Trello MCP Server (rdeprey/trello-mcp-server) is an MCP server listed on the M8ven Trust Index. It scores 54 out of 100, grade D. It declares 17 tools. No publisher has claimed this listing.

D
Caution
54/100

Trello MCP Server

An MCP server that connects Claude to Trello, enabling comprehensive management of boards, lists, and cards through natural language conversation. It supports a wide range of actions including searching cards, adding comments, managing checklists, and tracking board activity.

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

rdeprey

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

Install from

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
⚠️
Known vulnerabilities in dependencies: 17 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
17 tools verified — handlers match their declared behaviour
9 read-only tools verified — handlers contain no write/delete/exec
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
🔐
You'll be asked for 2 credentials: TRELLO_API_KEY, TRELLO_TOKEN
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// tools this server exposes17 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

trello_list_boards

List all boards accessible to the authenticated Trello user. Returns boards the user is a member of. Archived boards are included when filter is set to 'all'. Args: - filter ('all' | 'open' | 'closed'): Filter boards by status (default: 'open') - response_format ('markdown' | 'json'): Output f

trello_get_board

Get detailed information about a specific Trello board, including its lists and labels. Args: - board_id (string): The Trello board ID - include_lists (boolean): Whether to include the board's lists (default: true) - include_labels (boolean): Whether to include the board's labels (default: tr

trello_list_lists

List all lists on a specific Trello board. Args: - board_id (string): The Trello board ID - filter ('all' | 'open' | 'closed'): Filter lists by status (default: 'open') - response_format ('markdown' | 'json'): Output format (default: 'markdown') Returns: List of lists with id, name, and stat

trello_create_list

Create a new list on a Trello board. Args: - board_id (string): The board to create the list on - name (string): Name for the new list - pos ('top' | 'bottom' | number): Position of the list (default: 'bottom') Returns: The newly created list object.

trello_archive_list

Archive or unarchive a Trello list. Args: - list_id (string): The list ID to archive/unarchive - archive (boolean): true to archive, false to unarchive (default: true) Returns: Confirmation of the action.

trello_list_cards

List cards on a Trello board or within a specific list. You can filter by board or by list. At least one of board_id or list_id must be provided. Args: - board_id (string, optional): Board ID to get all cards from - list_id (string, optional): List ID to get cards from a specific list - filt

trello_get_card

Get detailed information about a specific Trello card. Args: - card_id (string): The card ID - response_format ('markdown' | 'json'): Output format (default: 'markdown') Returns: Full card details including name, description, due date, labels, members, checklists, and URL.

trello_create_card

Create a new card on a Trello list. Args: - list_id (string): The list to create the card in (required) - name (string): Card title (required) - desc (string, optional): Card description (supports Markdown) - pos ('top' | 'bottom' | number): Position in the list (default: 'bottom') - due

trello_update_card

Update an existing Trello card. Only provided fields will be changed. This tool can also move a card by setting idList and/or idBoard. Args: - card_id (string): The card to update (required) - name (string, optional): New card title - desc (string, optional): New description - closed (bool

trello_delete_card

Permanently delete a Trello card. This cannot be undone. Consider using trello_update_card with closed=true to archive instead. Args: - card_id (string): The card to delete (required) Returns: Confirmation that the card was deleted.

trello_search_cards

Search for cards across all boards using Trello's search API. Supports Trello search operators like @member, #label, board:name, list:name, is:open, is:archived, has:attachments, due:week, etc. Args: - query (string): Search query (supports Trello search operators) - board_id (string, optional

trello_list_members

List all members of a Trello board. Args: - board_id (string): The board ID - response_format ('markdown' | 'json'): Output format (default: 'markdown') Returns: Members with full name, username, and ID.

trello_get_activity

Get recent activity (actions) on a Trello board, including comments, card moves, and updates. Args: - board_id (string): The board ID - filter (string, optional): Comma-separated action types (e.g. 'commentCard,updateCard,createCard') - limit (number): Max actions to return (1-100, default: 2

trello_add_comment

Add a comment to a Trello card. Args: - card_id (string): The card to comment on - text (string): Comment text (supports Markdown) Returns: The created comment action.

trello_get_comments

Get all comments on a Trello card. Args: - card_id (string): The card to get comments from - limit (number): Max comments to return (1-100, default: 20) - response_format ('markdown' | 'json'): Output format (default: 'markdown') Returns: Comments with author, timestamp, and text.

trello_add_checklist

Create a new checklist on a Trello card, optionally with items. Args: - card_id (string): The card to add the checklist to - name (string): Checklist name - items (string[], optional): List of checklist item names to pre-populate Returns: The created checklist.

trello_create_label

Create a new label on a Trello board. Args: - board_id (string): The board to create the label on - name (string): Label name - color (string): Label color — one of: green, yellow, orange, red, purple, blue, sky, lime, pink, black, null (no color) Returns: The created label.

// known CVEs in dependencies17 high12 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.12.1GHSA-345p-7cg4-v4c7

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

high@modelcontextprotocol/sdk@1.12.1GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.12.1GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

highaxios@1.7.9GHSA-35jp-ww65-95wh

axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

highaxios@1.7.9GHSA-3g43-6gmg-66jw

axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
🔐 secretTRELLO_API_KEY"": "your-api-key",
🔐 secretTRELLO_TOKEN"": "your-token"
// quality suggestions

Tool inputs are validated

14/17 tool handlers declare input schemas (82%)

Declare an inputSchema with zod/joi/yup on every tool definition.

License file

No license file

Add a LICENSE file (MIT, Apache-2.0, etc.).

Tests exist

No test files found

Add tests that exercise each declared tool.

Production dependencies are patched

0 critical, 17 high severity in production deps — @modelcontextprotocol/sdk@1.12.1 (high), @modelcontextprotocol/sdk@1.12.1 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 4 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/rdeprey/trello-mcp-server?variant=verified)](https://m8ven.ai/mcp/rdeprey/trello-mcp-server)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: 4de4546198e82ce2ee856609a7db936060265061
code hash: 58402ff722d51dbac1cf7c67310560dc50bdc953c059cc6babd888d076770ba2
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client