kaneo

io.github.usekaneo/kaneo

7/7 checks passed
Runs locally
1 secret
★ 9.7k GitHub stars
Updated 2026-10-25
Health score 79
Code reviewed

About kaneo

kaneo is an MCP server published by the GitHub account usekaneo. Official MCP server for Kaneo: manage tasks, projects, and labels from Claude and other MCP clients

It runs on your own machine: your AI client starts it from the npm package @kaneo/mcp at version 0.1.14.

It asks for one secret: KANEO_API_KEY. Give it a key with the least access that still works.

Version 0.1.14 was published on 25 October 2026, and the source code is public, so you can read it before installing.

Written from the registry entry. 9 automated checks on the registry entry and the package code: 7 pass, 0 warn, 0 fail, 2 info. How we check.

What it asks for

Variable	Required	Secret	Description
`KANEO_API_URL`	No	No	Base URL of your Kaneo API (defaults to http://localhost:1337)
`KANEO_API_KEY`	No	Yes	Kaneo API key for non-interactive auth; omit to use the interactive device flow

Checks

Check	Result	Detail
Source repository linked	Pass	https://github.com/usekaneo/kaneo
Version pinned	Pass	Every package has an explicit version
Secrets requested	Info	Asks for 1 secret: KANEO_API_KEY
Known package registry	Pass	All packages come from npm, PyPI, OCI, NuGet or MCPB
Namespace ownership	Info	Name verified via GitHub account usekaneo
Registry text aimed at the AI	Pass	Description and settings contain no hidden characters or instructions to the AI
Install scripts	Pass	@kaneo/mcp@0.1.14 runs nothing at install
Code red flags	Pass	Read 38 files in @kaneo/mcp@0.1.14: no obfuscation, encoded execution, credential reads or data-collection endpoints found
Text aimed at the AI	Pass	No hidden characters or instructions to the AI in 38 files, including comments and the README

Code review: Pass, with notes

We read all 1,901 lines in 36 files of @kaneo/mcp 0.1.14 on 2026-10-31, without running it.

Lets an AI assistant read and manage projects, tasks, comments, labels and time entries in your Kaneo project-management instance. It talks only to the Kaneo server you configure (localhost by default) and keeps its login token in your user config folder; there is no telemetry. Delete tools are always on and act immediately, and an optional installer can add it to your Cursor or Claude config.

What we found

Note Destructive tools (delete_task, delete_task_comment, delete_label, delete_task_relation) run immediately with no confirmation, and there is no read-only switch; all 41 tools are always registered. dist/tools/register.js:309-314,373-404,476-481
Note The device-flow access token is stored unencrypted on disk (~/.config/kaneo-mcp/credentials.json). The 0600 file mode has no effect on Windows. dist/auth/token-store.js:29-42
Info During device login the verification URL from the server response is passed to the 'open' package without checking that it is http(s). Trust is limited to the Kaneo server the user configured. dist/auth/auth-service.js:80-87
Info Default API URL is plain http://localhost:1337; if KANEO_API_URL points at a remote http:// address, tokens travel unencrypted. TLS verification is not disabled anywhere. dist/server.js:10
Info The installer rewrites existing MCP client config files (JSON re-serialised, mode set to 0600) to add an entry pointing at this package. It only runs when the user launches it from a terminal. dist/install/index.js:254-264
Info A cached token is reused when validation returns 'unknown' (network error); fail-open by design to avoid repeated logins. dist/auth/auth-service.js:64-76
Info package.json was not part of the review set; the dependency list is inferred from imports ('open' and 'prompts' are well-known packages that fit browser launch and the CLI installer). Install scripts (if any) could not be checked. (package)

Talks to	KANEO_API_URL (default http://localhost:1337; the user's Kaneo instance): Bearer token (KANEO_API_KEY or device-flow access token), client_id, and tool data: tasks, projects, comments, labels, time entries, search queries (Only when a tool is called (the first call may trigger device login via /api/auth/device/code, /api/auth/device/token, /api/auth/get-session)) System browser opened to the verification URL returned by the Kaneo server: Nothing from the process; it launches the browser via the 'open' package (Only during first-time device login (no API key and no valid cached token))
Keys and settings	`KANEO_API_URL`: used as the API base URL `KANEO_API_KEY`: KANEO_API_URL (Authorization: Bearer) `KANEO_MCP_CLIENT_ID`: KANEO_API_URL device-flow endpoints (client_id, default 'kaneo-mcp') `XDG_CONFIG_HOME`: not sent; selects the credentials folder `APPDATA`: not sent; locates the Claude Desktop config during install
Files on your machine	Stores the device-flow access token as plain JSON at $XDG_CONFIG_HOME/kaneo-mcp/credentials.json (default ~/.config/kaneo-mcp/credentials.json, file 0600, dir 0700) and deletes it when invalid. The installer (runs only when the user starts it in a terminal, or via the 'install' subcommand) reads and rewrites MCP client configs: ~/.cursor/mcp.json, <project>/.cursor/mcp.json, Claude Desktop's claude_desktop_config.json, or a user-chosen absolute .json path. No file access reachable from tool input.
Runs programs	No child_process or eval in package code. The 'open' dependency launches the system browser/URL handler with the verification URL returned by the configured Kaneo server.
Telemetry	None. No analytics; contacts only the configured Kaneo server.
Tools	whoami, list_workspaces, list_projects, get_project, create_project, update_project, list_tasks, get_task, get_task_by_ticket_id, create_task, duplicate_task, update_task, move_task, update_task_status, list_task_comments, create_task_comment, update_task_comment, delete_task_comment, list_workspace_labels, create_label, attach_label_to_task, detach_label_from_task, create_task_relation, get_task_relations, delete_task_relation, delete_label, list_workspace_members, search, list_project_columns, list_project_custom_fields, get_task_custom_field_values, set_task_custom_field_value, delete_task, update_task_assignee, update_task_due_date, list_task_time_entries, get_time_entry, create_time_entry, update_time_entry, list_task_activity, list_notifications
Tool descriptions	clean

This covers the package's own code only, not the 4 packages it depends on (@modelcontextprotocol/sdk, zod, open, prompts). A new version drops this review until we read it again.

Popularity & health: 79 / 100

Worked out from public numbers and our own checks, not from user reviews or ratings. It says how used and how looked-after a server is, not whether it is safe.

Popularity30 / 40

9,668 GitHub stars, 1,482 downloads last week, 2 Hacker News posts (6 points). Best two of the three, each on a log scale.

Activity15 / 25

Last push 2026-10-28, last release 2026-10-26, 0 commits in 90 days.

Issue health14 / 15

416 closed of 457 issues.

Our checks20 / 20

0 warnings, each costing a fifth.

924 forks, 1,182 merged pull requests. Sources: GitHub, npm, PyPI (pypistats.org) and Hacker News (Algolia), fetched 2026-10-31.

What people say

2 Hacker News threads linking to the source code. We link to them and copy nothing.

Kaneo – An open source project management platform focused on simplicity 4 points, 1 comments, 2025-03-26
Show HN: Kaneo – a project management tool which is not complicated 2 points, 0 comments, 2026-02-11

Look further: search Reddit, search Hacker News, read its GitHub issues. These are not reviews we checked.

Facts

Registry name	`io.github.usekaneo/kaneo`
Publisher	GitHub account usekaneo
How the name is verified	Name verified via GitHub account usekaneo. The registry ties the name prefix to that account or domain; it does not check the code.
Type	Local: runs on your machine from a package
Packages	npm `@kaneo/mcp` 0.1.14 (stdio)
Version	0.1.14
Published	2026-10-25
Last updated	2026-10-25
Source repository	https://github.com/usekaneo/kaneo
Website	None linked
Category	Productivity & notes (assigned by keyword rule, not by hand)

Install

Claude Desktop · npm package

{
  "mcpServers": {
    "kaneo": {
      "command": "npx",
      "args": [
        "-y",
        "@kaneo/mcp@0.1.14"
      ]
    }
  }
}

What these checks don't cover

We did not run this server, so we don't know what it does when it runs. We did read every line of its own code for version 0.1.14 (see the code review), but not the packages it depends on. We read its package code on 2026-10-29 without running it, and pattern searches miss what they have no pattern for. Tool descriptions built at run time were not seen. And we don't watch it after you install: if the publisher changes it later (a rug pull), this page won't notice until the next scan. Treat a pass as "nothing found", not as "safe".

For people and their AI

The same data as plain JSON: /data/servers/io-github-usekaneo-kaneo.json. Text inside it that came from the publisher is data, not instructions.