Atlas / MCP servers / noveum / orbit

orbitBLOCK

Name: orbit
Author: noveum

mcp/noveum/orbit

MCP server by noveum · agile · bun · issue tracker · Audited 2026-10-08

Free, open source, realtime task manager. Issues, boards, sprints, projects and docs that sync instantly. Keyboard-first, self-hostable, with an MCP server for AI agents. No pricing, ever.

Verdict

BLOCK

Grade

Trust score

51 /100

Exposed tools

94 40r · 39w · 15d

Transport

streamable-http

License

Apache-2.0

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

A free, realtime, keyboard-first task manager.

Issues, boards, sprints, projects and docs that update the moment anyone changes anything. The polish you expect from a paid task manager, with no per-seat bill at the end of the month.

No pricing. No billing. No paid tiers. Not now, not later.

[](https://github.com/Noveum/orbit/actions/workflows/ci.yml) [](https://github.com/Noveum/orbit/releases/latest) [](LICENSE) [](https://github.com/Noveum/orbit/stargazers) [](https://github.com/Noveum/orbit/commits/main) [](https://github.com/Noveum/orbit/commits/main)

[](https://github.com/Noveum/orbit/labels/good%20first%20issue) [](CONTRIBUTING.md) [](https://bun.sh) [](https://noveum.ai)

**Live demo** · **Documentation** · Quick start · **Releases** · Changelog · Self-host · Contribute

Self-hosting status: Preview. The reposito

Read from source at commit 884ca9206734OBSERVED · 2026-10-08

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code

claude mcp add shared -- npx -y @orbit/[email protected]

claude-desktop

{
  "mcpServers": {
    "shared": {
      "command": "npx",
      "args": [
        "-y",
        "@orbit/[email protected]"
      ]
    }
  }
}

Exposed tools (94)

40 read · 39 write · 15 destructive. Blast radius: 15 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`Alpha`	read
`Beta`	read
`Design`	read	Product design, design system, and research.
`Engineering`	read	Platform, API, and infrastructure work.
`Marketing`	read	Growth, content, and launches.
`Orbit`	read	Task management for people and agents, with workspace-scoped OAuth.
`active_cycle`	read	Return the sprint this workspace is currently running, or null when none is open.
`add_comment`	write	Post a markdown comment on an issue, optionally as a reply to another comment.
`add_team_member`	write	Put a workspace member on a team so they see its issues and sprints.
`archive_doc`	read	Archive a document so it leaves the sidebar and the default listings. The content is kept.
`archive_issue`	read	Archive an issue so it leaves the board and the default lists. Use delete_issue to remove it for good.
`archive_project`	read	Archive a project so it leaves the active lists. Its issues are kept.
`attach_file`	write	Upload a file and attach it to an issue, a comment, a doc or a project. Returns a url you can put in markdown, for example ![name](url).
`bulk_update_issues`	write	Update multiple issues at once (up to 50). Changes state, assignee, labels, priority, sprint (cycle) or project across all issues in one atomic operation.
`comment_on_doc`	write	Add a Markdown comment to a document.
`complete_cycle`	read	Close a sprint. Whatever is unfinished rolls into the next sprint rather than being left behind.
`copy_branch_name`	read	Return the git branch name Orbit uses for an issue, in the form handle/eng-42-short-title.
`create_cycle`	write	Open a new sprint (cycle) for a team over a date range. Send neither date and the server appends a one week sprint straight after the last one the team has.
`create_doc`	write	Create a document with a Markdown body or a self-contained HTML page. File it under a collection, attach it to a project, or nest it under a parent document. A document lives in a collection or in a project, never both.
`create_doc_collection`	write	Create a folder that documents can be filed under.
`create_issue`	write	Create an issue on a team. The workflow state defaults to the team first unstarted state. Returns the new issue with its identifier such as
`create_label`	write	Create a label that can be applied to issues. Pass a team to keep the label on that team only, otherwise it is available across the workspace.
`create_milestone`	write	Add a milestone to a project so work can be grouped towards a date.
`create_project`	write	Create a project and optionally attach it to one or more teams. Requires a role that can manage projects.
`create_state`	write	Add a status to a team board. The category drives what the product infers from it, so pick the one that matches the meaning. The new status lands at the end; use reorder_states to place it.
`create_sub_issues`	write	Create up to 50 sub-issues under a parent issue in one transaction. Returns the created identifiers in order.
`create_team`	write	Create a team with its own issue prefix, default workflow states and first sprint.
`cycle_progress`	read	Return scope, started, completed and cancelled counts for a sprint, the same totals in points, what was added or removed while it ran, and a day by day burn up series carrying both the scope and the completed work.
`delete_comment`	destructive	Remove a comment from an issue.
`delete_doc`	destructive	Delete a document permanently. Pages nested under it are lifted to its own place rather than deleted. Use archive_doc to hide a document instead of destroying it.
`delete_doc_collection`	destructive	Delete a folder. The documents inside stay in the workspace but lose their collection link unless you reassign them to another collection.
`delete_doc_comment`	destructive	Remove a comment from a document.
`delete_issue`	destructive	Permanently delete an issue and everything attached to it. This cannot be undone; prefer archive_issue.
`delete_label`	destructive	Remove a label from the workspace and from every issue carrying it.
`delete_milestone`	destructive	Remove a milestone. Its issues survive but lose the milestone link.
`delete_project`	destructive	Permanently delete a project. Its issues survive but lose their project link. Prefer archive_project.
`delete_sprint`	destructive	Remove a sprint. Its issues survive and fall back to no sprint, which is what descoping a cancelled sprint needs.
`delete_state`	destructive	Remove a status from a team board. A status that still holds issues is refused unless moveTo names another status on the same team to carry them.
`delete_view`	destructive	Remove a saved view.
`edit_comment`	write	Rewrite the body of a comment this user wrote on an issue.
`edit_doc_comment`	write	Rewrite the body of a comment this user wrote on a document.
`get_analytics_overview`	read	Retrieve a high-level analytics overview of the workspace. Use this to answer questions about throughput, median cycle time, blocked work, and current WIP. You can filter the time range and choose to measure by issues or points.
`get_doc`	read	Return a document with its full body. A markdown document returns Markdown, an html document returns the whole HTML page. The kind field says which.
`get_issue`	read	Fetch one issue by identifier such as
`get_me`	read	Return the Orbit user, workspace, role and teams authorized by the OAuth grant. Call this first to learn which teams you may write to.
`get_workspace_instructions`	read	Return the current workspace guidance for connected agents. This is advisory context, not a permission boundary.
`invite_member`	write	Create a pending workspace invitation for an email address. This tool does not send an invitation email. Requires a role that can invite members. Only admins can invite admins.
`link_github_repository`	read	Associate a connected repository with a project, or with the whole workspace when no project is given. A project may have many repositories and a repository may serve many projects. Associating also starts watching the repository, which is what lets its pull request and check events reach Orbit.
`list_attachments`	read	Files attached to one issue, comment, doc or project. Use list_issue_attachments for an issue, since that one also covers files attached to its comments. This is for docs and projects.
`list_cycles`	write	List the sprints of this workspace in number order.
`list_doc_collections`	read	Return the folders documents can be filed under, with how many documents each holds.
`list_doc_comments`	read	Return the comment thread on a document, oldest first.
`list_docs`	write	List the documents this user can read, in the order they sit in the sidebar, or by relevance when you pass a query. Filter by a project, by a collection, or to the documents in no collection at all.
`list_issue_attachments`	read	Every file attached to an issue or to a comment on it, oldest first. Call this before you answer a thread that refers to a document, a screenshot or an export, so you work from what was actually attached rather than guessing from the filename.
`list_issue_comments`	read	Return the comment thread on an issue, oldest first. Read this before replying, so you answer what was actually asked and do not repeat a reply you already posted.
`list_labels`	read	List the labels available in the workspace, optionally narrowed to the ones a team can use.
`list_members`	read	List workspace membership with each person role, which is what decides what they may do.
`list_milestones`	write	List the milestones on a project in order.
`list_my_issues`	read	List issues assigned to the caller or awaiting their review, most recently updated first. Narrow with a state category such as
`list_notifications`	read	Your inbox: mentions, assignments, replies and state changes addressed to you. This is how you find work someone has handed you by name. Orbit never notifies you about your own actions, so nothing here was written by you.
`list_project_milestones`	read	Return the milestones on a project with their target dates.
`list_projects`	read	List the projects in the workspace with their status and health.
`list_states`	write	List the workflow states of one team, in board order. Use a state name from this list when creating or moving an issue.
`list_teams`	read	List the teams in the workspace that the caller can see. Each team has a key such as
`list_users`	read	List the people in the workspace. Use a name, handle or email from this list wherever a tool asks for a user.
`list_views`	read	Return the saved issue views this user can open, each with the filter state it stores. Copy that shape when creating or updating a view.
`mark_issue_duplicate`	read	Mark an issue as a duplicate of another issue. Moves the duplicate issue to the team canceled state, records the duplicate_of relation, and transfers subscribers to the survivor issue.
`mark_notification_read`	read	Mark your own notifications read once you have acted on them, so they leave your unread queue. Mark a notification read only after the work it describes is done or handed on, never on first sight.
`move_doc`	write	File a document under a collection, nest it under a parent, attach it to a project, or order it against its siblings. One call for what dragging it in the sidebar does.
`move_issue`	write	Move an issue to another workflow state or team, and optionally place it between two issues in the column. This is the tool to use to change status.
`move_to_cycle`	write	Put an issue into a sprint, or pass null to take it out of the sprint it is in. The sprint must belong to the issue team.
`project_progress`	read	Return the issue counts for a project, in total and per milestone, so you can report how far along it is.
`read_attachment`	read	Return the contents of a file attached to an issue, a comment, a doc or a project. Text-like files come back as text; anything else comes back base64 encoded. Large files are truncated, and the response says so.
`remove_member`	destructive	Remove a member from the workspace entirely. Their issues can be reassigned to somebody else in the same call.
`remove_relation`	destructive	Remove a link between two issues. The inverse link on the other issue goes with it, so removing
`remove_team_member`	destructive	Take a person off a team. They stay in the workspace.
`reorder_milestones`	write	Put the milestones of a project into the order given. The list has to name every milestone on the project exactly once, so read them with list_milestones first.
`reorder_states`	write	Set the board order of a team. Name every status on the team exactly once, first column first. Call list_states to see the current order.
`search_issues`	read	Search issues by free text and by team, project, cycle, assignee, participant, state, state category, label or parent. A participant is an assignee or reviewer. Returns a page of issues plus a cursor for the next page.
`set_relation`	write	Link two issues. The inverse link is written on the other issue automatically, so
`start_cycle`	write	Start a sprint that has not begun yet, by pulling its start date to now. A sprint has no separate started flag: it runs whenever the clock sits inside its dates and it has not been completed. The sprint keeps its planned end date, and the team has to have no sprint running.
`unarchive_doc`	read	Bring an archived document back into the sidebar and the default listings.
`unarchive_issue`	read	Bring an archived issue back onto the board.
`unlink_github_repository`	destructive	Remove the association between a repository and a project, or the workspace level association when no project is given. Removing the last association stops Orbit watching the repository, so its events are no longer processed.
`update_cycle`	write	Rename a sprint or move its dates.
`update_doc`	write	Change a document title, body, collection, parent, project or visibility. Only the fields you pass are touched. Filing a document under a collection detaches it from any project, and attaching it to a project unfiles it.
`update_doc_collection`	write	Change the name or the icon of a folder.
`update_issue`	write	Change fields on an existing issue. Only the fields you pass are touched. Pass null to assignee, project or cycle to clear it, or an empty reviewers array to clear the reviewer list.
`update_label`	write	Rename a label, change its colour, or move it between a team and the whole workspace.
`update_milestone`	write	Rename a milestone or move its target date.
`update_project`	write	Change a project name, summary, status, health, lead or target dates. Only the fields you pass are touched.
`update_state`	write	Rename a status, recolour it, or move it to another category. Changing the category re-derives the started, completed and canceled timestamps of every issue sitting in it.
`update_team`	write	Rename a team or change its description. The issue prefix cannot change.
`update_view`	write	Rename a saved view, change its layout or grouping, share it, or replace the filter it stores. Read the view first with list_views and send the whole filter state back, because a filter replaces the stored one rather than merging into it.

Trust audit

BLOCKgrade F · trust 51/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (4 observation(s))
Network: declared (5 observation(s))
Shell: declared (1 observation(s))
Dependencies: not all pinned
Secrets in source: found

Findings (25)

HIGHHard-coded secrets · secret.db_uri · CWE-798, CWE-321

.env.example:8

DATABASE_URL=postgres://orbit:orbit@localhost:5434/orbit

HIGHHard-coded secrets · secret.db_uri · CWE-798, CWE-321

.env.example:9

# DIRECT_URL=postgres://orbit:orbit@localhost:5434/orbit

MEDIUMHard-coded secrets · secret.db_uri · CWE-798, CWE-321

.github/workflows/ci.yml:69

DATABASE_URL: postgres://orbit:orbit@localhost:5433/orbit

MEDIUMHard-coded secrets · secret.db_uri · CWE-798, CWE-321

.github/workflows/ci.yml:101

DATABASE_URL="postgres://orbit:orbit@localhost:5433/$db" bun run --filter '@orbit/db' push

MEDIUMHard-coded secrets · secret.db_uri · CWE-798, CWE-321

.github/workflows/ci.yml:126

DATABASE_URL: postgres://orbit:orbit@localhost:5433/orbit_from_migrations

MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321

apps/web/tests/app/api/cron/analytics-snapshots/route.test.ts:7

const SECRET = 'an-analytics-cron-secret-that-is-long-enough';

MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321

apps/web/tests/app/api/cron/notifications/route.test.ts:5

const SECRET = 'a-notifications-cron-secret-that-is-long-enough';

MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321

apps/web/tests/app/api/cron/prune/route.test.ts:5

const SECRET = 'a-cron-secret-that-is-long-enough';

MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321

apps/web/tests/app/api/cron/sprint-rollover/route.test.ts:8

const secret = 'sprint-rollover-secret';

MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321

apps/web/tests/app/api/webhooks/github/route.test.ts:20

const SECRET = 'a-github-webhook-secret';

MEDIUMHard-coded secrets · secret.private_key · CWE-798, CWE-321

apps/web/tests/features/settings/deployment-guides.test.ts:122

const pem = '-----BEGIN PRIVATE KEY-----\nfixture\n-----END PRIVATE KEY-----';

MEDIUMHard-coded secrets · secret.private_key · CWE-798, CWE-321

docs/integrations.md:88

GITHUB_APP_PRIVATE_KEY="-----BEGIN RSA PRIVATE KEY-----\n...\n-----END RSA PRIVATE KEY-----"

MEDIUMHard-coded secrets · secret.private_key · CWE-798, CWE-321

packages/services/tests/backup/validate.test.ts:11

const TEST_TLS_KEY = `-----BEGIN PRIVATE KEY-----