
Security News
upm Launches as a Fast, Tiny Package Manager Written in TypeScript
upm uses Node.js to deliver fast npm installs in about 250 KB, with a JavaScript API and security defaults.
@tasklite/mcp
Advanced tools
TaskLite MCP server: build a full backend (projects, boards, data, REST endpoints), deploy a frontend onto it, and get a ready-made admin, from Claude Code and other MCP clients
A backend and an admin for apps built by AI agents. tasklite.net · docs
Describe a system and get the thing behind it: a project with typed tables and relations, rows, REST endpoints, an API key, and an admin interface the business itself operates afterwards. From Claude Code, Claude Desktop, ChatGPT, Gemini, Cursor or VS Code. Deploy a frontend onto it and hand the whole thing over.
Not the CLI task manager. There is an older, unrelated project also called TaskLite, ad-si/TaskLite at tasklite.org, a command-line task manager. This is a different product from a different author: a hosted backend at tasklite.net, published as
@tasklite/mcpand asnet.tasklite/mcpin the MCP registry.
Every tool declares readOnlyHint, destructiveHint and openWorldHint, so a
client can tell what is safe to run unattended.
| Area | Tools |
|---|---|
| Account | sign_up connect login disconnect connection_status list_organizations configure_external_access |
| Structure | create_project create_board create_column update_board update_column delete_board delete_column delete_project reorder_columns get_board_schema list_projects list_boards export_project |
| Data | query_items create_item update_item set_cell delete_item search fetch |
| Comments | list_comments add_comment update_comment delete_comment |
| Apps and API | build_backend create_app publish_app list_apps get_app_spec create_app_endpoint list_app_endpoints update_app_endpoint create_app_api_key |
| Frontend hosting | deploy_frontend list_deployments rollback_deployment get_frontend_prompt |
| Automation and push | create_automation list_automations push_status send_test_push |
build_backend is the one to reach for first: it takes a description of a
system and creates the project, the boards, their typed columns including the
relations between them, sample rows, and a published REST API with a key, in
one call, instead of a dozen.
Install the package (and Claude Code if you don't have it), then add the server
by its binary. That avoids a known Windows issue where claude mcp add
mis-parses npx -y.
npm install -g @anthropic-ai/claude-code @tasklite/mcp
claude mcp add tasklite -- tasklite-mcp
Add -s user to claude mcp add to make it available in every project
(claude mcp add -s user tasklite -- tasklite-mcp); the default scope is the
current project only.
Then tell Claude what you want to build. The sign_up tool creates your account, organization, and connection from the conversation (a strong random password is generated locally and never shown; use "forgot password" with your email for web access).
Already have an account? Create a key at TaskLite → Integrations → "Connect Claude Code" and use:
claude mcp add tasklite -e TASKLITE_API_KEY=tl_xxx -- tasklite-mcp
Point any MCP client at the hosted server; there is nothing to install locally:
claude mcp add --transport http tasklite https://mcp.tasklite.net/mcp \
--header "Authorization: Bearer tl_xxx"
The hosted server is stateless: every request carries its own credential, so one endpoint serves every account safely.
Simplest of all: the connector. In Claude (claude.ai or the desktop app), Settings → Connectors → add TaskLite, or add it by address using the URL above. You sign in once over OAuth; there is no key to create or store. Note that the tools appear in a new chat, not in the conversation you were already in.
Optional env: TASKLITE_API_URL (default https://api.tasklite.net), TASKLITE_APP_URL (default https://app.tasklite.net).
One hosted server, every MCP client. Full setup notes: https://tasklite.net/docs/guides/connector-from-cursor-codex-desktop
{"mcpServers":{"tasklite":{"url":"https://mcp.tasklite.net/mcp"}}} in .cursor/mcp.json..vscode/mcp.json with {"servers":{"tasklite":{"type":"http","url":"https://mcp.tasklite.net/mcp"}}}.https://mcp.tasklite.net/mcp. The server implements search and fetch.gemini extensions install https://github.com/shimon-ks/tasklite-mcp (this repo ships gemini-extension.json), or add httpUrl + oauth to ~/.gemini/settings.json.Authorization: Bearer tl_….create_project → create_board → create_column × N builds the schema.create_item / query_items seed and inspect data.create_app → create_app_endpoint (with exposedColumns + RLS) → create_app_api_key expose the REST surface for your frontend.get_app_spec / get_frontend_prompt generate the frontend against it.adminUrl, the ready-made admin for the end client.deploy_frontend puts a static frontend on https://{slug}.tasklite.dev.
No server, no hosting account, no CI to configure. Hand the site over in one
of three ways:
deploy_frontend(appId: "app-xxxxxx", files: [{ path: "index.html", content: "<!doctype html>…" }, { path: "app.js", content: "…" }])
deploy_frontend(appId: "app-xxxxxx", zipUrl: "https://github.com/you/site/releases/download/v1/dist.zip")
deploy_frontend(appId: "app-xxxxxx", dir: "./dist")
files is the path from ChatGPT or any hosted client: the assistant writes the
page and deploys it in the same turn. zipUrl takes an export from Lovable,
Bolt or a GitHub release. dir is for an MCP running on the machine with the
build output.
Hosted pages call the app API through the relative path /api/{endpoint}. The
hosting proxy attaches the app identity server-side, so the browser never
carries an API key. list_deployments shows the versions and
rollback_deployment points the live URL back at an earlier one.
tl_ key is exchanged for a short-lived JWT (POST /public/v1/auth/session); all calls run with the key owner's own permissions, never super-admin.tasklite.dev need no key at all.npm install
npm run build
TASKLITE_API_KEY=tl_xxx TASKLITE_API_URL=http://localhost:3333 node dist/index.js
MIT
FAQs
TaskLite MCP server: build a full backend (projects, boards, data, REST endpoints), deploy a frontend onto it, and get a ready-made admin, from Claude Code and other MCP clients
The npm package @tasklite/mcp receives a total of 245 weekly downloads. As such, @tasklite/mcp popularity was classified as not popular.
We found that @tasklite/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
upm uses Node.js to deliver fast npm installs in about 250 KB, with a JavaScript API and security defaults.

Company News
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.