Uses a Notion database as the task queue and optionally a Notion page for business memory. Provides tools to list tasks and agents, get task details and reports, create draft tasks, cancel draft tasks, approve tasks, and read the company's business memory.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@Narla MCP Connector draft a task for Narla Marketing to post our new product"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Work with your Narla AI agents from the assistant you already have open: ChatGPT, Claude or Cursor.
Narla installs AI agents inside a company: Narla Marketing (edits photos and video, writes and publishes posts, keeps the website and online shop up to date), Narla Ops (company systems and documents) and Narla Voice (answers customers by phone and WhatsApp). The team directs them in plain language. This connector, built on the open Model Context Protocol, lets the team do that from any MCP-capable assistant.
Tool | Scope | What it does |
| read | The agents installed for the company and what each one does |
| read | Recent tasks and their status, newest first |
| read | One task: its instructions, its status and the agent's report (what it did and what it changed) |
| read | The company's single source of truth: brand kit, services, prices, hours |
| write | Gives an agent a task in plain language. Saved as Draft: nothing runs yet |
| write | Voids a Draft task |
| approve | Approves a Draft task so the agent starts it. Requires |
Nothing runs without a person's approval. Every task starts as a Draft, and every finished task keeps a report. Narla Voice takes no instructions from staff; changes to it go through Narla Ops.
Tasks live in a Notion database (the queue the agents read). The connector only touches pages inside that one queue.
Related MCP server: Rootr MCP Server
npm install
npm run build
NARLA_DEMO=1 NARLA_TOKENS="$(openssl rand -hex 32):read,write" npm start # in-memory demo, no NotionWith Notion, copy .env.example, fill in a Notion integration token that has access only to the task queue (and, optionally, the business memory page), and start the server.
Clone this repository, run npm install && npm run build, then add to ~/.cursor/mcp.json:
{
"mcpServers": {
"narla": {
"command": "node",
"args": ["/path/to/narla-mcp/dist/stdio.js"],
"env": {
"NOTION_TOKEN": "secret_xxx",
"NARLA_QUEUE_DATA_SOURCE_ID": "your-data-source-id",
"NARLA_TASK_PREFIX": "NARLA-TASK",
"NARLA_SCOPES": "read,write"
}
}
}
}Cursor can also use the remote server: "url": "https://your-host/mcp" with header Authorization: Bearer <token>.
Deploy the HTTP server (any Node 20+ host). In the assistant's custom connector settings, add:
https://your-host/mcp/<your-token>The token in the path is for apps whose connector settings take only a URL. Treat that URL as a password. Clients that support headers should use Authorization: Bearer <token> with https://your-host/mcp instead.
Same as Cursor, in claude_desktop_config.json.
Variable | Required | Meaning |
| yes, unless | Notion integration token |
| yes | Data source id of the task queue |
| no | Task numbering prefix, e.g. |
| no | Notion page with the business memory |
| no | Value for the queue's |
| HTTP only |
|
| stdio only | Scopes for local mode. Default |
| HTTP only | Bind address and allowed |
The queue is expected to have these properties: Title (title), Status (select with Draft, Approved, Running, Done, Failed, Voided), Tier (select: Low, Medium, High), Result (text, written by the agent), and optionally Model (select).
Give each person their own token, with the smallest scope they need. Only the owner should have approve.
Tokens are held in memory only as SHA-256 hashes and compared in constant time.
The Notion integration should be shared with the queue and the memory page only. The connector refuses any page outside the configured queue.
The HTTP server is stateless and keeps no conversation data.
OAuth is on the roadmap; until then, rotate a token by changing NARLA_TOKENS and restarting.
Found a security issue? Write to contact@narla.digital rather than opening a public issue.
npm test # vitest: tools, scopes, HTTP auth, Notion store
npm run dev # HTTP server with tsxApache License 2.0. Copyright 2026 NARLA S.R.L.
Marks a Draft task as Voided, so it never runs.
| Name | Required | Description | Default |
|---|---|---|---|
| task_id | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true and idempotentHint=true, so the safety profile is covered. The description adds real value beyond them by specifying the exact state transition (Draft -> Voided) and its effect (the task will never run), which clarifies what 'destructive' means here.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One front-loaded sentence with no filler; the state change and its consequence arrive immediately.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a low-complexity, single-parameter mutation with no output schema, the description covers the action and effect adequately. It omits the failure mode for tasks that have already started, which the title implies but the description body never states.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the single required parameter task_id is never mentioned in the description. With only one parameter the burden is light, but the definition gives no hint about how a task is identified (ID format, source, etc.).
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Marks a Draft task as Voided') plus the state transition and consequence ('so it never runs'). That is enough to distinguish it from create_task/get_task/list_tasks, though it never names a sibling explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The title and the phrase 'a Draft task' imply the precondition that only unstarted tasks can be cancelled, which is useful routing context. However, the description never states when to prefer this over alternatives or what to do for a task already running.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Creates a task for one agent, in plain language. The task is saved as a Draft and does not run until a person approves it. Narla Voice does not take tasks; send changes for it to Narla Ops.
| Name | Required | Description | Default |
|---|---|---|---|
| tier | No | How much is at stake: Low, Medium or High. | Low |
| agent | Yes | Which agent: marketing (Narla Marketing), ops (Narla Ops). | |
| title | Yes | One line saying what should be done. | |
| instructions | Yes | What the agent should do, in plain language. Markdown is fine. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only cover the safety profile (not read-only, not destructive, not idempotent); the description adds the substantive lifecycle trait that the task is saved as a Draft and will not execute until a human approves it. It also discloses a non-obvious constraint that the Voice agent cannot receive tasks, which the agent enum alone would not reveal.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, front-loaded with purpose, then lifecycle, then routing constraint. Every sentence carries information an agent needs and none is wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a mutation tool with no output schema and full schema coverage, the description covers lifecycle, approval gating and a routing exclusion. The only mild gap is that it does not indicate what is returned (e.g., a task identifier) after creation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3; the description adds the meaningful clarification that the task is for exactly one agent (the 'agent' param is singular, not a list). It does not elaborate on tier or instructions semantics, which the schema already covers adequately.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Creates a task for one agent') and immediately clarifies the scope is a single agent. It is clearly distinguishable from siblings like get_task, list_tasks and cancel_task without opening either schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives an explicit when-not ('Narla Voice does not take tasks; send changes for it to Narla Ops') and indicates the task lands in a pre-approval Draft state. It does not, however, say how this relates to modifying an existing task versus creating a new one, so guidance is strong but not exhaustive.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Returns one task: its instructions, its status and the report the agent wrote (what it did and what it changed).
| Name | Required | Description | Default |
|---|---|---|---|
| task_id | Yes | The task id, as returned by list_tasks or create_task. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover the safety profile (readOnlyHint=true, openWorldHint=false), so the description's added value is the return shape — notably that the report contains what the agent did and what it changed. That is meaningful because no output schema exists. It omits error behavior for an unknown task_id, keeping it short of a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One sentence, front-loaded with the verb and the resource, and every clause (instructions, status, report) describes actual returned content. No filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-read tool with annotations covering safety, the description fills the most important gap: with no output schema, it tells the agent what comes back. Missing only failure-mode behavior for invalid ids.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with a single documented parameter, so the schema already explains task_id fully. The description adds no format, validation, or lookup semantics beyond what is structured. Baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('Returns one task') and enumerates the payload: instructions, status, and the agent's report. The singular framing implicitly contrasts with list_tasks, though no sibling is named explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use guidance, prerequisites, or alternatives are given in the description. The only usage hint ('as returned by list_tasks or create_task') lives in the schema's task_id description, not the tool description.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Lists the Narla agents installed for this company and what each one does.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=false, so the safety profile is covered. The description adds scope context (company-scoped, not global) and hints at the return content (per-agent purpose), but does not describe result shape or ordering.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single efficient sentence with the resource and scope front-loaded and no filler. It is appropriately sized, though it is terse enough to leave the aforementioned usage gaps.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a no-parameter, read-only listing tool with annotations covering the safety profile, the description supplies everything an agent needs: what is listed, whose agents, and that per-agent descriptions are included. No output schema is needed given the simple return.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so there is nothing for the description to disambiguate; the baseline of 4 applies. No parameter information is needed or missing.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ("Lists") and resource ("Narla agents installed for this company"), plus the scope of returned content ("what each one does"). It is clearly distinct from the task-oriented siblings (list_tasks, get_task), though it does not explicitly name or contrast them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied: an agent infers this is the tool for discovering available agents. There is no explicit when-to-use guidance, no prerequisites, and no mention of alternatives, though the sibling set does not overlap with this resource.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Lists the most recent tasks, newest first, with their status. Filter by status to see, for example, what is waiting for approval (Draft) or what is finished (Done).
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | How many tasks to return. | |
| status | No | Only tasks with this status. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=false, so the safety profile is covered. The description adds the newest-first ordering, which is useful behavioral context, but says nothing about the default result count or pagination beyond the schema's limit parameter.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences with the sorting behavior front-loaded and the filter guidance second; no filler and no repetition of the tool name or schema fields verbatim.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only list tool with full schema coverage and annotations carrying the safety profile, the description covers scope, ordering, and filtering adequately. Return-shape details are only lightly touched ('with their status'), which is a minor gap given no output schema exists.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3, but the description adds real semantic value by interpreting enum values in workflow terms (Draft = awaiting approval, Done = finished). The limit parameter is left entirely to the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Lists) and resource (tasks) plus ordering (newest first) and the included field (status). It is clearly distinct from get_task (single task), create_task, and cancel_task, though it never names those siblings explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives concrete usage context by mapping status filters to real scenarios ('what is waiting for approval (Draft)', 'what is finished (Done)'), so an agent knows when to reach for the status parameter. It stops short of stating when not to use this tool or pointing to list_agents/get_task as alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Returns the company's business memory, the single source of truth every agent reads: brand kit, services, prices, opening hours and approved answers.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=false, covering the safety profile. The description adds useful transparency by listing exactly what data is returned, which is important since there is no output schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no wasted words. It states the action first, then qualifies it with the source-of-truth context and a compact content list.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a parameterless read tool with annotations covering safety and closed-world behavior, the description provides enough context: it identifies the resource, its authoritative role, and the categories of data returned. No output schema exists, and the content list adequately compensates.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, and per the rubric zero parameters sets a baseline of 4. The description adds no parameter details because none are needed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb (Returns) and resource (the company's business memory), then enumerates its contents (brand kit, services, prices, opening hours, approved answers). No sibling tool overlaps with this resource, so an agent can identify it immediately.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'the single source of truth every agent reads' gives clear context for when to use the tool, implying it should be consulted for authoritative company information. It does not name alternatives or when-not-to-use conditions, but no sibling tool provides this data.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
v0.1.0cancel_taskcreate_taskget_tasklist_agentslist_tasksread_business_memoryScored across 6 tools
Each tool targets a distinct resource and action: list_agents (agents), list_tasks/get_task (tasks at collection vs single level), read_business_memory (memory), and create_task/cancel_task (distinct mutations). There is no overlap that would cause misselection.
All six tools follow a clean verb_noun pattern (list_agents, list_tasks, get_task, read_business_memory, create_task, cancel_task) in consistent snake_case. Minor get/read variation is idiomatic and predictable.
Six tools is well-scoped for an agent/task connector: enough to cover discovery, inspection, creation, and cancellation without bloat.
The task surface has create, list, get, and cancel, but no update tool and no approve tool, even though the workflow explicitly depends on a person approving Drafts before they run. Agents hit a dead end after creating a task, unable to approve or edit it.
Let AI agents query data and act across all your business apps via MCP.
Task management your AI agents can actually run. One line becomes a context-ready task over MCP.
MCP server for your apps' tools and custom tools, plus hosted AI agents and approval-gated workflows
Talk to your public-facing AI from any MCP client — Claude, ChatGPT, Cursor, Cline, Windsurf.
