Things MCP

An MCP server for Things 3 on macOS that enables AI assistants to create, read, update, and manage tasks and projects. It utilizes the Things URL scheme for write operations and AppleScript for querying data from the app.

→ lucas-flatwhite/things-app-mcp · listed on glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

✅

17 tools verified — handlers match their declared behaviour

10 read-only tools verified — handlers contain no write/delete/exec

✅

No credential exfiltration, no sensitive file access, no obfuscation

Static analysis found nothing flowing your secrets to unexpected places.

🔐

You'll be asked for 1 credential: THINGS_AUTH_TOKEN

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// required environment variables

This server reads these from process.env. You'll be asked to provide them before it can run.

🔐 secretTHINGS_AUTH_TOKEN— Set the environment variable in your MCP client configuration. This avoids needing to pass the token with every request.

configTHINGS_MCP_TEST_ALLOW_WRITES— 1 npm run test:tools

configTHINGS_MCP_TEST_PROJECT_ID

configTHINGS_MCP_TEST_TODO_ID

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// improvement guidance — verified publishers only

We have 4 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/lucas-flatwhite-things-app-mcp-1xgll9)](https://m8ven.ai/mcp/lucas-flatwhite-things-app-mcp-1xgll9)

commit: 580999b93d67a222c66555534fe3093683cf2d22

code hash: 911c36d9dbd8bdc2bcbc44d451fad06bf3966efffadc50db8b52c84fe0e645f3

verified: 6/12/2026, 11:30:36 AM

view raw JSON →