
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
A Model Context Protocol (MCP) server for the Quire project management platform.
This server allows AI assistants (like Claude) to interact with your Quire projects, tasks, and data securely.
http://localhost:3000/callbackChoose the setup that matches your MCP client:
Add to your claude_desktop_config.json:
macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
Windows: %APPDATA%\Claude\claude_desktop_config.json
{
"mcpServers": {
"quire": {
"command": "npx",
"args": ["-y", "quire-mcp"],
"env": {
"QUIRE_OAUTH_CLIENT_ID": "your-client-id",
"QUIRE_OAUTH_CLIENT_SECRET": "your-client-secret"
}
}
}
}
Add to your Claude Code MCP settings (~/.claude/mcp.json or project-level):
{
"mcpServers": {
"quire": {
"command": "npx",
"args": ["-y", "quire-mcp"],
"env": {
"QUIRE_OAUTH_CLIENT_ID": "your-client-id",
"QUIRE_OAUTH_CLIENT_SECRET": "your-client-secret"
}
}
}
}
In Cursor settings, add an MCP server:
{
"mcpServers": {
"quire": {
"command": "npx",
"args": ["-y", "quire-mcp"],
"env": {
"QUIRE_OAUTH_CLIENT_ID": "your-client-id",
"QUIRE_OAUTH_CLIENT_SECRET": "your-client-secret"
}
}
}
}
On first use, the server will:
Subsequent uses will automatically refresh tokens as needed.
The server supports two transport modes: stdio (default) and http.
STDIO mode is the simplest setup. The MCP client spawns the server process directly and communicates via JSON-RPC over stdin/stdout.
How it works:
npx quire-mcp with environment variableslocalhost:3000/callback where the server captures the tokenToken cache locations:
%APPDATA%\quire-mcp\tokens.json~/Library/Application Support/quire-mcp/tokens.json~/.config/quire-mcp/tokens.jsonHTTP mode runs an HTTP server with OAuth 2.0 endpoints. Use this when you need:
Important: In HTTP mode, the server must be running before clients can connect. Environment variables are set on the server process, not in client configs.
Step 1: Start the server:
# Using npx
QUIRE_OAUTH_CLIENT_ID=your-client-id \
QUIRE_OAUTH_CLIENT_SECRET=your-client-secret \
MCP_TRANSPORT=http \
npx quire-mcp
# Or using pnpm (for development)
pnpm dev:http
The server will output:
[quire-mcp] HTTP server listening on 127.0.0.1:3001
[quire-mcp] OAuth metadata: http://localhost:3001/.well-known/oauth-authorization-server
[quire-mcp] MCP endpoint: http://localhost:3001/mcp
Step 2: Configure your MCP client to connect:
{
"mcpServers": {
"quire": {
"type": "http",
"url": "http://localhost:3001/mcp"
}
}
}
Note: No env section is needed in the client config for HTTP mode—the OAuth credentials are on the server.
Step 3: When the MCP client connects, it will:
/.well-known/oauth-authorization-server| Variable | Required | Default | Description |
|---|---|---|---|
MCP_TRANSPORT | Yes | stdio | Set to http to enable HTTP mode |
QUIRE_OAUTH_CLIENT_ID | Yes | - | Quire OAuth Client ID |
QUIRE_OAUTH_CLIENT_SECRET | Yes | - | Quire OAuth Client Secret |
MCP_SERVER_HOST | No | 127.0.0.1 | Host to bind the HTTP server |
MCP_SERVER_PORT | No | 3001 | Port for the HTTP server |
MCP_ISSUER_URL | No | http://localhost:3001 | Base URL for OAuth endpoints |
QUIRE_OAUTH_REDIRECT_URI | No | http://localhost:3001/oauth/callback | Quire OAuth callback URL |
Quire App Configuration for HTTP Mode:
When using HTTP mode, update your Quire app's redirect URL to: http://localhost:3001/oauth/callback
If you have a pre-obtained access token (e.g., from Postman), you can skip OAuth entirely:
{
"mcpServers": {
"quire": {
"command": "npx",
"args": ["-y", "quire-mcp"],
"env": {
"QUIRE_ACCESS_TOKEN": "your-access-token"
}
}
}
}
Note: Manually-obtained tokens will eventually expire and won't auto-refresh without OAuth credentials.
| Variable | Required | Default | Description |
|---|---|---|---|
QUIRE_OAUTH_CLIENT_ID | Yes* | - | Quire OAuth Client ID |
QUIRE_OAUTH_CLIENT_SECRET | Yes* | - | Quire OAuth Client Secret |
QUIRE_ACCESS_TOKEN | No | - | Manual token override (skips OAuth flow) |
QUIRE_OAUTH_REDIRECT_URI | No | http://localhost:3000/callback | OAuth callback URL (stdio mode) |
QUIRE_TOKEN_STORE_PATH | No | Platform default | Path to token cache file |
MCP_TRANSPORT | No | stdio | Transport mode: stdio or http |
MCP_SERVER_HOST | No | 127.0.0.1 | HTTP server bind address |
MCP_SERVER_PORT | No | 3001 | HTTP server port |
MCP_ISSUER_URL | No | http://localhost:3001 | OAuth issuer URL (HTTP mode) |
*Required unless QUIRE_ACCESS_TOKEN is set.
The server provides 60+ tools organized by category:
| Tool | Description |
|---|---|
quire.whoami | Get the current authenticated user's profile |
| Tool | Description |
|---|---|
quire.listOrganizations | List all accessible organizations |
quire.getOrganization | Get organization details by ID or OID |
quire.updateOrganization | Update organization followers |
| Tool | Description |
|---|---|
quire.listProjects | List all projects, optionally filtered by organization |
quire.getProject | Get project details including task counts |
quire.updateProject | Update project name, description, icon, and followers |
quire.exportProject | Export project tasks in JSON or CSV format |
| Tool | Description |
|---|---|
quire.listTasks | List tasks in a project (root-level or subtasks) |
quire.getTask | Get task details by project+ID or OID |
quire.createTask | Create a new task with optional priority, dates, assignees, tags |
quire.updateTask | Update task properties |
quire.deleteTask | Delete a task and its subtasks |
quire.searchTasks | Search tasks in a project by keyword and filters |
quire.createTaskAfter | Create a task after a specified task |
quire.createTaskBefore | Create a task before a specified task |
quire.searchFolderTasks | Search tasks within a folder |
quire.searchOrganizationTasks | Search tasks across an entire organization |
| Tool | Description |
|---|---|
quire.listTags | List all tags in a project |
quire.getTag | Get tag details by OID |
quire.createTag | Create a new tag with name and color |
quire.updateTag | Update tag name or color |
quire.deleteTag | Delete a tag |
| Tool | Description |
|---|---|
quire.listTaskComments | List all comments on a task |
quire.addTaskComment | Add a comment to a task |
quire.updateComment | Update comment text |
quire.deleteComment | Delete a comment |
quire.listChatComments | List all comments in a chat channel |
quire.addChatComment | Add a comment to a chat channel |
| Tool | Description |
|---|---|
quire.getUser | Get user details by ID, OID, or email |
quire.listUsers | List all accessible users |
quire.listProjectMembers | List all members of a project |
| Tool | Description |
|---|---|
quire.listStatuses | List custom statuses in a project |
quire.getStatus | Get status details by value |
quire.createStatus | Create a custom workflow status |
quire.updateStatus | Update status name or color |
quire.deleteStatus | Delete a custom status |
| Tool | Description |
|---|---|
quire.getPartner | Get external team details |
quire.listPartners | List all external teams in a project |
| Tool | Description |
|---|---|
quire.createDocument | Create a document in an organization or project |
quire.getDocument | Get document content and metadata |
quire.listDocuments | List all documents |
quire.updateDocument | Update document name or content |
quire.deleteDocument | Delete a document |
| Tool | Description |
|---|---|
quire.createSublist | Create a sublist |
quire.getSublist | Get sublist details |
quire.listSublists | List all sublists |
quire.updateSublist | Update sublist name or description |
quire.deleteSublist | Delete a sublist |
| Tool | Description |
|---|---|
quire.createChat | Create a chat channel |
quire.getChat | Get chat channel details |
quire.listChats | List all chat channels |
quire.updateChat | Update chat name, description, or members |
quire.deleteChat | Delete a chat channel |
| Tool | Description |
|---|---|
quire.getStorageValue | Get a stored value by key |
quire.listStorageEntries | List storage entries by prefix |
quire.putStorageValue | Store a value |
quire.deleteStorageValue | Delete a stored value |
| Tool | Description |
|---|---|
quire.sendNotification | Send notification to users |
| Tool | Description |
|---|---|
quire.uploadTaskAttachment | Upload a file attachment to a task |
quire.uploadCommentAttachment | Upload a file attachment to a comment |
The server exposes data as MCP resources:
| Resource URI | Description |
|---|---|
quire://user/me | Current authenticated user's profile |
quire://organizations | List of all accessible organizations |
quire://projects | List of all accessible projects |
| Resource URI | Description |
|---|---|
quire://project/{id} | Specific project details and metadata |
quire://project/{projectId}/tasks | Root tasks in a project |
quire://project/{projectId}/tags | Tags defined in a project |
quire://project/{projectId}/statuses | Custom statuses in a project |
The server provides guided prompts for common workflows:
| Prompt | Description |
|---|---|
quire.create-project-plan | Generate a task plan from a goal description |
quire.daily-standup | Generate a daily standup summary |
quire.sprint-planning | Plan a sprint from the backlog |
quire.task-breakdown | Break down a complex task into subtasks |
quire.weekly-summary | Generate a weekly progress report |
# Clone the repo
git clone https://github.com/jacob-hartmann/quire-mcp.git
cd quire-mcp
# Use the Node.js version from .nvmrc
# (macOS/Linux nvm): nvm install && nvm use
# (Windows nvm-windows): nvm install 22 && nvm use 22
nvm install
nvm use
# Install dependencies
pnpm install
# Copy .env.example and configure
cp .env.example .env
# Edit .env with your OAuth credentials
# Development mode (stdio, auto-reload)
pnpm dev
# Development mode (http, auto-reload)
pnpm dev:http
# Production build
pnpm build
# Production run
pnpm start # stdio mode
pnpm start:http # http mode
You can use the MCP Inspector to debug the server:
# Run from source
pnpm inspect
# Run from built output
pnpm inspect:dist
pnpm inspect loads .env automatically via dotenv (see .env.example).
If you see Ignored build scripts: esbuild..., run pnpm approve-builds and allow esbuild.
In CI we install dependencies with lifecycle scripts disabled (pnpm install --ignore-scripts) and then explicitly rebuild only esbuild for the production build job.
Contributions are welcome! Please see CONTRIBUTING.md for guidelines on how to contribute to this project.
See SECURITY.md for security policy and reporting vulnerabilities.
This is a community project provided "as is" with no guaranteed support. See SUPPORT.md for details.
MIT © Jacob Hartmann
FAQs
Model Context Protocol (MCP) server for Quire project management
The npm package quire-mcp receives a total of 8 weekly downloads. As such, quire-mcp popularity was classified as not popular.
We found that quire-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.