THRESHOLD72000 Seconds before a Taiga auth token's age triggers a background refresh. Default is 20 hours. Only relevant in Bootstrap mode.
configTAIGA_USERNAME(Bootstrap only) Username of the Taiga service account. Leave empty for multi-user deployments.
Deployment configuration, supplied by whoever hosts the server. Users are not asked for these.
deployPORT
// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

50/50 tools missing one or more hints — taiga_auth_status (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); taiga_get_current_user (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); taiga_login (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +47 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Tool inputs are validated

46/50 tool handlers declare input schemas (92%)

Declare an inputSchema with zod/joi/yup on every tool definition.

License file

No license file

Add a LICENSE file (MIT, Apache-2.0, etc.).

Tests exist

No test files found

Add tests that exercise each declared tool.

Production dependencies are patched

0 critical, 18 high severity in production deps — @modelcontextprotocol/sdk@1.10.0 (high), @modelcontextprotocol/sdk@1.10.0 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 6 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/ens-ray-nguyen/taiga-mcp-remote?variant=verified)](https://m8ven.ai/mcp/ens-ray-nguyen/taiga-mcp-remote)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: a6ec0818d00f837fcf8f0539188c17e93b8494b4
code hash: 824db23e242169b060651bf4e8134819d794d8acc7367721505aa1475e4be33d
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client