Yandex TrackerCAUTION
Yandex Tracker MCP Server with OAuth2 support
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
mcp-name: io.github.aikts/yandex-tracker-mcp
A comprehensive Model Context Protocol (MCP) server that enables AI assistants to interact with Yandex Tracker APIs. This server provides secure, authenticated access to Yandex Tracker issues, queues, comments, worklogs, and search functionality with optional Redis caching for improved performance.
Documentation in Russian is available here / Документация на русском языке доступна здесь.
Features
- Complete Queue Management: List and access all available Yandex Tracker queues with pagination support, tag retrieval, and detailed metadata
- Projects, Portfolios and Goals: Dedicated read and write tools with explicit schemas for each entity type in the Tracker "entities" API (opt-in via
TRACKER_ENTITIES_ENABLED) - User Management: Retrieve user account information, including login details, email addresses, license status, and organizational data
- Full Issue Lifecycle: Create, read, update, and manage issues with support for custom fields, attachments, and workflow transitions
- Status Workflow Management: Execute status transitions, close issues with resolutions, and navigate complex workflows
- Field Management: Access global fields, queue-specific local fields, statuses, issue types, priorities, and resolutions
- Boards and Sprints: List agile boards and their sprints to find sprint IDs for issue planning
- Advanced Query Language: Full Yandex Tracker Query La
d2d6ae93b6daOBSERVED · 2026-10-07Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add yandex-tracker-mcp -- None yandex-tracker-mcp==0.10.0
claude mcp add yandex-tracker-mcp:0.10.0 -- docker run -i --rm ghcr.io/aikts/yandex-tracker-mcp:0.10.0:None
Trust audit
CAUTIONgrade C · trust 76/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (5 observation(s))
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- found
Findings (11)
private_key="-----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC8Q7HgL\n-----END PRIVATE KEY-----",
private_key="-----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC8Q7HgL\n-----END PRIVATE KEY-----",
private_key="-----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC8Q7HgL\n-----END PRIVATE KEY-----",
private_key="-----BEGIN PRIVATE KEY-----\ntest-private-key\n-----END PRIVATE KEY-----",
key="-----BEGIN PRIVATE KEY-----\ntest-private-key\n-----END PRIVATE KEY-----",
.cursorignore
.mcpbignore
module = importlib.import_module(f"{types_package.__name__}.{module_info.name}")key_bytes = base64.b64decode(key_b64)
`TRACKER_READ_ONLY_QUEUES=MGMT` gives full access to `DEV` and read-only
Gates applied: no_behavioural_pass.
d2d6ae93b6dafull audit observations/trust-audit/mcp-server/aikts__yandex-tracker-1.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-07 | d2d6ae93b6da | CAUTION | C | 76 | first audit |
Questions
What is the Yandex Tracker MCP server?
Yandex Tracker MCP Server with OAuth2 support
Is Yandex Tracker safe to connect to an agent?
With care. The audit graded it C (76/100) and found 11 things worth knowing before you trust this server, listed below with the exact line each was found on.
What credentials does Yandex Tracker need?
It reads TRACKER_IAM_TOKEN and TRACKER_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does Yandex Tracker run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on PyPI as yandex-tracker-mcp.
How current is this page?
The grade is for one exact copy of the source (d2d6ae93b6da), read on 2026-10-07. The repository is watched and re-audited when it changes.