Atlas / MCP servers / nerpatech / trac-mcp-server

trac-mcp-serverBLOCK

Name: trac-mcp-server
Author: nerpatech

mcp/nerpatech/trac-mcp-server

MCP server by nerpatech · mcp server · trac · Audited 2026-10-11

A MCP (Model Context Protocol) server that provides AI assistants with tools to interact with Trac project management instances — managing tickets, wiki pages, and milestones

Verdict

BLOCK

Grade

Trust score

63 /100

Exposed tools

25 14r · 7w · 4d

Transport

sse · stdio · streamable-http

License

MIT

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Standalone MCP server that gives AI agents full access to Trac project management -- tickets, wiki, milestones, and search -- via the Model Context Protocol.

Quick Start

Requires Python 3.10 or later.

pip install .

Set your Trac connection:

export TRAC_URL="https://trac.example.com"
export TRAC_USERNAME="your-username"
export TRAC_PASSWORD="your-password"

Run the server:

trac-mcp-server

Using auto-pm? When trac-mcp-server is driven through auto-pm, auto-pm reads its connection settings from .auto_pm/config.yml in your project root (rather than the environment variables above). Run auto-pm setup in your project directory to generate the file; the resulting .auto_pm/config.yml carries trac.url, trac.username, a ${TRAC_PASSWORD} reference, and component mappings.

Configuration

Configuration via environment variables, .env file, or YAML config file (.trac_mcp/config.yaml):

Read from source at commit e3af4997ffc7OBSERVED · 2026-10-11

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add trac-mcp-server --env TRAC_MCP_AUTH_TOKEN=${TRAC_MCP_AUTH_TOKEN} --env TRAC_PASSWORD=${TRAC_PASSWORD} --env TRAC_PASSWORD_2=${TRAC_PASSWORD_2} -- uvx trac-mcp-server

claude-desktop

{
  "mcpServers": {
    "trac-mcp-server": {
      "command": "uvx",
      "args": [
        "trac-mcp-server"
      ],
      "env": {
        "TRAC_MCP_AUTH_TOKEN": "${TRAC_MCP_AUTH_TOKEN}",
        "TRAC_PASSWORD": "${TRAC_PASSWORD}",
        "TRAC_PASSWORD_2": "${TRAC_PASSWORD_2}"
      }
    }
  }
}

Exposed tools (25)

14 read · 7 write · 4 destructive. Blast radius: 4 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`get_server_time`	read	Get current Trac server time for temporal reasoning and coordination. Returns server timestamp in both ISO 8601 and Unix timestamp formats.
`milestone_create`	write	Create a new milestone. Requires TICKET_ADMIN permission. Attributes: due (ISO 8601 date), completed (ISO 8601 date or 0), description (string).
`milestone_delete`	destructive	Delete a milestone by name. Requires TICKET_ADMIN permission. Warning: This cannot be undone.
`milestone_get`	read	Get milestone details by name. Returns name, due date, completion date, and description as stored: TracWiki, byte-for-byte. Requires TICKET_VIEW permission.
`milestone_list`	read	List all milestone names. Returns array of milestone names (e.g., [
`milestone_update`	write	Update an existing milestone. Requires TICKET_ADMIN permission. Attributes: due (ISO 8601 date), completed (ISO 8601 date or 0), description (string).
`ping`	read	Test Trac MCP server connectivity and return API version
`ticket_actions`	read	Get valid workflow actions for a ticket
`ticket_attachment_list`	read	List attachments on a Trac ticket.
`ticket_batch_create`	write	Create multiple tickets in a single batch operation. Best-effort: all items attempted, per-item results reported. Bounded by TRAC_MAX_PARALLEL_REQUESTS semaphore. Descriptions are TracWiki and are stored byte-for-byte.
`ticket_batch_delete`	destructive	Delete multiple tickets in a single batch operation. Best-effort: all items attempted, per-item results reported. Requires TICKET_ADMIN permission.
`ticket_batch_update`	write	Update multiple tickets in a single batch operation. Best-effort: all items attempted, per-item results reported. Comments are TracWiki and are stored byte-for-byte.
`ticket_changelog`	read	Get ticket change history. Use this to investigate who changed what and when. Comment content is returned as stored: TracWiki, byte-for-byte.
`ticket_create`	write	Create a new ticket. The description is TracWiki and is stored byte-for-byte -- nothing is converted, so hand-authored markup survives exactly as written.
`ticket_delete`	destructive	Delete a ticket permanently. Warning: This cannot be undone. Requires TICKET_ADMIN permission and
`ticket_fields`	read	Get all ticket field definitions (standard + custom fields). Returns field metadata including name, type, label, options (for select fields), and custom flag. Use to discover instance-specific ticket schema.
`ticket_search`	read	Search tickets with filtering by status, owner, and keywords. Returns ticket IDs with summaries.
`whoami`	read	Return the in-flight request
`wiki_create`	write	Create a new wiki page. Content is TracWiki and is stored byte-for-byte -- nothing is converted, so hand-authored markup survives exactly as written. Fails if the page exists (use wiki_update instead).
`wiki_delete`	destructive	Delete a wiki page. Warning: This cannot be undone. Requires WIKI_DELETE permission.
`wiki_get`	read	Get wiki page content as stored: TracWiki, byte-for-byte. Returns full content with metadata (version, author, modified date).
`wiki_get_history`	read	Get wiki page revision history newest-first. Returns list of revisions with version, author, lastModified, and comment (commit message). Useful for detecting prior edits or scanning attribution markers in change comments.
`wiki_recent_changes`	read	Get recently modified wiki pages. Returns pages sorted by modification date (newest first). Useful for finding stale or recently updated documentation.
`wiki_search`	read	Search wiki pages by content with relevance ranking. Returns snippets showing matched text, as stored: TracWiki, byte-for-byte.
`wiki_update`	write	Update an existing wiki page with optimistic locking (requires version for conflict detection). Content is TracWiki and is stored byte-for-byte -- nothing is converted, so hand-authored markup survives exactly as written.

Trust audit

BLOCKgrade D · trust 63/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	FAIL
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (1 observation(s))
Network: declared (10 observation(s))
Shell: none-observed
Dependencies: pinned
Secrets in source: none-found

Findings (25)

HIGHNetwork egress · net.tls_off · CWE-200, CWE-319

scripts/agent_scenarios.py:342

server_args.append("--insecure")

Why it matters. certificate verification is disabled

Fix. leave verification on

HIGHNetwork egress · net.tls_off · CWE-200, CWE-319

scripts/agent_scenarios.py:493

"--insecure",

Why it matters. certificate verification is disabled

Fix. leave verification on

HIGHNetwork egress · net.tls_off · CWE-200, CWE-319

src/trac_mcp_server/mcp/server.py:500

"--insecure",

Why it matters. certificate verification is disabled

Fix. leave verification on

HIGHPrompt injection · prompt.zero_width · CWE-94, CWE-1427

tests/fixtures/convert_preview/row01_intertrac_wiki.html:2

<a class="ext-link" href="http://192.168.10.4:8000/auto_pm/intertrac/wiki%3ARules/trac/RenderVerify" title="wiki:Rules/trac/RenderVerify in Automated Project Manager"><span class="icon"></span>auto_pm

Why it matters. invisible characters in instruction text

Fix. strip non-printing characters

HIGHPrompt injection · prompt.zero_width · CWE-94, CWE-1427

tests/fixtures/convert_preview/row01_pre_fix.html:2

<a class="ext-link" href="http://192.168.10.4:8000/auto_pm/intertrac/wiki%3ARules/trac/%21RenderVerify" title="wiki:Rules/trac/!RenderVerify in Automated Project Manager"><span class="icon"></span>aut

Why it matters. invisible characters in instruction text

Fix. strip non-printing characters

HIGHPrompt injection · prompt.zero_width · CWE-94, CWE-1427

tests/fixtures/convert_preview/row02_intertrac_wiki_bcs.html:2

<a class="ext-link" href="http://192.168.10.4:8000/bcs/intertrac/wiki%3Ab-node/bench/BoardIdentity" title="wiki:b-node/bench/BoardIdentity in Backyard Control System (b-node)"><span class="icon"></spa

Why it matters. invisible characters in instruction text

Fix. strip non-printing characters

HIGHPrompt injection · prompt.zero_width · CWE-94, CWE-1427

tests/fixtures/convert_preview/row03_bracket_intertrac.html:2

<a class="ext-link" href="http://192.168.10.4:8000/auto_pm/intertrac/wiki%3APage" title="wiki:Page in Automated Project Manager"><span class="icon"></span>label</a>

Why it matters. invisible characters in instruction text

Fix. strip non-printing characters

HIGHPrompt injection · prompt.zero_width · CWE-94, CWE-1427

tests/fixtures/convert_preview/row05_intertrac_index.html:2

<a class="ext-link" href="http://192.168.10.4:8000/auto_pm/intertrac/wiki%3AIndex" title="wiki:Index in Automated Project Manager"><span class="icon"></span>auto_pm:wiki:Index</a>

Why it matters. invisible characters in instruction text

Fix. strip non-printing characters

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

deploy.sh:79

resp="$(curl -sf "http://127.0.0.1:${port}/healthz")"

MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59

milestone_delete, ticket_batch_delete, ticket_delete, wiki_delete

Why it matters. 4 tool(s) can delete or overwrite

Fix. prefer a read-only mode or scoped tokens; the page states the blast radius

LOWCode injection · code.deserialize · CWE-78, CWE-94, CWE-95

tests/test_config_bootstrap.py:563

server = yaml.load(

Why it matters. deserialises untrusted bytes into live objects

Fix. use json or yaml.safe_load

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319

docs/deployment.md:282

curl -s http://127.0.0.1:8080/healthz

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319

docs/deployment.md:290

claude mcp add --transport http trac http://127.0.0.1:8080/mcp \

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319

docs/reference/cli.md:176

| `--url URL` | MCP endpoint, e.g. `http://192.0.2.10:8091/mcp` |

LOWNetwork egress · net.raw_ip · CWE-200, CWE-319

docs/reference/http-transport.md:21

The endpoint must be reached at exactly the configured path (e.g. `http://127.0.0.1:8080/mcp`, no trailing slash) -- it is not a path *prefix*, so there is no redirect to `/mcp/`.

LOWNetwork egress · net.tls_off · CWE-200, CWE-319

scripts/test_trac.py:2636

server_args.append("--insecure")

Why it matters. certificate verification is disabled

Fix. leave verification on

LOWNetwork egress · net.tls_off · CWE-200, CWE-319

scripts/test_trac.py:2732

"--insecure",

Why it matters. certificate verification is disabled

Fix. leave verification on