Todo ListSAFE
A Todo List MCP Server
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
🎯 O que é este projeto?
Este é um servidor MCP (Model Context Protocol) completo que implementa um sistema de gerenciamento de tarefas (Todo List) com validação robusta usando TypeScript e Zod. O servidor se integra diretamente com o Claude Desktop, permitindo que você gerencie suas tarefas através de conversas naturais com o Claude.
Tutorial - Passo a Passo!
Quer aprender a desenvolver essa aplicação e aprender também sobre MCP? Está disponível o tutorial passo a passo, para você [AQUI](https://github.com/glaucia86/todo-list-mcp-server/blob/main/TUTORIAL.md)
🌟 Por que usar MCP?
O Model Context Protocol é um protocolo desenvolvido pela Anthropic que permite aos assistentes de IA se conectarem com ferramentas e recursos externos de forma padronizada. Com este projeto, você pode:
- 🤖 Conversar naturalmente com Claude sobre suas tarefas
- 🔧 Executar operações diretamente através do chat
- 📊 Obter insights inteligentes sobre sua produtividade
- 🛡️ Garantir validação robusta de todos os dados
✨ Funcionalidades
🛠️ CRUD Completo
- ✅ Criar tarefas com título, descrição, prioridade e tags
- 📖 Listar tarefas com filtros avançados e paginação
- ✏️ Atualizar tarefas (marcar como concluída, alterar prioridade, etc.)
- 🗑️ Deletar tarefas específicas
- 🔍 Buscar tarefas por texto
📊 Recursos Inteligentes
- 📈 Estatísticas em tempo real (total, concluídas, pendentes)
- 📋 Resumos personalizados das tarefas
- 🎯 **Ajuda de prio
14e426b779f6OBSERVED · 2026-10-08Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add todo-list-mcp-server -- npx -y [email protected]
{
"mcpServers": {
"todo-list-mcp-server": {
"command": "npx",
"args": [
"-y",
"[email protected]"
]
}
}
}Exposed tools (14)
11 read · 2 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
analysisDepth | read | Profundidade da análise (superficial, detalhada, completa) |
context | read | Contexto adicional para priorização |
create_todo | write | Create a new todo item with validation |
delete_todo | destructive | Delete a todo item |
focusArea | read | Área de foco (trabalho, pessoal, estudos, etc.) |
get_todo | read | Get a specific todo by ID |
includeCompleted | read | Incluir todos completos na análise |
list_todos | read | List todos with filtering and pagination |
period | read | Período para análise |
search_todos | read | Search todos by title or description |
todo-insights | read | Fornece insights detalhados sobre padrões de produtividade |
todo-prioritization | read | Sugere priorização inteligente dos todos baseada em múltiplos critérios |
todo-summary | read | Gera um resumo analítico dos todos com estatísticas avançadas |
update_todo | write | Update an existing todo item |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- UNDECLARED (1 observation(s))
- Network
- none-observed
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (2)
delete_todo
@modelcontextprotocol/sdk, zod, zod-to-json-schema, @types/node, nodemon, tsx, typescript
Gates applied: no_behavioural_pass.
14e426b779f6full audit observations/trust-audit/mcp-server/glaucia86__todo-list-1.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-08 | 14e426b779f6 | SAFE | B | 89 | first audit |
Questions
What is the Todo List MCP server?
A Todo List MCP Server
What tools does Todo List expose?
14 in total: 11 read-only, 2 that write, and 1 that can delete or overwrite (delete_todo). Every one is listed on this page with its risk.
Is Todo List safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does Todo List need?
No credential environment variables were found in its source, so it appears to need none.
How does Todo List run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as todo-list-mcp-server at 1.0.0.
How current is this page?
The grade is for one exact copy of the source (14e426b779f6), read on 2026-10-08. The repository is watched and re-audited when it changes.