spatialy/huly-mcp (spatialy/huly-mcp) is an MCP server listed on the M8ven Trust Index. It scores 60 out of 100, grade C. It declares 164 tools. No publisher has claimed this listing.

C
Caution
60/100

spatialy/huly-mcp

MCP server for Huly platform enabling project management, issue tracking, and collaboration through natural language.

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

spatialy

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

Install from

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
⚠️
Known vulnerabilities in dependencies: 3 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 1 credential: HULY_TOKEN
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// tools this server exposes164 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

list_activity

List activity messages for a Huly object. Returns activity sorted by date (newest first).

add_reaction

Add an emoji reaction to an activity message.

remove_reaction

Remove an emoji reaction from an activity message.

list_reactions

List reactions on an activity message.

save_message

Save/bookmark an activity message for later reference.

unsave_message

Remove an activity message from saved/bookmarks.

list_saved_messages

List saved/bookmarked activity messages.

list_mentions

List @mentions of the current user in activity messages.

list_attachments

List attachments on a Huly object (issue, document, etc.). Returns attachments sorted by modification date (newest first).

get_attachment

Retrieve full details for a Huly attachment including download URL.

add_attachment

Add an attachment to a Huly object. Provide ONE of: filePath (local file - preferred), fileUrl (fetch from URL), or data (base64). Returns the attachment ID and download URL.

update_attachment

Update attachment metadata (description, pinned status).

delete_attachment

Permanently delete an attachment. This action cannot be undone.

pin_attachment

Pin or unpin an attachment.

download_attachment

Get download URL for an attachment along with file metadata (name, type, size).

add_issue_attachment

Add an attachment to a Huly issue. Convenience method that finds the issue by project and identifier. Provide ONE of: filePath, fileUrl, or data.

add_document_attachment

Add an attachment to a Huly document. Convenience method that finds the document by teamspace and title/ID. Provide ONE of: filePath, fileUrl, or data.

list_events

List calendar events. Returns events sorted by date. Supports filtering by date range.

get_event

Retrieve full details for a calendar event including description. Use this to view event content and metadata.

create_event

Create a new calendar event. Description supports markdown formatting. Returns the created event ID.

update_event

Update fields on an existing calendar event. Only provided fields are modified. Description updates support markdown.

delete_event

Permanently delete a calendar event. This action cannot be undone.

list_recurring_events

List recurring event definitions. Returns recurring events sorted by modification date (newest first).

create_recurring_event

Create a new recurring calendar event with RFC5545 RRULE rules. Description supports markdown. Returns the created event ID.

list_event_instances

List instances of a recurring event. Returns instances sorted by date. Supports filtering by date range. Use includeParticipants=true to fetch full participant info (extra lookups).

list_card_types

List available card types (MasterTags) in the Huly workspace. Use this to discover what card types exist before creating or filtering cards.

list_cards

List cards in the Huly workspace. Optionally filter by card type ID. Returns cards sorted by modification date (newest first).

get_card

Get full details of a Huly card including markdown content. Look up by title or ID.

create_card

Create a new card in the Huly workspace. Optionally specify a card type (MasterTag ID from list_card_types). Content supports markdown.

update_card

Update fields on an existing Huly card. Only provided fields are modified. Content updates support markdown.

delete_card

Permanently delete a Huly card. This action cannot be undone.

list_channels

List all Huly channels. Returns channels sorted by name. Supports filtering by archived status. Supports searching by name substring (nameSearch) and topic substring (topicSearch).

get_channel

Retrieve full details for a Huly channel including topic and member list.

create_channel

Create a new channel in Huly. Returns the created channel ID and name.

update_channel

Update fields on an existing Huly channel. Only provided fields are modified.

delete_channel

Permanently delete a Huly channel. This action cannot be undone.

list_channel_messages

List messages in a Huly channel. Returns messages sorted by date (newest first).

send_channel_message

Send a message to a Huly channel. Message body supports markdown formatting.

list_direct_messages

List direct message conversations in Huly. Returns conversations sorted by date (newest first).

list_thread_replies

List replies in a message thread. Returns replies sorted by date (oldest first).

add_thread_reply

Add a reply to a message thread. Reply body supports markdown formatting.

update_thread_reply

Update a thread reply. Only the body can be modified.

delete_thread_reply

Permanently delete a thread reply. This action cannot be undone.

list_comments

List comments on a Huly issue. Returns comments sorted by creation date (oldest first).

add_comment

Add a comment to a Huly issue. Comment body supports markdown formatting.

update_comment

Update an existing comment on a Huly issue. Comment body supports markdown formatting.

delete_comment

Delete a comment from a Huly issue. This action cannot be undone.

list_persons

List all persons in the Huly workspace. Returns persons sorted by modification date (newest first). Supports searching by name substring (nameSearch) and email substring (emailSearch).

get_person

Retrieve full details for a person including contact channels. Use personId or email to identify the person.

create_person

Create a new person in Huly. Returns the created person ID.

update_person

Update fields on an existing person. Only provided fields are modified.

delete_person

Permanently delete a person from Huly. This action cannot be undone.

list_employees

List employees (persons who are team members). Returns employees sorted by modification date (newest first).

list_organizations

List all organizations in the Huly workspace. Returns organizations sorted by modification date (newest first).

create_organization

Create a new organization in Huly. Optionally add members by person ID or email. Returns the created organization ID.

preview_deletion

Preview the impact of deleting a Huly entity before actually deleting it. Shows affected sub-entities, relations, and warnings. Supports issues, projects, components, and milestones. Use this to understand cascade effects before calling a delete operation.

list_teamspaces

List all Huly document teamspaces. Returns teamspaces sorted by name. Supports filtering by archived status.

get_teamspace

Get details of a single Huly teamspace by name or ID. Returns teamspace metadata including name, description, archived and private status.

create_teamspace

Create a new Huly document teamspace. Returns the created teamspace id and name.

update_teamspace

Update fields on an existing Huly teamspace. Only provided fields are modified.

delete_teamspace

Permanently delete a Huly teamspace and all its documents. This action cannot be undone.

list_documents

List documents in a Huly teamspace. Returns documents sorted by modification date (newest first). Supports searching by title substring (titleSearch) and content (contentSearch).

get_document

Retrieve full details for a Huly document including markdown content. Use this to view document content and metadata.

create_document

Create a new document in a Huly teamspace. Content supports markdown formatting. Returns the created document id.

update_document

Update fields on an existing Huly document. Only provided fields are modified. Content updates support markdown.

delete_document

Permanently delete a Huly document. This action cannot be undone.

list_issues

Query Huly issues with optional filters. Returns issues sorted by modification date (newest first). Supports filtering by project, status, assignee, and milestone. Supports searching by title substring (titleSearch) and description content (descriptionSearch).

get_issue

Retrieve full details for a Huly issue including markdown description. Use this to view issue content, comments, or full metadata.

create_issue

Create a new issue in a Huly project. Optionally create as a sub-issue by specifying parentIssue. Description supports markdown formatting. Returns the created issue identifier.

update_issue

Update fields on an existing Huly issue. Only provided fields are modified. Description updates support markdown.

add_issue_label

Add a tag/label to a Huly issue. Creates the tag if it doesn't exist in the project.

remove_issue_label

Remove a tag/label from a Huly issue. Detaches the label reference; does not delete the label definition.

delete_issue

Permanently delete a Huly issue. This action cannot be undone.

list_components

List components in a Huly project. Components organize issues by area/feature. Returns components sorted by modification date (newest first).

get_component

Retrieve full details for a Huly component. Use this to view component content and metadata.

create_component

Create a new component in a Huly project. Components help organize issues by area/feature. Returns the created component ID and label.

update_component

Update fields on an existing Huly component. Only provided fields are modified.

set_issue_component

Set or clear the component on a Huly issue. Pass null for component to clear it.

delete_component

Permanently delete a Huly component. This action cannot be undone.

list_issue_templates

List issue templates in a Huly project. Templates define reusable issue configurations. Returns templates sorted by modification date (newest first).

get_issue_template

Retrieve full details for a Huly issue template. Use this to view template content and default values.

create_issue_template

Create a new issue template in a Huly project. Templates define default values for new issues. Returns the created template ID and title.

create_issue_from_template

Create a new issue from a template. Applies template defaults, allowing overrides for specific fields. Returns the created issue identifier.

update_issue_template

Update fields on an existing Huly issue template. Only provided fields are modified.

delete_issue_template

Permanently delete a Huly issue template. This action cannot be undone.

add_issue_relation

Add a relation between two issues. Relation types: 'blocks' (source blocks target — pushes into target's blockedBy), 'is-blocked-by' (source is blocked by target — pushes into source's blockedBy), 'relates-to' (bidirectional link — updates both sides). targetIssue accepts cross-project identifiers l

remove_issue_relation

Remove a relation between two issues. Mirrors add_issue_relation: 'blocks' pulls from target's blockedBy, 'is-blocked-by' pulls from source's blockedBy, 'relates-to' pulls from both sides. No-op if the relation doesn't exist.

list_issue_relations

List all relations of an issue. Returns blockedBy (issues blocking this one) and relations (bidirectional links) with resolved identifiers. Does NOT return issues that this issue blocks — use list_issue_relations on the target issue to see that.

list_labels

List label/tag definitions in the workspace. Labels are global (not project-scoped). Returns labels for tracker issues sorted by modification date (newest first).

create_label

Create a new label/tag definition in the workspace. Labels are global and can be attached to any issue. Returns existing label if one with the same title already exists (created=false). Use add_issue_label to attach a label to a specific issue.

update_label

Update a label/tag definition. Accepts label ID or title. Only provided fields are modified.

delete_label

Permanently delete a label/tag definition. Accepts label ID or title. This action cannot be undone.

list_milestones

List milestones in a Huly project. Returns milestones sorted by modification date (newest first).

get_milestone

Retrieve full details for a Huly milestone. Use this to view milestone content and metadata.

create_milestone

Create a new milestone in a Huly project. Returns the created milestone ID and label.

update_milestone

Update fields on an existing Huly milestone. Only provided fields are modified.

set_issue_milestone

Set or clear the milestone on a Huly issue. Pass null for milestone to clear it.

delete_milestone

Permanently delete a Huly milestone. This action cannot be undone.

list_notifications

List inbox notifications. Returns notifications sorted by modification date (newest first). Supports filtering by read/archived status.

get_notification

Retrieve full details for a notification. Use this to view notification content and metadata.

64 further tools are not listed here. The complete surface is in the source.

// known CVEs in dependencies3 high1 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.0.4GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

higheffect@3.19.15GHSA-38f7-945m-qr2g

Effect `AsyncLocalStorage` context lost/contaminated inside Effect fibers under concurrent load with RPC

highws@8.18.2GHSA-96hv-2xvq-fx4p

ws: Memory exhaustion DoS from tiny fragments and data chunks

ws: Uninitialized memory disclosure

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
🔐 secretHULY_TOKENAuth API token (alternative to email/password)
// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

164/164 tools missing one or more hints — list_activity (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); add_reaction (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); remove_reaction (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +161 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Tool test coverage

Only 1/164 tools referenced in tests (1%)

Write tests that reference each tool by name so every tool has at least one test.

Shell command execution

1 child_process call — runs shell commands

Prefer library functions over shell-outs. If you must shell out, ensure all inputs are properly escaped.

Production dependencies are patched

0 critical, 3 high severity in production deps — @modelcontextprotocol/sdk@1.0.4 (high), effect@3.19.15 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 5 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/spatialy/huly-mcp?variant=verified)](https://m8ven.ai/mcp/spatialy/huly-mcp)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: bbca4ba5e394c43a26bd66527f4a2b401d3a1147
code hash: 5505b55a5336c930c1e7c646cc7b9200539de247d13a17d13c3521f6574aa6d6
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client