gsd-task-managerBLOCK
Stop juggling, start finishing. GSD Task Manager makes it easy to sort your to-dos into what’s urgent and what’s important, so you can finally get stuff done without burning out. It’s simple, visual, and works entirely offline.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
A privacy-first Eisenhower matrix for deciding what to do, schedule, delegate, or eliminate.
Live app: gsd.vinny.dev Current version: 13.9.0 Current product: the v11 single-matrix shell, offline-first local storage, optional PocketBase sync, and the GSD MCP server.
[](https://www.npmjs.com/package/gsd-mcp-server) [](https://www.npmjs.com/package/gsd-mcp-server) [](LICENSE)
What ships in v11
- A responsive four-quadrant matrix with drag-and-drop movement.
- Quick Capture, full task editing, search, keyboard navigation, and optional
built-in Smart Views.
- Due dates, tags, dependency selection, and circular-dependency prevention.
- Archive, dashboard/review analytics, sync history, settings, and onboarding.
- Local IndexedDB persistence, JSON import/export, offline PWA support, and
user-controlled update prompts.
- Optional multi-device PocketBase sync with Google, Apple, or GitHub OAuth and
realtime server-sent events.
- A separately installed MCP server with 19 task, analytics, and diagnostic
tools, including validated and dry-run-aware writes.
- Light and dark Inkwell "GSD Editorial" themes with WCAG AA as the
accessibility floor.
Retired v7/v8 surfaces such as selection-mode batch operations, the Quick Settings panel, and smart-view pinning shortcuts are not part of the v11 shell.
Privacy and data custody
Local-only mode is the default. Tasks are stored in the browser's IndexedDB and the core product does not require a backend. Clearing browser data can erase local tasks, so export backups regularly.
Cloud sync is explicitly optional. When enabled, task data is sent to the configured PocketBase server; the hosted configuration use
eeffc2e9f9eeOBSERVED · 2026-10-08Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add gsd-mcp-server --env ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY} --env GSD_AUTH_TOKEN=${GSD_AUTH_TOKEN} --env GSD_TASKS_ENC_KEY=${GSD_TASKS_ENC_KEY} --env GSD_WEB_OAUTH_CALLBACK_URL=${GSD_WEB_OAUTH_CALLBACK_URL} -- npx -y [email protected]{
"mcpServers": {
"gsd-mcp-server": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"ANTHROPIC_API_KEY": "${ANTHROPIC_API_KEY}",
"GSD_AUTH_TOKEN": "${GSD_AUTH_TOKEN}",
"GSD_TASKS_ENC_KEY": "${GSD_TASKS_ENC_KEY}",
"GSD_WEB_OAUTH_CALLBACK_URL": "${GSD_WEB_OAUTH_CALLBACK_URL}"
}
}
}
}Exposed tools (26)
19 read · 6 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
Delegate | read | Interruptions. Hand these off. |
Eliminate | write | Noise. Stop doing these. |
Schedule | write | Strategy, growth. Protect this time. |
bulk_update_tasks | write | Update multiple tasks at once. Supports completing, moving quadrants, adding/removing tags, setting due dates, and deleting. Limited to 50 tasks per operation (10 for deletes) for safety. Destructive deletes default to dryRun=true — pass dryRun=false explicitly to apply. |
complete_task | read | Mark a task as complete or incomplete. Quick shortcut for updating completion status. Use dryRun=true to preview changes. |
create_task | write | Create a new task in the user |
daily-standup | read | Daily task review: today |
delete_task | destructive | Permanently delete a task. This action cannot be undone. Deletes default to dryRun=true, so pass dryRun=false explicitly to apply. |
focus-mode | read | Get urgent and important tasks (Q1: Do First) to focus on right now |
get_cache_stats | read | Get task cache statistics including hit rate, cache size, and TTL configuration. Useful for monitoring MCP server performance and debugging caching behavior. |
get_help | read | Get help documentation for this server: the tool list, analytics capabilities, setup, example queries, and troubleshooting. Pass topic to return one section; omit it for all sections. |
get_productivity_metrics | read | Get comprehensive productivity metrics including completion counts, streaks, rates, quadrant distribution, tag statistics, and due date tracking. |
get_quadrant_analysis | read | Analyze task distribution and performance across all four Eisenhower matrix quadrants. Shows completion rates, task counts, and identifies top-performing quadrants. |
get_sync_status | write | Check PocketBase sync backend health. Returns healthy (boolean), taskCount, authenticated, and the redacted pocketBaseUrl. lastSyncAt is always null: PocketBase is live, so there is no last-sync timestamp. Use validate_config for a full diagnostic and get_task_stats for task counts by status. |
get_tag_analytics | read | Get per-tag statistics: usage counts and completion rates for every tag. This is the tagStats section of get_productivity_metrics on its own; call this when only tag data is needed, and get_productivity_metrics when you also need completion counts, streaks, or quadrant distribution. |
get_task | read | Get a single task by its ID. Returns the full task object. Fails with |
get_task_insights | read | Get a prose summary of key metrics, streaks, upcoming deadlines, quadrant distribution, and top tags, computed from the same data as get_productivity_metrics. Returns text rather than JSON; use get_productivity_metrics when you need numbers to compute with. |
get_task_stats | read | Get task counts: totalTasks, activeTasks (not completed), completedTasks, plus lastUpdated, oldestTask, and newestTask timestamps. Counts cover every task in the account regardless of quadrant. Use list_tasks when you need the tasks themselves rather than counts. |
get_token_status | read | Check authentication token status including expiration date, days remaining, and warnings. Use this to proactively check if re-authentication is needed. Returns status (healthy/warning/critical/expired), expiration details, and re-authentication instructions if needed. |
get_upcoming_deadlines | read | Get tasks grouped by deadline urgency: overdue, due today, and due this week. Useful for prioritizing time-sensitive work. |
productivity-report | read | Comprehensive productivity report with metrics, streaks, and insights |
tag-analysis | read | Analyze task distribution and completion rates by tags/projects |
upcoming-deadlines | read | Show all overdue tasks, tasks due today, and tasks due this week |
update_task | write | Update an existing task. All fields except ID are optional - only provide fields you want to change. Supports moving between quadrants, updating content, changing due dates, and more. Use dryRun=true to preview changes. |
validate_config | read | Validate MCP server configuration and diagnose issues. Checks environment variables, PocketBase connectivity, authentication, and sync status. Returns detailed diagnostics. |
weekly-review | read | Weekly productivity analysis: completion stats, trends, and top quadrants |
Trust audit
BLOCKgrade F · trust 57/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | FAIL |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (2 observation(s))
- Network
- declared (8 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (25)
feedback-payload.ts
**Re-point at the end of a multi-doc workflow; don't claim a doc is on screen unless you put it there.** The one-shot attach (signal 3) opens the preview *once* — later writes do NOT move the pane; it
* Never bypass safety checks with shortcuts like `--no-verify`. Do not discard unfamiliar files.
verify-frontend-change.skill
.devin/skills/diagnose
.devin/skills/grill-me
.devin/skills/grill-with-docs
.devin/skills/handoff
.devin/skills/improve-codebase-architecture
# Default (dev): http://127.0.0.1:8090
# NEXT_PUBLIC_POCKETBASE_URL=http://127.0.0.1:8090
"http://127.0.0.1:8090",
# the PocketBase port directly — set PB_URL=http://127.0.0.1:8090 on the host,
delete_task
.diagram-design
.fallowrc.json
.gitleaksignore
.mcp.json.example
.nojekyll
feedback-payload.test.ts
new Function(collectorSource)();
new Function(collectorSource)();
logger.info("config", { apikey: "key-value" });import type { GsdConfig } from '../../types.js';vi.mock('../../api/retry.js', async () => {Gates applied: instruction_override, no_behavioural_pass.
eeffc2e9f9eefull audit observations/trust-audit/mcp-server/vscarpenter__gsd-task-manager.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-08 | eeffc2e9f9ee | BLOCK | F | 57 | first audit |
Questions
What is the gsd-task-manager MCP server?
Stop juggling, start finishing. GSD Task Manager makes it easy to sort your to-dos into what’s urgent and what’s important, so you can finally get stuff done without burning out. It’s simple, visual, and works entirely offline.
What tools does gsd-task-manager expose?
26 in total: 19 read-only, 6 that write, and 1 that can delete or overwrite (delete_task). Every one is listed on this page with its risk.
Is gsd-task-manager safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (57/100) and found 3 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does gsd-task-manager need?
It reads ANTHROPIC_API_KEY, GSD_AUTH_TOKEN, GSD_TASKS_ENC_KEY, GSD_WEB_OAUTH_CALLBACK_URL and PB_ADMIN_PASSWORD from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does gsd-task-manager run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as gsd-mcp-server at 1.3.0.
How current is this page?
The grade is for one exact copy of the source (eeffc2e9f9ee), read on 2026-10-08. The repository is watched and re-audited when it changes.