HAOps MCP Server (tbranzov/haops-mcp-server) is an MCP server listed on the M8ven Trust Index. It scores 50 out of 100, grade D. It declares 169 tools. No publisher has claimed this listing.

D
Caution
50/100

HAOps MCP Server

Enables Claude to interact with the HAOps project management system for managing projects, modules, features, and issues.

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

tbranzov

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

Install from

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
⚠️
Known vulnerabilities in dependencies: 11 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
🔐
You'll be asked for 1 credential: HAOPS_API_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// tools this server exposes169 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

haops_list_projects

List all projects in HAOps

haops_create_module

Create a new module in a HAOps project

haops_update_module

Update an existing module in a HAOps project

haops_create_feature

Create a new feature in a HAOps module

haops_update_feature

Update an existing feature in a HAOps module

haops_create_issue

Create a new issue in a HAOps feature

haops_delete_module

Delete a module from a HAOps project. If the module has child features, requires confirm=true to cascade delete.

haops_delete_feature

Delete a feature from a HAOps module. If the feature has child issues, requires confirm=true to cascade delete.

haops_delete_issue

Delete an issue from a HAOps feature. No confirmation needed (issues are leaf nodes with no children).

haops_update_issue

Update an existing issue in a HAOps feature

haops_bulk_update_issues

Update multiple issues at once. Useful for batch status changes, priority updates, or reassignments.

haops_create_discussion

Create a discussion thread in a HAOps project. Two modes: (1) Entity-linked — provide discussableType + discussableId to link to a Module/Feature/Issue (no channelId needed). (2) Channel-based — provide channelId (use haops_list_channels to find it). Can combine both. At least one of channelId or di

haops_list_discussions

List discussions in a HAOps project. Filter by entity (Module/Feature/Issue) to find entity-linked discussions, or by channel/status. Essential for the Entity Discussion Protocol — use this to find the discussion linked to a work item before posting.

haops_list_channels

List all channels in a HAOps project. Use this to discover channel UUIDs needed for creating channel-based discussions via haops_create_discussion.

haops_post_message

Post a message to a discussion thread in a HAOps project. Markdown is recommended for agent messages — it will be converted to HTML server-side.

haops_send_dm

Send a direct message to a user in a HAOps project. Supports markdown formatting — content will be converted to HTML server-side.

haops_get_discussion

Get detailed information about a specific discussion thread, including metadata and entity linkage.

haops_get_discussion_messages

Retrieve messages from a discussion thread with pagination. Essential for reading conversation context before responding.

haops_list_dm_conversations

List all direct message conversations in a project with unread counts and last message previews.

haops_get_dm_history

Retrieve direct message history with a specific user. Use this to read DM context before replying.

haops_update_discussion

Update discussion properties (title, status, priority, assignment, locking, pinning). Use this to resolve/close discussions or change metadata.

haops_mark_dm_read

Mark all direct messages from a specific user as read.

haops_delete_discussion

Delete a discussion thread. This is permanent and will also delete all messages in the thread. Use with caution.

haops_edit_message

Edit an existing message in a discussion thread. Only the message author can edit. Useful for correcting typos or updating information.

haops_delete_message

Delete a message from a discussion thread. Only the message author can delete. This is permanent.

haops_list_members

List all members of a HAOps project with their roles and activity stats.

haops_add_member

Add a user as a member to a HAOps project.

haops_update_member_role

Update a project member's role. Cannot change the owner role.

haops_get_activity

Get activity log for a specific entity (Module, Feature, or Issue) in a HAOps project. Shows who changed what and when.

haops_get_audit_log

Get system-wide audit log (admin only). Shows all changes across the platform with filters.

haops_claim_issue

Claim an issue for work. Checks availability and marks as in-progress. Use before starting implementation.

haops_claim_feature

Claim a feature for work. Checks availability and marks as in-progress. Use before starting implementation on a feature.

haops_claim_module

Claim a module for work. Checks availability and marks as in-progress. Use before starting implementation on a module.

haops_work_entity_health_check

Run health checks on work entities to detect stale, inconsistent, or problematic states. Returns findings with severity and recommendations.

haops_list_help_sections

List all help center sections with article counts. Returns published and unpublished sections.

haops_list_help_articles

List help articles, optionally filtered by section slug.

haops_create_help_article

Create a new help article in a section.

haops_get_help_article

Get a help article by slug, including full HTML content. Use this before haops_update_help_article when you need to append to existing content (update is wholesale replace).

haops_update_help_article

Update an existing help article by slug.

haops_list_doc_artifacts

List documentation artifacts for a project. Each artifact represents a type of documentation (architecture, developer, deployment, api, user_guide, changelog, adr, plans).

haops_create_doc_artifact

Create a new documentation artifact for a project. One artifact per type per project.

haops_update_doc_artifact

Update a documentation artifact (title, description, status, version).

haops_create_doc_section

Create a new section within a documentation artifact. IMPORTANT: Uses `artifactSlug` (kebab-case slug of the parent artifact, e.g. "deployment" or "api-routes") — NOT the artifact UUID. This is an exception: most other create-* tools use UUID identifiers. Use `haops_list_doc_artifacts` to find the s

haops_update_doc_section

Update a documentation section content, title, slug, or source hint. IMPORTANT: Uses `artifactSlug` (kebab-case slug of the parent artifact, e.g. "deployment" or "api-routes") — NOT the artifact UUID. This is an exception: most other update-* tools use UUID identifiers. Use `haops_list_doc_artifacts

haops_write_docsection_summary

Write an agent-authored summary/covers/relevantTo/sectionStatus onto a DocSection's agentMetadata — the agent-facing replacement for the retired Gemma-distiller write path (fdev debf977a). Any caller with project write access can use this; it does NOT require an admin browser session. Read-merge sem

haops_get_doc_section

Get a specific documentation section content and metadata.

haops_export_doc_markdown

Export a documentation artifact as Markdown text. Returns the full Markdown content as a string (not a file download). Useful for syncing documentation to a git repository.

haops_generate_onboarding

Generate a Developer Onboarding Kit (ZIP) for a new developer joining a project. Creates pre-configured agent workspace with memory files, agent definitions, and project configuration. The ZIP is saved to a local temp file and the file path is returned.

haops_read_memory
haops_append_memory

Append a tagged log entry to entity agent memory. Author is auto-populated from the API key. Tag must be allowed for the API key's agent role (e.g. dev can use: context, decision, progress, issue; qa: review, issue; architect/admin: all tags).

haops_consolidate_memory

Consolidate entity agent memory: replace baseText with updated summary and mark log entries as integrated. Admin and architect roles ONLY. Use this to keep baseText concise by integrating accumulated log entries.

haops_read_protocol
haops_update_protocol

Update (create new version of) the work protocol for a specific agent role in a project. Creates a new version and marks the previous as historical. Architect and admin roles ONLY. Partial-body support: Provide ONLY the fields you want to change. Server carries forward unchanged fields. • Common

haops_list_protocol_versions

List all versions of a work protocol for a specific agent role. Returns version numbers, timestamps, change summaries, and who updated each version.

haops_get_protocol_health

Returns per-role composed-protocol health: missing Ability UUIDs, deprecated references, Ability pack health, snapshot metadata. Surfaces drift programmatically (same data as the Project Settings → Protocol Health panel in HAOps Desktop UI). Requires ENABLE_COMPOSED_PROTOCOLS=true on the server.

haops_list_skills

List agent Abilities (system-wide + optionally project-scoped). Abilities are reusable, role-tagged knowledge units (e.g. "out-of-scope-findings", "three-layer-boot") that compose into agent protocols. Filter by scope, category, role, project, or free-text search. Deprecated Abilities are excluded b

haops_read_skill

Read a single Ability by its kebab-case name. Returns full markdown content + metadata (category, applicableRoles, version, ID, isDeprecated). Use this after haops_list_skills — or after a haops_read_protocol(mode="lazy") response's skillRefs[] manifest — to fetch the actual instructions on demand.

haops_create_skill

Create a new agent Ability (system or project-scoped). Inserts version=1 with isCurrent=true. Admin-only on the server, gated by ENABLE_COMPOSED_PROTOCOLS. Returns the new Ability row on success; 409 if an Ability with the same name already exists in the target scope (use haops_update_skill to publi

haops_update_skill

Publish a new version of an existing Ability (PUT /api/skills/[name]). Server bumps version in a single transaction. A no-op update (no field differs from current) returns the current row WITHOUT a version bump (mirrors prompt PATCH semantics). At least one mutable field must be supplied. Admin-only

haops_deprecate_skill

Soft-delete + deprecate an Ability (DELETE /api/skills/[name]). Cascades the soft-delete across ALL versions (current + historical) and flips isDeprecated=true on the current row. History remains visible via /api/skills/[name]/history for audit context. Admin-only, gated by ENABLE_COMPOSED_PROTOCOLS

haops_get_skill_history

Returns the full version history of a named Ability (GET /api/skills/[name]/history). Each entry contains the version number, publication timestamp, author, lifecycle state, and full content at that point in time. When diff=true the server computes unified diffs between consecutive versions and incl

haops_get_role_template_history

Returns the full version history of a named role template (GET /api/role-templates/[name]/history). Role templates are system-wide (no scope/projectSlug). Each entry contains version, publication timestamp, author, lifecycle state, and the full `baseBody` markdown. When diff=true the server computes

haops_bulk_publish_skills

Atomically publish multiple Abilities in a single DB transaction (POST /api/skills/bulk-publish). All version bumps happen in one round-trip; when cascade=true, consumer re-wiring (role templates, Ability packs, project protocols) runs ONCE at the end — significantly cheaper than N sequential haops_

haops_create_project_skill

Create a PROJECT-SCOPED Ability (POST /api/projects/[slug]/skills). Project-scoped Abilities are visible only to that project's protocol resolver — they cannot be referenced by system role templates or other projects' protocols. For Abilities you want reusable across all projects, use haops_create_s

haops_get_protocol_spawn_lines

Returns the per-role spawn-line text (GET /api/projects/[slug]/protocol/spawn-lines). Spawn lines are short boot-ritual strings injected at agent session start when composed protocols are active. Omit `role` to get spawn lines for ALL configured roles; pass a specific role to narrow to one. Read-on

haops_preview_project_protocol

Dry-run the composed-protocol resolver for a project role — returns the assembled manifest as if PUT had been applied, WITHOUT persisting. Use BEFORE haops_update_protocol to verify that the new templateId / skillsConfig combo resolves correctly and has no warnings. When called with no optional par

haops_preview_skill_cascade

Preview which consumers (role templates, Ability packs, project protocols) would need re-wiring if the named Ability is bumped via PUT. Read-only — does not mutate. Use BEFORE calling `haops_update_skill({ ..., cascade: true })` on a high-impact Ability to estimate blast radius.

haops_preview_role_template_cascade

Preview which project protocols would need re-wiring if the named role template is bumped via PUT. Read-only — does not mutate. Use BEFORE calling `haops_update_role_template({ ..., cascade: true })` on a high-impact template to estimate blast radius.

haops_list_role_templates

List agent role templates. A role template bundles a core `baseBody` (boot + scope + handoff markdown) with a set of default Abilities, and serves as the starting point for an agent role (architect/dev/qa/devops). System templates are seeded; admins may publish project-specific custom templates.

haops_read_role_template

Read a single role template by its kebab-case name. Returns the current version with `baseBody` (full markdown) + `defaultSkills` hydrated (each entry includes Ability name + description) + `ID` UUID. Use after haops_list_role_templates to fetch the full template contents. Abilities are managed thro

haops_create_role_template

Create a new agent role template (admin-only, requires composed-protocols feature flag). Templates are system-wide (no project scope) and always start at version=1, isCurrent=true, isSystem=false. `baseBody` is admin-trusted markdown. `defaultSkills` is the optional bundle of Ability IDs auto-enable

haops_update_role_template

Publish a new version of an existing role template (admin-only, requires composed-protocols feature flag). The server flips the current row to isCurrent=false and inserts a new row at version+1, transactionally. Only supply fields you want to change — a no-op call (no diff) returns the current row u

haops_deprecate_role_template

Soft-delete a role template, cascading across ALL versions (admin-only, requires composed-protocols feature flag). System templates (isSystem=true) cannot be deleted and return 403 — to "deprecate" a system template, publish a new version via haops_update_role_template or alter the seeder. Soft-dele

haops_list_skill_packs

List Ability packs — curated bundles of agent Abilities (e.g. helpdesk-pack, security-pack, mobile-pack) that owners adopt at project onboarding. Each pack groups related Ability IDs under a category; the onboarding wizard pre-enables them in one click. System packs are seeded and cannot be deleted.

haops_create_skill_pack

Create a new Ability pack (admin only, requires ENABLE_COMPOSED_PROTOCOLS=true on the server — returns 404 when the flag is off, by design). Body fields mirror POST /api/skill-packs: kebab-case `name` (1..100, leading letter), non-empty `description`, `category` from the SkillPackCategory enum, and

haops_update_skill_pack

Update an existing Ability pack in place — no version bump (packs are unversioned; audit log captures the diff). Admin only, requires ENABLE_COMPOSED_PROTOCOLS=true. `name` and `isSystem` are immutable post-create. Supply only the fields you want to change; supplying none (or only same-as-current va

haops_deprecate_skill_pack

Soft-delete (deprecate) an Ability pack — paranoid destroy on a single row (packs are unversioned, no cascade). Admin only, requires ENABLE_COMPOSED_PROTOCOLS=true. System packs (isSystem=true) cannot be deleted — the server returns 403; to "deprecate" a system pack, update its skillIds to empty via

haops_transition_skill

Transition an Ability through its lifecycle (propose / publish / deprecate). Hits POST /api/skills/[name]/[action]. The server enforces the allowed-from-here state machine — on a disallowed transition you get a 409 with `from`, `to`, and the `allowed` set listed in the response. Admin-only, requires

haops_transition_role_template

Transition a role template through its lifecycle (propose / publish / deprecate). Hits POST /api/role-templates/[name]/[action]. Role templates are system-wide — no scope axis. Server enforces the allowed-from-here state machine and returns 409 with `allowed` on a disallowed transition. System templ

haops_transition_skill_pack

Transition an Ability pack through its lifecycle (propose / publish / deprecate). Hits POST /api/skill-packs/[name]/[action]. Packs are unversioned and system-wide. Server enforces the allowed-from-here state machine and returns 409 with `allowed` on a disallowed transition. System packs (isSystem=t

haops_report_test_run

Report test results to HAOps. Creates a TestRun with individual TestResult records. Used by agents to manually report results (Jest/Playwright reporters do this automatically).

haops_get_test_health

Get aggregated test health summary for a project or specific entity. Returns pass rates, trend, recent failures, and coverage data.

haops_list_tests

List tests in a project with optional filters. Returns test records with metadata.

haops_list_test_runs

List recent test runs for a project. Returns run summaries with pass/fail counts.

haops_link_tests_to_entity

Link tests to a module, feature, or issue by test IDs or file path pattern. Sets testableType and testableId on matching tests.

haops_list_test_suites

List test suites for a project.

haops_export_test_suite

Export a test suite as a JSON bundle for cross-project sharing. Includes suite config and all test definitions.

haops_import_test_suite

Import a test suite from a JSON bundle into a project. Creates new suite and test records with fresh UUIDs.

haops_git_list_files

List files and directories in a project's Git repository at a given path. Returns directory entries with type (file/dir), name, and SHA. Supports multi-repo projects via repositoryName.

haops_git_read_file

Read file content from a project's Git repository. Returns text content for text files, or a "binary file" message for binary files. Supports multi-repo projects via repositoryName.

haops_git_commit_log

Get recent commit history from a project's Git repository. Returns commits with SHA, author, date, and message. Supports multi-repo projects via repositoryName.

haops_git_get_remote_url

Get SSH remote URL and setup instructions for pushing to HAOps Git. Returns the SSH URL, default branch, and copy-pasteable setup commands. Supports multi-repo projects via repositoryName.

haops_manage_ssh_keys

Manage SSH keys for HAOps Git access (list, add, or revoke). Agents can use this to self-service their SSH keys for git push access.

haops_create_merge_request

Create a merge request in a HAOps Git repository. Auto-detects conflicts and snapshots commit SHAs. Returns the created MR with status, conflict info, and diff stats.

haops_get_merge_request

Get merge request detail including diff stats, reviews with verdicts, conflict status, and branch info. Use this to review an MR before approving or merging.

haops_list_merge_requests

List merge requests for a project with optional filters. Returns MR title, status, branches, author, and timestamps.

haops_review_merge_request

Submit a review on a merge request. Verdicts: approved, changes_requested, commented. When enough approvals are met (per branch protection rules), MR status auto-transitions to approved.

haops_merge_merge_request

Merge an approved merge request. Checks branch protection rules (required approvals, allowed roles) and conflicts before merging. Supports fast-forward and three-way merge.

haops_get_branch_diff

Compare two branches in a HAOps Git repository. Returns commits ahead/behind, changed files with stats, diff content, and conflict detection. Use before creating an MR to preview changes.

haops_list_updates

List available updates for a project. Shows update type, version, status, and date. Use to check for new MCP server versions, protocol changes, test suites, or onboarding templates.

69 further tools are not listed here. The complete surface is in the source.

// known CVEs in dependencies11 high6 medium12 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

highaxios@1.13.5GHSA-35jp-ww65-95wh

axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

highaxios@1.13.5GHSA-3g43-6gmg-66jw

axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

highaxios@1.13.5GHSA-6chq-wfr3-2hj9

Axios: Header Injection via Prototype Pollution

highaxios@1.13.5GHSA-777c-7fjr-54vf

Allocation of Resources Without Limits or Throttling in Axios

highaxios@1.13.5GHSA-hfxv-24rg-xrqf

Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
🔐 secretHAOPS_API_KEY## " environment variable is required"
configHAOPS_API_URLCheck points to running HAOps instance
configHAOPS_MEMORY_CONSOLIDATE_THRESHOLD
configHAOPS_MEMORY_LAZY_DEFAULT
// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

169/169 tools missing one or more hints — haops_list_projects (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); haops_create_module (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); haops_update_module (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +166 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

License file

No license file

Add a LICENSE file (MIT, Apache-2.0, etc.).

Tool test coverage

Only 48/169 tools referenced in tests (28%)

Write tests that reference each tool by name so every tool has at least one test.

Production dependencies are patched

0 critical, 11 high severity in production deps — axios@1.13.5 (high), axios@1.13.5 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Dependency freshness

1/6 production deps stale: dagre@2022-06-14 (4.3y)

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 5 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/tbranzov/haops-mcp-server?variant=verified)](https://m8ven.ai/mcp/tbranzov/haops-mcp-server)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: 7352f4950fab246410066c8f5b84a640039e0785
code hash: 850a3ab379a273fda138ef9819c4847cd40ac15bbd244cc98e8c3663ccf12071
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client