kaiten-mcp-server
MCP server for integrating Kaiten API with Claude Desktop, enabling management of cards, comments, spaces, and boards with advanced features like verbosity control, response format selection, and auto-truncation.
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
vsaranyuk
Source: Glama
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
kaiten_get_cardRetrieve complete information about a Kaiten card by its ID, including subtasks, blocking status, and relationships. PURPOSE: Get comprehensive card details after discovering the card via kaiten_search_cards or from a URL. Use this when you need full information including description, owner, board …
kaiten_create_cardCreate a new card on a Kaiten board with specified properties. Supports idempotency for safe retries. PURPOSE: Create new task cards with title, description, owner, due date, and board placement. Use after discovering board structure via kaiten_list_boards, kaiten_list_columns, kaiten_list_lanes, a…
kaiten_update_cardUpdate existing card fields. Only modifies specified fields, leaving others unchanged. Supports idempotency. PURPOSE: Modify card properties including title, description, state, board position (column/lane), assignment, dates, and flags. Use kaiten_get_card first to see current state before updatin…
kaiten_delete_card⚠️ DESTRUCTIVE: Permanently delete a card. Cannot be undone. Use with extreme caution. PURPOSE: Permanently remove a card from Kaiten. This is an irreversible operation - once deleted, the card and all its data (comments, history, attachments, relationships) are gone forever. Consider archiving (co…
kaiten_get_card_commentsGet all comments for a card, including author info and timestamps. Returns complete comment thread. PURPOSE: Retrieve full comment history and discussion thread for a card. Use to review feedback, track decisions, or analyze communication. Comments appear in Kaiten card history and support markdown…
kaiten_create_commentAdd a new comment to a card. Supports markdown formatting and appears in card activity history. Supports idempotency. PURPOSE: Post feedback, ask questions, provide updates, or document decisions on a card. Comments are visible to all card participants and appear in Kaiten card history chronologica…
kaiten_update_commentEdit an existing comment on a card. Supports markdown. Can only edit your own comments. Supports idempotency. PURPOSE: Fix typos, add information, or clarify existing comments. Preserves comment ID and creation date, updates modified timestamp. Essential for maintaining accurate discussion threads.…
kaiten_delete_commentDelete comment
kaiten_search_cardsSearch for Kaiten cards with flexible filtering and pagination. Returns compact format optimized for context economy. PURPOSE: Find cards matching specific criteria across boards and spaces. Use this as your primary discovery tool before performing operations on cards. Searches default space by def…
kaiten_get_space_cardsGet all cards from a specific space with pagination. Returns compact format optimized for context economy. PURPOSE: Retrieve cards from a space when you need all/recent cards without complex filtering. For filtered search, use kaiten_search_cards instead. PARAMETERS: - space_id (required): The spa…
kaiten_get_board_cardsGet all cards from a specific board with pagination. Returns compact format optimized for context economy. PURPOSE: Retrieve cards from a board when you need all/recent cards without complex filtering. For filtered search, use kaiten_search_cards instead. PARAMETERS: - board_id (required): The boa…
kaiten_list_spacesList all Kaiten spaces (workspaces) accessible to your API token. Top-level organization structure. PURPOSE: Discover available spaces to get space_id for board operations. Spaces are top-level containers that group boards, users, and projects. Use this for workspace discovery, especially when KAIT…
kaiten_get_spaceGet space details by ID. PURPOSE: Retrieve comprehensive information about a specific Kaiten space. PARAMETERS: - space_id (required): Space ID. Positive integer. How to find: Use kaiten_list_spaces to discover space_id - format (optional): Response format - 'json' or 'markdown' (default) • Us…
kaiten_list_boardsList all boards in a space. Essential discovery tool for finding board_id before card operations. PURPOSE: Discover available boards in your workspace to get board_id for creating/searching cards. First step in board structure discovery workflow. Uses cached results (5 min TTL) for performance. PA…
kaiten_get_boardGet board details by ID. PURPOSE: Retrieve comprehensive information about a specific Kaiten board. PARAMETERS: - board_id (required): Board ID. Positive integer. How to find: Use kaiten_list_boards to discover board_id - format (optional): Response format - 'json' or 'markdown' (default) • Us…
kaiten_list_columnsList all columns (workflow stages) for a board. Required before creating/moving cards to get valid column_id. PURPOSE: Discover board columns (stages like "Backlog", "In Progress", "Done") to place cards correctly. Columns represent workflow stages and are required for precise card placement. Use b…
kaiten_list_lanesList board lanes (swimlanes) for vertical card grouping. Optional but useful for complex board organization. PURPOSE: Discover lane IDs for creating/moving cards with vertical categorization. Lanes (swimlanes) provide secondary grouping orthogonal to columns, useful for team separation, priority le…
kaiten_list_typesList card types available on a board. Types categorize cards by nature of work (Task, Bug, Feature, etc.). PURPOSE: Discover valid type_id values for creating/updating cards. Card types categorize work by nature (implementation task, bug fix, feature request, etc.), help with filtering and reportin…
kaiten_get_current_userGet information about the currently authenticated user (you) based on the API token. PURPOSE: Verify API token is working, check your permissions, get your user_id for filtering "my cards", or confirm account details. Quick health check for API authentication. PARAMETERS: None RETURNS: Simplified…
kaiten_list_usersSearch for Kaiten users by name or email with server-side filtering. CRITICAL: Kaiten stores names in LATIN characters only. PURPOSE: Find user_id to assign cards, filter by owner, or search by member. Essential preprocessing step before any user-related operations. Server supports efficient server…
kaiten_cache_invalidate_spacesInvalidate spaces cache
kaiten_cache_invalidate_boardsInvalidate boards cache
kaiten_cache_invalidate_usersInvalidate users cache
kaiten_cache_invalidate_allInvalidate all caches
kaiten_get_statusGet server status (cache/queue/config/metrics)
kaiten_set_log_levelChange logging config at runtime
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse
Anthropic's MCP TypeScript SDK has a ReDoS vulnerability
Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default
axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
DOTENV_CONFIG_QUIETKAITEN_API_TOKENyour_api_token_hereKAITEN_API_URL"": "https://your-domain.kaiten.ru/api/latest",KAITEN_CACHE_TTL_SECONDS300 # Время жизни кеша в секундах (0 = выкл.)KAITEN_DEFAULT_SPACE_ID12345 # Ваш основной space_idKAITEN_LOG_ENABLEDKAITEN_LOG_FILE_ENABLEDKAITEN_LOG_FILE_PATH./logs/kaiten-mcp.logKAITEN_LOG_LEVELKAITEN_LOG_MCP_ENABLEDKAITEN_LOG_METRICSПри включенных метриках (=true) используйте kaiten_get_status для просмотра:KAITEN_LOG_REQUESTSKAITEN_MAX_CONCURRENT_REQUESTS5 # Макс. одновременных запросов (1-20)KAITEN_REQUEST_TIMEOUT_MS10000 # Таймаут запроса в мс (1-60000)Tool annotations
8/26 tools have annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
26/26 tools missing one or more hints — kaiten_get_card (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); kaiten_create_card (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); kaiten_update_card (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +23 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
License file
No license file
Add a LICENSE file (MIT, Apache-2.0, etc.).
Tests exist
No test files found
Add tests that exercise each declared tool.
Secrets not logged
1 secret value sent to console.log
Redact or omit secret values from log output.
Production dependencies are patched
0 critical, 14 high severity in production deps — @modelcontextprotocol/sdk@1.20.0 (high), @modelcontextprotocol/sdk@1.20.0 (high)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Dependency freshness
1/8 production deps stale: axios-retry@2024-08-02 (2y)
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/vsaranyuk/kaiten-mcp-server)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check