Skip to main content
Glama

tasks-mcp-poc

Prueba de concepto de un gestor de tareas genérico (al estilo Monday, Jira o Trello) cuya única interfaz es MCP: no hay frontend tradicional, solo modelo de datos persistido en Postgres, reglas de negocio y un servidor MCP que expone todo como herramientas para ser usadas por Claude, tanto local (vía stdio) como desplegado en la nube (vía HTTP).

Dominio

Gestión simple de usuarios y tareas:

  • Usuarios: admin o member.

  • Tareas: título, descripción, estado (pendiente | en_progreso | completada) y usuario asignado.

  • El estado persiste en Postgres (Neon) vía Drizzle ORM — ver Persistencia.

Related MCP server: Taskmaster

Reglas de negocio

  • Toda operación (salvo login) requiere un token de sesión válido obtenido con login.

  • Las sesiones expiran a la hora de creadas.

  • Solo admin puede: listar/crear/eliminar usuarios, eliminar tareas, gestionar dependencias.

  • delete_user no permite eliminar el propio usuario ni uno con tareas asignadas o creadas por él (hay que reasignarlas o eliminarlas primero); sus sesiones y registros de tiempo sí se eliminan en cascada.

  • Cualquier usuario puede crear tareas (create_task): un admin puede asignarlas a cualquier usuario; un member solo puede asignarlas a sí mismo o a otro member (no a un admin).

  • Un member solo puede ver y actualizar el estado de las tareas que tiene asignadas.

  • admin puede ver y actualizar cualquier tarea.

  • Una tarea puede depender de otras (add_task_dependency): mientras alguna dependencia no esté completada, la tarea no puede salir de pendiente. No se permiten dependencias circulares.

  • Un usuario solo puede tener un registro de tiempo activo a la vez: si inicia el timer de una tarea mientras tiene otra corriendo, la anterior se pausa automáticamente.

  • Al pausar (stop_task_timer) se puede indicar una razón y, opcionalmente, crear una tarea de seguimiento asignada a otra persona (ej. "pausa porque espero respuesta de Juan") — esta creación puntual no requiere rol admin, cualquier sesión válida puede reportar un bloqueo.

Autenticación

Autenticación simple usuario/contraseña:

  • Contraseñas guardadas con hash scrypt + salt (nunca en texto plano).

  • login(username, password) devuelve un token opaco (UUID) que debe pasarse en el resto de las herramientas, simulando una sesión.

  • logout(token) invalida la sesión.

Usuario semilla (solo para esta PoC):

username

password

rol

admin

admin123

admin

El resto de los usuarios (member) se crean con create_user una vez logueado como admin.

Persistencia

  • Base de datos Postgres gestionada en Neon, acceso vía drizzle-orm/neon-http.

  • Schema en src/db/schema.ts (tablas users, tasks, task_dependencies, task_time_entries, sessions).

  • Migraciones con Drizzle Kit:

    npm run db:generate   # genera SQL a partir de src/db/schema.ts
    npm run db:migrate    # aplica migraciones pendientes contra DATABASE_URL
    npm run db:seed       # crea el usuario admin semilla (idempotente)
    npm run db:studio     # UI de Drizzle Studio para inspeccionar los datos
  • DATABASE_URL se lee de .env en desarrollo (nunca commitear ese archivo) y de un secret de la plataforma de hosting en producción — ver Deploy.

Transporte MCP

El servidor de tools (src/mcp.ts) es el mismo en ambos casos; solo cambia el transporte:

Entry point

Transporte

Uso

src/server.ts

StdioServerTransport

Local, spawneado por Claude Code (claude mcp add)

src/httpServer.ts

StreamableHTTPServerTransport

Remoto, servido vía Express en /mcp (deploy en Fly.io)

Herramientas MCP expuestas

Herramienta

Rol requerido

Descripción

login

público

Autenticarse y obtener token

logout

sesión válida

Cerrar sesión

whoami

sesión válida

Ver datos del usuario actual

list_users

admin

Listar usuarios

create_user

admin

Crear usuario

delete_user

admin

Eliminar usuario (no el propio, ni uno con tareas asignadas/creadas)

list_tasks

sesión válida

Listar tareas (propias o todas si es admin)

create_task

sesión válida

Crear tarea; member solo puede asignarla a sí mismo u otro member

update_task_status

dueño de la tarea o admin

Cambiar el estado de una tarea (bloqueado si tiene dependencias sin completar)

start_task_timer

dueño de la tarea o admin

Iniciar registro de tiempo (pausa automáticamente cualquier otro timer activo del usuario)

stop_task_timer

dueño de la tarea o admin

Detener/pausar el timer activo; opcionalmente crea una tarea de seguimiento para otra persona

list_task_time_entries

sesión válida

Listar los registros de tiempo (inicio/fin/motivo) de una tarea

add_task_dependency

admin

Marcar que una tarea depende de que otra esté completada

remove_task_dependency

admin

Quitar una dependencia previamente creada

list_task_dependencies

sesión válida

Listar las tareas que bloquean a una tarea dada

delete_task

admin

Eliminar una tarea

Uso

npm install
npm run build

Probar con el smoke test incluido

Ejercita todo el flujo (login, permisos denegados, CRUD de tareas) contra el servidor real vía stdio:

npm run build
npm run smoke

Registrar el servidor en Claude Code

claude mcp add admin-poc -- node /Users/ckastli/gm2/mcp-poc/dist/server.js

Luego, desde Claude, se puede pedir por ejemplo:

"Inicia sesión como admin (admin/admin123), crea un usuario member nuevo y asígnale una tarea."

Claude usará las herramientas MCP (login, create_user, create_task, etc.) para completar el pedido, respetando las reglas de negocio y permisos definidos en el servidor.

Desarrollo

npm run dev        # corre src/server.ts (stdio) directo con tsx, sin compilar
npm run dev:http   # corre src/httpServer.ts (Streamable HTTP) en localhost:8080

Deploy

El servidor está desplegado en Fly.io usando el transporte HTTP (src/httpServer.ts), con Docker (Dockerfile) y config en fly.toml.

fly deploy -a tasks-mcp-poc

Seguridad: MCP_API_KEY

Como el endpoint HTTP queda expuesto públicamente en internet (a diferencia del modo stdio, que solo corre localmente spawneado por Claude Code), src/httpServer.ts exige un bearer token en todas las requests antes de llegar a la lógica de negocio propia del MCP (login, tokens de sesión, etc. — esto es una capa extra, no un reemplazo):

Authorization: Bearer <MCP_API_KEY>

Si la variable de entorno MCP_API_KEY no está seteada, el middleware no se activa (uso solo aceptable en desarrollo local). En producción siempre debe estar seteada como secret de la plataforma, nunca en .env commiteado ni en el código.

Generar/rotar el valor:

# 1. Generar un valor aleatorio nuevo
API_KEY=$(node -e 'console.log(require("crypto").randomUUID())')

# 2. Cargarlo como secret en Fly (esto reinicia las máquinas automáticamente para aplicarlo)
fly secrets set MCP_API_KEY="$API_KEY" -a tasks-mcp-poc

# 3. Guardar $API_KEY en un gestor de secretos (1Password, Doppler, etc.) —
#    Fly no permite volver a leer el valor de un secret ya seteado.

Rotarlo periódicamente o ante sospecha de filtración es solo repetir esos tres pasos; no requiere cambios de código ni un nuevo fly deploy.

Estructura

src/
  types.ts                 tipos del dominio (derivados del schema de Drizzle)
  crypto-utils.ts           hashing de contraseñas
  auth.ts                   login/logout/verificación de sesión y rol
  mcp.ts                    factory createMcpServer(): registra las herramientas
  server.ts                 entry point stdio (uso local con Claude Code)
  httpServer.ts              entry point Streamable HTTP (uso remoto, Fly.io)
  db/
    schema.ts                tablas de Drizzle (users, tasks, task_dependencies, task_time_entries, sessions)
    client.ts                 cliente Drizzle sobre el driver HTTP de Neon
    seed.ts                    usuario admin semilla (idempotente)
  services/
    userService.ts            reglas de negocio de usuarios
    taskService.ts             reglas de negocio de tareas (incluye dependencias)
    timeTrackingService.ts      registro de tiempo trabajado por tarea
drizzle/
  *.sql                       migraciones generadas por drizzle-kit
scripts/
  smoke-test.ts                cliente MCP que ejercita el flujo completo (vía stdio)

Limitaciones (a propósito, es una PoC)

  • Las sesiones (tabla sessions) no se purgan automáticamente al expirar, solo al ser usadas.

  • Sin rate limiting, recuperación de contraseña, ni auditoría.

  • MCP_API_KEY es un único secreto compartido (no hay múltiples API keys ni scopes por cliente).

  • Las sesiones de transporte MCP viven en memoria del proceso (src/httpServer.ts): si la máquina de Fly se duerme por inactividad o se hace un fly deploy, esas sesiones se pierden y el cliente tiene que reconectar (el token de login, en cambio, persiste en Postgres). Es una decisión deliberada para mantener las cosas simples en esta PoC — la alternativa (persistir sesiones MCP en la base) es un cambio real de código, no de configuración.

Available Tools

16 tools
add_task_dependencyAgregar dependencia entre tareasA

Marca que una tarea no puede pasar de 'pendiente' hasta que otra tarea esté 'completada'. Requiere sesión con rol 'admin'.

ParametersJSON Schema
NameRequiredDescriptionDefault
tokenYesToken de sesión de un usuario admin
taskIdYesTarea que queda bloqueada
dependsOnTaskIdYesTarea que debe completarse primero

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden. It explains the effect (task cannot move from pending) and authentication need. It doesn't cover error states or reversibility, but the key behavioral trait is disclosed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Extremely concise: one sentence for action, one for requirement. No extraneous words, front-loaded with the purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple 3-parameter mutation tool with no output schema, the description covers the effect and prerequisite. It could mention success/error behavior but is reasonably complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and descriptions are adequate. The description adds minor context (token is admin, taskId is blocked, dependsOnTaskId must be completed first), but the schema already provides similar info.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb ('Marca que... no puede pasar'), the resource (task dependency), and the condition for the dependency. It distinguishes from the sibling 'remove_task_dependency'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description mentions the admin requirement but does not explicitly state when to use this tool versus alternatives like 'remove_task_dependency'. Usage context is implied but not fully spelled out.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

create_taskCrear tareaA

Crea una nueva tarea y la asigna a un usuario existente. Un admin puede asignarla a cualquier usuario; un member solo puede asignarla a sí mismo o a otro member.

ParametersJSON Schema
NameRequiredDescriptionDefault
titleYes
tokenYesToken de sesión
assignedToYesid del usuario al que se asigna la tarea
descriptionNo

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden. It discloses the assignment constraint, but omits behavioral details such as success response, default task status, error conditions (e.g., invalid token, nonexistent user), or side effects. It partially meets expectations but leaves gaps.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise with two sentences, no redundancy, and immediately states the purpose. Every sentence adds value: the action and the authorization nuance.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a create operation with 4 parameters, no output schema, and no annotations, the description covers the core action and authorization but lacks details on response format, error handling, and the optional description parameter. It is adequate but not fully comprehensive.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is only 50% (2 of 4 parameters have descriptions). The description does not add meaning beyond 'assigns to user', failing to compensate for undocumented parameters like title and description. The parameter 'token' is only described in the schema, not in the description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool creates a new task and assigns it to an existing user. This distinguishes it from sibling tools like create_user, delete_task, etc. The action and resource are explicit.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides important usage context by specifying authorization rules: admin can assign to any user, member only to themselves or another member. This guides when the tool is appropriate. However, it does not explicitly compare to alternatives like list_tasks or update_task_status.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

create_userCrear usuarioA

Crea un nuevo usuario (admin o member). Requiere sesión con rol 'admin'.

ParametersJSON Schema
NameRequiredDescriptionDefault
roleYes
tokenYesToken de sesión de un usuario admin
fullNameYes
passwordYes
usernameYes

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries full burden. It discloses the admin requirement but lacks details on error handling, return values, or duplicate checks.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence with no wasted words, front-loading the core action and requirement.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 5-param creation tool with no output schema, the description omits success/failure behavior, return value, and error scenarios, leaving significant gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is only 20% and the description adds minimal parameter insight beyond the role enum. Parameters like fullName and password remain undocumented.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it creates a new user (admin or member), matching the tool name and resource. The verb 'Crea' is specific and distinguishes it from sibling tools like delete_user.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly requires admin role session, providing clear context for when to use. No alternative tool is available for user creation, so no exclusions are mentioned.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

delete_taskEliminar tareaC

Elimina una tarea. Requiere sesión con rol 'admin'.

ParametersJSON Schema
NameRequiredDescriptionDefault
tokenYesToken de sesión de un usuario admin
taskIdYes

TDQS

C2.8/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It discloses the authorization requirement but does not mention behavioral traits like irreversibility, side effects (e.g., cascading deletions), or error conditions. Partial coverage only.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two short sentences, front-loaded with the action, and contains no extraneous information. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite having 2 required parameters, no output schema, and no annotations, the description is minimal. It lacks details on output, error handling, and expected behavior, making it incomplete for a deletion tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 50% (token described, taskId not). The tool description adds no additional meaning beyond the schema. Given low coverage, it should compensate but does not.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Elimina una tarea' (Deletes a task), specifying the verb and resource. It distinguishes from sibling tools like create_task or update_task_status. However, it does not mention whether deletion is permanent or cascading, just slightly reducing clarity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description lists a precondition: 'Requiere sesión con rol 'admin'.' This tells when to use (only if admin), but provides no guidance on when not to use, alternatives (e.g., update status), or context for choosing this tool over others.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

delete_userEliminar usuarioA

Elimina un usuario. Requiere sesión con rol 'admin'. No se puede eliminar el propio usuario ni uno con tareas asignadas o creadas por él.

ParametersJSON Schema
NameRequiredDescriptionDefault
tokenYesToken de sesión de un usuario admin
userIdYes

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses key preconditions (admin role, constraints on deletion) but does not explain post-conditions, error handling, or whether deletion is permanent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, no extraneous content. The action is front-loaded and every sentence adds value without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema and two parameters, the description covers essential constraints and preconditions. It lacks details on return value or error cases, but for a deletion tool this is reasonably complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 50% (token has description, userId lacks one). The description adds semantic constraints (admin requirement for token, restrictions on userId). It partially compensates for missing schema descriptions but does not fully specify parameter formats.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action 'Elimina un usuario' (delete user) and specifies constraints (admin role, cannot delete self or users with tasks). This distinguishes it from sibling tools like create_user or list_users.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to use (requires admin session) and when not to (cannot delete self or user with tasks). It provides clear usage context but does not mention alternative tools for similar operations.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_task_dependenciesListar dependencias de una tareaA

Lista las tareas que deben completarse antes de poder avanzar la tarea indicada.

ParametersJSON Schema
NameRequiredDescriptionDefault
tokenYesToken de sesión
taskIdYes

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden. It conveys a simple read operation but does not disclose details like whether dependencies are direct only, ordering, or behavior when none exist.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence, front-loaded with the action. Every word contributes to the purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given sibling tools and no output schema, description could mention the response structure or dependency type. It is adequate but not thorough.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 50% (token described, taskId not). Description does not add meaning beyond the schema for taskId, and token is already documented. Does not compensate for the missing schema description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool lists prerequisite tasks for a given task, using a specific verb ('Lista') and resource ('dependencias de una tarea'). It distinguishes from sibling tools like 'add_task_dependency' and 'remove_task_dependency'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use (to view dependencies), but lacks explicit guidance on when not to use or alternatives. No exclusions or context for differentiation from siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_tasksListar tareasA

Lista tareas. Un admin ve todas las tareas; un member solo ve las tareas que tiene asignadas.

ParametersJSON Schema
NameRequiredDescriptionDefault
tokenYesToken de sesión

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It discloses role-based filtering (admin sees all, member sees own tasks), adding significant behavioral context beyond just 'list tasks'.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences, front-loaded with purpose, every sentence adds value with no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple tool with one parameter and no output schema, the description covers the key behavioral nuance (role-based visibility) but could mention pagination or sorting if supported.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the description adds only marginal value by implying the token determines role. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool lists tasks and distinguishes between admin and member visibility, which differentiates it from sibling tools like list_task_dependencies or create_task.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides context for when to use (listing tasks) but lacks explicit guidance on when not to use or alternatives among sibling tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_task_time_entriesListar registros de tiempo de una tareaB

Lista los registros de tiempo (inicio, fin, motivo de pausa) de la tarea indicada, ordenados cronológicamente.

ParametersJSON Schema
NameRequiredDescriptionDefault
tokenYesToken de sesión
taskIdYes

TDQS

B3.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It discloses the fields returned and ordering but does not mention safety (read-only), required permissions, or potential side effects. Missing details on pagination, error handling, or authentication requirements beyond the token parameter.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence front-loading purpose and details without extraneous words. Efficiently conveys action, target, and output characteristics.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, so description partially compensates by mentioning returned fields and ordering. However, it omits return format (array?), authentication details, error scenarios, and any limits. Adequate for a simple listing but not fully complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 50% schema description coverage (only token described), the description adds no parameter-level information. It does not explain what 'taskId' represents or how to obtain it. The description focuses on output, not input, so parameters remain under-documented.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool lists time entries with specific fields (start, end, pause reason) for a given task, sorted chronologically. It uses a specific verb 'List' and resource 'registros de tiempo de una tarea', distinguishing it from sibling tools like start_task_timer and stop_task_timer.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives, no prerequisites or exclusions mentioned. It simply describes function without context on appropriate usage scenarios.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_usersListar usuariosA

Lista todos los usuarios del sistema. Requiere sesión con rol 'admin'.

ParametersJSON Schema
NameRequiredDescriptionDefault
tokenYesToken de sesión de un usuario admin

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description adds the auth requirement but lacks details on pagination, sorting, error handling, or output format. It is minimally sufficient.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences, front-loaded with the primary action, no unnecessary words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple list operation with one parameter and no output schema, the description is nearly complete; it covers purpose and key requirement, though output structure is not described.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already describes the 'token' parameter, but the description adds the context that the token must belong to an admin, which is not in the schema description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states the action ('Lista todos los usuarios del sistema') clearly, with a specific verb ('lista') and resource ('usuarios'), and distinguishes from sibling tools that list other entities like tasks.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description specifies the prerequisite (admin role) but does not provide guidance on when to use this tool versus alternatives like 'whoami' or exclusion criteria.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

loginIniciar sesiónA

Autentica a un usuario con username y password. Devuelve un token de sesión que debe pasarse en el resto de las herramientas. Usuarios demo: admin/admin123 (rol admin), empleado/empleado123 (rol member).

ParametersJSON Schema
NameRequiredDescriptionDefault
passwordYesContraseña
usernameYesNombre de usuario

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must carry the full burden. It mentions the return of a session token but does not disclose error handling, token expiry, or potential side effects. This is adequate but has gaps.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise: three sentences with front-loaded purpose, followed by output usage and demo users. Every sentence adds value without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple login tool with no output schema, the description covers the main aspects: authentication action, token output, and demo users. It lacks explicit token format or usage instructions, but is largely complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 100% schema coverage, the baseline is 3. The description adds value by providing concrete demo credentials (admin/admin123, empleado/empleado123), which help the agent understand valid parameter values.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: authenticates a user with username and password and returns a session token. It distinguishes itself from sibling tools like logout and whoami by being the entry point for authentication.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains that the returned token must be passed to other tools and provides demo credentials for testing. While it does not explicitly state when not to use it, the context is clear for a login tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

logoutCerrar sesiónB

Invalida un token de sesión activo.

ParametersJSON Schema
NameRequiredDescriptionDefault
tokenYesToken de sesión obtenido en 'login'

TDQS

B3.1/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description only states the basic action of invalidating a token. With no annotations, it lacks details on side effects (e.g., whether other sessions are affected), authentication requirements, or error conditions. Minimal disclosure beyond the core effect.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is very short (one sentence) and front-loaded with the verb. It is concise but could be slightly expanded without losing efficiency. No wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple one-parameter tool with no output schema, the description is mostly adequate. It explains the action and parameter origin. However, it could mention the result (e.g., 'subsequent requests with this token will fail') to be fully complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% for the single parameter. The description adds value by linking the token to the 'login' tool ("obtenido en 'login'"), clarifying the token's origin, which goes beyond what the schema provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action of invalidating an active session token ("Invalida un token de sesión activo"), which is specific and distinct from sibling tools like 'login' or 'whoami'. However, it could be more explicit about the overall effect (e.g., logging out the user).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives. While it logically follows 'login', the description does not state prerequisites or context (e.g., 'Call after user requests logout').

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

remove_task_dependencyQuitar dependencia entre tareasA

Elimina una dependencia previamente creada con 'add_task_dependency'. Requiere sesión con rol 'admin'.

ParametersJSON Schema
NameRequiredDescriptionDefault
tokenYesToken de sesión de un usuario admin
taskIdYes
dependsOnTaskIdYes

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description reveals the need for an admin session and the destructive nature, but lacks details on error handling or side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single, well-structured sentence that places the action and prerequisite upfront with no unnecessary words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema and low schema coverage, the description should explain parameter roles and outcome behavior; it only covers purpose and a prerequisite, missing key usage context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Only 33% of parameters have schema descriptions; the tool description adds no parameter-specific details beyond the schema, failing to compensate for low coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description explicitly states the tool removes a dependency, referencing 'add_task_dependency' to clearly distinguish its purpose from the sibling that creates dependencies.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description mentions the admin role requirement and that it removes dependencies created by a specific sibling, but does not provide when-not-to-use or alternatives for viewing dependencies.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

start_task_timerIniciar registro de tiempo en una tareaA

Crea un registro con la fecha/hora de inicio para la tarea indicada. Si el usuario ya tenía un registro activo en otra tarea, esa tarea queda pausada automáticamente (permite cambiar de tarea rápido). Solo puede hacerlo el usuario asignado o un admin.

ParametersJSON Schema
NameRequiredDescriptionDefault
tokenYesToken de sesión
taskIdYes

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Without annotations, the description carries full burden. It discloses auto-pause behavior and authorization requirements, which are key behavioral traits. It does not cover error or edge cases, but for a simple timer tool this is sufficient.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, each adding critical information: the primary action and the key behaviors. No redundancy, and the most important points are front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity and lack of output schema, the description covers the main purpose, the auto-pause feature, and authorization. It does not mention what happens if the task is already being timed or if the token is invalid, but these fall within acceptable gaps for a basic tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description adds minimal meaning beyond the schema: taskId is implied as the task to start. Since schema_description_coverage is only 50%, more detail on parameters (e.g., what constitutes a valid taskId) would be beneficial, but the description partially compensates by providing context.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it creates a start time record for a task, and distinguishes from sibling stop_task_timer by mentioning automatic pausing of previous timers. The verb and resource are specific.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains automatic pausing for task switching and restricts usage to assignee or admin. It does not explicitly compare to siblings like stop_task_timer, but the context is clear enough for an agent to infer when to use this tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

stop_task_timerDetener/pausar registro de tiempo en una tareaA

Cierra el registro de tiempo activo de la tarea indicada con la fecha/hora de fin. Opcionalmente acepta una razón y puede crear una tarea de seguimiento para otra persona (por ejemplo, si se pausa porque se está esperando una respuesta suya). Solo puede hacerlo el usuario asignado o un admin.

ParametersJSON Schema
NameRequiredDescriptionDefault
tokenYesToken de sesión
reasonNoMotivo de la pausa, ej: 'esperando respuesta de Juan'
taskIdYes
followUpTaskNoSi se indica, crea una tarea asignada a esa persona con este contenido

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden. It reveals that it closes time registration with end time, can create a follow-up task, and has access control. However, it doesn't mention side effects (e.g., notifications, record immutability) or return behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, front-loaded with main action, no redundant phrasing. Efficiently covers primary function, optional behavior with example, and access restriction.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite no output schema or annotations, the description adequately covers main action, optional parameters, a use case, and access control. Lacks return value hints but is otherwise complete for a relatively simple tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 75% (taskId lacks description). The description adds context for taskId ('de la tarea indicada') and explains the purpose of followUpTask beyond schema, including a concrete example. This compensates for the missing schema description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool stops active time tracking for a task ('Cierra el registro de tiempo activo'), specifies optional reason and follow-up task creation, and distinguishes from sibling 'start_task_timer'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear context for use (stopping a timer) and mentions a specific scenario (waiting for a response) and access restriction (only assigned user or admin), but lacks explicit when-not-to-use or comparison with alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

update_task_statusActualizar estado de tareaA

Actualiza el estado de una tarea (pendiente | en_progreso | completada). Solo puede hacerlo el usuario asignado o un admin.

ParametersJSON Schema
NameRequiredDescriptionDefault
tokenYesToken de sesión
statusYes
taskIdYes

TDQS

A3.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must fully disclose behavior. It mentions who can perform the update but lacks details on idempotency, side effects, return value, or error conditions. This is insufficient for a mutation tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences with no unnecessary words. The verb and resource are front-loaded, and every sentence provides essential information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the basic operation and constraints but omits expected input (token validity) and output behavior. For a simple 3-parameter tool with no output schema, it is adequate but not fully complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description adds meaning to the 'status' parameter by listing its enum values. However, it provides no additional context for 'token' or 'taskId'. With low schema coverage (33%), the description only partially compensates.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool updates the task status and lists the allowed values (pendiente, en_progreso, completada). It distinguishes from sibling tools like create_task, delete_task, and timer tools, making its purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description specifies who can use the tool (assigned user or admin), providing a clear constraint. However, it does not explicitly indicate when to use this tool versus alternatives, though no direct competitor exists among siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

whoamiVer usuario actualA

Devuelve los datos del usuario dueño del token de sesión.

ParametersJSON Schema
NameRequiredDescriptionDefault
tokenYesToken de sesión

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden. It mentions returning data but does not specify if it's read-only, any side effects, or authentication requirements beyond the token. The token parameter is required, implying auth, but not explicit.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, clear sentence with no wasted words. It is front-loaded and easy to parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple tool with one parameter and no output schema, the description is adequate. It conveys the core functionality. Minor gap: does not specify what data fields are returned, but that is acceptable without output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% coverage with a description for 'token'. The tool description adds no extra meaning beyond the schema. Baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool returns user data based on a session token. It uses a specific verb-resource pair ('devuelve los datos del usuario') and is distinct from siblings like 'list_users' or 'login'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage when needing current user details, but provides no explicit guidance on when not to use it or alternatives. For example, it does not mention that 'list_users' could be used for other users.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

TDQS

A3.5/5.0
Disambiguation5/5

All tools have clearly distinct purposes. There is no overlap between create/delete/update/list operations for tasks, users, dependencies, and time tracking. Authentication tools are separate.

Naming Consistency4/5

Most tools follow a consistent verb_noun pattern (e.g., create_task, list_tasks). The authentication tools (login, logout, whoami) break the pattern, but they are standard and easily recognizable.

Tool Count4/5

16 tools is slightly above the typical range but still reasonable for a task management server covering users, tasks, dependencies, time tracking, and authentication. Each tool serves a clear purpose.

Completeness3/5

The tool set covers core CRUD for users (create, delete, list) and tasks (create, delete, update status, list) but lacks update for users and task details (e.g., edit description, reassign). Also missing a get_task_by_id tool. Time tracking and dependencies are well-covered.

Maintenance

ActivityStale
ResponsivenessSyncing

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/cizar/tasks-mcp-poc'

If you have feedback or need assistance with the MCP directory API, please join our Discord server