OpenProject CE MCP Server

Overview Schema Source Related Servers Discussions Admin

Upload attachment

upload_attachment

Attaches a local file to an existing OpenProject work package, wiki page, meeting, document, budget, or comment, checking file existence and size locally before transfer.

Instructions

Attach a local file to a work package, wiki page, meeting, document, budget or comment.

Use it when a file that already exists on the server's machine should be added to an existing container. The file's existence and its size against this instance's maximumAttachmentFileSize are checked locally first, so an oversized file fails instantly instead of after the transfer.

Returns the created attachment row (id, file_name, size_bytes, content_type, description, author, created_at, status) — the id feeds download_attachment.

Pitfalls: uploading to a container needs edit permission on that container, so to give a brand-new work package its files use create_work_package(attachment_paths=[...]) instead, which uploads the files unattached and claims them on create. Instances may restrict extensions; a rejected type comes back as validation_failed with the allowlist hint and nothing is stored. The stored name comes from file_name (or the path's basename), never from the multipart part.

Related: list_attachments shows what a container already holds; download_attachment is the reverse direction.

Input Schema

Name	Required	Description
`file_name`	No	Name to store the file under, with extension. This is the only thing that decides the stored name: OpenProject ignores the multipart filename and re-detects the content type from the bytes. Defaults to the basename of file_path.
`file_path`	Yes	Absolute path of the file to upload, on the machine running this server. Existence and size are checked locally before anything is transferred.
`description`	No	Optional caption shown next to the file in OpenProject.
`container_id`	Yes	Numeric id of the container: work package id, wiki page id, meeting id, document id, budget id, or activity id for 'comment'.
`container_type`	Yes	Kind of object to attach the file to. Use 'comment' to attach to a work-package comment and pass its activity id as container_id.

Output Schema

Name	Required	Description	Default
`id`	No
`author`	No
`status`	No
`file_name`	No
`created_at`	No
`size_bytes`	No
`description`	No
`content_type`	No

Schema Changelog

Changes observed during successful MCP inspections.

Changed32 schema fields changedv0.4.0Oct 24, 2026

removedOutput schema / description
```
Removed value: -"One attached file."
```

changedOutput schema / properties / author / anyOf

Previous value: -[
-  {
-    "additionalProperties": false,
-    "description": "A reference to another resource. Canonical output shape.",
-    "properties": {
-      "id": {
-        "anyOf": [
-          {
-            "type": "integer"
-          },
-          {
-            "type": "string"
-          },
-          {
-            "type": "null"
-          }
-        ],
-        "default": null,
-        "description": "Resource id."
-      },
-      "name": {
-        "anyOf": [
-          {
-            "type": "string"
-          },
-          {
-            "type": "null"
-          }
-        ],
-        "default": null,
-        "description": "Human-readable name."
-      }
-    },
-    "type": "object"
-  },
-  {
-    "type": "null"
-  }
-]New value: +[
+  {
+    "additionalProperties": false,
+    "properties": {
+      "id": {
+        "type": [
+          "integer",
+          "string",
+          "null"
+        ]
+      },
+      "name": {
+        "type": [
+          "string",
+          "null"
+        ]
+      }
+    },
+    "type": "object"
+  },
+  {
+    "type": "null"
+  }
+]

removedOutput schema / properties / author / default
```
Removed value: -null
```
removedOutput schema / properties / author / description
```
Removed value: -"User who uploaded the file."
```

removedOutput schema / properties / content_type / anyOf

Removed value: -[
-  {
-    "type": "string"
-  },
-  {
-    "type": "null"
-  }
-]

removedOutput schema / properties / content_type / default
```
Removed value: -null
```

removedOutput schema / properties / content_type / description

Removed value: -"MIME type detected by OpenProject from the bytes."

addedOutput schema / properties / content_type / type
```
Added value: +[
+  "string",
+  "null"
+]
```

removedOutput schema / properties / created_at / anyOf

Removed value: -[
-  {
-    "type": "string"
-  },
-  {
-    "type": "null"
-  }
-]

removedOutput schema / properties / created_at / default
```
Removed value: -null
```
removedOutput schema / properties / created_at / description
```
Removed value: -"ISO 8601 UTC upload timestamp."
```
addedOutput schema / properties / created_at / type
```
Added value: +[
+  "string",
+  "null"
+]
```

removedOutput schema / properties / description / anyOf

Removed value: -[
-  {
-    "type": "string"
-  },
-  {
-    "type": "null"
-  }
-]

removedOutput schema / properties / description / default
```
Removed value: -null
```
removedOutput schema / properties / description / description
```
Removed value: -"Caption stored with the file."
```
addedOutput schema / properties / description / type
```
Added value: +[
+  "string",
+  "null"
+]
```

removedOutput schema / properties / file_name / anyOf

Removed value: -[
-  {
-    "type": "string"
-  },
-  {
-    "type": "null"
-  }
-]

removedOutput schema / properties / file_name / default
```
Removed value: -null
```
removedOutput schema / properties / file_name / description
```
Removed value: -"Stored file name including extension."
```
addedOutput schema / properties / file_name / type
```
Added value: +[
+  "string",
+  "null"
+]
```

removedOutput schema / properties / id / anyOf

Removed value: -[
-  {
-    "type": "integer"
-  },
-  {
-    "type": "string"
-  },
-  {
-    "type": "null"
-  }
-]

removedOutput schema / properties / id / default
```
Removed value: -null
```

removedOutput schema / properties / id / description

Removed value: -"Attachment id; pass it to download_attachment."

addedOutput schema / properties / id / type

Added value: +[
+  "integer",
+  "string",
+  "null"
+]

removedOutput schema / properties / size_bytes / anyOf

Removed value: -[
-  {
-    "type": "integer"
-  },
-  {
-    "type": "null"
-  }
-]

removedOutput schema / properties / size_bytes / default
```
Removed value: -null
```
removedOutput schema / properties / size_bytes / description
```
Removed value: -"File size in bytes."
```
addedOutput schema / properties / size_bytes / type
```
Added value: +[
+  "integer",
+  "null"
+]
```

removedOutput schema / properties / status / anyOf

Removed value: -[
-  {
-    "type": "string"
-  },
-  {
-    "type": "null"
-  }
-]

removedOutput schema / properties / status / default
```
Removed value: -null
```

removedOutput schema / properties / status / description

Removed value: -"Virus-scan state: 'uploaded'/'scanned' are downloadable, 'quarantined' is not, anything else is still being scanned."

addedOutput schema / properties / status / type
```
Added value: +[
+  "string",
+  "null"
+]
```

First observedv0.1.0Aug 12, 2026

TDQS

A4.6/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Well beyond the annotations (which only say non-readonly, non-destructive, non-idempotent), it discloses local existence/size pre-checks against maximumAttachmentFileSize, the edit-permission requirement, extension allowlist enforcement with validation_failed and no partial storage, and the naming rule that ignores the multipart part. That is exactly the failure-mode context an agent needs for a write operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with purpose and usage, then return value, pitfalls, and related tools in clearly separated blocks. Slightly long, and the return-field list is arguably redundant with the output schema, but nearly every line carries actionable information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite being a multi-container mutation with 5 parameters, the description covers preconditions, failure modes, naming, permissions, and sibling routing. Since an output schema exists, the brief return summary is sufficient rather than necessary.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and the schema already documents file_name precedence, container_id per-type meaning, and the container_type enum. The description's notes on file_name and 'comment' mapping largely restate what the schema provides, so it adds little parameter-level meaning beyond baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Opens with a specific verb and resource (attach a local file) and enumerates the exact container kinds it targets. It is immediately distinguishable from siblings like list_attachments and download_attachment, which are named as the reverse/other directions.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

States the selection condition ('when a file that already exists on the server's machine should be added to an existing container') and gives an explicit alternative with the case that selects it: create_work_package(attachment_paths=[...]) for brand-new work packages because uploading requires edit permission on the container.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server