HAOps MCP Server (tbranzov/haops-mcp-server) is an MCP server listed on the M8ven Trust Index. It scores 50 out of 100, grade D. It declares 169 tools. No publisher has claimed this listing.
Enables Claude to interact with the HAOps project management system for managing projects, modules, features, and issues.
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
tbranzov
Source: Glama
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
haops_list_projectsList all projects in HAOps
haops_create_moduleCreate a new module in a HAOps project
haops_update_moduleUpdate an existing module in a HAOps project
haops_create_featureCreate a new feature in a HAOps module
haops_update_featureUpdate an existing feature in a HAOps module
haops_create_issueCreate a new issue in a HAOps feature
haops_delete_moduleDelete a module from a HAOps project. If the module has child features, requires confirm=true to cascade delete.
haops_delete_featureDelete a feature from a HAOps module. If the feature has child issues, requires confirm=true to cascade delete.
haops_delete_issueDelete an issue from a HAOps feature. No confirmation needed (issues are leaf nodes with no children).
haops_update_issueUpdate an existing issue in a HAOps feature
haops_bulk_update_issuesUpdate multiple issues at once. Useful for batch status changes, priority updates, or reassignments.
haops_create_discussionCreate a discussion thread in a HAOps project. Two modes: (1) Entity-linked — provide discussableType + discussableId to link to a Module/Feature/Issue (no channelId needed). (2) Channel-based — provide channelId (use haops_list_channels to find it). Can combine both. At least one of channelId or di…
haops_list_discussionsList discussions in a HAOps project. Filter by entity (Module/Feature/Issue) to find entity-linked discussions, or by channel/status. Essential for the Entity Discussion Protocol — use this to find the discussion linked to a work item before posting.
haops_list_channelsList all channels in a HAOps project. Use this to discover channel UUIDs needed for creating channel-based discussions via haops_create_discussion.
haops_post_messagePost a message to a discussion thread in a HAOps project. Markdown is recommended for agent messages — it will be converted to HTML server-side.
haops_send_dmSend a direct message to a user in a HAOps project. Supports markdown formatting — content will be converted to HTML server-side.
haops_get_discussionGet detailed information about a specific discussion thread, including metadata and entity linkage.
haops_get_discussion_messagesRetrieve messages from a discussion thread with pagination. Essential for reading conversation context before responding.
haops_list_dm_conversationsList all direct message conversations in a project with unread counts and last message previews.
haops_get_dm_historyRetrieve direct message history with a specific user. Use this to read DM context before replying.
haops_update_discussionUpdate discussion properties (title, status, priority, assignment, locking, pinning). Use this to resolve/close discussions or change metadata.
haops_mark_dm_readMark all direct messages from a specific user as read.
haops_delete_discussionDelete a discussion thread. This is permanent and will also delete all messages in the thread. Use with caution.
haops_edit_messageEdit an existing message in a discussion thread. Only the message author can edit. Useful for correcting typos or updating information.
haops_delete_messageDelete a message from a discussion thread. Only the message author can delete. This is permanent.
haops_list_membersList all members of a HAOps project with their roles and activity stats.
haops_add_memberAdd a user as a member to a HAOps project.
haops_update_member_roleUpdate a project member's role. Cannot change the owner role.
haops_get_activityGet activity log for a specific entity (Module, Feature, or Issue) in a HAOps project. Shows who changed what and when.
haops_get_audit_logGet system-wide audit log (admin only). Shows all changes across the platform with filters.
haops_claim_issueClaim an issue for work. Checks availability and marks as in-progress. Use before starting implementation.
haops_claim_featureClaim a feature for work. Checks availability and marks as in-progress. Use before starting implementation on a feature.
haops_claim_moduleClaim a module for work. Checks availability and marks as in-progress. Use before starting implementation on a module.
haops_work_entity_health_checkRun health checks on work entities to detect stale, inconsistent, or problematic states. Returns findings with severity and recommendations.
haops_list_help_sectionsList all help center sections with article counts. Returns published and unpublished sections.
haops_list_help_articlesList help articles, optionally filtered by section slug.
haops_create_help_articleCreate a new help article in a section.
haops_get_help_articleGet a help article by slug, including full HTML content. Use this before haops_update_help_article when you need to append to existing content (update is wholesale replace).
haops_update_help_articleUpdate an existing help article by slug.
haops_list_doc_artifactsList documentation artifacts for a project. Each artifact represents a type of documentation (architecture, developer, deployment, api, user_guide, changelog, adr, plans).
haops_create_doc_artifactCreate a new documentation artifact for a project. One artifact per type per project.
haops_update_doc_artifactUpdate a documentation artifact (title, description, status, version).
haops_create_doc_sectionCreate a new section within a documentation artifact. IMPORTANT: Uses `artifactSlug` (kebab-case slug of the parent artifact, e.g. "deployment" or "api-routes") — NOT the artifact UUID. This is an exception: most other create-* tools use UUID identifiers. Use `haops_list_doc_artifacts` to find the s…
haops_update_doc_sectionUpdate a documentation section content, title, slug, or source hint. IMPORTANT: Uses `artifactSlug` (kebab-case slug of the parent artifact, e.g. "deployment" or "api-routes") — NOT the artifact UUID. This is an exception: most other update-* tools use UUID identifiers. Use `haops_list_doc_artifacts…
haops_write_docsection_summaryWrite an agent-authored summary/covers/relevantTo/sectionStatus onto a DocSection's agentMetadata — the agent-facing replacement for the retired Gemma-distiller write path (fdev debf977a). Any caller with project write access can use this; it does NOT require an admin browser session. Read-merge sem…
haops_get_doc_sectionGet a specific documentation section content and metadata.
haops_export_doc_markdownExport a documentation artifact as Markdown text. Returns the full Markdown content as a string (not a file download). Useful for syncing documentation to a git repository.
haops_generate_onboardingGenerate a Developer Onboarding Kit (ZIP) for a new developer joining a project. Creates pre-configured agent workspace with memory files, agent definitions, and project configuration. The ZIP is saved to a local temp file and the file path is returned.
haops_read_memoryhaops_append_memoryAppend a tagged log entry to entity agent memory. Author is auto-populated from the API key. Tag must be allowed for the API key's agent role (e.g. dev can use: context, decision, progress, issue; qa: review, issue; architect/admin: all tags).
haops_consolidate_memoryConsolidate entity agent memory: replace baseText with updated summary and mark log entries as integrated. Admin and architect roles ONLY. Use this to keep baseText concise by integrating accumulated log entries.
haops_read_protocolhaops_update_protocolUpdate (create new version of) the work protocol for a specific agent role in a project. Creates a new version and marks the previous as historical. Architect and admin roles ONLY. Partial-body support: Provide ONLY the fields you want to change. Server carries forward unchanged fields. • Common …
haops_list_protocol_versionsList all versions of a work protocol for a specific agent role. Returns version numbers, timestamps, change summaries, and who updated each version.
haops_get_protocol_healthReturns per-role composed-protocol health: missing Ability UUIDs, deprecated references, Ability pack health, snapshot metadata. Surfaces drift programmatically (same data as the Project Settings → Protocol Health panel in HAOps Desktop UI). Requires ENABLE_COMPOSED_PROTOCOLS=true on the server.
haops_list_skillsList agent Abilities (system-wide + optionally project-scoped). Abilities are reusable, role-tagged knowledge units (e.g. "out-of-scope-findings", "three-layer-boot") that compose into agent protocols. Filter by scope, category, role, project, or free-text search. Deprecated Abilities are excluded b…
haops_read_skillRead a single Ability by its kebab-case name. Returns full markdown content + metadata (category, applicableRoles, version, ID, isDeprecated). Use this after haops_list_skills — or after a haops_read_protocol(mode="lazy") response's skillRefs[] manifest — to fetch the actual instructions on demand. …
haops_create_skillCreate a new agent Ability (system or project-scoped). Inserts version=1 with isCurrent=true. Admin-only on the server, gated by ENABLE_COMPOSED_PROTOCOLS. Returns the new Ability row on success; 409 if an Ability with the same name already exists in the target scope (use haops_update_skill to publi…
haops_update_skillPublish a new version of an existing Ability (PUT /api/skills/[name]). Server bumps version in a single transaction. A no-op update (no field differs from current) returns the current row WITHOUT a version bump (mirrors prompt PATCH semantics). At least one mutable field must be supplied. Admin-only…
haops_deprecate_skillSoft-delete + deprecate an Ability (DELETE /api/skills/[name]). Cascades the soft-delete across ALL versions (current + historical) and flips isDeprecated=true on the current row. History remains visible via /api/skills/[name]/history for audit context. Admin-only, gated by ENABLE_COMPOSED_PROTOCOLS…
haops_get_skill_historyReturns the full version history of a named Ability (GET /api/skills/[name]/history). Each entry contains the version number, publication timestamp, author, lifecycle state, and full content at that point in time. When diff=true the server computes unified diffs between consecutive versions and incl…
haops_get_role_template_historyReturns the full version history of a named role template (GET /api/role-templates/[name]/history). Role templates are system-wide (no scope/projectSlug). Each entry contains version, publication timestamp, author, lifecycle state, and the full `baseBody` markdown. When diff=true the server computes…
haops_bulk_publish_skillsAtomically publish multiple Abilities in a single DB transaction (POST /api/skills/bulk-publish). All version bumps happen in one round-trip; when cascade=true, consumer re-wiring (role templates, Ability packs, project protocols) runs ONCE at the end — significantly cheaper than N sequential haops_…
haops_create_project_skillCreate a PROJECT-SCOPED Ability (POST /api/projects/[slug]/skills). Project-scoped Abilities are visible only to that project's protocol resolver — they cannot be referenced by system role templates or other projects' protocols. For Abilities you want reusable across all projects, use haops_create_s…
haops_get_protocol_spawn_linesReturns the per-role spawn-line text (GET /api/projects/[slug]/protocol/spawn-lines). Spawn lines are short boot-ritual strings injected at agent session start when composed protocols are active. Omit `role` to get spawn lines for ALL configured roles; pass a specific role to narrow to one. Read-on…
haops_preview_project_protocolDry-run the composed-protocol resolver for a project role — returns the assembled manifest as if PUT had been applied, WITHOUT persisting. Use BEFORE haops_update_protocol to verify that the new templateId / skillsConfig combo resolves correctly and has no warnings. When called with no optional par…
haops_preview_skill_cascadePreview which consumers (role templates, Ability packs, project protocols) would need re-wiring if the named Ability is bumped via PUT. Read-only — does not mutate. Use BEFORE calling `haops_update_skill({ ..., cascade: true })` on a high-impact Ability to estimate blast radius.
haops_preview_role_template_cascadePreview which project protocols would need re-wiring if the named role template is bumped via PUT. Read-only — does not mutate. Use BEFORE calling `haops_update_role_template({ ..., cascade: true })` on a high-impact template to estimate blast radius.
haops_list_role_templatesList agent role templates. A role template bundles a core `baseBody` (boot + scope + handoff markdown) with a set of default Abilities, and serves as the starting point for an agent role (architect/dev/qa/devops). System templates are seeded; admins may publish project-specific custom templates.
haops_read_role_templateRead a single role template by its kebab-case name. Returns the current version with `baseBody` (full markdown) + `defaultSkills` hydrated (each entry includes Ability name + description) + `ID` UUID. Use after haops_list_role_templates to fetch the full template contents. Abilities are managed thro…
haops_create_role_templateCreate a new agent role template (admin-only, requires composed-protocols feature flag). Templates are system-wide (no project scope) and always start at version=1, isCurrent=true, isSystem=false. `baseBody` is admin-trusted markdown. `defaultSkills` is the optional bundle of Ability IDs auto-enable…
haops_update_role_templatePublish a new version of an existing role template (admin-only, requires composed-protocols feature flag). The server flips the current row to isCurrent=false and inserts a new row at version+1, transactionally. Only supply fields you want to change — a no-op call (no diff) returns the current row u…
haops_deprecate_role_templateSoft-delete a role template, cascading across ALL versions (admin-only, requires composed-protocols feature flag). System templates (isSystem=true) cannot be deleted and return 403 — to "deprecate" a system template, publish a new version via haops_update_role_template or alter the seeder. Soft-dele…
haops_list_skill_packsList Ability packs — curated bundles of agent Abilities (e.g. helpdesk-pack, security-pack, mobile-pack) that owners adopt at project onboarding. Each pack groups related Ability IDs under a category; the onboarding wizard pre-enables them in one click. System packs are seeded and cannot be deleted.…
haops_create_skill_packCreate a new Ability pack (admin only, requires ENABLE_COMPOSED_PROTOCOLS=true on the server — returns 404 when the flag is off, by design). Body fields mirror POST /api/skill-packs: kebab-case `name` (1..100, leading letter), non-empty `description`, `category` from the SkillPackCategory enum, and …
haops_update_skill_packUpdate an existing Ability pack in place — no version bump (packs are unversioned; audit log captures the diff). Admin only, requires ENABLE_COMPOSED_PROTOCOLS=true. `name` and `isSystem` are immutable post-create. Supply only the fields you want to change; supplying none (or only same-as-current va…
haops_deprecate_skill_packSoft-delete (deprecate) an Ability pack — paranoid destroy on a single row (packs are unversioned, no cascade). Admin only, requires ENABLE_COMPOSED_PROTOCOLS=true. System packs (isSystem=true) cannot be deleted — the server returns 403; to "deprecate" a system pack, update its skillIds to empty via…
haops_transition_skillTransition an Ability through its lifecycle (propose / publish / deprecate). Hits POST /api/skills/[name]/[action]. The server enforces the allowed-from-here state machine — on a disallowed transition you get a 409 with `from`, `to`, and the `allowed` set listed in the response. Admin-only, requires…
haops_transition_role_templateTransition a role template through its lifecycle (propose / publish / deprecate). Hits POST /api/role-templates/[name]/[action]. Role templates are system-wide — no scope axis. Server enforces the allowed-from-here state machine and returns 409 with `allowed` on a disallowed transition. System templ…
haops_transition_skill_packTransition an Ability pack through its lifecycle (propose / publish / deprecate). Hits POST /api/skill-packs/[name]/[action]. Packs are unversioned and system-wide. Server enforces the allowed-from-here state machine and returns 409 with `allowed` on a disallowed transition. System packs (isSystem=t…
haops_report_test_runReport test results to HAOps. Creates a TestRun with individual TestResult records. Used by agents to manually report results (Jest/Playwright reporters do this automatically).
haops_get_test_healthGet aggregated test health summary for a project or specific entity. Returns pass rates, trend, recent failures, and coverage data.
haops_list_testsList tests in a project with optional filters. Returns test records with metadata.
haops_list_test_runsList recent test runs for a project. Returns run summaries with pass/fail counts.
haops_link_tests_to_entityLink tests to a module, feature, or issue by test IDs or file path pattern. Sets testableType and testableId on matching tests.
haops_list_test_suitesList test suites for a project.
haops_export_test_suiteExport a test suite as a JSON bundle for cross-project sharing. Includes suite config and all test definitions.
haops_import_test_suiteImport a test suite from a JSON bundle into a project. Creates new suite and test records with fresh UUIDs.
haops_git_list_filesList files and directories in a project's Git repository at a given path. Returns directory entries with type (file/dir), name, and SHA. Supports multi-repo projects via repositoryName.
haops_git_read_fileRead file content from a project's Git repository. Returns text content for text files, or a "binary file" message for binary files. Supports multi-repo projects via repositoryName.
haops_git_commit_logGet recent commit history from a project's Git repository. Returns commits with SHA, author, date, and message. Supports multi-repo projects via repositoryName.
haops_git_get_remote_urlGet SSH remote URL and setup instructions for pushing to HAOps Git. Returns the SSH URL, default branch, and copy-pasteable setup commands. Supports multi-repo projects via repositoryName.
haops_manage_ssh_keysManage SSH keys for HAOps Git access (list, add, or revoke). Agents can use this to self-service their SSH keys for git push access.
haops_create_merge_requestCreate a merge request in a HAOps Git repository. Auto-detects conflicts and snapshots commit SHAs. Returns the created MR with status, conflict info, and diff stats.
haops_get_merge_requestGet merge request detail including diff stats, reviews with verdicts, conflict status, and branch info. Use this to review an MR before approving or merging.
haops_list_merge_requestsList merge requests for a project with optional filters. Returns MR title, status, branches, author, and timestamps.
haops_review_merge_requestSubmit a review on a merge request. Verdicts: approved, changes_requested, commented. When enough approvals are met (per branch protection rules), MR status auto-transitions to approved.
haops_merge_merge_requestMerge an approved merge request. Checks branch protection rules (required approvals, allowed roles) and conflicts before merging. Supports fast-forward and three-way merge.
haops_get_branch_diffCompare two branches in a HAOps Git repository. Returns commits ahead/behind, changed files with stats, diff content, and conflict detection. Use before creating an MR to preview changes.
haops_list_updatesList available updates for a project. Shows update type, version, status, and date. Use to check for new MCP server versions, protocol changes, test suites, or onboarding templates.
69 further tools are not listed here. The complete surface is in the source.
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
Axios: Header Injection via Prototype Pollution
Allocation of Resources Without Limits or Throttling in Axios
Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection
HAOPS_API_KEY## " environment variable is required"HAOPS_API_URLCheck points to running HAOps instanceHAOPS_MEMORY_CONSOLIDATE_THRESHOLDHAOPS_MEMORY_LAZY_DEFAULTTool annotations
No tools have read-only/destructive annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
169/169 tools missing one or more hints — haops_list_projects (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); haops_create_module (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); haops_update_module (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +166 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
License file
No license file
Add a LICENSE file (MIT, Apache-2.0, etc.).
Tool test coverage
Only 48/169 tools referenced in tests (28%)
Write tests that reference each tool by name so every tool has at least one test.
Production dependencies are patched
0 critical, 11 high severity in production deps — axios@1.13.5 (high), axios@1.13.5 (high)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Dependency freshness
1/6 production deps stale: dagre@2022-06-14 (4.3y)
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/tbranzov/haops-mcp-server)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check