
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@task-shepherd/mcp
Advanced tools
Model Context Protocol tools for Task Shepherd - allows AI agents to access GraphQL API
Model Context Protocol server providing Claude Code with direct access to Task Shepherd's project management capabilities. Perfect for AI-powered development workflows and automated project management.
# No installation needed - always uses latest version
npx @task-shepherd/mcp
# Install globally for permanent CLI access
npm install -g @task-shepherd/mcp
# Then use directly
task-shepherd-mcp
Note: npx is recommended as it ensures you're always using the latest version without managing global installations.
Get your Task Shepherd API key from your instance dashboard:
Your Dashboard → Settings → API Keys → Create New Key
export TASK_SHEPHERD_GRAPHQL_ENDPOINT="https://your-instance.taskshepherd.com/graphql"
export TASK_SHEPHERD_API_KEY="tks_your_api_key_here"
task-shepherd-mcp
Add to your Claude Code MCP configuration (~/.claude/config.json):
Using npx (recommended):
{
"mcpServers": {
"task-shepherd": {
"command": "npx",
"args": ["@task-shepherd/mcp"],
"env": {
"TASK_SHEPHERD_GRAPHQL_ENDPOINT": "https://your-instance.taskshepherd.com/graphql",
"TASK_SHEPHERD_API_KEY": "tks_your_api_key"
}
}
}
}
Using global install:
{
"mcpServers": {
"task-shepherd": {
"command": "task-shepherd-mcp",
"env": {
"TASK_SHEPHERD_GRAPHQL_ENDPOINT": "https://your-instance.taskshepherd.com/graphql",
"TASK_SHEPHERD_API_KEY": "tks_your_api_key"
}
}
}
}
claude --mcp task-shepherd
# Now Claude has access to all Task Shepherd tools!
The MCP server supports multiple Task Shepherd organizations automatically. When you use the Task Shepherd agent (@task-shepherd/agent), the MCP server will:
~/.task-shepherd-agent/config.json (customizable via AGENT_CONFIG_DIR){
"mcpServers": {
"task-shepherd": {
"command": "npx",
"args": ["@task-shepherd/mcp"],
"env": {
"AGENT_CONFIG_DIR": "/custom/path"
}
}
}
}
# List available organizations
list_organizations
# Set default organization for operations
set_default_organization --organizationId "production"
All tools now accept an optional organizationId parameter:
# List projects from specific organization
list_projects --organizationId "production" --limit 10
# Create project in specific organization
create_project --organizationId "staging" --name "Test Project"
The agent creates a multi-org config like this:
{
"defaultOrganization": "default",
"organizations": {
"default": {
"name": "Default Organization",
"apiUrl": "http://default.dev.taskshepherd.local/api/graphql",
"apiKey": "tks_user_xxx",
"enabled": true
},
"production": {
"name": "Production Environment",
"apiUrl": "https://prod.taskshepherd.com/api/graphql",
"apiKey": "tks_prod_xxx",
"enabled": true
}
}
}
Claude can directly interact with your Task Shepherd instance - no intermediate services or complexity.
Full access to projects, stories, tasks, and work assignment capabilities across multiple organizations.
No caching, state management, or data transformation - everything goes directly to the Task Shepherd API.
Uses your Task Shepherd API keys with proper scoping and permissions per organization.
All operations happen in real-time against your live Task Shepherd data.
# List all projects
list_projects
# Get specific project with stories
get_project --id "project-123"
# Create new project
create_project --name "New Project" --description "Project description"
# Update project details
update_project --id "project-123" --stage "DEVELOPMENT"
# List stories for a project
list_stories --projectId "project-123"
# Get story with tasks
get_story --id "story-456"
# Create new story
create_story --projectId "project-123" --title "User Authentication"
# Claim story for implementation
claim_story --id "story-456"
# Mark story complete
complete_story --id "story-456" --implementationSummary "Added JWT authentication..."
# List tasks for a story
list_tasks --storyId "story-456"
# Get task details
get_task --id "task-789"
# Create new task
create_task --storyId "story-456" --title "Create login form" --areas "frontend,react"
# Claim task
claim_task --id "task-789"
# Complete task
complete_task --id "task-789" --implementationSummary "Created login form component"
# Find available work to claim
get_available_work --projectId "project-123" --areas "frontend,backend"
# Claude can analyze a codebase and create tasks
claude "Analyze this React project and create appropriate stories and tasks in Task Shepherd"
# Claude will:
# 1. Use get_project to understand the project structure
# 2. Use create_story to break down features
# 3. Use create_task to define implementation steps
# 4. Use update_project to reflect current status
# Claude can manage development workflow
claude "Find available frontend tasks and provide implementation guidance"
# Claude will:
# 1. Use get_available_work to find unclaimed tasks
# 2. Use claim_task to assign work
# 3. Provide implementation guidance
# 4. Use complete_task when implementation is done
# Claude can help with project planning
claude "Review project requirements and suggest a development plan"
# Claude will:
# 1. Use get_project to understand current state
# 2. Use list_stories to review planned features
# 3. Use create_story for missing requirements
# 4. Use update_project to reflect planning decisions
# Required: Task Shepherd API endpoint
TASK_SHEPHERD_GRAPHQL_ENDPOINT="https://api.taskshepherd.com/graphql"
# Required: API key for authentication
TASK_SHEPHERD_API_KEY="tks_your_api_key"
# Optional: Enable debug logging
DEBUG=mcp:*
For Claude Desktop, add to your MCP configuration:
Using npx (recommended):
{
"mcpServers": {
"task-shepherd": {
"command": "npx",
"args": ["@task-shepherd/mcp"],
"env": {
"TASK_SHEPHERD_GRAPHQL_ENDPOINT": "https://your-instance.taskshepherd.com/graphql",
"TASK_SHEPHERD_API_KEY": "tks_your_api_key"
}
}
}
}
Using global install:
{
"mcpServers": {
"task-shepherd": {
"command": "task-shepherd-mcp",
"env": {
"TASK_SHEPHERD_GRAPHQL_ENDPOINT": "https://your-instance.taskshepherd.com/graphql",
"TASK_SHEPHERD_API_KEY": "tks_your_api_key"
}
}
}
}
For Claude Code CLI, add to ~/.claude/config.json:
Using npx (recommended):
{
"mcpServers": {
"task-shepherd": {
"command": "npx",
"args": ["@task-shepherd/mcp"],
"env": {
"TASK_SHEPHERD_GRAPHQL_ENDPOINT": "https://your-instance.taskshepherd.com/graphql",
"TASK_SHEPHERD_API_KEY": "tks_your_api_key"
}
}
}
}
Using global install:
{
"mcpServers": {
"task-shepherd": {
"command": "task-shepherd-mcp",
"env": {
"TASK_SHEPHERD_GRAPHQL_ENDPOINT": "https://your-instance.taskshepherd.com/graphql",
"TASK_SHEPHERD_API_KEY": "tks_your_api_key"
}
}
}
}
The MCP server connects directly to your Task Shepherd GraphQL API:
# Test your connection
curl -X POST \
-H "Content-Type: application/json" \
-H "X-API-Key: $TASK_SHEPHERD_API_KEY" \
-d '{"query": "query { __typename }"}' \
$TASK_SHEPHERD_GRAPHQL_ENDPOINT
All requests use your API key for authentication:
Claude Code → MCP Server → Task Shepherd GraphQL API → Database
All operations are real-time and directly modify your Task Shepherd data.
# Test GraphQL endpoint
curl -X POST -H "Content-Type: application/json" \
-H "X-API-Key: $TASK_SHEPHERD_API_KEY" \
-d '{"query": "query { __typename }"}' \
$TASK_SHEPHERD_GRAPHQL_ENDPOINT
# Should return: {"data": {"__typename": "Query"}}
# Verify API key format
echo $TASK_SHEPHERD_API_KEY
# Should start with "tks_"
# Check API key permissions in Task Shepherd dashboard
# Ensure key has required scopes for your operations
# Test MCP server directly
npx @task-shepherd/mcp
# or if globally installed: task-shepherd-mcp
# Enable debug logging
DEBUG=mcp:* npx @task-shepherd/mcp
# Check Claude Code can see the tools
claude --mcp task-shepherd --list-tools
# Install dependencies
npm install
# Build with bundling (ESM + esbuild)
npm run build
# Run in development mode
npm run dev
# Run tests
npm run test
# Type checking
npm run type-check
"type": "module")@task-shepherd/shared and zod inline@modelcontextprotocol/sdk, graphql, and graphql-request remain external@task-shepherd/mcp@x.y.z), CI handles npm publishing# After code changes, update Task Shepherd
claude "I just implemented user authentication. Update the relevant tasks in Task Shepherd as complete."
# Review code and create improvement tasks
claude "Review this pull request and create tasks for any issues found."
# Plan new features
claude "Analyze these requirements and create a complete project plan in Task Shepherd."
Proprietary software - see LICENSE.md for usage terms.
DEBUG=mcp:* npx @task-shepherd/mcpclaude --mcp task-shepherd --list-toolsFAQs
Model Context Protocol tools for Task Shepherd - allows AI agents to access GraphQL API
We found that @task-shepherd/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.