The official Todoist MCP server
Drift inferred · capture-to-capture
No drift recorded — single capability capture; advisories appear once its surface changes.
transport stdio · http counts 0 tools · 0 res
· 0 prompts
permission surface via code analysis
No tools enumerated yet for this server.
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 96
filesystem 4
- fs package/dist/mcp-server-DmDfXvc6.js :3
import { readFileSync as Os } from "node:fs"; - fs (weak) package/scripts/bump-plugin-version.mjs :2
import { readFileSync, writeFileSync } from 'node:fs' - fs (weak) package/scripts/eval-instructions.ts :34
import { mkdirSync, writeFileSync } from 'node:fs' - fs (weak) package/scripts/run-tool.ts :17
import { readFileSync } from 'node:fs'
shell / exec 1
- shell (weak) package/scripts/test-executable.cjs :3
const { spawn } = require('node:child_process')
network 1
- net package/dist/main-http.js :2
import { isIP as p } from "node:net";
secrets 3
- secrets package/dist/main-http.js :120
const t = process.env.TODOIST_BASE_URL, r = process.env.TODOIST_API_KEY; - secrets package/dist/main.js :6
const e = process.env.TODOIST_BASE_URL, r = process.env.TODOIST_API_KEY; - secrets (weak) package/scripts/run-tool.ts :101
const apiKey = process.env.TODOIST_API_KEY
install hooks 2
- prepublishOnly package/package.json :64
npm run build && npm test - prepare package/package.json :65
husky
declared dependencies 42
- @modelcontextprotocol/ext-apps@1.2.2
- @modelcontextprotocol/client@2.0.0
- @modelcontextprotocol/inspector@0.22.0
- @modelcontextprotocol/node@^2.0.0
- @modelcontextprotocol/server@^2.0.0
- @doist/todoist-sdk@14.0.1
- date-fns@4.1.0
- dompurify@3.3.3
- dotenv@17.3.1
- express@5.2.1
- zod@4.3.6
- @anthropic-ai/sdk@0.115.0
- @semantic-release/changelog@6.0.3
- @semantic-release/exec@7.1.0
- @semantic-release/git@10.0.1
- @types/dompurify@3.2.0
- @types/express@5.0.6
- @types/morgan@1.9.10
- @types/node@22.20.1
- @types/react@19.2.17
- @types/react-dom@19.2.3
- @vitejs/plugin-react@5.2.0
- concurrently@9.2.4
- conventional-changelog-conventionalcommits@9.3.1
- gpt-tokenizer@3.4.0
- husky@9.1.7
- lint-staged@16.4.0
- morgan@1.11.0
- nodemon@3.1.14
- oxfmt@0.55.0
- oxlint@1.70.0
- react@19.2.7
- react-dom@19.2.7
- rimraf@6.1.3
- semantic-release@25.0.9
- snarkdown@2.0.0
- tsx@4.22.4
- typescript@6.0.3
- vite@7.3.5
- vite-plugin-dts@4.5.4
- vite-plugin-singlefile@2.3.3
- vitest@4.1.9
obfuscation 1
- dynamic require()/import() package/scripts/validate-schemas.ts :161
const { registeredTools } = await import(`${process.cwd()}/dist/index.js`)