
Research
/Security News
Mini Shai-Hulud Campaign Hits Red Hat Cloud Services npm Packages
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.
@doist/comms-mcp
Advanced tools
MCP server and importable AI tools for the Doist Comms API. Use the tools through an MCP server, or import them directly to plug Comms into your own AI conversational interface.
npm install @doist/comms-mcp
Example with Vercel's AI SDK:
import { fetchInbox, reply, markDone } from '@doist/comms-mcp'
import { streamText } from 'ai'
const result = streamText({
model: yourModel,
system: 'You are a helpful Comms assistant',
tools: {
fetchInbox,
reply,
markDone,
},
})
npx @doist/comms-mcp
Add to claude_desktop_config.json:
{
"mcpServers": {
"comms": {
"command": "npx",
"args": ["-y", "@doist/comms-mcp"],
"env": {
"COMMS_API_KEY": "your-comms-api-key-here"
}
}
}
}
~/.cursor/mcp.json (global) or .cursor/mcp.json (per-project):
{
"mcpServers": {
"comms": {
"command": "npx",
"args": ["-y", "@doist/comms-mcp"],
"env": {
"COMMS_API_KEY": "your-comms-api-key-here"
}
}
}
}
claude mcp add comms npx @doist/comms-mcp
export COMMS_API_KEY=your-comms-api-key-here
{
"servers": {
"comms": {
"command": "npx",
"args": ["-y", "@doist/comms-mcp"],
"env": {
"COMMS_API_KEY": "your-comms-api-key-here"
}
}
}
}
By default the server talks to https://comms.todoist.com. To point at
staging or a custom deployment, also set COMMS_BASE_URL:
"env": {
"COMMS_API_KEY": "your-comms-api-key-here",
"COMMS_BASE_URL": "https://comms.staging.todoist.com"
}
Generate a personal API token from the Comms app console, then export
it as COMMS_API_KEY (or paste it into the MCP client config above).
The tools are intentionally workflow-shaped rather than 1:1 wrappers around API endpoints, so an LLM can complete a useful action with a small number of calls.
displayInInbox boolean (default false). When true, the thread is unarchived after creation so it appears in the author's Inbox. See also COMMS_CREATE_THREAD_DISPLAY_IN_INBOX.For details, see src/tools.
| Variable | Default | Description |
|---|---|---|
COMMS_API_KEY | (required) | Your Comms API key. |
COMMS_CREATE_THREAD_DISPLAY_IN_INBOX | false | Set to true to unarchive every newly-created thread so it appears in the author's Inbox, without needing to pass displayInInbox: true on each call. Only takes effect when running the MCP locally. The remote/hosted MCP does not have this variable set and will use the per-call displayInInbox parameter only. |
git clone https://github.com/Doist/comms-mcp.git
cd comms-mcp
npm install
cp .env.example .env # then add your COMMS_API_KEY
npm run build
npm start — Build and run the MCP inspectornpm run dev — Watch mode with auto-restartnpm test — Jestnpm run type-check — TypeScriptnpm run format:check / npm run format:fix — oxlint + oxfmtnpx tsx scripts/run-tool.ts user-info '{}'
npx tsx scripts/run-tool.ts --list
npm test)npm run type-check)npm run format:check)Use Conventional Commits — feat:, fix:, docs:, test:, chore:.
MIT
FAQs
MCP server and importable AI tools for the Doist Comms API
We found that @doist/comms-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 12 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.

Research
/Security News
The North Korean malware loader hides in a Packagist-listed package and its GitHub branch to fetch and execute remote code in a likely Contagious Interview-style lure.

Security News
The Rust project is moving toward formal rules on LLM use in contributions after months of internal debate over maintainer burden, code quality, and contributor experience.