OpenProject CE MCP Server
by kar-thik
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| OPENPROJECT_URL | No | Instance root URL, e.g. https://openproject.example.com. A trailing /api/v3 is tolerated and stripped. | |
| OPENPROJECT_API_KEY | No | API key from My account → Access tokens. Sent as HTTP Basic apikey:<token>. | |
| OPENPROJECT_MCP_OTEL | No | Reserved for OpenTelemetry tracing. Accepted but not yet wired to anything in this release. | false |
| OPENPROJECT_MCP_DISABLE | No | Comma-separated group tags to remove whole tool groups at startup. | |
| OPENPROJECT_OAUTH_TOKEN | No | OAuth bearer token, as an alternative to the API key. | |
| OPENPROJECT_MCP_INSECURE | No | Allow --transport http to start without auth tokens. Local development only. | false |
| OPENPROJECT_MCP_CACHE_TTL | No | TTL in seconds for the metadata cache (statuses, types, priorities, schemas). | 300 |
| OPENPROJECT_MCP_CA_BUNDLE | No | Path to a CA bundle (PEM) for instances behind a private CA. TLS is always verified. | system trust store |
| OPENPROJECT_MCP_HTTP_HOST | No | Bind address for --transport http. | 127.0.0.1 |
| OPENPROJECT_MCP_HTTP_PORT | No | Port for --transport http. | 8000 |
| OPENPROJECT_MCP_LOG_LEVEL | No | DEBUG, INFO, WARNING, ERROR or CRITICAL (case-insensitive). | INFO |
| OPENPROJECT_MCP_READ_ONLY | No | Serve read tools only: every write, destructive and admin tool is removed at startup. | false |
| OPENPROJECT_MCP_LOG_BODIES | No | Log request/response bodies — only at DEBUG level, with credentials redacted. Development use only. | false |
| OPENPROJECT_MCP_LOG_FORMAT | No | text or json. Logs always go to stderr. | text |
| OPENPROJECT_MCP_ADMIN_TOOLS | No | Expose the three admin-gated membership write tools (hidden by default). | false |
| OPENPROJECT_MCP_AUTH_TOKENS | No | Comma-separated bearer tokens accepted by --transport http. Every request must carry Authorization: Bearer <token>. | |
| OPENPROJECT_MCP_MAX_RETRIES | No | Retry budget for idempotent requests. | 3 |
| OPENPROJECT_MCP_DOWNLOAD_DIR | No | Directory where download_attachment writes files (created if missing; default is relative to the server's working directory). | ./openproject-downloads |
| OPENPROJECT_MCP_POOL_TIMEOUT | No | Seconds to wait for a free connection from the pool. | 5 |
| OPENPROJECT_MCP_READ_TIMEOUT | No | Seconds to wait for response data. | 30 |
| OPENPROJECT_MCP_WRITE_TIMEOUT | No | Seconds to wait while sending request data (uploads). | 60 |
| OPENPROJECT_MCP_ACCEPT_LANGUAGE | No | Sent as the Accept-Language header; OpenProject localizes validation messages accordingly. | |
| OPENPROJECT_MCP_CONNECT_TIMEOUT | No | Seconds to wait for a TCP/TLS connection to OpenProject. | 10 |
| OPENPROJECT_MCP_MAX_CONNECTIONS | No | Connection pool size toward OpenProject. | 10 |
| OPENPROJECT_MCP_MAX_DOWNLOAD_MB | No | Size cap for attachment downloads, in MiB. | 100 |
Capabilities
Server capabilities have not been inspected yet.
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
No tools | |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/kar-thik/openproject-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server