MCP ERPNext (sharat9703/mcp-erpnext-taiga-gitlab-redmine) is an MCP server listed on the M8ven Trust Index. It scores 56 out of 100, grade D. It declares 104 tools. No publisher has claimed this listing.
Model Context Protocol (MCP) server for ERPNext - manage timesheets, leave applications, projects, and software releases via Claude, Gemini, or any MCP-compatible AI assistant.
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
sharat9703
Source: Glama
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
erpnext_loginLogin to ERPNext with username/password and optional TOTP. Call this first before other operations.
erpnext_get_current_employeeGet the employee record linked to the currently logged in user
erpnext_list_activity_typesList all available activity types for timesheets
erpnext_list_projectsList all projects
erpnext_list_tasksList tasks for a specific project
erpnext_create_timesheetCreate a new timesheet with time logs.
erpnext_quick_timesheetCreate a timesheet for today with a single entry
erpnext_list_timesheetsList timesheets with optional filters
erpnext_get_timesheetGet details of a specific timesheet
erpnext_get_my_draft_timesheetsGet all draft timesheets for current employee
erpnext_add_time_logAdd time log to existing draft timesheet
erpnext_submit_timesheetSubmit a draft timesheet
erpnext_cancel_timesheetCancel a submitted timesheet
erpnext_create_weekly_timesheetCreate weekly timesheet: 7h Billable + 2h Non-Billable per day, Mon-Fri
erpnext_create_custom_timesheetCreate timesheet with custom entries
erpnext_update_time_logUpdate a specific time log in a draft timesheet. Use this to edit hours, times, project, activity type, or description of an existing time entry.
erpnext_remove_time_logRemove a specific time log from a draft timesheet. Cannot remove the last time log.
erpnext_update_timesheet_noteUpdate the note on a draft timesheet
erpnext_delete_timesheetDelete a draft timesheet. Only works on timesheets that have not been submitted.
erpnext_list_leave_typesList all available leave types
erpnext_get_leave_balanceGet leave balance for employee
erpnext_list_leave_applicationsList leave applications with filters
erpnext_get_leave_applicationGet details of a specific leave application
erpnext_get_my_pending_leavesGet pending leave applications for current employee
erpnext_get_my_approved_leavesGet approved leave applications for current employee
erpnext_apply_leaveApply for leave (single or multiple days)
erpnext_submit_leave_applicationSubmit leave application for approval
erpnext_cancel_leave_applicationCancel a leave application
erpnext_create_software_releaseCreate a software release document in ERPNext from GitLab merge request URL(s). When template_release_url is provided, auto-fills Product, Customer, and Reviewer from that release. Also auto-fetches: Redmine IDs from MR description (#123456), patch/test report URLs from MR notes, and Redmine ticket …
erpnext_preview_software_releasePreview what a software release will look like BEFORE creating it. Shows all auto-detected fields, their sources, and any missing required fields. Use this to review the release details before calling erpnext_create_software_release.
erpnext_list_productsList available products (Brands) for software release selection
erpnext_list_customers_for_releaseList available customers for software release selection
erpnext_get_mr_detailsGet details from a GitLab merge request URL including auto-detected customer, version, Redmine IDs from description, and auto-fetched patch/test report URLs from MR notes
erpnext_get_redmine_issueGet Redmine issue details (title/subject) from issue ID or URL. Requires REDMINE_API_KEY to be configured.
erpnext_get_redmine_issue_detailsGet FULL Redmine issue details from an ID or URL: description, status, priority, assignee, done ratio, comments/journal notes, attachments, sub-tasks (children) and relations. Use this (not erpnext_get_redmine_issue) when you need the actual issue content, reported bugs, or discussion. Requires REDM…
erpnext_update_redmine_issueUpdate a Redmine issue: add a comment/note and/or change fields (status, assignee, priority, done ratio, subject, description, dates). Provide either status_id or status_name (name is resolved automatically). Requires REDMINE_API_KEY with write permission on the project.
erpnext_create_redmine_issueCreate a NEW Redmine issue in a project. Use this to open a fresh ticket (e.g. a Clarification/tracking ticket) — distinct from erpnext_update_redmine_issue, which only edits an existing issue. Some projects require assignee (yourself), due date and certain custom fields (e.g. Complexity); pass assi…
erpnext_get_software_releaseGet details of an existing software release (can be used as template reference)
erpnext_list_software_releasesList recent software releases with optional filters
erpnext_download_redmine_attachmentDownload a file attachment from a Redmine issue to local disk (e.g. an issue's SQL script, spreadsheet, or document). Accepts the attachment id or a Redmine attachment download URL. Returns the saved file path, metadata, and — for text-like files — a content preview. Requires REDMINE_API_KEY.
erpnext_list_merge_requestsList merge requests from a GitLab project with filters (state, author, date range). Returns a list of MRs that can be selected for task creation analysis.
erpnext_analyze_merge_requestAnalyze one or multiple GitLab merge requests and generate intelligent task breakdown. Extracts commits, groups them by type (features/fixes/refactors), and identifies Redmine issues from MR descriptions. Returns suggested tasks for user review before creation.
erpnext_create_tasks_from_analysisCreate tasks in ERPNext from previously analyzed merge request data. Tasks are created with "Completed" status and automatically assigned to the current employee.
erpnext_get_developer_tasksGet Developer Tasks assigned to a developer (defaults to the logged-in user) with optional filters by date range, status, product, or subject search. Returns the tasks plus a breakdown of task counts per client/project (SBI, ICICI, TCIL/Mudra 2, etc.). Useful for building a delivery footprint or act…
erpnext_validate_user_storyValidate a Taiga User Story by its URL and return its id, title and project. Use this before creating tasks to confirm the user story exists and to obtain the user_story_id.
erpnext_create_user_storyCreate a new User Story in a Taiga project. Returns the created user story id, ref and URL. Use the returned user_story_id with erpnext_create_taiga_tasks to add tasks under it.
erpnext_create_taiga_tasksCreate one or more tasks in Taiga under a given User Story. Resolves assignees from project members and sets custom attributes (complexity, task_type) when those attributes exist on the project. Returns created task refs/ids and any failures.
erpnext_export_tasks_to_erpExport tasks to ERPNext as "Developer Task" documents. Resolves the developer (employee code) from a name when not provided, maps the Taiga task_type to an ERP category, and normalizes complexity. Returns created ids, in-batch skips, and failures.
erpnext_get_taiga_tasksGet Taiga tasks assigned to a user (defaults to the authenticated user), with each task's description and attachment metadata. Optionally filter by project (slug or name) and status; by default only OPEN tasks are returned. Use this to read a task's description and see its attachments (download them…
erpnext_get_user_story_tasksGet ALL tasks under a Taiga user story (any assignee) with their FULL descriptions, plus the merge-commit SHAs and Redmine issue ids referenced in each description. Use this — not erpnext_get_taiga_tasks — when working from a user story URL/ref, e.g. to collect the 'Ready for test' points of a sprin…
erpnext_update_taiga_taskUpdate a Taiga task's status and/or description. Identify the task by numeric task_id, or by ref + project (slug or name). Status names are resolved to the project's status ids automatically.
erpnext_download_taiga_attachmentDownload a Taiga task attachment to local disk. Provide the attachment url (from erpnext_get_taiga_tasks) or a numeric attachment_id. Returns the saved file path and — for text-like files — a content preview.
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default
axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig
Axios is vulnerable to DoS attack through lack of data size check
ERPNEXT_PASSWORDyour-passwordERPNEXT_TOTP_SECRETyour-totp-secret # Optional, for 2FAERPNEXT_URL"": "https://your-erpnext-instance.com",ERPNEXT_USERNAMEyour-email@example.comGITLAB_TOKENyour-gitlab-personal-access-tokenGITLAB_URLREDMINE_API_KEYyour-redmine-api-key # For auto-fetching ticket titlesREDMINE_URLTAIGA_HOSTTAIGA_PASSTAIGA_TOKENTAIGA_USERTool annotations
No tools have read-only/destructive annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
104/104 tools missing one or more hints — erpnext_login (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); erpnext_get_current_employee (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); erpnext_list_activity_types (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +101 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
Tests exist
No test files found
Add tests that exercise each declared tool.
Shell command execution
8 child_process calls — runs shell commands
Prefer library functions over shell-outs. If you must shell out, ensure all inputs are properly escaped.
Secrets not logged
4 secret values sent to console.log
Redact or omit secret values from log output.
Production dependencies are patched
0 critical, 14 high severity in production deps — @modelcontextprotocol/sdk@1.0.0 (high), axios@1.6.0 (high)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/sharat9703/mcp-erpnext-taiga-gitlab-redmine)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check