Kanboard MCP

What bivex/kanboard-mcp MCP server does

The bivex/kanboard-mcp MCP server exposes Kanboard project-management operations to MCP clients. It is intended for use with a Kanboard instance that provides API access and an MCP-compatible assistant. Rather than requiring an agent workflow to call Kanboard's JSON-RPC interface directly, the server provides named tools that clients can invoke for common project and task actions.

Supported project operations include listing projects, creating and updating them, looking up projects by several identifiers, removing or toggling projects, controlling public access, and retrieving project activity. Task operations include creating, reading, updating, deleting, opening, closing, locating tasks by reference, listing overdue work, and moving tasks between columns or positions. The available excerpt also identifies support for users, columns, and other Kanboard management areas, although their individual tools are not listed here.

How it works

The server is written in Go and communicates directly with Kanboard's API. An MCP client starts the local executable and passes requests to it using the client's MCP configuration. The assistant can then select the relevant Kanboard tool based on a user's request, such as finding a project, creating a task, or showing overdue tasks.

Kanboard authentication can use a global API token, a user-specific token, or bearer authentication. The selected mode is controlled with KANBOARD_AUTH_METHOD; global-token authentication is the default when that setting is omitted. The README also documents username and password configuration, but the exact credential combination depends on the authentication method and Kanboard setup.

Role-based access control is part of the server configuration. Application roles include administrator, manager, and basic user access. Project roles include manager, member, and viewer. Roles can be obtained from Kanboard or supplied through environment variables for application-level and project-specific permissions.

Setup and configuration

Building the bivex/kanboard-mcp MCP server requires Go 1.21 or later, a Kanboard instance with API access, and an MCP-compatible client. The repository provides platform-specific build scripts and also documents a manual go build command that produces a kanboard-mcp executable.

At minimum, configure the Kanboard API endpoint, API key, username, and password in the process environment or in the MCP client's server configuration. The endpoint should point to Kanboard's JSON-RPC path. Optional settings control application roles, project roles, debug logging, and whether RBAC checks are skipped during troubleshooting.

After adding the executable and environment values to the MCP client's configuration, restart the client. The README gives Cursor and Claude Desktop as supported client examples and shows a local executable configured with an empty argument list.

Tools and capabilities

The documented tools are grouped around Kanboard project and task management. Project tools cover retrieval by ID, name, identifier, or email, creation, updates, deletion, enablement, public access, and activity feeds. Task tools cover project task retrieval, creation, modification, deletion, status changes, external-reference lookup, overdue-task queries, and position movement.

These operations support workflows such as creating a project and its initial tasks, reviewing activity, finding overdue work, changing task state, and maintaining project visibility. Each tool is designed to be selected by an MCP client in response to a natural-language request.

Limitations and notes

The server depends on a reachable Kanboard installation and valid API access; it does not provide Kanboard itself. Permissions can prevent operations even when the MCP process is running, so the configured application and project roles must match the requested action.

The README warns about proxy-related issues and recommends a separate mcpproxy project as a proxy solution. That proxy is not part of this server. Skipping RBAC is documented as a debugging option and should not be treated as a normal production setting because it disables permission checks.