claude-taskflowSAFE
DAG runtime for coding-agent workflows with verification, resume, replay, and effect checks.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://github.com/heggria/taskflow/actions/workflows/ci.yml) [](https://nodejs.org) [](./LICENSE) [](#host-adapters)
English · 简体中文
1.0 overview · Quickstart · Docs · Examples · Changelog
taskflow is a declarative runtime for coding-agent workflows. It turns a graph into a verifiable execution contract, runs phases in isolation, and keeps intermediate work out of the host conversation. In Taskflow 1.0, the contract also describes the effects a phase is allowed to propose.
Taskflow 1.0.0 includes the DAG runtime, trusted filesystem effects and complete Control Plane (CLI/MCP/WebUI). GitHub Releases and npm establish publication; see the acceptance scoreboard for verified scope and limits.
The declared-effect contract
An agent can propose content. It should not become the mutation authority merely because it can run a command.
For admitted, declared filesystem-write targets, taskflow 1.0 makes the path explicit and routes the final mutation through the resources transaction:
flow / .tf.ts │ ▼ validate + verify ──► EffectIR + FlowIR hash │ │ │ ▼ │
726f3e89df8eOBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add taskflow-website --env TASKFLOW_E2E_TOKEN=${TASKFLOW_E2E_TOKEN} -- npx -y [email protected]{
"mcpServers": {
"taskflow-website": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"TASKFLOW_E2E_TOKEN": "${TASKFLOW_E2E_TOKEN}"
}
}
}
}Exposed tools (76)
60 read · 15 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
a | read | test agent |
alpha | read | first |
analyst | read | built-in analyst |
audit-endpoints | read | audit endpoints for auth |
auditor | read | audits code |
b | read | test agent b |
bad-thinking | read | test |
bare | read | minimal |
beta | read | second |
builder-agent | read | builder |
builtin | read | package agent |
csv | read | csv tools |
deep | read | found deep |
default | read | test |
empty | read | no body |
executor | read | test executor |
full | read | fully specced |
gamma | read | third |
good | read | readable |
gp-agent | read | from grandparent |
judge | read | judge agent |
large | read | x |
linked | read | via symlink |
literal-agent | read | literal |
my-flow | read | desc |
nomodel-agent | read | no model |
ok | read | fine |
p | read | proj |
packed | read | packed |
parent-agent | read | from parent |
pathcheck | read | check |
planner | read | test |
probe | read | Harmless compatibility probe |
reviewer | read | test |
role-agent | read | role |
roundtrip | read | full fidelity |
scout | read | finds things |
scout-agent | read | scout |
spaces | read | spaced tools |
stall | read | d |
t | read | t |
taskflow | read | Taskflow |
taskflow_analytics | read | Summarize the last N runs of a flow: status histogram, p50/p95 duration, per-phase fail and cache-hit rates. Zero tokens, no writes, no auto-tune. |
taskflow_compile | read | Render a flow |
taskflow_control_approval_decide | write | Approve, reject, or edit a pending approval with its expected run version. Edit requires a staged artifact and editKind. |
taskflow_control_approval_stage_edit | write | Stage bounded output or plan text as a ledger-reachable approval edit artifact. Refresh status before deciding. |
taskflow_control_approvals | read | List durable approval requests in the authorized project. |
taskflow_control_cancel | write | Cancel a run through the Host |
taskflow_control_coordinator | read | Read user-global capacity and only this project |
taskflow_control_force_release | destructive | Explicit operator only: release capacity without proving execution stopped; permanently marks operator-overridden. Requires acknowledgement and an audit reason. |
taskflow_control_projects | read | List projects authorized for this local session. |
taskflow_control_receipt | write | Read the authorized evidence receipt for a terminal run. |
taskflow_control_result | write | Read the authorized run result, including final output only. |
taskflow_control_resume | write | Resume a recoverable run through Host admission and authority checks. |
taskflow_control_runs | write | List durable run status in the authorized project. |
taskflow_control_set_max_active_runs | write | Explicit operator only: set the user-global admitted-run limit. Reuse commandId for exact retries. |
taskflow_control_status | read | Read durable status without phase transcripts. |
taskflow_control_submit | write | Submit a flow to the authenticated Host. Reuse commandId when retrying the same request. |
taskflow_control_why | write | Explain authorized durable run evidence and effect causes. |
taskflow_lint | write | Run built-in and project-local pluggable verifiers (script-lint, custom checks) on a flow WITHOUT executing it. Discovers verifiers from .pi/taskflows/verifiers/. Provide |
taskflow_list | read | List the saved taskflows discoverable from the current working directory (user + project scope). |
taskflow_plan | read | Terraform-plan for taskflows: bind typed args, verify structure, project phase order + dynamic/unresolved bindings, and compute a worst-case agent-call bound — WITHOUT spawning any agent. Provide |
taskflow_replay | write | Re-evaluate a stored run |
taskflow_run | write | Run a taskflow DAG and return its final output. Provide EITHER |
taskflow_runs | write | List recent background runs, inspect one run, wait for completion without losing it when the MCP request ends, or request cancellation. Use after taskflow_run with mode: |
taskflow_show | read | Show a saved flow |
taskflow_verify | read | Statically verify a flow (cycles, missing deps, undefined refs, ...) WITHOUT executing it. Provide |
taskflow_version | write | Report the engine package version, the git commit the dist was built from, the bound host identity (codex/claude/opencode/grok/hermes), and the run-state schema version. Zero tokens, no execution. Use to verify which taskflow build a host is running. |
taskflow_why_effect | read | Given a runId + effectId (+ optional phaseId): explain authorization and lifecycle from the durable resource intent ledger. Zero tokens and read-only. A declaration without matching principal/capability/intent evidence is unauthorized. |
taskflow_why_stale | read | Given a runId (+ optional phaseId seed): with no seed, prints the observed dependency graph; with a seed, computes the transitive stale frontier — exactly which phases would need re-running and why (observed ∪ declared edges). Zero tokens. Read-only. |
test | read | |
tooled | read | has tools |
u | read | user |
unk | read | unknown |
worker | read | test worker |
writer | read | test |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- declared (1 observation(s))
- Shell
- declared (1 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (17)
taskflow_control_force_release
} from "../../../scripts/verify-published-package.mjs";
const repo = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../../..");
} from "../../src/project/types.ts";
const repo = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../../..");
} from "../../../examples/charterarc-phase-docs.ts";
- **Flow hooks (`hooks.onComplete` / `onFail` / `onBlocked`).** Fire-and-forget `webhook` | `file` | `command` (argv only) with summary payload `taskflow.hook.v1` (never transcripts). `https` and `htt
- `url` must be `https:` (or `http://127.0.0.1` for local dev — document)
| 2 | Webhook localhost | **Allow** `https:` and `http://127.0.0.1` / `http://localhost` (other `http:` rejected) |
- Allow: `https://...`, `http://127.0.0.1...`, `http://localhost...` (and `[::1]` if we parse IPv6 loopback)
"url": "http://127.0.0.1:8123/v1/embeddings",
@types/node, typebox, typescript
typescript
typescript
typescript
@types/mdx, zod
Claude Code is a powerful coding agent on its own. But when a job needs a **repeatable pipeline** — review every changed file, gate on risk, and set an observed-usage stop-loss — ad-hoc prompting runs
Gates applied: no_behavioural_pass.
726f3e89df8efull audit observations/trust-audit/mcp-server/heggria__taskflow.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | 726f3e89df8e | SAFE | B | 89 | first audit |
Questions
What is the claude-taskflow MCP server?
DAG runtime for coding-agent workflows with verification, resume, replay, and effect checks.
What tools does claude-taskflow expose?
76 in total: 60 read-only, 15 that write, and 1 that can delete or overwrite (taskflow_control_force_release). Every one is listed on this page with its risk.
Is claude-taskflow safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does claude-taskflow need?
It reads TASKFLOW_E2E_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How current is this page?
The grade is for one exact copy of the source (726f3e89df8e), read on 2026-10-12. The repository is watched and re-audited when it changes.