freelo-mcp-server (sesonet/freelo-mcp-server) is an MCP server listed on the M8ven Trust Index. It scores 58 out of 100, grade D. It declares 33 tools. No publisher has claimed this listing.
MCP server for Freelo project management API, enabling task, project, and time tracking management. Features 33 curated tools, readonly mode, and audit logging.
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
sesonet
Source: Glama
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
freelo_get_all_commentsFetches all comments across projects with filtering and sorting. Includes discussions on tasks, documents, files, and links.
freelo_get_noteFetches a specific note by ID, including title, content, and metadata. Notes are standalone documents for project documentation.
freelo_create_noteCreates a new note in a project. Notes are standalone documents for project documentation, meeting minutes, or specifications.
freelo_update_noteUpdates an existing note's title or content. All fields are optional - only provide what needs to change.
freelo_get_projectsFetches your own active projects in Freelo. Returns only projects that you own. For all accessible projects, use freelo_get_all_projects.
freelo_get_all_projectsFetches all projects in Freelo - both owned and shared. Supports pagination.
freelo_get_project_detailsFetches detailed information about a specific project including workers, tasklists, and settings.
freelo_get_project_workersFetches all workers (team members) assigned to a specific project.
freelo_search_elasticsearchPerforms full-text search across Freelo using Elasticsearch. Searches tasks, subtasks, projects, tasklists, files, and comments.
freelo_get_tasks_by_filter_uuidFetches tasks using a custom filter UUID. Custom filters are pre-configured task searches with multiple criteria.
freelo_get_all_statesFetches all available task states in Freelo. States represent task lifecycle (1=active, 2=finished). Essential for state_id filters.
freelo_get_subtasksFetches all subtasks belonging to a parent task. Returns subtasks with their names, statuses, and assignments.
freelo_create_subtaskCreates a subtask under an existing task. Subtasks help break down complex tasks into smaller pieces.
freelo_get_project_tasklistsFetches all tasklists within a project. Tasklists organize tasks into logical groups (e.g., "To Do", "In Progress", "Done"). Use after freelo_get_projects to drill down into project structure.
freelo_get_tasklist_detailsFetches detailed information about a specific tasklist including name, description, color, workers, and settings.
freelo_get_all_tasksFetches all tasks across all projects with filtering. Supports search, project/tasklist filter, label filter, date ranges, worker assignment, and pagination.
freelo_get_task_detailsFetches complete details about a specific task including name, description, assignees, due date, priority, status, labels, and metadata. Use after finding tasks with freelo_get_all_tasks.
freelo_get_task_descriptionFetches only the description content of a task. More lightweight than freelo_get_task_details when you only need the description text.
freelo_get_finished_tasksFetches completed/finished tasks from a specific tasklist. For finished tasks across all projects, use freelo_get_all_tasks with state_id=2.
freelo_get_public_linkGenerates or retrieves a public sharing link for a task. Anyone with this link can view task details without logging in.
freelo_create_taskCreates a new task in a specific tasklist. Task is created in active state.
freelo_create_task_from_templateCreates a new task based on an existing template task. The new task inherits the template's name, description, and structure.
freelo_edit_taskUpdates an existing task. Can modify name, assignment, due date, or priority. For description updates, use freelo_update_task_description.
freelo_update_task_descriptionUpdates only the description of a task. Supports plain text or markdown. Previous description is replaced completely.
freelo_finish_taskMarks a task as finished/completed. Task is moved to finished state, preserving all data. Can be reactivated with freelo_activate_task.
freelo_activate_taskReactivates a finished task, moving it back to active state. Use when a completed task needs to be reopened.
freelo_start_time_trackingStarts real-time time tracking for a task. Creates an active timer that runs until stopped with freelo_stop_time_tracking.
freelo_stop_time_trackingStops the currently active time tracking session. Calculates elapsed time and automatically creates a work report.
freelo_get_usersFetches all users in the Freelo workspace. Returns user list with names, emails, IDs, and roles. Essential for getting user IDs before assigning tasks.
freelo_get_assignable_workersFetches users who can be assigned to tasks in a specific tasklist. Use before creating or assigning tasks to ensure the assignee has access.
freelo_get_work_reportsFetches work reports (time entries) with filtering. Essential for billing, productivity analysis, and project reporting.
freelo_create_work_reportCreates a new work report (time entry) for a task. Use after completing work for timesheet entry.
freelo_update_work_reportUpdates an existing work report. Use to correct time entries or add descriptions.
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse
Anthropic's MCP TypeScript SDK has a ReDoS vulnerability
Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default
axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
FREELO_API_KEYexport ="your-api-key"FREELO_AUDIT_ENABLEDfalse # Disable loggingFREELO_AUDIT_LOG./logs/audit.jsonl # Log file pathFREELO_AUDIT_WEBHOOKNo Webhook URLFREELO_EMAILexport ="your@email.com"FREELO_READONLYfalse freelo-mcp-serverAll four hints declared on every tool
33/33 tools missing one or more hints — freelo_get_all_comments (missing: destructiveHint, idempotentHint, openWorldHint); freelo_get_note (missing: destructiveHint, idempotentHint, openWorldHint); freelo_create_note (missing: readOnlyHint, destructiveHint, openWorldHint), +30 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
Tests exist
No test files found
Add tests that exercise each declared tool.
Production dependencies are patched
0 critical, 14 high severity in production deps — @modelcontextprotocol/sdk@1.22.0 (high), @modelcontextprotocol/sdk@1.22.0 (high)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/sesonet/freelo-mcp-server)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check