Pack local or remote codebases into AI-friendly files that LLMs and coding agents can read or search
Nothing to run from here
TaskLite is installed from its publisher's own source and answers where it runs, so this marketplace is not in the path of a single call. There is no address here to send one to, and a panel that pretended otherwise would be showing you an answer we made up. Install it and call it from your own client — the Installation tab has the entry for each one.
99/100
trust score
13
downloads a day
local
runs on your machine
790
downloads in 30d
What it does
tasklite.net: hosted backend, REST API and admin for apps built by AI agents
Quickstart
# 1 — add it to Claude Code
claude mcp add --scope user tasklite-mcp '--' npx -y @tasklite/mcp
# 2 — ask your agent for something these tools do
# connection_status, sign_up, connect and 79 more
TaskLite costs nothing on mcprush: there is no plan to choose here, no cap to set and nothing mcprush can bill you for.
Publishernot claimed
TAAll 1 server
tasklite1 server
1 category
Collected from a public index. Nobody has claimed this account, so nothing here was written by its author — claim it if it is yours.
Installation
Where are you running it?
Every route below installs the same thing and ends at the same approval screen. This one runs on your machine: your client starts TaskLite as a process under your own user, with your files and your network, so the tool surface below is what it can do to your computer rather than to a server somewhere else. Its scan result is on the Security tab — read the surface before you approve it.
Claude Codedeclared by this listing
This is a public server: you run it yourself and this marketplace is not in the path. You need Node.js — the current LTS (24) is the safe choice; npx comes with it. Claude Code registers it in one command; --scope user makes it available in every project. The '--' is in quotes so that PowerShell passes it on.
claude mcp add --scope user tasklite-mcp '--' npx -y @tasklite/mcpReconnect, or start a new session, and the tools appear in the model’s tool list.
Free on mcprush, and it runs from its publisher’s own package: this marketplace is not in the path, so there is no key of ours to hold and no card to add.
What it writes
One config entry your client uses to start the process locally. A local server runs with your file system and your network, which is why it is priced without metering.
What you approve
82 tools, with what each one reads, writes and reaches shown before you agree — the same list on every route above. Read the tool surface.
Tool surface
What the model actually sees. Descriptions are diffed on every release — see version history.
Read from its source code. A server that builds its tool list when it starts can list more tools than this.
Check whether this machine is connected to a TaskLite account. Call this first if any tool fails with an auth error.
No parameter schema on file.
Create a brand-new TaskLite account + organization and connect this machine, no website visit needed. A strong random password is generated locally and never shown or stored; for web access the user later uses "forgot password" with this email. Ask the user for email, their name, and a business…
No parameter schema on file.
Connect this machine to an existing TaskLite account, or switch to a different one. Takes a personal API key (tl_...) created at TaskLite → Integrations → "Connect Claude Code". Replaces the current connection if there is one, use this to switch user or organization. The switch takes effect…
No parameter schema on file.
Connect this machine to an existing TaskLite account with email + password, or switch to a different account. Creates a personal API key named "claude-code" on that account and stores it, so the password is used once and never saved. Replaces the current connection if there is one. Prefer connect…
No parameter schema on file.
Disconnect this machine from TaskLite by forgetting the stored credential. Use before connecting a different account, or to revoke local access. Does not delete anything in TaskLite itself and does not revoke the key server-side.
No parameter schema on file.
List the organizations the authenticated user belongs to. Use the returned id as organizationId in other tools.
No parameter schema on file.
How much of the monthly email quota an organization has used: emails sent this month, emails waiting in the queue, the plan limit (Free 300, Plus 3000, Pro 20000; null means unlimited), whether the plan allows marketing email, and whether sending is paused for the organization (too many bounces or…
No parameter schema on file.
No parameter schema on file.
List projects in an organization. The API returns 50 per page, an organization with more than that needs page 2 and beyond, so check the returned total before assuming a project does not exist.
No parameter schema on file.
List the boards inside a project, id, name, description. Every other board tool needs a boardId, and this is the only way to discover one without being handed a URL.
No parameter schema on file.
Create a project (a business process container). Boards with data live inside projects.
No parameter schema on file.
Create a board (a data table) inside a project. Add typed columns with create_column afterwards. kind: "tasks" (default) also gives the board the built-in task columns, status, priority, assignee, due date, tags, for work people track; "data" creates a plain table with only the columns you add,…
No parameter schema on file.
Add a typed column to a board. Valid types: text, rich_text, number, status, date, datetime, duration, people, checkbox, dropdown, label, priority, link, email, phone, relation, lookup, rollup, formula, rating, currency, file. Choose by meaning, date for dates, phone for phones, number/currency…
No parameter schema on file.
Get a board with its full column schema (ids, names, types, settings). Call this before creating items with cells.
No parameter schema on file.
Rename a board or change its description. Structure (columns) is changed with update_column / delete_column / reorder_columns.
No parameter schema on file.
Delete a board with every item on it. Destructive and not undoable, confirm with the user first, and prefer delete_column when only part of the model is wrong.
No parameter schema on file.
Delete a project with every board, column and row inside it. Destructive: confirm with the user first, and name the project in the confirmation. The project goes to the organization recycle bin, so it can be restored from the admin until it is emptied.
No parameter schema on file.
Change a column after the fact: rename it, change its type (e.g. number -> currency), replace settings (dropdown options), or set isRequired / isHidden. A type change converts existing values (number↔currency, text→number/date/checkbox, anything→text) and clears the ones that cannot convert; the…
No parameter schema on file.
Delete a column and every value stored in it. Destructive, confirm with the user first. Use update_column when the column is right but its name, type or options are wrong.
No parameter schema on file.
Set the display order of a board's columns. Pass every column id in the wanted order (get_board_schema lists them).
No parameter schema on file.
The whole project as JSON, boards, columns with settings, items with their cells keyed by column id. For migrations, backups and reading a system back. Items are capped per board for the model's sake; the REST endpoint GET /organizations/{orgId}/projects/{projectId}/export.json returns everything.
No parameter schema on file.
List items (rows) of a board, including their cell values. Returns all items unless limit/page are given (the API defaults to 50 per page when unpaged, so the tool pages through and concatenates). Narrow the result with search, status, priority and sort instead of fetching everything. This is the…
No parameter schema on file.
Create an item (row) with all of its data in one call. cells maps columnId -> value (use get_board_schema for column ids); every cell is saved with the row. Use set_cell only for later edits.
No parameter schema on file.
Update item fields (title, description, status, priority, dueDate, tags). On a data board the task fields (status, priority, dueDate, tags) are hidden: its columns, status included, are set with set_cell.
No parameter schema on file.
Set a single cell value on an item by columnId.
No parameter schema on file.
Read cells of one item from the database (not a cache): one current value per column, the value set_cells_if_unchanged compares. Use it to decide a conditional write, and pass each value back as expected exactly as it came.
No parameter schema on file.
Compare-and-set on cells of one item, all or none. Each cell carries the value you read (expected, null = empty) and the value to write. If any cell no longer holds its expected, nothing is written and the answer is an error with code CELL_CONFLICT and conflicts [{columnId, current}]: read…
No parameter schema on file.
Delete an item. Destructive, confirm with the user before calling.
No parameter schema on file.
List the comments (the correspondence thread) on an item, oldest first. Each comment includes its author and any @mentions. Needs projectId and itemId (get itemId from query_items).
No parameter schema on file.
Post a comment on an item's thread. To notify people, pass their user ids in mentionedUserIds (each also appears as an @mention). attachmentIds references already-uploaded files. Needs projectId and itemId.
No parameter schema on file.
Edit the text of an existing comment. Only the author can edit their comment. Needs projectId, itemId and the commentId.
No parameter schema on file.
Delete a comment from an item thread. Destructive, confirm with the user before calling. Needs projectId, itemId and the commentId.
No parameter schema on file.
Create a link that puts files onto an item from outside TaskLite: the customer's photos, a signed contract, a logo, a build zip. Returns an address like https://app.tasklite.net/upload/<token> that anyone you hand it to can use with no account, no login and no API key; pass clientEmail and…
No parameter schema on file.
Close an upload link before it expires, so the address stops accepting files. The files already uploaded stay on the item. Use it as soon as the material is in, because until then anyone holding the link can add more.
No parameter schema on file.
Create an app, a named API surface over the boards of a project, for an external frontend. Then add endpoints and an API key.
No parameter schema on file.
Whether an app can send push notifications to phones, and how many devices are registered. Push goes out through the customer's OWN Firebase project, so it has to be configured once per app before send_push automations do anything. This tool never returns the key.
No parameter schema on file.
Send one real push notification to the given app users, to prove the chain works before an automation depends on it. Confirm with the user first: this reaches actual phones.
No parameter schema on file.
Publish an app, required before its API endpoints accept external calls.
No parameter schema on file.
Expose a board as a REST endpoint of an app: /apps/{appSlug}/api/{slug}. exposedColumns limits which columns are readable/writable. rowLevelSecurity.enabled makes the endpoint per-user: the developer's server sends X-App-User: <their user id> next to the API key, and the endpoint returns,…
No parameter schema on file.
List an app's REST endpoints, slug, board, allowed methods, and how many columns each exposes. An endpoint exposing 0 columns is broken: it returns only item metadata and silently discards writes.
No parameter schema on file.
Change an existing endpoint, most often to set exposedColumns on one that was created without them. Get the endpoint id from list_app_endpoints and the column ids from get_board_schema.
No parameter schema on file.
Delete an endpoint of an app for good: /apps/{appSlug}/api/{slug} stops answering at once and the endpoint cannot be brought back (create it again with create_app_endpoint). The board and its rows are not touched. Confirm with the user first: a frontend that calls this endpoint breaks. To take an…
No parameter schema on file.
Read or change the settings object of an app. Call with only appId to read. To change, pass set: the keys in it are MERGED into the current settings (objects merge key by key at every depth, arrays and plain values replace, null removes a key). The server itself does not merge: PATCH replaces the…
No parameter schema on file.
List the people of an app, as { users, pending }. users: everyone who ever called it with X-App-User or signed in to it with a code. Each has userId (the id set_app_user_role, remove_app_user, link_app_user, list_app_user_links and send_test_push take), externalId (the developer's own id for them,…
No parameter schema on file.
Give a person access to an app by their phone number: the phone and a role, nothing else. This is how the people who run an app (the business owner, a manager, staff) get into its admin screen, whose endpoints are in row-level security mode "shared". The person needs no invite code and does not…
No parameter schema on file.
Change what an existing user of an app may do, or switch them off or back on. Takes the userId from list_app_users and at least one of role and isActive. It also puts on the app's access list a user who is not on it yet (hasAccessRow false in list_app_users), which is what an endpoint in row-level…
No parameter schema on file.
Take a person's access to an app away. Pass exactly one of two ids from list_app_users: userId, for someone who already signed in, switches them off (the same as set_app_user_role with isActive false: their calls are refused in every mode, nothing of theirs is deleted, and set_app_user_role or…
No parameter schema on file.
Create an invite code for an app (8 characters shown as XXXX-XXXX, typed without regard to case or the dash). The person signs up or signs in through the app with the code: the app sends it as inviteCode with POST /auth/otp/verify, /auth/register-external or /auth/google-external, after it may…
No parameter schema on file.
List the invite codes of an app, newest first (the latest 200): the ones created with create_app_invite and the ones the app's own users minted through a relation endpoint with allowInvites (createdVia admin or app). Each carries id, code, itemId, role, label, maxUses, useCount, expiresAt,…
No parameter schema on file.
Revoke an invite code so nobody else can sign up with it. People who already used it stay linked to their row and keep their access; to cut one of them off use unlink_app_user. Cannot be undone, create a new invite instead. Requires organization owner or admin. Get the invite id (not the code)…
No parameter schema on file.
Check whether an invite code works right now, the way an app does before sign-up (POST /auth/invites/check, the same public route, limited to 10 calls a minute per address). A working code answers { valid: true, organizationId, app: { name, slug }, label, expiresAt }; anything else (unknown,…
No parameter schema on file.
Link an existing user of an app to a row, so the user "is" that row for every endpoint in row-level security mode "relation": link a coach to his Coaches row and he reaches the trainees whose Coach column points at it. This is the manual form of what an invite code does at sign-up; use it for…
No parameter schema on file.
List the rows one user of an app is linked to, oldest first: each link has itemId, source (invite or admin) and createdAt. These are the rows the user "is" under row-level security mode "relation". A user can also stand for a row with no link at all, through identityPhoneColumn or…
No parameter schema on file.
Remove the link between a user of an app and a row: the user stops being that row, and at once loses the rows of every relation endpoint they reached through it. The account, the row and the user's app access are not touched, and nothing is deleted. A user matched to the row by identityPhoneColumn…
No parameter schema on file.
List the business roles of an app's project, as { roles: [{ key, label }] }. Roles are what board policies (set_board_policy) name in their roles lists; they are separate from the app access role (viewer, editor, submitter) of add_app_user. Requires organization owner or admin.
No parameter schema on file.
Create a business role of an app's project, or change the label of an existing one (calling again with the same key and a label updates the label). A role is only a name; what it may do is written in the board policies. Example: key "manager", label "Agents manager". Roles can also come from the…
No parameter schema on file.
Delete a business role of an app's project. Check first with list_app_role_grants who holds it and with get_board_policy where policies still name it: a policy that names a role that no longer exists simply matches nobody. Requires organization owner or admin.
No parameter schema on file.
Give an app user a business role (a user can hold several). Takes the userId from list_app_users and a role key from list_app_roles. expiresAt makes the grant temporary. Granting the same pair again changes only expiresAt. This is for personal exceptions; for a whole team prefer…
No parameter schema on file.
Take a business role away from an app user (a grant made with grant_app_role). A role the user gets from the employees board (set_policy_identity) is not a grant: change the board row instead. Revoking a grant that does not exist also succeeds. Requires organization owner or admin.
No parameter schema on file.
List the role grants of an app's project, as { grants }: who holds which role and until when. Pass userId to see one person's. Roles that come from the employees board (set_policy_identity) are not grants and are not listed here; explain_access with a userId shows the roles a person ends up with.…
No parameter schema on file.
Read the project's role identity: which board holds the people and how their rows map to roles (see set_policy_identity). Returns { identity }, null when none is set. Requires organization owner or admin.
No parameter schema on file.
Derive "who is this user and what is their role" from the data, instead of a grant per person: point at the employees board, its phone/email column, the column that says what each person does, and a map from that column's values to role keys. A signed-in user whose verified phone (or email) is in…
No parameter schema on file.
Read a board's access policy: { boardId, policy, updatedAt, updatedBy }, policy null when the board has none. A policy only takes effect on endpoints whose rowLevelSecurity mode is "policy". Requires organization owner or admin.
No parameter schema on file.
No parameter schema on file.
Remove a board's access policy. An endpoint of that board in rowLevelSecurity mode "policy" then has no policy to follow; check what it allows afterwards with explain_access before leaving it on a live app. Requires organization owner or admin.
No parameter schema on file.
Say what a user, or a list of roles, may do on a board under its policy: which rows they read and write, which columns, create and delete. Pass boardId and exactly one of userId (an app user from list_app_users; the answer includes the roles that person has) or roles (role keys, to try a role…
No parameter schema on file.
Dry-run one app API request in the name of a user and get the verdict (allowed or refused, and why), changing nothing: the endpoint slug, the HTTP method (or the name of a policy action, with its itemId) and optionally the column keys the body would carry. Use it to prove that a forbidden thing is…
No parameter schema on file.
Read the change history of one item (row), newest first: who changed which field, from what to what, when, through which channel, with the event and reason when a named action made the change. Returns { items: [{ field, fieldId, from, to, at, actor: { userId, name }, channel, event, reason }],…
No parameter schema on file.
Create an API key for an app. SECURITY: the key must live server-side only (env var, Next.js API routes), never in browser code. If the app has its own users, the server also sends X-App-User: <user id> with the key so per-user endpoints know who is acting.
No parameter schema on file.
Build a whole backend in one call from a spec you compose: the project, its boards, their typed columns (including relations between the boards), optional sample rows, and optionally a published REST API with one endpoint per board and a server-side key. Use it whenever the user describes a system…
No parameter schema on file.
No parameter schema on file.
Change an existing automation: its actions, conditions, trigger config or name, or switch it off with isActive false. Fields left out stay as they are; actions and conditions, when given, replace the whole list. Use it to fix an automation instead of creating a second one next to it. Get the id…
No parameter schema on file.
List the automations on a board, so you can see what already runs before adding another.
No parameter schema on file.
List the apps in the organization, id, slug, status. Call this first when you need an app id: the slug (app-xxxxxx) is what shows up in URLs and in generated code, and this is how you map it back to the app.
No parameter schema on file.
Get the machine-readable spec of an app: base URL, endpoints, methods, fields, auth. Two formats: "tasklite" (default), the compact shape the frontend prompts are built from, and "openapi", a standard OpenAPI 3.1 document for developers and other tools. When the user asks for the OpenAPI spec, or…
No parameter schema on file.
Get a ready-made prompt describing the app backend, for pasting into a frontend generator (v0/bolt/lovable/cursor). appId accepts the app UUID or its slug (app-xxxxxx), use list_apps to find it.
No parameter schema on file.
Full-text search across the projects, boards and items of the organization. Returns { results: [{ id, title, url }] }, the shape ChatGPT connectors and deep research expect; pass a result id to fetch for the full record. When you already know the board, query_items is cheaper and complete.
No parameter schema on file.
One project, board or item in full, by the id search returned (project:<id>, board:<projectId>:<boardId>, item:<projectId>:<boardId>:<itemId>) or by an app URL path. Returns { id, title, text, url, metadata }, the ChatGPT fetch contract; text is the record as JSON.
No parameter schema on file.
Deploy a static frontend to TaskLite hosting and get a live URL https://{slug}.tasklite.dev (HTTPS, auto-published on first deploy, versions kept for rollback_deployment). Hand over the frontend in ONE of three ways: files, the files inline (path + content), the way to go from ChatGPT or any…
No parameter schema on file.
List the hosted-frontend deployments of an app, versions, which one is live, and the public URL.
No parameter schema on file.
Read back what a hosted frontend version is made of: every file with its size and its URL on that version, and the full text of the text files (HTML, CSS, JS, JSON, SVG...). This is how a new conversation continues a site an earlier one built: "take my Krispool site and keep going" starts here,…
No parameter schema on file.
Point the live URL back at a previous deployment version (see list_deployments for available versions).
No parameter schema on file.
Free
$0 forever
- Every tool, no call limit
- No card, and mcprush charges nothing for it
- Source published under MIT
- Runs on your machine — nothing of it reaches our gateway
- Nothing to cap, because mcprush bills nothing
What counts against your monthly calls
| Tool | Unit | Calls used | Out of the allowance |
|---|
Nothing here is billable: mcprush charges nothing to install TaskLite or to call it, at any volume.
Call allowance · this installenforced at the gateway
Monthly allowance, in calls
—
—
Alert at 80% · then the tool returns a normal MCP error
Used this month: —
ATrust score 99 / 100
Release 0.21.0 · scanned 29 Oct 2026
Two independent axes, because powerful and malicious are different questions. The grade is threat only. The capability level is blast radius, and it is never a penalty on the grade — it is priced as one subtract-only term in the score, where you can see it.
Threat score100
Client score99
Findings0 threat · 0 capability
Capabilityminimal
Coveragesource
Verificationrepo
Surface digestf800d235c4d2909634ca836dce596421dd12e1f7b425015294a298310a5c9322
Score vectorthreat 100 → client 99
| Term | Level | What it prices | Points |
|---|---|---|---|
| capability-exposure | minimal | capability blast radius (minimal) — client exposure if the model is manipulated | −0 |
| verification-discount | repo | publisher verification (public source) — no provenance, but the source is public and inspectable | −1 |
| coverage-honesty | source | inspection depth (source) — how much of the target the scan could see | −0 |
score = clamp(round(threatScore − E_cap − E_ver − E_cov), 0, 100). No model, no opinion, no network call at scoring time: the same methodology version against the same bytes always produces this number, and every line above is a field of the report rather than a summary of it.
What the scan could actually read
A grade is only as meaningful as its coverage, so the scanner publishes its own depth before it publishes its result.
Tool surfaceread
Implementation sourceread
Package metadataread
Live transportnot available
Tools were statically extracted from the published source (1 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
Capability — what it could do if the model were manipulated
Tags derived from each tool’s schema and the implementation, not from what the tool calls itself. minimal is the level these add up to.
| Tool | Capability tags | Why the tag was assigned |
|---|---|---|
| list_app_users | no tags |
Toxic-flow graph
The lethal trifecta, checked as a graph rather than as a checklist: untrusted input, a sensitive source and an external sink have to meet before there is a path worth worrying about.
The public result for this release does not print the flow graph, so there is nothing to show here. That is not the same as "no paths were found": what the scan did read is above, under coverage.
Supply chain and provenance
Integrityfirst-seen
Surface digestf800d235c4d29096
Scanned2026-10-29
This is the first scan of this surface here, so there is nothing yet to compare it against.
Every result on this tab comes from one deterministic pass over the published package — offline, rule by rule, and auditable line by line above. Same methodology version, same bytes, same score.
Release history
Always latest — the install command names no version, so it installs the newest release when it runs; the current release on file is 0.21.0. Pin a release below and the command asks for exactly that one.
0.21.0
29 Oct 2026
latestNo release note was published with this version.
0.19.0
20 Oct 2026
No release note was published with this version.
0.17.1
14 Oct 2026
No release note was published with this version.
0.16.1
8 Oct 2026
No release note was published with this version.
0.16.0
8 Oct 2026
No release note was published with this version.
0.15.0
23 Sep 2026
No release note was published with this version.
0.14.4
16 Sep 2026
No release note was published with this version.
0.5.1
undated
- The version this listing was on when mcprush began following its releases. The registry was not asked when it shipped, so this row carries no date.
—
no reviews yet
Who can review
One review per account, from a signed-in account that does not publish this listing. Nothing else is asked — you can say what you think before you install it. Publishers can reply once per review, and a review can be edited or deleted by whoever wrote it.
Sign in to write one
Any signed-in account that does not publish TaskLite can review it, once — before installing it or after. A review from an account that has installed it is marked as one.
No reviews yet
Nobody has reviewed this listing. The rating on the card is the mean of the reviews written here and nothing else, so there is no rating until somebody writes the first — which takes a signed-in account that does not publish it, and nothing else.