redmine-mcp connects AI assistants to Redmine over MCP, exposing 9 tool groups for authentication, Redmine data operations, and a raw API escape hatch.
Authenticate with browser OAuth2 PKCE (or API key) and inspect session, login, permissions, and access.
Work with issues: list, get, create, update, delete, add notes, manage relations, attach uploads, filter/paginate, and run saved queries.
Manage projects: list, get, create, update, memberships/member roles, and issue categories.
Inspect users: current user, user lookup, update own account, and show my access via visible projects/roles.
Track time: list, log, update, and delete time entries; list time activities.
Manage wiki pages: list, get, save, and delete.
Handle files: attachment metadata, download base64 content, upload files, list project files, and list documents.
Search Redmine globally across issues, wiki pages, documents, files, and news.
List and run saved issue queries.
With --org-mode, use admin metadata tools for trackers, statuses, priorities, roles, groups, custom fields, news, and versions.
Use redmine_request as an escape hatch for arbitrary Redmine REST paths (writes require --allow-generic-write).
Provides tools for interacting with a Redmine instance via its REST API, covering issues, projects, users, time tracking, wiki pages, files/attachments, search, and saved queries, with OAuth 2.0 or API-key authentication.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@redmine-mcp list my open issues assigned to me"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
MCP server connecting Redmine to AI assistants: issues, projects, users, time tracking, wiki, files, search, and saved queries over the Redmine REST API.
Sign-in happens in the system browser via OAuth 2.0 (authorization code + PKCE, Redmine 6.1+), with an encrypted local token cache and silent refresh. Pre-6.1 servers use an API-key binding instead.
npm install -g @devyhan/redmine-mcpOr run without installing:
npx -y @devyhan/redmine-mcp --redmine-url https://redmine.example.comStraight from GitHub (tracks the default branch instead of a release):
npx -y github:devyhan/redmine-mcp --redmine-url https://redmine.example.comNode 22.23.4+, 24.22.1+, or 26.12.1+ required (October 2026 security floor; Node 20 and below are EOL and unpatched).
Related MCP server: Redmine MCP Server
Register an OAuth2 application in Redmine (Administration → OAuth2
Applications) with redirect URI http://127.0.0.1:<port>/callback and the
permission scopes you need (see permissions below).
Sign in once:
redmine-mcp --redmine-url https://redmine.example.com \
--client-id <ID> --client-secret <SECRET> loginPre-6.1 servers (or no browser): set REDMINE_MCP_API_KEY and skip login
entirely, or redmine-mcp --redmine-url … login --api-key <KEY> once.
Add to your MCP client:
{
"mcpServers": {
"redmine": {
"command": "redmine-mcp",
"args": ["--redmine-url", "https://redmine.example.com"]
}
}
}In the conversation, call session_status first. If no session is signed
in, call auth_begin_login, finish in the browser, then auth_login_status.
Command | What it does |
| Speak MCP over stdio |
| Sign in |
| Clear the cached session |
| Session, reachability, consent checklist |
| Tool groups and the scopes they need |
Every flag has a REDMINE_MCP_* environment fallback; flags win. See
redmine-mcp --help and configuration.
9 groups, 55 tools (44 in the personal preset; admin needs --org-mode):
Group | Tools |
| list, get, create, update, add_note, delete, list/create/delete_relation |
| list, get, create, update, list_memberships, add/update/remove_member, list_categories |
| get_current, get, list, update_current |
| list_entries, log, update_entry, delete_entry, list_activities |
| list_pages, get_page, save_page, delete_page |
| get_attachment, download, upload, list_project_files, list_documents |
| query |
| list, run |
| list_trackers/statuses/priorities/roles/groups/custom_fields/news, list/create/update/delete_version |
| auth_begin_login, auth_login_status, session_status, redmine_list_permissions, redmine_request |
Full reference: tools. Small-context clients: --discovery
collapses the catalogue to discover_tools/call_tool plus the session tools.
Why redmine-mcp · Auth · Configuration · Tools · Examples · Security · Agents · Troubleshooting
Research report — reference-repo analysis, OAuth design, API coverage
npm install
npm test # typecheck + node:test suite (offline, stubbed network)
npm run contract # live drift check against a Redmine (needs REDMINE_MCP_URL + creds)MIT
Starts a Redmine OAuth2 sign-in in the system browser and returns immediately. Ask the user to finish there, then call auth_login_status. Never ask for credentials, an API key, or an authorization code in the conversation.
Inputs: scopes.
Reports where the background browser sign-in has got to: pending, signed in, or failed with the fix. Never returns a token.
Inputs: no named parameters.
Downloads an attachment and returns base64 bytes plus metadata. Text files come back decoded as well. Refuses files over maxBytes with metadata only.
Inputs: id (required), maxBytes.
Returns one attachment metadata (filename, size, content type, download URL).
Inputs: id (required).
Lists the documents of a project's Documents module. Needs Redmine 7.1+.
Inputs: project_id (required).
Lists the files attached to a project's Files module.
Inputs: project_id (required).
Uploads raw bytes and returns an upload token. Reference it from issues_create or issues_update via uploads: [{token, filename}]. Tokens expire with the session.
Inputs: filename (required), content_base64 (required), content_type.
Appends a journal note to an issue without changing anything else.
Inputs: id (required), notes (required), private_notes.
Creates an issue in a project. Returns the created issue (with its id).
Inputs: subject (required), project_id (required), uploads, due_date, +13 more.
Links two issues (relates, blocks, duplicates, precedes, …).
Inputs: issue_id (required), issue_to_id (required), delay, relation_type.
Deletes an issue. This cannot be undone.
Inputs: id (required).
Removes an issue relation by its relation id.
Inputs: id (required).
Returns one issue by id, with optional associated data via include. A 403 means the issue sits in a project you cannot see or is private to someone else — call users_my_access to list what is visible instead of retrying the id.
Inputs: id (required), include. Returns: object
Lists issues with Redmine filters (project, tracker, status, assignee, saved query). Returns the page plus total_count; pass offset to walk further pages.
Inputs: sort, limit, offset, include, +6 more. Returns: issues, total_count
Lists the relations (blocks, duplicates, …) of an issue.
Inputs: issue_id (required).
Updates issue attributes; only the fields passed change. Pass notes to append a journal entry with the update.
Inputs: id (required), notes, subject, uploads, +13 more.
Adds a user to a project with the given roles.
Inputs: user_id (required), role_ids (required), project_id (required).
Creates a project. Returns the created project (with its id).
Inputs: name (required), identifier (required), homepage, is_public, +5 more.
Returns one project by id or identifier, with optional associated data.
Inputs: id (required), include.
Lists visible projects. Returns the page plus total_count.
Inputs: limit, offset, include. Returns: projects, total_count
Lists the issue categories of a project with their ids and assignees.
Inputs: project_id (required).
Lists the members of a project with their roles.
Inputs: project_id (required), limit, offset.
Removes a project membership by its membership id.
Inputs: id (required).
Updates project attributes; only the fields passed change.
Inputs: id (required), name, homepage, is_public, +3 more.
Sets the roles of a project membership by its membership id.
Inputs: id (required), role_ids (required).
Lists the visible saved issue queries with their filters and columns.
Inputs: limit, offset.
Runs a saved issue query and returns the matching issues plus total_count.
Inputs: query_id (required), limit, offset.
Lists the tool groups, the Redmine permission scopes each needs, and which groups are enabled. The first call when something returns 403.
Inputs: no named parameters.
Escape hatch: any Redmine REST path with the signed-in credential. GET by default; write methods need --allow-generic-write. Prefer the typed tools: they page, project, and explain errors.
Inputs: path (required), body, query, method.
Searches across issues, wiki pages, documents, files, and news. Returns ranked results with type, title, and excerpt.
Inputs: q (required), limit, scope, offset.
Call once first. Reports the cached account, whether Redmine is reachable with a live GET /users/current.json, and the consent checklist for this configuration.
Inputs: no named parameters.
Deletes a time entry. This cannot be undone.
Inputs: id (required).
Lists the time-tracking activities (Design, Development, …) with their ids.
Inputs: no named parameters.
Lists time entries filtered by issue, project, user, or date range.
Inputs: to, from, limit, offset, +3 more.
Logs time on an issue or a project. Returns the created entry (with its id).
Inputs: hours (required), comments, issue_id, spent_on, +2 more.
Updates a time entry; only the fields passed change.
Inputs: id (required), hours, comments, spent_on, +1 more.
Returns one user by id, with optional membership and group data.
Inputs: id (required), include.
Returns the signed-in account (id, login, name, mail, admin flag) from /users/current.json. The live identity check; session_status reports the cached copy.
Inputs: no named parameters.
Answers "what can I see" before anything 403s: admin flag, group memberships, and every visible project with its roles. Check this before querying issues or users outside your projects — a 403 almost always means the object lives where this list does not reach, not that the call was malformed.
Inputs: no named parameters. Returns: admin, login, groups, projects
Updates the signed-in account name or mail address.
Inputs: mail, lastname, firstname.
Deletes a wiki page. This cannot be undone.
Inputs: title (required), project_id (required).
Returns one wiki page with its text and attachments.
Inputs: title (required), project_id (required), version.
Lists the wiki page index of a project.
Inputs: project_id (required).
Creates the page when it does not exist, otherwise saves a new version.
Inputs: text (required), title (required), project_id (required), comments.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 44 tools
Most tools map cleanly to one resource+action (issues_*, projects_*, wiki_*, time_*, files_*), so selection is usually obvious. The only real confusion zone is the identity layer—session_status, users_get_current, auth_begin_login, auth_login_status, and users_my_access all touch 'who am I / am I signed in', and their descriptions have to explicitly cross-reference each other to sort it out. redmine_request also overlaps every typed tool, though it is clearly framed as a fallback.
The dominant pattern is resource_verb_noun snake_case (issues_create, projects_remove_member, time_list_entries, wiki_get_page), which is predictable and readable. Deviations are minor: session_status and auth_login_status are noun-first with no verb, and redmine_list_permissions/redmine_request use a server-name prefix rather than a resource prefix. No mixed casing or chaotic verb styles.
44 tools is heavy, but Redmine is genuinely a broad domain (projects, issues, wiki, files, time, users, queries, search), so most tools earn their place. Still, the set is larger than it needs to be: the five session/auth/identity tools and the generic redmine_request could be consolidated, and several list operations could be parameterized rather than split.
Coverage is strong: issues have full CRUD plus notes and relations, projects have list/get/create/update plus full membership management, wiki has list/get/save/delete, time entries are fully covered, and files/download/upload/search/queries are present. Gaps are minor but real—no users_list, no project delete, and no lookups for trackers/statuses/priorities that issue creation typically needs—though redmine_request serves as a workaround for all of them.
Query your team's drift, vulnerability, and upgrade data from any AI assistant. OAuth 2.1, 51 tools.
Manage Redbooth tasks, task lists, comments, tags and files from Claude and other AI assistants.
Connects AI assistants to TrackingTime for querying time entries, projects, tasks, customers, and team data using natural language.
AI-native project and portfolio management platform for PMOs. OAuth + PAT.
