
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
task-master-sync
Advanced tools
A bidirectional synchronization tool between TaskMaster AI and Monday.com with automatic item recreation
A command-line synchronization tool for TaskMaster AI and Monday.com, designed for DevOps workflows.
This CLI tool bridges the gap between AI-driven task management (TaskMaster AI) and collaborative project tracking on Monday.com. It's particularly useful for DevOps workflows, CI/CD pipelines, and automating task synchronization between developers and project managers.
For developers using Cursor IDE, an MCP configuration file is required to enable TaskMaster AI integration. Follow these steps:
.cursor directory in your project root (if it doesn't already exist):mkdir -p .cursor
mcp.json file inside the .cursor directory with your API keys:touch .cursor/mcp.json
mcp.json file. You can use the provided example file as a reference:# Option 1: Copy the example file
cp .cursor/example-mcp.json .cursor/mcp.json
# Option 2: Create your own based on the template below
Basic configuration template:
{
"mcpServers": {
"task-master-ai": {
"command": "npx",
"args": [
"-y",
"--package=task-master-ai",
"task-master-ai"
],
"env": {
"ANTHROPIC_API_KEY": "your-anthropic-api-key-here",
"PERPLEXITY_API_KEY": "your-perplexity-api-key-here",
"MODEL": "claude-3-7-sonnet-20250219",
"PERPLEXITY_MODEL": "sonar",
"MAX_TOKENS": 64000,
"TEMPERATURE": 0.2,
"DEFAULT_SUBTASKS": 5,
"DEFAULT_PRIORITY": "medium"
}
}
}
}
You need at least one of these API keys depending on which AI provider you prefer:
ANTHROPIC_API_KEY: Required for using Claude models (recommended)PERPLEXITY_API_KEY: Required for research-backed operationsYou can also add these optional API keys for alternative providers:
OPENAI_API_KEY: For using OpenAI modelsGOOGLE_API_KEY: For using Google AI modelsMISTRAL_API_KEY: For using Mistral AI modelsOPENROUTER_API_KEY: For using OpenRouter's model routerMODEL: Primary model for task generation (default: "claude-3-7-sonnet-20250219")PERPLEXITY_MODEL: Model for research operations (default: "sonar")MAX_TOKENS: Maximum tokens for model responses (default: 64000)TEMPERATURE: Controls randomness in responses (lower values = more deterministic, default: 0.2)DEFAULT_SUBTASKS: Default number of subtasks when expanding tasks (default: 5)DEFAULT_PRIORITY: Default priority for new tasks (default: "medium")Important: The
mcp.jsonfile contains sensitive API keys and should not be committed to your repository. It is already added to.gitignore.
TaskMaster-Monday Sync v0.2.0+ features robust bidirectional synchronization with automatic item recreation:
When pushing tasks from TaskMaster to Monday.com:
When pulling items from Monday.com to TaskMaster:
recreateMissingTasks option (default: true) controls this behaviorAdditional configuration options for bidirectional sync:
# Push sync with deletion of orphaned Monday items (default)
taskmaster-sync push
# Push sync without deletion of orphaned Monday items
taskmaster-sync push --no-delete-orphaned
# Pull sync with automatic recreation of missing tasks (default)
taskmaster-sync pull
# Pull sync without recreation of missing tasks
taskmaster-sync pull --no-recreate-missing-tasks
For more details on the bidirectional sync implementation, see README-BidirectionalSync.md.
# Install globally
npm install -g task-master-sync
# Or use directly with npx
npx task-master-sync ...
# Option 1: Using environment variables
export MONDAY_API_KEY="your_api_key_here"
export MONDAY_BOARD_ID="your_board_id_here"
npm run get-columns
# Option 2: Using command-line arguments
npm run get-columns -- --api-key="your_api_key_here" --board-id="your_board_id_here"
# Option 3: Using the global command
taskmaster-sync-get-columns --api-key="your_api_key_here" --board-id="your_board_id_here"
cp sync-config.example.json sync-config.json
Create a sync-config.json file in your project root:
{
"monday_board_id": "your_board_id",
"monday_group_ids": ["your_group_id"],
"monday_api_key": "your_api_key",
"developer_id": "your_unique_id",
"column_mappings": {
"taskId": "text_column_id",
"status": "status_column_id",
"priority": "priority_column_id",
"dependencies": "text_column_id",
"complexity": "color_column_id",
"description": "long_text_column_id",
"details": "long_text_column_id",
"testStrategy": "long_text_column_id"
},
"status_mappings": {
"pending": "pending",
"in-progress": "in-progress",
"done": "done"
},
"priority_mappings": {
"high": "high",
"medium": "medium",
"low": "low"
}
}
Alternatively, you can set your Monday.com API key as an environment variable:
export MONDAY_API_KEY=your_api_key
The column_mappings object in your configuration maps TaskMaster task fields to Monday.com column IDs. These column IDs are specific to your Monday.com board and can be found in the board settings or using the Monday.com API.
For each field, provide the corresponding Monday.com column ID:
| Field | Description | Monday.com Column Type |
|---|---|---|
taskId | The TaskMaster task ID | Text column |
status | Task status (pending, in-progress, done, etc.) | Status column |
priority | Task priority (high, medium, low) | Status column |
dependencies | Comma-separated list of dependent task IDs | Text column |
complexity | Task complexity (1-10) | Status column |
description | Task description | Long text column |
details | Implementation details | Long text column |
testStrategy | Testing strategy | Long text column |
To help you find the column IDs for your Monday.com board, we've included a utility command:
# If installed globally
taskmaster-sync-get-columns
# If installed locally in your project
npx taskmaster-sync-get-columns
# Or using npm script
npm run get-columns
This command will:
Make sure you have a valid sync-config.json with your monday_board_id and monday_api_key before running this command.
# If installed globally
taskmaster-sync --help
# If installed locally in your project
npx taskmaster-sync --help
# View command-specific help
taskmaster-sync push --help
taskmaster-sync pull --help
# Display current configuration
taskmaster-sync config
Push your local TaskMaster tasks to Monday.com.
taskmaster-sync push [options]
| Option | Description | Default |
|---|---|---|
-d, --dry-run | Show what would be synced without making changes | false |
-v, --verbose | Increase logging detail | false |
-c, --config <path> | Path to sync config file | sync-config.json |
-t, --tasks <path> | Path to tasks.json file | tasks/tasks.json |
-s, --state <path> | Path to sync state file | .taskmaster_sync_state.json |
# Basic push with default options
taskmaster-sync push
# Dry run to preview changes
taskmaster-sync push --dry-run
# Use a custom tasks file
taskmaster-sync push --tasks custom-tasks/tasks.json
# Enable verbose logging
taskmaster-sync push --verbose
Pull Monday.com items to your local TaskMaster tasks.
taskmaster-sync pull [options]
| Option | Description | Default |
|---|---|---|
-d, --dry-run | Show what would be synced without making changes | false |
-v, --verbose | Increase logging detail | false |
-c, --config <path> | Path to sync config file | sync-config.json |
-t, --tasks <path> | Path to tasks.json file | tasks/tasks.json |
-s, --state <path> | Path to sync state file | .taskmaster_sync_state.json |
-a, --assign-task-ids | Automatically assign Task IDs to new Monday.com items | false |
-f, --force | Overwrite local changes with Monday.com data | false |
--skip-conflicts | Skip tasks with local changes | false |
--task-id <id> | Pull only a specific task by ID | |
--group <group_id> | Pull from a specific Monday.com group | |
--regenerate | Regenerate task files after pull | true |
--remove-orphaned | Remove orphaned local tasks | true |
--no-remove-orphaned | Keep orphaned local tasks | |
--recreate-missing-tasks | Recreate tasks that exist in Monday but not locally | true |
--no-recreate-missing-tasks | Don't recreate missing tasks |
MIT
# Clone the repository
git clone https://github.com/yourusername/task-master-sync.git
cd task-master-sync
# Install dependencies
npm install
# Run tests
npm test
# Try the CLI locally
node src/cli/index.js --help
The package doesn't require a build step as it uses plain JavaScript. However, before publishing:
package.jsonfiles field in package.json includes all necessary filesFor Integrity Internal use - check the password manager for the npm username/password and publish token.
# Login to npm (only needed once)
npm login
# Test the package contents that would be published
npm pack
# Review the generated .tgz file to ensure it contains the correct files
tar -tf task-master-sync-*.tgz
# Run the prepublish checks (linting and tests)
npm run prepublishOnly
# Publish to npm
npm publish
# For testing with a specific version before publishing publicly
npm publish --tag beta
You can automate publishing using GitHub Actions by adding a workflow file:
# .github/workflows/publish.yml
name: Publish to npm
on:
release:
types: [created]
jobs:
publish:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- uses: actions/setup-node@v3
with:
node-version: '20.x'
registry-url: 'https://registry.npmjs.org'
- run: npm ci
- run: npm test
- run: npm publish
env:
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
Remember to add an NPM_TOKEN secret in your GitHub repository settings.
# Create a global symlink
npm link
# In another project, use the linked package
npm link task-master-sync
# Run the commands from your development version
taskmaster-sync --help
FAQs
A bidirectional synchronization tool between TaskMaster AI and Monday.com with automatic item recreation
The npm package task-master-sync receives a total of 0 weekly downloads. As such, task-master-sync popularity was classified as not popular.
We found that task-master-sync demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.