Atlas / MCP servers / eyaltoledano / task-master-ai

task-master-aiBLOCK

Name: task-master-ai
Author: eyaltoledano

mcp/eyaltoledano/claude-task-master

MCP server by eyaltoledano · ai · cursor · cursor ai · Audited 2026-10-12

⚑ Report / re-scan Source ↗

An AI-powered task-management system you can drop into Cursor, Lovable, Windsurf, Roo, and others.

Verdict

BLOCK

Grade

Trust score

48 /100

Exposed tools

104 72r · 24w · 8d

Transport

—

License

NOASSERTION

Stars

28,203

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Taskmaster: A task management system for AI-driven development, designed to work seamlessly with any AI chat.

Docs

Read from source at commit 07049f099312OBSERVED · 2026-10-12

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add profiles --env ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY} --env AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID} --env AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY} --env AZURE_OPENAI_API_KEY=${AZURE_OPENAI_API_KEY} -- npx -y @tm/profiles

claude-desktop

{
  "mcpServers": {
    "profiles": {
      "command": "npx",
      "args": [
        "-y",
        "@tm/profiles"
      ],
      "env": {
        "ANTHROPIC_API_KEY": "${ANTHROPIC_API_KEY}",
        "AWS_ACCESS_KEY_ID": "${AWS_ACCESS_KEY_ID}",
        "AWS_SECRET_ACCESS_KEY": "${AWS_SECRET_ACCESS_KEY}",
        "AZURE_OPENAI_API_KEY": "${AZURE_OPENAI_API_KEY}"
      }
    }
  }
}

Exposed tools (104)

72 read · 24 write · 8 destructive. Blast radius: 8 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`add_dependency`	write	Add a dependency relationship between two tasks
`add_subtask`	write	Add a subtask to an existing task
`add_tag`	write	Create a new tag for organizing tasks in different contexts
`add_task`	write	Add a new task using AI
`analyze`	read	Analyze codebase
`analyze_project_complexity`	read	Analyze task complexity and generate expansion recommendations.
`auth`	read	Manage authentication with tryhamster.com
`autopilot`	write	AI agent orchestration for TDD workflow (start, resume, next, complete, commit, status, abort)
`autopilot_abort`	destructive	Abort the current TDD workflow and clean up workflow state. This will remove the workflow state file but will NOT delete the git branch or any code changes.
`autopilot_commit`	write	Create a git commit with automatic staging, message generation, and metadata embedding. Generates appropriate commit messages based on subtask context and TDD phase.
`autopilot_complete_phase`	read	Complete the current TDD phase (RED or GREEN) with test result validation. RED phase: expects failures (if 0 failures, feature is already implemented and subtask auto-completes). GREEN phase: expects all tests passing. For COMMIT phase, use autopilot_commit instead.
`autopilot_finalize`	read	Finalize and complete the workflow. Validates that all changes are committed and working tree is clean before marking workflow as complete.
`autopilot_next`	read	Get the next action to perform in the TDD workflow. Returns detailed context about what needs to be done next, including the current phase, subtask, and expected actions.
`autopilot_resume`	read	Resume a previously started TDD workflow from saved state. Restores the workflow state machine and continues from where it left off.
`autopilot_start`	write	Initialize and start a new TDD workflow for a task. Creates a git branch and sets up the workflow state machine.
`autopilot_status`	read	Get comprehensive workflow status including current phase, progress, subtask details, and activity history.
`briefs`	read	Manage briefs (Hamster only)
`clear_subtasks`	destructive	Clear subtasks from specified tasks
`cmd`	read	TaskMaster command
`cmd1`	read	Command 1
`cmd2`	read	Second command
`complexity_report`	read	Display the complexity analysis report in a readable format
`context`	read	Manage workspace context (organization/brief)
`copy_tag`	write	Copy an existing tag to create a new tag with all tasks and metadata
`delete_tag`	destructive	Delete an existing tag and all its tasks
`deploy`	write	Deploy the application
`docs`	read	Documentation command
`empty`	read	Empty command
`expand-all-tasks`	read	Expand All Tasks
`expand_all`	read	Expand all pending tasks into subtasks based on complexity or defaults
`expand_task`	read	Expand a task into subtasks for detailed implementation
`export`	read	Export tasks to Hamster by creating a new brief
`export-tag`	read	Export a specific tag to Hamster
`fix-dependencies`	read	Fix Dependencies
`fix_dependencies`	read	Fix invalid dependencies in tasks automatically
`formatted`	read	Formatted command
`generate`	read	Generate individual task files from tasks.json
`generate-tasks`	read	Generate Task Files
`get_operation_status`	read	Retrieves the status and result/error of a background operation.
`get_task`	read	Get detailed information about a specific task
`get_tasks`	read	Get all tasks from Task Master, optionally filtering by status and including subtasks.
`goham`	write	Start Working with Hamster Brief
`help`	read	Show help
`initialize_project`	read	Initializes a new Task Master project structure by calling the core initialization logic. Creates necessary folders and configuration files for Task Master in the current directory.
`install-taskmaster`	write	Install TaskMaster
`list`	read	List all tasks with filtering and status overview
`list-tasks-with-subtasks`	read	List Tasks With Subtasks
`list_tags`	read	List all available tags with task counts and metadata
`login`	read	Login to Hamster (alias for
`logout`	read	Logout from Hamster (alias for
`loop`	write	Run Claude Code in a loop, one task per iteration
`models`	write	Get information about available AI models or set model configurations. Run without arguments to get the current model configuration and API key status for the selected model providers.
`move_task`	write	Move a task or subtask to a new position
`multi`	read	Multiline command
`multiline`	read	Multiline command
`nested`	read	Nested frontmatter test
`next`	read	Find the next available task to work on
`next_task`	read	Find the next task to work on based on dependencies and status
`nonexistent`	read	Non-existent command
`only-cmd`	read	Only command
`parse_prd`	read	Parse a Product Requirements Document (PRD) text file to automatically generate initial tasks. Reinitializing the project is not necessary to run this tool. It is recommended to run parse-prd after initializing the project and creating/importing a prd.txt file in the project root
`plain-test`	read	Plain test command
`quick-install-taskmaster`	write	Quick Install TaskMaster
`quoted`	read	Command with
`remove-all-subtasks`	destructive	Remove All Subtasks
`remove_dependency`	destructive	Remove a dependency from a task
`remove_subtask`	destructive	Remove a subtask from its parent task
`remove_task`	destructive	Remove a task or subtask permanently from the tasks list
`rename_tag`	write	Rename an existing tag
`research`	read	Perform AI-powered research queries with project context
`response-language`	write	Get or set the response language for the project
`rules`	destructive	Add or remove rule profiles from the project.
`scope_down_task`	read	Decrease the complexity of one or more tasks using AI
`scope_up_task`	read	Increase the complexity of one or more tasks using AI
`set-status`	write	Update the status of one or more tasks
`set_task_status`	write	Set the status of one or more tasks or subtasks.
`setup-models`	read	Setup Models
`show`	read	Display detailed information about a specific task
`show-task`	read	Show task
`special`	read	Special args
`start`	write	Start working on a task with claude-code
`static-cmd`	read	Static command
`static-test`	read	Static test command
`static1`	read	Static command 1
`static2`	read	Static command 2
`tags`	read	Manage tags for task organization
`task-runner`	write	Run automated tasks
`test`	read	Test
`test-cmd`	read	Test command
`test-cmd-123`	read	Test with numbers
`test-project`	read	Test project description
`test_underscore`	read	Test with underscore
`tm-cmd`	read	TaskMaster command
`tm-cmd1`	read	TaskMaster command 1
`tm-cmd2`	read	TaskMaster command 2
`tm-main`	read	Task Master Main
`update`	write	Update multiple upcoming tasks (with ID >=
`update_subtask`	write	Appends timestamped information to a specific subtask without replacing existing content. If you just want to update the subtask status, use set_task_status instead.
`update_task`	write	Updates a single task by ID with new information or context provided in the prompt.
`use_tag`	read	Switch to a different tag context for task operations
`validate-dependencies`	read	Validate Dependencies
`validate_dependencies`	read	Check tasks for dependency issues (like circular references or links to non-existent tasks) without making changes.
`view-models`	read	View Models
`with-hint`	read	Command with hint

Trust audit

BLOCKgrade F · trust 48/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	WARN
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	FAIL
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (7 observation(s))
Network: declared (3 observation(s))
Shell: declared (1 observation(s))
Dependencies: not all pinned
Secrets in source: found

Findings (25)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

scripts/modules/prompt-manager.js:280

const func = new Function(...Object.keys(context), `return ${condition}`);

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHPrompt injection · prompt.override · CWE-94, CWE-1427

docs/configuration.md:579

- **`dangerouslyBypassApprovalsAndSandbox`** (boolean, optional): Bypass all safety checks (dangerous!)

Why it matters. asks the agent to drop prior instructions or safety

Fix. remove the instruction

HIGHPrompt injection · prompt.override · CWE-94, CWE-1427

docs/providers/codex-cli.md:240

- Bypass all safety checks including approvals and sandbox

Why it matters. asks the agent to drop prior instructions or safety

Fix. remove the instruction

HIGHPrompt injection · prompt.tool_poisoning · CWE-94, CWE-1427

.taskmaster/docs/autonomous-tdd-git-workflow.md:392

<INSTRUCTION>

Why it matters. a tool description carrying instructions to the agent

Fix. tool descriptions describe the tool; nothing else

HIGHPrompt injection · prompt.tool_poisoning · CWE-94, CWE-1427

.taskmaster/docs/autonomous-tdd-git-workflow.md:437

<INSTRUCTION>

Why it matters. a tool description carrying instructions to the agent

Fix. tool descriptions describe the tool; nothing else

HIGHPrompt injection · prompt.tool_poisoning · CWE-94, CWE-1427

.taskmaster/docs/tdd-workflow-phase-1-core-rails.md:282

'<INSTRUCTION>',

Why it matters. a tool description carrying instructions to the agent

Fix. tool descriptions describe the tool; nothing else

MEDIUMInventory / provenance · inv.binary · CWE-1104

taskmaster.mcpb

taskmaster.mcpb

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

MEDIUMInformation disclosure · disclose.log_secret · CWE-209, CWE-532

apps/cli/src/commands/auth.command.ts:238

console.log(chalk.gray(`  Token Type: standard`));

MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321

tests/unit/ai-providers/gemini-cli.test.js:114

apiKey: 'gemini-cli-no-key-required'

MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321

tests/unit/ai-providers/gemini-cli.test.js:255

await provider.getClient({ apiKey: 'gemini-cli-no-key-required' });

MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59

autopilot_abort, clear_subtasks, delete_tag, remove-all-subtasks, remove_dependency, remove_subtask, remove_task, rules

Why it matters. 8 tool(s) can delete or overwrite

Fix. prefer a read-only mode or scoped tokens; the page states the blast radius