Atlas / MCP servers / runekaagaard / Redmine

RedmineCAUTION

Name: Redmine
Author: runekaagaard

mcp/runekaagaard/redmine-2

MCP server by runekaagaard · Audited 2026-10-06

⚑ Report / re-scan Source ↗

A redmine MCP server covering close to 100% of redmines API

Verdict

CAUTION

Grade

Trust score

89 /100

Exposed tools

5 4r · 1w · 0d

Transport

stdio · streamable-http

License

MPL-2.0

Stars

246

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Status: Actively maintained and in daily use. Tested releases are published to PyPI with git tags, and issues and pull requests are triaged regularly.

Let Claude be your Redmine assistant! MCP Redmine connects Claude Desktop to your Redmine instance, allowing it to:

Search and browse projects and issues
Create and update issues with full markdown support
Upload and download file attachments
Manage and track time entries
Update issue statuses and fields
Access comprehensive Redmine API functionality

Uses httpx for API requests and integrates with the Redmine OpenAPI specification for comprehensive API coverage.

Usage with Claude Desktop

1. Installation using `uv`

Ensure you have uv installed.

uv --version

Install uv if you haven't already.

Linux

curl -LsSf https://astral.sh/uv/install.sh | sh

macOS

brew install uv

windows

powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex"

Add to your claude_desktop_config.json:

{
"mcpServers": {
"redmine": {
"command": "uvx",
"args": ["--from", "mcp-redmine==2026.09.10.084818",
"--refresh-package", "mcp-redmine", "mcp-redmine"],
"env": {
"REDMINE_URL": "https://your-redmine-instance.example.com",
"REDMINE_API_KEY": "your-api-key",
"REDMINE_REQUEST_INSTRUCTIONS": "/path/to/instructions.md",
"REDMINE_ALLOWED_DIRECTORIES": "/tmp,/home/user/uploads"
}
}
}
}

2. Installation using `docker`

Ensure you have docker installed.

docker --version

Pull the published image from GitHub Container Registry:

docker pull ghcr.io/runekaagaard/mcp-redmine:latest

Or build the image yourself:

git clone [email protected]:runeka

Read from source at commit 36c4ae170057OBSERVED · 2026-10-06

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add mcp-redmine --env REDMINE_API_KEY=${REDMINE_API_KEY} -- uvx mcp-redmine

claude-desktop

{
  "mcpServers": {
    "mcp-redmine": {
      "command": "uvx",
      "args": [
        "mcp-redmine"
      ],
      "env": {
        "REDMINE_API_KEY": "${REDMINE_API_KEY}"
      }
    }
  }
}

Exposed tools (5)

4 read · 1 write · 0 destructive.

Tool	Risk	Description
`redmine_attachment_image`	read
`redmine_download`	read
`redmine_paths_info`	read	Get full path information for given path templates
`redmine_paths_list`	read	Return a list of available API paths from OpenAPI spec
`redmine_upload`	write

Trust audit

CAUTIONgrade B · trust 89/100 Install with care. The audit found things worth knowing before you trust its output.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (2 observation(s))
Network: declared (3 observation(s))
Shell: none-observed
Dependencies: pinned
Secrets in source: found

Findings (4)

HIGHNetwork egress · net.tls_off · CWE-200, CWE-319

mcp_redmine/server.py:47

_ssl_verify = False

Why it matters. certificate verification is disabled

Fix. leave verification on

MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321

README.md:213

token: "7.ed32257a2ab0f7526c0d72c32994c58b131bb2c0775f7aa84aae01ea8397ea54"

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

tests/test_server.py:69

"../../../collect",  # dot segments resolved by urljoin, can't climb above the host

INFOSupply chain · prompt.pipe_to_shell · CWE-829, CWE-1357

README.md:31

curl -LsSf https://astral.sh/uv/install.sh | sh

Gates applied: no_behavioural_pass.

Audited 2026-10-06 · audit v0.4.1 · source sha 36c4ae170057full audit observations/trust-audit/mcp-server/runekaagaard__redmine-2.json · Report an issue / request a re-scan

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

Date	Source	Verdict	Grade	Score	Change
2026-10-06	`36c4ae170057`	CAUTION	B	89	first audit

Questions

What is the Redmine MCP server?

A redmine MCP server covering close to 100% of redmines API

What tools does Redmine expose?

5 in total: 4 read-only, 1 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is Redmine safe to connect to an agent?

With care. The audit graded it B (89/100) and found 4 things worth knowing before you trust this server, listed below with the exact line each was found on.

What credentials does Redmine need?

It reads REDMINE_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does Redmine run?

It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on PyPI as mcp-redmine.

How current is this page?

The grade is for one exact copy of the source (36c4ae170057), read on 2026-10-06. The repository is watched and re-audited when it changes.