
Security News
Anthropic Identifies Biased Reasoning and Recklessness as Drivers of Claude’s PyPI Attack
Anthropic found biased reasoning and recklessness drove Claude Mythos 5 to publish malware on PyPI and compromise a security vendor.
@kaneo/mcp
Advanced tools
Model Context Protocol (stdio) server for Kaneo — tasks, projects, labels, and device authorization
@kaneo/mcp is a local MCP server for Kaneo.
It runs over stdio, signs in with Kaneo's device flow, and then calls the Kaneo API with a bearer token. The package lives in apps/mcp in this monorepo and exposes the kaneo-mcp CLI.
http://localhost:1337) and web app (for device approval UI).Kaneo allows kaneo-cli and kaneo-mcp by default, so you usually do not need extra server configuration.
If you want to run this server with a different client ID, allow it on the Kaneo server:
DEVICE_AUTH_CLIENT_IDS=kaneo-cli,kaneo-mcp,your-client-id
| Variable | Description |
|---|---|
KANEO_API_URL | Kaneo API origin (default http://localhost:1337). Do not include /api. |
KANEO_MCP_CLIENT_ID | Device-flow client id (default kaneo-mcp). Must match DEVICE_AUTH_CLIENT_IDS on the server. |
Recommended (no global install): run the interactive installer with npx:
npx @kaneo/mcp
npm downloads the package, then an interactive menu (arrow keys + Enter) asks where to register the server (Cursor user-wide, Cursor project, Claude Desktop, or a custom JSON path). It then merges a mcpServers entry that points at this package’s dist/index.js with your current Node binary.
In a normal terminal, npx @kaneo/mcp and kaneo-mcp with no subcommand both start the installer. When the process is not attached to a TTY (for example when Cursor launches the MCP server with a pipe), the same entry runs the stdio MCP server instead.
To run the server manually from a shell (for example to debug stdio), use:
npx @kaneo/mcp serve
If you prefer a global install:
npm install -g @kaneo/mcp
kaneo-mcp
(kaneo-mcp install is the same installer with an explicit subcommand.)
Non-interactive example (Cursor user config, skip overwrite prompts):
kaneo-mcp install --target cursor-user -y
Point at a self-hosted API when generating the config:
kaneo-mcp install --target cursor-user -y --api-url https://kaneo.example.com
See all options:
kaneo-mcp install --help
If you are currently inside the local apps/mcp package directory, npm may resolve the local workspace package instead of the published one and fail to expose the bin. In that case, either run npx from outside apps/mcp, or use a local build:
node dist/index.js
The published package includes dist/. prepublishOnly runs the build before publish.
From the repo root:
pnpm install
pnpm --filter @kaneo/mcp run build
pnpm --filter @kaneo/mcp run start
pnpm --filter @kaneo/mcp run test
Or run it from the package directory:
pnpm -C apps/mcp run build
The CLI entry points to ./dist/index.js. Use npx @kaneo/mcp or kaneo-mcp after a global install so your IDE config points at the resolved path.
On the first tool call that needs Kaneo, the server:
POST /api/auth/device/codestderrPOST /api/auth/device/token until approved~/.config/kaneo-mcp/credentials.json with mode 0600whoami, list_workspaceslist_projects, get_project, create_project, update_projectlist_tasks, get_task, create_task, update_task, move_task, update_task_statuslist_task_comments, create_task_commentlist_workspace_labels, create_label, attach_label_to_task, detach_label_from_taskFAQs
Official MCP (Model Context Protocol) server for Kaneo, the open source project management platform: manage tasks, projects, and labels from Claude, Cursor, and other MCP clients
The npm package @kaneo/mcp receives a total of 71 weekly downloads. As such, @kaneo/mcp popularity was classified as not popular.
We found that @kaneo/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.

Security News
Anthropic found biased reasoning and recklessness drove Claude Mythos 5 to publish malware on PyPI and compromise a security vendor.

Research
/Security News
Malicious Chrome and Firefox extensions target Axiom Trade and Padre users, stealing session tokens and wallet data.

Security News
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.