Skip to main content
Glama
SheetMaster Todo MCP

SheetMaster Todo MCP

by asisrasyid

SheetMaster Todo & Finance MCP

Remote MCP server for the unified SheetMaster Todo and personal finance REST API v3.

Authentication

Remote MCP requests use OAuth 2.1 with Supabase as the authorization server. Each ChatGPT user authorizes the MCP app once, and the resulting Bearer token is forwarded to the REST API as that user's Supabase session. The MCP does not store user tokens and does not require a shared user API key in Vercel.

The frontend's /oauth/consent page is the Supabase OAuth authorization path. It shows the signed-in user what the MCP client is requesting, then approves or denies the authorization. Access-token refresh is handled by the OAuth client and Supabase token endpoint, so users do not log in for every action.

For local stdio usage only, set the SheetMaster REST API URL and API key in the environment before starting Codex:

export SHEETMASTER_API_URL="https://todoappsapi.vercel.app/api"
export SHEETMASTER_API_KEY="sm_live_your_key"

Do not commit the key or put it in .mcp.json.

Related MCP server: TickTick MCP Server

Deploy to Vercel

  1. Import this repository into Vercel.

  2. Set these Vercel environment variables:

    • SHEETMASTER_API_URL=https://todoappsapi.vercel.app/api

    • MCP_RESOURCE_URL=https://YOUR_PROJECT.vercel.app/api/mcp

    • MCP_PROTECTED_RESOURCE_METADATA_URL=https://YOUR_PROJECT.vercel.app/.well-known/oauth-protected-resource

    • SUPABASE_AUTH_ISSUER=https://YOUR_PROJECT_REF.supabase.co/auth/v1

    MCP_RESOURCE_URL must exactly match the MCP URL that will be entered in ChatGPT. Do not set a shared SHEETMASTER_API_KEY for the remote OAuth flow.

  3. In Supabase Dashboard → Authentication → OAuth Server, enable the OAuth server, set the Authorization Path to /oauth/consent, and enable Dynamic Client Registration if it is available for the ChatGPT client.

  4. Deploy and use https://YOUR_PROJECT.vercel.app/api/mcp as the remote MCP URL.

  5. In the ChatGPT app configuration, choose OAuth authentication. ChatGPT will discover the protected-resource metadata, redirect to the SheetMaster consent page, and keep the resulting authorization for later requests.

The MCP server calls the REST API with Authorization: Bearer <supabase token> and sends JSON action envelopes. The default upstream timeout is 25 seconds, below the REST API function timeout. Write operations are never retried automatically, preventing duplicate tasks.

The OAuth protected-resource metadata is served at /.well-known/oauth-protected-resource. The API-key headers remain supported for backward-compatible custom clients, and local stdio still uses SHEETMASTER_API_KEY.

Tools

  • sheetmaster_add is the primary single gate for creating a Todo, expense, income, or transfer. It requires an explicit entryType so money requests cannot be silently routed to Todo. For expenses without an account, it checks balances and uses the safest sufficient recommended account; if no safe account exists, it returns a confirmation state instead of writing.

  • get_boards, get_board

  • get_task

  • create_task, update_task, move_task, delete_task

  • finance_get_overview, finance_get_insights, finance_get_accounts, finance_recommend_account, finance_get_categories

  • finance_list_transactions (filters, amount bounds, and pagination), finance_find_possible_duplicates

  • finance_get_budgets, finance_list_recurring_rules

  • finance_add_account, finance_update_account

  • finance_add_category, finance_update_category

  • finance_add_transaction, finance_update_transaction, finance_delete_transaction

  • finance_transfer, finance_set_budget, finance_update_budget

  • finance_add_recurring_rule, finance_update_recurring_rule, finance_delete_recurring_rule

Finance write tools require confirm: true in the MCP schema. The client should ask for confirmation of the exact account, category, amount, and date before invoking them. Amounts are integer strings in IDR (rupiah), and should not contain decimal separators.

The sheetmaster_add tool is the recommended entry point for mixed Todo and Finance requests. Use entryType=todo only for tasks, reminders, and work items; use expense for shopping, spending, and payments; income for money received; and transfer for moving money between accounts.

For expenses and transfers, the MCP performs a fresh balance preflight through finance_recommend_account before writing. If the selected source account cannot cover the amount, the write is rejected unless the client explicitly passes allowNegativeBalance: true after the user approves the overdraft.

These tools match the REST API actions currently permitted for SheetMaster API keys. User-session-only actions are intentionally not exposed by this MCP server.

Available Tools

14 tools
add_assigneeC

Assign a user to a task.

Inputs: taskId (required), userId (required).

add_task_labelC

Attach a label to a task.

Inputs: taskId (required), labelId (required).

create_labelC

Create a label on a board.

Inputs: name (required), color (required), boardId (required).

create_subtaskC

Create a subtask under a task.

Inputs: title (required), taskId (required).

create_taskC

Create a task in a specific board column.

Inputs: title (required), boardId (required), columnId (required), priority.

delete_subtaskB

Permanently delete a subtask.

Inputs: subTaskId (required).

delete_taskC

Permanently delete a task.

Inputs: taskId (required).

get_boardB

Get a board with its columns, tasks, members, and labels.

Inputs: boardId (required).

get_boardsB

List all Todo boards available to the authenticated user.

Inputs: no named parameters.

move_taskC

Move a task to another column. Approval may be required.

Inputs: taskId (required), position (required), toColumnId (required).

remove_assigneeC

Unassign a user from a task.

Inputs: taskId (required), userId (required).

remove_task_labelC

Remove a label from a task.

Inputs: taskId (required), labelId (required).

update_subtaskB

Update a subtask title or completion state.

Inputs: subTaskId (required), title, isCompleted.

update_taskC

Update one or more fields of an existing task.

Inputs: taskId (required), title, deadline, priority, +1 more.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

    TDQS

    B3.3/5.0

    Scored across 14 tools

    Disambiguation5/5

    Each tool targets a distinct resource and action: boards, tasks, subtasks, labels, and assignees. The only potential confusion is get_boards versus get_board, but the plural/singular distinction and descriptions clearly separate list-all from fetch-one.

    Naming Consistency5/5

    All tools follow a clean snake_case verb_noun pattern (get_, create_, update_, move_, delete_, add_, remove_). The use of add/remove for label and assignee operations is semantically appropriate and consistent with the pattern.

    Tool Count5/5

    With 14 tools, the set covers a complete task-management workflow without bloat. Each tool maps to a meaningful operation, and the count is well within the ideal 3-15 range.

    Completeness4/5

    The tool surface covers full CRUD for tasks and subtasks, plus label and assignee management. The main gaps are board lifecycle operations like create/delete board and label deletion/update, but these may be intentionally managed outside this MCP.

    Related MCP Connectors

    Related MCP Servers