A Model Context Protocol (MCP) server for interacting with Microsoft 365 and Office services through the Graph API
Nothing to run from here
Yandex Tracker is installed from its publisher's own source and answers where it runs, so this marketplace is not in the path of a single call. There is no address here to send one to, and a panel that pretended otherwise would be showing you an answer we made up. Install it and call it from your own client — the Installation tab has the entry for each one.
94/100
trust score
4
downloads a day
local
runs on your machine
1k
downloads in 30d
What it does
MCP server for Yandex Tracker: full API v3 coverage (187 tools)
Quickstart
# 1 — add it to Claude Code
claude mcp add --scope user --env 'TRACKER_TOKEN=${TRACKER_TOKEN}' --env 'TRACKER_ORG_ID=${TRACKER_ORG_ID}' --transport stdio sdamarketing-yandex-tracker-mcp '--' npx -y tracker-mcp
# 2 — ask your agent for something these tools do
# search_entities, get_entity, create_entity and 184 more
It needs TRACKER_TOKEN, TRACKER_ORG_ID: this reads them from your environment, so export them first.
Yandex Tracker costs nothing on mcprush: there is no plan to choose here, no cap to set and nothing mcprush can bill you for.
Publishernot claimed
SDAll 2 servers
sdamarketing2 servers
2 categories
Collected from a public index. Nobody has claimed this account, so nothing here was written by its author — claim it if it is yours.
Installation
Where are you running it?
Every route below installs the same thing and ends at the same approval screen. This one runs on your machine: your client starts Yandex Tracker as a process under your own user, with your files and your network, so the tool surface below is what it can do to your computer rather than to a server somewhere else. Its scan result is on the Security tab — read the surface before you approve it.
Claude Codedeclared by this listing
This is a public server: you run it yourself and this marketplace is not in the path. You need Node.js — the current LTS (24) is the safe choice; npx comes with it. Claude Code registers it in one command; --scope user makes it available in every project. Claude Code reads TRACKER_TOKEN (OAuth-токен Яндекс 360 (y0_...) или IAM-токен Yandex Cloud (t1....)), TRACKER_ORG_ID (ID организации (Яндекс 360 или Yandex Cloud)) from your environment each time it starts the server, so the value stays out of its config: export them in your shell profile (macOS, Linux), or run setx TRACKER_TOKEN …, setx TRACKER_ORG_ID … and open a new terminal (Windows). The '--' is in quotes so that PowerShell passes it on.
claude mcp add --scope user --env 'TRACKER_TOKEN=${TRACKER_TOKEN}' --env 'TRACKER_ORG_ID=${TRACKER_ORG_ID}' --transport stdio sdamarketing-yandex-tracker-mcp '--' npx -y tracker-mcpReconnect, or start a new session, and the tools appear in the model’s tool list.
Free on mcprush, and it runs from its publisher’s own package: this marketplace is not in the path, so there is no key of ours to hold and no card to add.
What it asks of you
It reaches a system of yours, so it needs your own credential rather than the publisher’s: TRACKER_TOKEN — OAuth-токен Яндекс 360 (y0_...) или IAM-токен Yandex Cloud (t1....); TRACKER_ORG_ID — ID организации (Яндекс 360 или Yandex Cloud). You set them in your own client’s config, on your machine — this marketplace never holds it.
What it writes
One config entry your client uses to start the process locally. A local server runs with your file system and your network, which is why it is priced without metering.
What you approve
187 tools, with what each one reads, writes and reaches shown before you agree — the same list on every route above. Read the tool surface.
Tool surface
What the model actually sees. Descriptions are diffed on every release — see version history.
Search projects, portfolios or goals. Filter by name substring, field values or
No parameter schema on file.
Get a project, portfolio or goal by id (use search_entities to find ids).
No parameter schema on file.
Create a project, portfolio or goal.
No parameter schema on file.
Update a project, portfolio or goal by id.
No parameter schema on file.
Delete a project, portfolio or goal by id.
No parameter schema on file.
Add a comment to a project, portfolio or goal.
No parameter schema on file.
List comments of a project, portfolio or goal.
No parameter schema on file.
Get one comment of a project, portfolio or goal.
No parameter schema on file.
Edit a comment of a project, portfolio or goal.
No parameter schema on file.
Delete a comment of a project, portfolio or goal.
No parameter schema on file.
Create a checklist or append items to a project/portfolio checklist.
No parameter schema on file.
Bulk-edit ALL checklist items of a project/portfolio (item count cannot change;
No parameter schema on file.
Edit a single checklist item of a project/portfolio.
No parameter schema on file.
Move a checklist item of a project/portfolio before another item.
No parameter schema on file.
Delete all checklist items of a project/portfolio.
No parameter schema on file.
Delete one checklist item of a project/portfolio.
No parameter schema on file.
List files attached to a project, portfolio or goal.
No parameter schema on file.
Get metadata of one file attached to a project, portfolio or goal.
No parameter schema on file.
Attach a temporary file (from upload_temp_attachment) to a project, portfolio or goal.
No parameter schema on file.
Delete a file from a project, portfolio or goal.
No parameter schema on file.
Link a project/portfolio/goal to other entities. Relationships:
No parameter schema on file.
List entity links of a project, portfolio or goal.
No parameter schema on file.
Unlink an entity from another entity (by the linked entity id).
No parameter schema on file.
Event history of a project, portfolio or goal (relative pagination: pass the
No parameter schema on file.
Bulk update projects, portfolios or goals: fields, comment and links at once.
No parameter schema on file.
Get extended access settings of an entity, including inheritance sources.
No parameter schema on file.
Update extended access settings: enable/disable inheritance (permissionSources)
No parameter schema on file.
Get direct access permissions (READ/GRANT/WRITE) of an entity.
No parameter schema on file.
Grant/revoke direct permissions on an entity. roles: AUTHOR|OWNER|CLIENT|FOLLOWER|MEMBER.
No parameter schema on file.
List queues of the organization.
No parameter schema on file.
Get queue parameters by key or id.
No parameter schema on file.
Create a new queue. Requires key, name, lead, default type/priority and an
No parameter schema on file.
Get fields available/required for issues of the queue (includes required flags
No parameter schema on file.
List versions of a queue.
No parameter schema on file.
Create a version in a queue.
No parameter schema on file.
Create a component in a queue.
No parameter schema on file.
List components of a queue.
No parameter schema on file.
List local (queue-specific) issue fields of a queue. Field ids look like
No parameter schema on file.
List macroes of a queue (saved bundles of field updates + comment text).
No parameter schema on file.
List tags used in a queue.
No parameter schema on file.
List triggers configured in a queue.
No parameter schema on file.
List autoactions configured in a queue.
No parameter schema on file.
Get parameters of one autoaction.
No parameter schema on file.
Create an autoaction: periodically updates issues matching filter/query.
No parameter schema on file.
Autoaction run logs. Without runId — list of launches; with runId — one launch
No parameter schema on file.
Delete a queue (only when empty of issues). Only queue owner or Tracker admin can.
No parameter schema on file.
Restore a deleted queue (Tracker admin only).
No parameter schema on file.
Remove a tag from a queue (must not be used in any issue; admin only).
No parameter schema on file.
Change queue access rights: create/write/read/grant/deny with users, groups
No parameter schema on file.
Get user permissions in a queue.
No parameter schema on file.
Get group permissions in a queue.
No parameter schema on file.
Create a local (queue-specific) issue field.
No parameter schema on file.
Get one local field of a queue by its key.
No parameter schema on file.
Edit a local field of a queue: name, category, options, visibility.
No parameter schema on file.
List all components of the organization.
No parameter schema on file.
Get one component by id.
No parameter schema on file.
Edit a component: name, description, owner, default assignee. version = component version.
No parameter schema on file.
Delete a component by id.
No parameter schema on file.
Get user permissions for a component.
No parameter schema on file.
Get group permissions for a component.
No parameter schema on file.
Get one queue version by id.
No parameter schema on file.
Edit a queue version: name, description, dates.
No parameter schema on file.
Delete a queue version by id.
No parameter schema on file.
Get one trigger of a queue.
No parameter schema on file.
Create a queue trigger. actions: Transition/Update/CreateComment/Webhook/CalculateFormula/…
No parameter schema on file.
Edit a trigger: name, actions, conditions, position (version = trigger version).
No parameter schema on file.
Webhook-action execution logs of a trigger (optionally for one issue, time range).
No parameter schema on file.
Get one macro of a queue.
No parameter schema on file.
Create a queue macro: comment body and/or issue field updates applied on run.
No parameter schema on file.
Edit a queue macro: name, comment body, issue updates.
No parameter schema on file.
Delete a queue macro.
No parameter schema on file.
List files attached to an issue and its comments.
No parameter schema on file.
Attach a local file to an issue. Max file size is 1024 Mbit.
No parameter schema on file.
Get metadata of one attached file (name, size, mime type).
No parameter schema on file.
Download attachment content: images come back as image content (visible in chat),
No parameter schema on file.
Download the preview thumbnail of an attached image (image content).
No parameter schema on file.
Download an attachment of a project/portfolio/goal. Content path for entities is
No parameter schema on file.
Upload a temporary file (not yet attached anywhere). Returns a temp id usable once
No parameter schema on file.
Delete an attached file from an issue.
No parameter schema on file.
Create a new task board (via the liveBoards API; the legacy POST /boards ignores
No parameter schema on file.
List all issue boards of the organization.
No parameter schema on file.
Get board parameters by id, including its columns.
No parameter schema on file.
List columns of a board.
No parameter schema on file.
List sprints of a board (agile boards only).
No parameter schema on file.
List boards with relative pagination (for more than one page): pass the last
No parameter schema on file.
Update a board: name, backlog/sprints toggles, columns (with status mapping).
No parameter schema on file.
Delete a board by id.
No parameter schema on file.
Get parameters of one board column.
No parameter schema on file.
Create a column on a board. version = current board version (If-Match lock;
No parameter schema on file.
Rename a board column or change its statuses (version = board version).
No parameter schema on file.
Delete a board column (version = board version).
No parameter schema on file.
Get sprint parameters by id.
No parameter schema on file.
Create a sprint on a board (the board must have sprints enabled).
No parameter schema on file.
Rename a sprint, change dates or status (version = sprint version, If-Match lock).
No parameter schema on file.
Start a sprint (moves to in_progress; version = sprint version).
No parameter schema on file.
Archive a finished sprint (version = sprint version).
No parameter schema on file.
Delete a sprint by id.
No parameter schema on file.
Bulk edit many issues at once (max 10000). Values use the issue edit format;
No parameter schema on file.
Bulk move issues to another queue. Components, versions and projects are cleared by default.
No parameter schema on file.
Bulk move issues to a new status via a workflow transition. Get available transition
No parameter schema on file.
Get status and progress of a bulk change operation by its id.
No parameter schema on file.
Get the checklist of an issue.
No parameter schema on file.
Add a checklist item to an issue.
No parameter schema on file.
Edit a single checklist item. The Tracker API requires the full item list in the
No parameter schema on file.
Delete the whole checklist of an issue.
No parameter schema on file.
Delete a checklist item from an issue.
No parameter schema on file.
Add a comment to an issue. Supports Yandex Flavored Markdown.
No parameter schema on file.
List comments of an issue.
No parameter schema on file.
Edit an existing comment text.
No parameter schema on file.
Get one comment of an issue by id (numeric id or longId).
No parameter schema on file.
Add a reaction to a comment.
No parameter schema on file.
Delete a comment from an issue.
No parameter schema on file.
Create a new dashboard.
No parameter schema on file.
Add a "Cycle time" chart widget to an existing dashboard.
No parameter schema on file.
List external applications available for issue external links.
No parameter schema on file.
List external application links of an issue.
No parameter schema on file.
Link an issue to an object in an external application (e.g. Jira via a connector).
No parameter schema on file.
Delete an external application link of an issue.
No parameter schema on file.
Get parameters of a single global issue field by its key (e.g. "tags", "priority").
No parameter schema on file.
Create a global issue field (admin). type is a class name like
No parameter schema on file.
Rename a global issue field and/or update its dropdown values, category, order,
No parameter schema on file.
Create an issue field category (admin).
No parameter schema on file.
Rename an issue field category, change its order (admin).
No parameter schema on file.
Create a saved filter for issue lists.
No parameter schema on file.
Get saved filter parameters by id.
No parameter schema on file.
Update a saved filter. "filter"/"query" fully replace the previous conditions.
No parameter schema on file.
Delete a saved filter (uses the v2 API path per official docs).
No parameter schema on file.
Create employee absences (vacation, illness, trip…). Admin rights required.
No parameter schema on file.
Find absences of given users in a date range (admin). Pass the last user uid
No parameter schema on file.
Delete absences by ids (admin).
No parameter schema on file.
MIGRATION (admin): create an issue with a custom author and creation date.
No parameter schema on file.
MIGRATION (admin): add a comment with a custom author and date.
No parameter schema on file.
MIGRATION (admin): create an issue link with a custom author and date.
No parameter schema on file.
MIGRATION (admin): add a worklog record with a custom author and date.
No parameter schema on file.
MIGRATION (admin): attach a local file with a custom author and date,
No parameter schema on file.
Find issues in Yandex Tracker. Pass exactly ONE search parameter:
No parameter schema on file.
Get the number of issues matching a filter or query.
No parameter schema on file.
Create a new issue in Yandex Tracker. Requires queue key and summary.
No parameter schema on file.
Get issue parameters by key or id, e.g. "TREK-123".
No parameter schema on file.
Edit an existing issue (PATCH): only provided fields are changed.
No parameter schema on file.
Move an issue to a different queue. Components, versions and projects are cleared
No parameter schema on file.
List workflow transitions available for the issue (with target statuses).
No parameter schema on file.
Move an issue to a new status by executing a workflow transition.
No parameter schema on file.
List links of an issue (related, dependent, subtask, duplicate, epic links).
No parameter schema on file.
Free scroll-search resources when you stopped paging through a scrolled
No parameter schema on file.
Create a link between the current issue and another issue.
No parameter schema on file.
Delete a link between issues by link id (see get_issue_links).
No parameter schema on file.
Get the change history (changelog) of an issue.
No parameter schema on file.
List all projects of the organization.
No parameter schema on file.
Get project parameters by id.
No parameter schema on file.
Create a project.
No parameter schema on file.
Update project parameters.
No parameter schema on file.
List queues whose issues are included in a project.
No parameter schema on file.
Delete a project by id. Issues are not deleted.
No parameter schema on file.
Create a saved issue-list report (used by dashboard "issue list" widgets).
No parameter schema on file.
Search saved issue reports (filter by id/shortId/author).
No parameter schema on file.
Autocomplete suggestions for issue summaries — use when the user references
No parameter schema on file.
Get info about the current user (the token owner). Good for connectivity checks.
No parameter schema on file.
Get user info by login or uid.
No parameter schema on file.
List users of the organization (up to 10 000 — use get_users_relative beyond).
No parameter schema on file.
List users with relative pagination (works beyond the 10 000-user limit of
No parameter schema on file.
List all issue types (task, bug, epic, ...) available in the organization.
No parameter schema on file.
List all issue statuses.
No parameter schema on file.
List all issue priorities.
No parameter schema on file.
List all issue resolutions.
No parameter schema on file.
List all global issue fields (standard and custom) with their types and options —
No parameter schema on file.
List issue link types (relates, depends, subtask, duplicates, epic, clone) with
No parameter schema on file.
Create a new issue type (admin).
No parameter schema on file.
Rename an issue type (admin). version locks edits to that version.
No parameter schema on file.
Create an issue status (admin).
No parameter schema on file.
Edit an issue status: name, description, order, category (admin).
No parameter schema on file.
Create a resolution (admin).
No parameter schema on file.
Edit a resolution: name, description, order (admin).
No parameter schema on file.
Create a priority (admin).
No parameter schema on file.
Edit a priority: name, description (admin). The icon cannot be changed.
No parameter schema on file.
Create a workflow (admin): statuses/steps plus transitions. Omit "queue" to create
No parameter schema on file.
List all workflows of the organization.
No parameter schema on file.
Get workflows of a queue: map workflow id → bound issue types.
No parameter schema on file.
Get one workflow by id.
No parameter schema on file.
Update a workflow (admin). Pass only the fields to change; version is required
No parameter schema on file.
Update one transition action of a workflow step (admin): name, target status,
No parameter schema on file.
Delete a workflow by id (admin).
No parameter schema on file.
Get time tracking records (worklog) of an issue.
No parameter schema on file.
Add a time tracking record to an issue. Tracker counts time in 5-day work weeks
No parameter schema on file.
Edit a time tracking record (worklog).
No parameter schema on file.
Search worklog records across all issues by author and/or creation date range.
No parameter schema on file.
Delete a time tracking record (worklog).
No parameter schema on file.
Free
$0 forever
- Every tool, no call limit
- No card, and mcprush charges nothing for it
- Source published under MIT
- Runs on your machine — nothing of it reaches our gateway
- Nothing to cap, because mcprush bills nothing
What counts against your monthly calls
| Tool | Unit | Calls used | Out of the allowance |
|---|
Nothing here is billable: mcprush charges nothing to install Yandex Tracker or to call it, at any volume.
Call allowance · this installenforced at the gateway
Monthly allowance, in calls
—
—
Alert at 80% · then the tool returns a normal MCP error
Used this month: —
ATrust score 94 / 100
Release 1.2.0 · scanned 15 Oct 2026
Two independent axes, because powerful and malicious are different questions. The grade is threat only. The capability level is blast radius, and it is never a penalty on the grade — it is priced as one subtract-only term in the score, where you can see it.
Threat score100
Client score94
Findings7 threat · 1 capability
Capabilityhigh
Coveragesource
Verificationsource
Surface digest81f4500fe612bd13e0a7463d72d2448e061fa0d858b1d180202d7fe7244135f4
Score vectorthreat 100 → client 94
| Term | Level | What it prices | Points |
|---|---|---|---|
| capability-exposure | high | capability blast radius (high) — client exposure if the model is manipulated | −6 |
| verification-discount | source | publisher verification (provenance) — cryptographic build provenance ties the artifact to its source | −0 |
| coverage-honesty | source | inspection depth (source) — how much of the target the scan could see | −0 |
score = clamp(round(threatScore − E_cap − E_ver − E_cov), 0, 100). No model, no opinion, no network call at scoring time: the same methodology version against the same bytes always produces this number, and every line above is a field of the report rather than a summary of it.
What the scan could actually read
A grade is only as meaningful as its coverage, so the scanner publishes its own depth before it publishes its result.
Tool surfaceread
Implementation sourceread
Package metadataread
Live transportnot available
Tools were statically extracted from the published source (187 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
Capability — what it could do if the model were manipulated
Tags derived from each tool’s schema and the implementation, not from what the tool calls itself. high is the level these add up to.
| Tool | Capability tags | Why the tag was assigned |
|---|---|---|
| list_issue_attachments | sensitive-source | sensitive-source: keyword "list_files" |
| upload_issue_attachment | external-sink | external-sink: handler sends an HTTP POST ( client.post(/issues/${encodeURIComponent(issueId)}/attachments) at dist/tools/attachments.js:78 |
| get_issue_attachment | no tags | |
| download_issue_attachment | untrusted-input | untrusted-input: keyword "download" |
| get_attachment_thumbnail | untrusted-input | untrusted-input: keyword "download" |
| download_entity_attachment | untrusted-input | untrusted-input: keyword "download" |
| upload_temp_attachment | external-sink | external-sink: handler sends an HTTP POST ( client.post('/attachments') at dist/tools/attachments.js:161 |
| delete_issue_attachment | external-sink | external-sink: handler sends an HTTP DELETE ( client.delete(`/issues/${encodeURIComponent(args.issueId)}/attachments/${encodeURICompone…) at dist/tools/attachments.js:170 |
| create_board | external-sink | external-sink: handler sends an HTTP POST ( client.post('/liveBoards') at dist/tools/boards.js:32 |
| get_boards | no tags | |
| get_board | no tags | |
| get_board_columns | no tags | |
| get_board_sprints | no tags | |
| get_boards_paginate | no tags | |
| update_board | external-sink | external-sink: handler sends an HTTP PATCH ( client.patch(/boards/${boardId}) at dist/tools/boards.js:81 |
| delete_board | external-sink | external-sink: handler sends an HTTP DELETE ( client.delete(/boards/${args.boardId}) at dist/tools/boards.js:86 |
| get_board_column | no tags | |
| create_board_column | external-sink | external-sink: handler sends an HTTP POST ( client.post(/boards/${boardId}/columns) at dist/tools/boards.js:102 |
| update_board_column | external-sink | external-sink: handler sends an HTTP PATCH ( client.patch(/boards/${boardId}/columns/${columnId}) at dist/tools/boards.js:115 |
| delete_board_column | external-sink | external-sink: handler sends an HTTP DELETE ( client.delete(/boards/${boardId}/columns/${columnId}) at dist/tools/boards.js:127 |
| get_sprint | no tags | |
| create_sprint | external-sink | external-sink: handler sends an HTTP POST ( client.post('/sprints') at dist/tools/boards.js:142 |
| update_sprint | external-sink | external-sink: handler sends an HTTP PATCH ( client.patch(/sprints/${encodeURIComponent(String(sprintId))}) at dist/tools/boards.js:160 |
| start_sprint | external-sink | external-sink: handler sends an HTTP POST ( client.post(/sprints/${encodeURIComponent(String(sprintId))}/_start) at dist/tools/boards.js:170 |
| archive_sprint | external-sink | external-sink: handler sends an HTTP POST ( client.post(/sprints/${encodeURIComponent(String(sprintId))}/_archive) at dist/tools/boards.js:180 |
| delete_sprint | external-sink | external-sink: handler sends an HTTP DELETE ( client.delete(/sprints/${encodeURIComponent(String(args.sprintId))}) at dist/tools/boards.js:185 |
| bulk_update_issues | external-sink | external-sink: handler sends an HTTP POST ( client.post('/bulkchange/_update') at dist/tools/bulk.js:21 |
| bulk_move_issues | external-sink | external-sink: handler sends an HTTP POST ( client.post('/bulkchange/_move') at dist/tools/bulk.js:35 |
| bulk_transition_issues | external-sink | external-sink: handler sends an HTTP POST ( client.post('/bulkchange/_transition') at dist/tools/bulk.js:57 |
| get_bulk_operation_info | no tags | |
| get_checklist | no tags | |
| add_checklist_item | external-sink | external-sink: handler sends an HTTP POST ( client.post(/issues/${encodeURIComponent(issueId)}/checklistItems) at dist/tools/checklists.js:32 |
| edit_checklist_item | no tags | |
| delete_checklist | external-sink | external-sink: handler sends an HTTP DELETE ( client.delete(/issues/${encodeURIComponent(args.issueId)}/checklistItems) at dist/tools/checklists.js:92 |
| delete_checklist_item | external-sink | external-sink: handler sends an HTTP DELETE ( client.delete(`/issues/${encodeURIComponent(args.issueId)}/checklistItems/${encodeURIComp…) at dist/tools/checklists.js:100 |
| add_comment | external-sink | external-sink: handler sends an HTTP POST ( client.post(/issues/${encodeURIComponent(args.issueId)}/comments) at dist/tools/comments.js:10 |
| get_issue_comments | no tags | |
| edit_comment | external-sink | external-sink: handler sends an HTTP PATCH ( client.patch(`/issues/${encodeURIComponent(issueId)}/comments/${encodeURIComponent(commen…) at dist/tools/comments.js:33 |
| get_issue_comment | no tags | |
| add_comment_reaction | external-sink | external-sink: handler sends an HTTP POST ( client.post(`/issues/${encodeURIComponent(issueId)}/comments/${encodeURIComponent(comment…) at dist/tools/comments.js:57 |
| delete_comment | external-sink | external-sink: handler sends an HTTP DELETE ( client.delete(`/issues/${encodeURIComponent(args.issueId)}/comments/${encodeURIComponent(…) at dist/tools/comments.js:66 |
| create_dashboard | external-sink | external-sink: handler sends an HTTP POST ( client.post('/dashboards') at dist/tools/dashboards.js:23 |
| create_cycle_time_widget | external-sink | external-sink: handler sends an HTTP POST ( client.post(/dashboards/${dashboardId}/widgets/cycleTime) at dist/tools/dashboards.js:68 |
| search_entities | no tags | |
| get_entity | no tags | |
| create_entity | external-sink | external-sink: handler sends an HTTP POST ( client.post(entityPath(entityType)) at dist/tools/entities.js:77 |
| update_entity | external-sink | external-sink: handler sends an HTTP PATCH ( client.patch(entityPath(entityType, entityId)) at dist/tools/entities.js:105 |
| delete_entity | external-sink | external-sink: handler sends an HTTP DELETE ( client.delete(entityPath(args.entityType, args.entityId)) at dist/tools/entities.js:114 |
| add_entity_comment | no tags | |
| get_entity_comments | no tags | |
| get_entity_comment | no tags | |
| update_entity_comment | no tags | |
| delete_entity_comment | no tags | |
| add_entity_checklist_items | no tags | |
| update_entity_checklist | no tags | |
| update_entity_checklist_item | no tags | |
| move_entity_checklist_item | no tags | |
| delete_entity_checklist | no tags | |
| delete_entity_checklist_item | no tags | |
| list_entity_attachments | sensitive-source | sensitive-source: keyword "list_files" |
| get_entity_attachment | no tags | |
| add_entity_attachment | no tags | |
| delete_entity_attachment | no tags | |
| create_entity_link | no tags | |
| get_entity_links | no tags | |
| delete_entity_link | no tags | |
| get_entity_events | no tags | |
| bulk_update_entities | external-sink | external-sink: handler sends an HTTP POST ( client.post(/entities/${encodeURIComponent(entityType)}/bulkchange/_update) at dist/tools/entities.js:392 |
| get_entity_access | no tags | |
| update_entity_access | no tags | |
| get_entity_permissions | no tags | |
| update_entity_permissions | no tags | |
| get_external_applications | no tags | |
| get_external_links | no tags | |
| create_external_link | external-sink | external-sink: handler sends an HTTP POST ( client.post(/issues/${encodeURIComponent(issueId)}/remotelinks) at dist/tools/externals.js:27 |
| delete_external_link | external-sink | external-sink: handler sends an HTTP DELETE ( client.delete(`/issues/${encodeURIComponent(args.issueId)}/remotelinks/${encodeURICompone…) at dist/tools/externals.js:36 |
| get_issue_field | no tags | |
| create_issue_field | external-sink | external-sink: keyword "create_issue", handler sends an HTTP POST ( client.post('/fields') at dist/tools/fields.js:31 |
| update_issue_field | external-sink | external-sink: handler sends an HTTP PATCH ( client.patch(/fields/${encodeURIComponent(fieldId)}) at dist/tools/fields.js:52 |
| create_issue_field_category | external-sink | external-sink: keyword "create_issue", handler sends an HTTP POST ( client.post('/fields/categories') at dist/tools/fields.js:61 |
| update_issue_field_category | external-sink | external-sink: handler sends an HTTP PATCH ( client.patch(/fields/categories/${encodeURIComponent(String(categoryId))}) at dist/tools/fields.js:73 |
| create_filter | external-sink | external-sink: handler sends an HTTP POST ( client.post('/filters') at dist/tools/filters.js:28 |
| get_filter | no tags | |
| update_filter | external-sink | external-sink: handler sends an HTTP PATCH ( client.patch(/filters/${encodeURIComponent(filterId)}) at dist/tools/filters.js:41 |
| delete_filter | external-sink | external-sink: handler sends an HTTP DELETE ( client.delete(/v2/filters/${encodeURIComponent(args.filterId)}) at dist/tools/filters.js:46 |
| create_gaps | external-sink | external-sink: handler sends an HTTP POST ( client.post('/gaps') at dist/tools/gaps.js:19 |
| find_gaps | no tags | |
| delete_gaps | external-sink | external-sink: handler sends an HTTP DELETE ( client.delete('/gaps') at dist/tools/gaps.js:40 |
| import_issue | external-sink | external-sink: handler sends an HTTP POST ( client.post('/issues/_import') at dist/tools/import.js:44 |
| import_issue_comment | external-sink | external-sink: handler sends an HTTP POST ( client.post(/issues/${encodeURIComponent(issueId)}/comments/_import) at dist/tools/import.js:57 |
| import_issue_link | external-sink | external-sink: handler sends an HTTP POST ( client.post(/issues/${encodeURIComponent(issueId)}/links/_import) at dist/tools/import.js:73 |
| import_worklog_record | external-sink | external-sink: handler sends an HTTP POST ( client.post(/issues/${encodeURIComponent(issueId)}/worklogs/_import) at dist/tools/import.js:87 |
| import_issue_attachment | no tags | |
| find_issues | no tags | |
| count_issues | external-sink | external-sink: handler sends an HTTP POST ( client.post('/issues/_count') at dist/tools/issues.js:147 |
| create_issue | external-sink | external-sink: keyword "create_issue", handler sends an HTTP POST ( client.post('/issues') at dist/tools/issues.js:160 |
| get_issue | no tags | |
| edit_issue | external-sink | external-sink: handler sends an HTTP PATCH ( client.patch(/issues/${encodeURIComponent(issueId)}) at dist/tools/issues.js:184 |
| move_issue | external-sink | external-sink: handler sends an HTTP POST ( client.post(/issues/${encodeURIComponent(issueId)}/_move) at dist/tools/issues.js:205 |
| get_issue_transitions | no tags | |
| execute_transition | external-sink | external-sink: handler sends an HTTP POST ( client.post(`/issues/${encodeURIComponent(issueId)}/transitions/${encodeURIComponent(tran…) at dist/tools/issues.js:234 |
| get_issue_links | external-sink | external-sink: handler sends an HTTP POST ( client.post(/issues/${encodeURIComponent(issueId)}/links/_list) at dist/tools/issues.js:257 |
| release_search_scroll | no tags | |
| create_issue_link | external-sink | external-sink: keyword "create_issue", handler sends an HTTP POST ( client.post(/issues/${encodeURIComponent(issueId)}/links) at dist/tools/issues.js:291 |
| delete_issue_link | external-sink | external-sink: handler sends an HTTP DELETE ( client.delete(`/issues/${encodeURIComponent(args.issueId)}/links/${encodeURIComponent(arg…) at dist/tools/issues.js:300 |
| get_issue_changelog | no tags | |
| get_projects | no tags | |
| get_project | no tags | |
| create_project | external-sink | external-sink: handler sends an HTTP POST ( client.post('/projects') at dist/tools/projects.js:33 |
| update_project | external-sink | external-sink: handler sends an HTTP PATCH ( client.patch(/projects/${encodeURIComponent(projectId)}) at dist/tools/projects.js:48 |
| get_project_queues | no tags | |
| delete_project | external-sink | external-sink: handler sends an HTTP DELETE ( client.delete(/projects/${encodeURIComponent(args.projectId)}) at dist/tools/projects.js:66 |
| get_queues | no tags | |
| get_queue | no tags | |
| create_queue | external-sink | external-sink: handler sends an HTTP POST ( client.post('/queues') at dist/tools/queues.js:41 |
| get_queue_fields | no tags | |
| get_queue_versions | no tags | |
| create_queue_version | external-sink | external-sink: handler sends an HTTP POST ( client.post('/versions') at dist/tools/queues.js:66 |
| create_component | external-sink | external-sink: handler sends an HTTP POST ( client.post('/components') at dist/tools/queues.js:80 |
| get_queue_components | no tags | |
| get_queue_local_fields | no tags | |
| get_queue_macroses | no tags | |
| get_queue_tags | no tags | |
| get_queue_triggers | no tags | |
| get_queue_autoactions | no tags | |
| get_queue_autoaction | no tags | |
| create_queue_autoaction | external-sink | external-sink: handler sends an HTTP POST ( client.post(/queues/${encodeURIComponent(String(queueId))}/autoactions) at dist/tools/queues.js:141 |
| get_queue_autoaction_logs | no tags | |
| delete_queue | external-sink | external-sink: handler sends an HTTP DELETE ( client.delete(/queues/${encodeURIComponent(String(args.queueId))}) at dist/tools/queues.js:160 |
| restore_queue | external-sink | external-sink: handler sends an HTTP POST ( client.post(/queues/${encodeURIComponent(String(args.queueId))}/_restore) at dist/tools/queues.js:164 |
| delete_queue_tag | external-sink | external-sink: handler sends an HTTP POST ( client.post(/queues/${encodeURIComponent(String(queueId))}/tags/_remove) at dist/tools/queues.js:174 |
| set_queue_access | external-sink | external-sink: handler sends an HTTP PATCH ( client.patch(/queues/${encodeURIComponent(String(queueId))}/permissions) at dist/tools/queues.js:190 |
| get_queue_user_access | no tags | |
| get_queue_group_access | no tags | |
| create_queue_local_field | external-sink | external-sink: handler sends an HTTP POST ( client.post(/queues/${encodeURIComponent(queueId)}/localFields) at dist/tools/queues.js:230 |
| get_queue_local_field | no tags | |
| update_queue_local_field | external-sink | external-sink: handler sends an HTTP PATCH ( client.patch(`/queues/${encodeURIComponent(queueId)}/localFields/${encodeURIComponent(fie…) at dist/tools/queues.js:255 |
| get_components | no tags | |
| get_component | no tags | |
| update_component | external-sink | external-sink: handler sends an HTTP PATCH ( client.patch(/components/${componentId}) at dist/tools/queues.js:281 |
| delete_component | external-sink | external-sink: handler sends an HTTP DELETE ( client.delete(/components/${args.componentId}) at dist/tools/queues.js:286 |
| get_component_user_access | no tags | |
| get_component_group_access | no tags | |
| get_queue_version | no tags | |
| update_queue_version | external-sink | external-sink: handler sends an HTTP PATCH ( client.patch(/versions/${versionId}) at dist/tools/queues.js:320 |
| delete_queue_version | external-sink | external-sink: handler sends an HTTP DELETE ( client.delete(/versions/${args.versionId}) at dist/tools/queues.js:325 |
| get_queue_trigger | no tags | |
| create_queue_trigger | external-sink | external-sink: keyword "webhook", handler sends an HTTP POST ( client.post(/queues/${encodeURIComponent(String(queueId))}/triggers) at dist/tools/queues.js:349 |
| update_queue_trigger | external-sink | external-sink: handler sends an HTTP PATCH ( client.patch(/queues/${encodeURIComponent(String(queueId))}/triggers/${triggerId}) at dist/tools/queues.js:367 |
| get_queue_trigger_logs | no tags | |
| get_queue_macro | no tags | |
| create_queue_macro | external-sink | external-sink: handler sends an HTTP POST ( client.post(/queues/${encodeURIComponent(String(queueId))}/macros) at dist/tools/queues.js:404 |
| update_queue_macro | external-sink | external-sink: handler sends an HTTP PATCH ( client.patch(`/queues/${encodeURIComponent(String(queueId))}/macros/${encodeURIComponent(…) at dist/tools/queues.js:417 |
| delete_queue_macro | external-sink | external-sink: handler sends an HTTP DELETE ( client.delete(`/queues/${encodeURIComponent(String(queueId))}/macros/${encodeURIComponent…) at dist/tools/queues.js:428 |
| create_issue_report | external-sink | external-sink: keyword "create_issue", handler sends an HTTP POST ( client.post('/entities/report/') at dist/tools/reports.js:43 |
| find_issue_reports | no tags | |
| get_search_suggest | no tags | |
| get_current_user | no tags | |
| get_user | no tags | |
| get_users | no tags | |
| get_users_relative | no tags | |
| get_issue_types | no tags | |
| get_statuses | no tags | |
| get_priorities | no tags | |
| get_resolutions | no tags | |
| get_issue_fields | no tags | |
| get_link_types | no tags | |
| create_issue_type | external-sink | external-sink: keyword "create_issue", handler sends an HTTP POST ( client.post('/issuetypes') at dist/tools/users.js:70 |
| update_issue_type | external-sink | external-sink: handler sends an HTTP PATCH ( client.patch(/issuetypes/${encodeURIComponent(typeKey)}) at dist/tools/users.js:81 |
| create_status | external-sink | external-sink: handler sends an HTTP POST ( client.post('/statuses') at dist/tools/users.js:92 |
| update_status | external-sink | external-sink: handler sends an HTTP PATCH ( client.patch(/statuses/${encodeURIComponent(statusKey)}) at dist/tools/users.js:106 |
| create_resolution | external-sink | external-sink: handler sends an HTTP POST ( client.post('/resolutions') at dist/tools/users.js:114 |
| update_resolution | external-sink | external-sink: handler sends an HTTP PATCH ( client.patch(/resolutions/${encodeURIComponent(resolutionKey)}) at dist/tools/users.js:127 |
| create_priority | external-sink | external-sink: handler sends an HTTP POST ( client.post('/priorities') at dist/tools/users.js:137 |
| update_priority | external-sink | external-sink: handler sends an HTTP PATCH ( client.patch(/priorities/${encodeURIComponent(priorityKey)}) at dist/tools/users.js:149 |
| create_workflow | external-sink | external-sink: handler sends an HTTP POST ( client.post('/workflows') at dist/tools/workflows.js:31 |
| get_workflows | no tags | |
| get_queue_workflows | no tags | |
| get_workflow | no tags | |
| update_workflow | external-sink | external-sink: handler sends an HTTP PATCH ( client.patch(/workflows/${encodeURIComponent(workflowId)}) at dist/tools/workflows.js:63 |
| update_workflow_action | external-sink | external-sink: handler sends an HTTP PATCH ( client.patch(`/workflows/${encodeURIComponent(workflowId)}/steps/${encodeURIComponent(sta…) at dist/tools/workflows.js:84 |
| delete_workflow | external-sink | external-sink: handler sends an HTTP DELETE ( client.delete(/workflows/${encodeURIComponent(args.workflowId)}) at dist/tools/workflows.js:90 |
| get_issue_worklog | no tags | |
| add_worklog_record | external-sink | external-sink: handler sends an HTTP POST ( client.post(/issues/${encodeURIComponent(issueId)}/worklog) at dist/tools/worklog.js:25 |
| edit_worklog_record | external-sink | external-sink: handler sends an HTTP PATCH ( client.patch(`/issues/${encodeURIComponent(issueId)}/worklog/${encodeURIComponent(worklog…) at dist/tools/worklog.js:37 |
| find_worklog_records | no tags | |
| delete_worklog_record | external-sink | external-sink: handler sends an HTTP DELETE ( client.delete(`/issues/${encodeURIComponent(args.issueId)}/worklog/${encodeURIComponent(a…) at dist/tools/worklog.js:67 |
Toxic-flow graph
The lethal trifecta, checked as a graph rather than as a checklist: untrusted input, a sensitive source and an external sink have to meet before there is a path worth worrying about.
download_entity_attachment → list_entity_attachments → add_checklist_item
A cross-tool exfiltration chain exists: download_entity_attachment → list_entity_attachments ⇒ add_checklist_item.
Supply chain and provenance
Integrityfirst-seen
Surface digest81f4500fe612bd13
Scanned2026-10-15
This is the first scan of this surface here, so there is nothing yet to compare it against.
Every result on this tab comes from one deterministic pass over the published package — offline, rule by rule, and auditable line by line above. Same methodology version, same bytes, same score.
Release history
Always latest — the install command names no version, so it installs the newest release when it runs; the current release on file is 1.2.0. Pin a release below and the command asks for exactly that one.
1.2.0
13 Oct 2026
latestNo release note was published with this version.
1.1.0
undated
- The version this listing was on when mcprush began following its releases. The registry was not asked when it shipped, so this row carries no date.
—
no reviews yet
Who can review
One review per account, from a signed-in account that does not publish this listing. Nothing else is asked — you can say what you think before you install it. Publishers can reply once per review, and a review can be edited or deleted by whoever wrote it.
Sign in to write one
Any signed-in account that does not publish Yandex Tracker can review it, once — before installing it or after. A review from an account that has installed it is marked as one.
No reviews yet
Nobody has reviewed this listing. The rating on the card is the mean of the reviews written here and nothing else, so there is no rating until somebody writes the first — which takes a signed-in account that does not publish it, and nothing else.