OpenProject MCP Server
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| OPENPROJECT_URL | Yes | The URL of your OpenProject instance (e.g., https://tasks.example.com) | |
| OPENPROJECT_API_TOKEN | Yes | Your OpenProject API token |
Capabilities
Features and capabilities supported by this server
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| list_projectsA | List visible projects with native filters, sorting, and pagination. Use this to discover project IDs or identifiers; use get_project when the target is already known and count_projects when only a total is needed. |
| search_work_packagesA | Search visible work packages with focused fields plus optional native filters, sorting, and pagination. Use this for discovery or lists; use get_work_package for the complete resource once an ID is known and count_work_packages for totals only. |
| get_work_packageA | Get the complete HAL+JSON representation of one work package by numeric ID. Use after search when full descriptions, links, custom fields, or lockVersion are required; this performs no write. |
| list_work_package_attachmentsA | List metadata for files attached directly to a work package. Use before get_work_package_attachment to verify the attachment ID and size; no file content is downloaded. |
| get_work_package_attachmentA | Download one verified attachment from a work package. Use after listing attachments. Text files return readable text; binary files return an embedded base64 MCP resource. The call fails before or during transfer if maxBytes is exceeded and does not write to disk. |
| create_work_packageA | Create a work package and return the created resource plus browser URL. Use only for a new task in a resolved project; this writes immediately and may notify interested users unless notify is false. Omit typeId to select the project's Task type or first available type. |
| update_work_packageA | Update only the supplied fields on an existing work package and return its browser URL. The tool fetches the current lockVersion first to prevent stale overwrites; null clears supported optional links. It writes immediately and may notify users unless notify is false. |
| add_work_package_commentA | Append a Markdown comment to one work package and return the activity plus work-package URL. Use for progress notes or follow-ups, not field changes; this creates a permanent activity and can notify subscribed users. |
| get_projectA | Get one complete project by numeric ID or identifier. Use when the target is already known and full project fields or links are needed; use list_projects for discovery. This is read-only. |
| create_projectA | Create a project or subproject immediately. Use only after confirming a new project is wanted; parentId creates it below an existing project. Requires add-project permission and is not idempotent. |
| update_projectA | Patch only the supplied fields on an existing project. Use for renaming, description, visibility, activation, or archival changes; omitted fields are preserved. Requires project administration permission. |
| delete_projectA | Permanently schedule deletion of a project by numeric ID. Use only after get_project verifies an explicit deletion target. OpenProject archives it immediately and deletes it asynchronously; this destructive action cannot be undone through this server. |
| count_projectsA | Return only the total number of projects matching native OpenProject filters. Use instead of list_projects when no project records are needed; this is read-only and minimizes response size. |
| count_work_packagesA | Return only the total number of work packages matching native filters and an optional project. Use instead of search_work_packages when no task records are needed; all filters are combined with AND. |
| list_work_package_activitiesA | List paginated comments and field-change history for one work package. Use for audit context or conversation history; use get_work_package for current state and add_work_package_comment to append a new note. This is read-only. |
| delete_work_packageA | Permanently delete one work package by ID. Use only for an explicit deletion request after verifying the target with get_work_package; this is destructive and cannot be undone through this server. |
| list_work_package_relationsA | List all typed relations involving one work package, including direction and lag. Use to inspect dependencies or duplicates before creating or deleting a relation; this is read-only. |
| get_work_package_relationA | Get one relation by relation ID, including its from/to links, type, description, and lag. Use after listing relations when complete details for a known relation are needed. |
| create_work_package_relationA | Create a directed typed relation from one work package to another, such as blocks, precedes, duplicates, or relates. Use after verifying both IDs and existing relations; this writes immediately and duplicate validity is enforced by OpenProject. |
| delete_work_package_relationA | Permanently delete one relation without deleting either work package. Use only after list_work_package_relations confirms the relation ID; this destructive change removes the dependency or association. |
| upload_work_package_attachmentA | Read one explicit allowlisted local file and upload it to a work package. Use only when the user identified both the file and target task. Paths must be under OPENPROJECT_ALLOWED_UPLOAD_DIRS (default: current working directory). The call rejects files above maxBytes, sends bytes only to the configured OpenProject origin, creates a permanent attachment, and never modifies the local file. |
| delete_work_package_attachmentA | Permanently delete one attachment by attachment ID. Use only after list_work_package_attachments verifies the file and ID; this is destructive and does not delete the work package. |
| get_current_userA | Return the current OpenProject user authenticated by the API token. Use to identify 'me' or verify credentials; unlike list_users, this does not require global user-management permission. |
| list_usersA | List or search the global OpenProject user directory with native filters and pagination. Use for administrator-level discovery; for ordinary task assignment prefer list_available_assignees because OpenProject may restrict this endpoint to user managers. This is read-only. |
| get_userA | Get one OpenProject user by numeric ID. Use when the ID is already known; use list_available_assignees for assignment choices and list_users for administrator-level discovery. |
| list_available_assigneesA | List users permitted as assignees for exactly one project or work package. Use this before assignment when the global user list is unavailable; provide projectId or workPackageId, never both. This is read-only. |
| list_work_package_typesA | List configured OpenProject work package types and their IDs. Use this read-only discovery tool before creating, filtering, or updating work packages that reference work package types. |
| list_work_package_statusesA | List configured OpenProject work package statuses and their IDs. Use this read-only discovery tool before creating, filtering, or updating work packages that reference work package statuses. |
| list_work_package_prioritiesA | List configured OpenProject work package priorities and their IDs. Use this read-only discovery tool before creating, filtering, or updating work packages that reference work package priorities. |
| list_project_versionsA | List version or milestone IDs globally or for one project. Use before assigning a work package to a version; projectId returns only versions available in that project. This is read-only. |
| list_work_package_watchersA | List current watchers of one work package. Use before adding or removing a watcher to verify membership and user IDs; this does not change subscriptions. |
| add_work_package_watcherA | Subscribe a user as a watcher of one work package so OpenProject can notify them about changes. Use only for an explicit subscription request; adding an existing watcher is idempotent. |
| remove_work_package_watcherA | Unsubscribe a user from one work package's watchers. Use only after verifying workPackageId and userId; this changes notification behavior but does not delete the user or work package. |
| list_notificationsA | List paginated in-app notifications for the authenticated user, optionally unread only. Use for inbox triage; this leaves read state unchanged. Use get_notification for one item's details and mark tools only after review. |
| get_notificationA | Get one in-app notification by ID with actor, project, activity, and related-resource links. Use after list_notifications when full context for a known notification is required; it remains unread. |
| mark_notification_readA | Mark one in-app notification as read for the authenticated user. Use after the notification has been reviewed; this changes inbox state but not the related project resource. |
| mark_all_notifications_readA | Mark every visible in-app notification as read for the authenticated user. Use only for an explicit clear-inbox request; this bulk state change is idempotent and does not modify related work packages. |
| list_boardsA | List paginated Kanban-style boards scoped to one project ID or identifier. Use to discover board grid IDs; use get_board for configuration or list_board_lanes for cards. This read-only call may return no boards when the module is disabled. |
| get_boardA | Get one OpenProject board by grid ID, including its widget and column configuration. Use when the board ID is already known; use list_boards for project discovery or list_board_lanes for cards. |
| list_board_lanesA | Resolve one board's work-package query widgets into lanes with card summaries and pagination metadata. Use after list_boards identifies a board; pageSize limits cards per lane. This is read-only and does not move cards. |
| get_openproject_apiA | Read an OpenProject API v3 endpoint not covered by a focused tool. Use only as a read-only escape hatch after checking the typed tools. The path must be relative under /api/v3; absolute URLs, other origins, writes, and filesystem access are rejected. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/alex13slem/openproject-codex-plugin'
If you have feedback or need assistance with the MCP directory API, please join our Discord server