Skip to main content
Glama

org-mcp

An MCP server that gives an LLM org-capture and org-agenda style workflows, backed by plain-text .org files on local disk. No database — every entry lives in a human-readable, hand-editable org file you can also open in Emacs.

It speaks MCP over Streamable HTTP, with support for isolating multiple users' data behind Cloudflare Access Service Tokens — built for running on a small always-on box (e.g. a Raspberry Pi) exposed through a Cloudflare Tunnel.

Data model

Entries are ordinary org headlines:

* TODO [#A] File taxes
  DEADLINE: <2026-08-19 Wed>
  :PROPERTIES:
  :ID:       8ece9756-205b-414d-a675-f7def6e231fa
  :CREATED:  [2026-08-19 Wed 00:21]
  :END:

Every captured entry gets a stable :ID: (a UUID) so it can be looked up, rescheduled, or marked done later regardless of edits elsewhere in the file. Hand-written entries (e.g. typed directly into the file in Emacs) that lack an :ID: are lazily assigned one the first time a listing tool (agenda, search, list-todos) encounters them — after that they're addressable too.

Repeaters and time ranges in timestamps (<2026-08-20 Thu +1w>, <2026-08-20 Thu 10:00-11:00>) are preserved verbatim across edits — a state change or a reschedule of one field never rewrites the other.

Related MCP server: razberri MCP Server

Multi-user isolation

Every request must resolve to an identity, which maps to a subdirectory:

<ORG_MCP_DIR>/
  alice/
    inbox.org
    projects.org
  bob/
    inbox.org

A single running server instance serves everyone; each user only ever sees their own subdirectory. There's no cross-user tool for browsing or sharing files — isolation is total.

Identity comes from one of two places:

  • Cloudflare Access (production): every request that passes an Access policy carries a Cf-Access-Jwt-Assertion header. org-mcp verifies that JWT against your Zero Trust team's public keys and reads the identity from the token's common_name (Service Tokens) or email (interactive logins, including Managed OAuth) claim.

  • A raw X-Org-User header (local dev only): used automatically when CF_ACCESS_TEAM_DOMAIN/CF_ACCESS_AUD aren't set. There's no verification at all in this mode — anyone who can reach the port can claim to be anyone. Only use it on 127.0.0.1.

Identity mapping

One person reaches org-mcp under different claims depending on the client. Claude Code authenticates with a Service Token, yielding its name (grayson); claude.ai authenticates interactively via Managed OAuth, yielding an email (j.g.cupit@gmail.com). Left alone those sanitize into two different directories, so the same human would see two different sets of tasks depending on which client they opened — which defeats the point of a shared memory layer.

ORG_MCP_IDENTITY_MAP points at a JSON file mapping each raw claim to a canonical user id:

{
  "grayson": "grayson",
  "j.g.cupit@gmail.com": "grayson",
  "alice-laptop": "alice",
  "alice@example.com": "alice"
}

Lookups are case-insensitive and whitespace-tolerant. The mapping is deliberately explicit rather than inferred — deriving an id by stripping an email's domain would silently collapse alice@gmail.com and alice@work.com, two different people, into one directory.

When a map is configured, unmapped identities are rejected with a 403. You're already minting a Service Token per person by hand, so adding a line here at the same time costs nothing, and a loud rejection beats silently creating an empty directory and having the LLM report you have no tasks. The map is read once at startup, so adding a user means restarting the process.

With no map configured, behavior is unchanged: every distinct claim gets its own directory. That keeps local dev and single-identity setups zero-config.

On startup the server logs the claims it loaded and the user ids they resolve to, and logs the resolved id each time a session opens — check those before pointing a second client at a user that already has data.

Setup

npm install
npm run build

Run it:

ORG_MCP_DIR=/home/pi/org-data \
CF_ACCESS_TEAM_DOMAIN=myteam.cloudflareaccess.com \
CF_ACCESS_AUD=<access-app-audience-tag> \
node dist/server.js

By default it listens on 127.0.0.1:3000 — deliberately loopback-only, so the only way in is through cloudflared running on the same box. Don't change HOST to 0.0.0.0 unless you have another reason to trust your LAN.

Environment variables

Variable

Default

Purpose

PORT

3000

HTTP port to listen on.

HOST

127.0.0.1

Interface to bind. Keep this loopback-only; let cloudflared do the exposing.

ORG_MCP_DIR

~/org-mcp-data

Base directory. Each user gets a subdirectory under it.

ORG_MCP_DEFAULT_FILE

inbox.org

Default capture target filename, per user.

CF_ACCESS_TEAM_DOMAIN

(unset)

Your Zero Trust team domain, e.g. myteam.cloudflareaccess.com. Required together with CF_ACCESS_AUD to enable real auth.

CF_ACCESS_AUD

(unset)

The Access Application's Audience (AUD) tag.

ORG_MCP_IDENTITY_MAP

(unset)

Path to a JSON file mapping Access claims to canonical user ids. See Identity mapping. Unset means every claim gets its own directory.

Setting only one of CF_ACCESS_TEAM_DOMAIN / CF_ACCESS_AUD is a startup error — they're required together or not at all.

Exposing it via Cloudflare Tunnel + Access

  1. Install and run cloudflared on the same machine as org-mcp, and point an ingress rule at the local port:

    # ~/.cloudflared/config.yml
    tunnel: <your-tunnel-id>
    credentials-file: /home/pi/.cloudflared/<your-tunnel-id>.json
    ingress:
      - hostname: org.example.com
        service: http://localhost:3000
      - service: http_status:404
    cloudflared tunnel route dns <your-tunnel-id> org.example.com
    cloudflared tunnel run <your-tunnel-id>
  2. Create a Zero Trust Access application (dash.cloudflare.com → Zero Trust → Access → Applications) for org.example.com. Note its Audience (AUD) tag from the app's Overview page — that's CF_ACCESS_AUD. Your team domain (Settings → Custom Pages, or the URL of your Zero Trust dashboard) is CF_ACCESS_TEAM_DOMAIN.

  3. Create one Service Token per user (Zero Trust → Access → Service Auth → Service Tokens). Each token is a Client ID / Client Secret pair with no login flow attached. Give the user's token a name you'll recognize (this name becomes their org-mcp user id, sanitized into a directory name — e.g. a token named "Alice" isolates into alice/).

  4. Add an Access policy on the application allowing those Service Tokens (policy action: Service Auth, selector: the tokens you created).

  5. Give each user their pair. Their MCP client needs to send it as request headers on every call to https://org.example.com/mcp:

    CF-Access-Client-Id: <client id>.access
    CF-Access-Client-Secret: <client secret>

    How you configure that depends on the client — e.g. a headers field in the MCP server config for clients that support remote HTTP servers with custom headers. See "Running under pm2" below for how to keep the server itself alive across reboots; start cloudflared with sudo systemctl enable --now cloudflared (or equivalent) so it survives one too.

Restart the server with CF_ACCESS_TEAM_DOMAIN/CF_ACCESS_AUD set once this is wired up — from then on every request must carry a valid, Cloudflare-signed identity.

Connecting clients

Which clients can connect depends on how they authenticate, and the two mechanisms need different Access configuration on the same application.

Clients that can send static headers (e.g. Claude Code) use the Service Tokens above directly:

claude mcp add --transport http org-mcp https://org.example.com/mcp \
  --header "CF-Access-Client-Id: <client id>.access" \
  --header "CF-Access-Client-Secret: <client secret>"

Chat clients (claude.ai, Claude Desktop, mobile) can't send custom headers — their custom-connector UI takes a URL and OAuth only. For those, turn on Access Managed OAuth (Zero Trust → Access controls → Applications → your app → Edit → Advanced settings → Managed OAuth). That makes Access itself the OAuth 2.0 authorization server: the client discovers it at https://org.example.com/.well-known/oauth-authorization-server, the user logs in through Access in a browser once, and Cloudflare resolves the resulting opaque token server-side and forwards the same Cf-Access-Jwt-Assertion header org-mcp already verifies. No org-mcp code changes are required — Cloudflare's only requirement for enabling it is that the origin validate that header, which this server does.

Alongside it you'll want to:

  • Set Allowed redirect URIs to permit the chat client's callback.

  • Set Access token lifetime to 5–15 minutes and Grant session duration to 1–2 weeks. Cloudflare recommends this pairing for agent clients: tokens refresh silently in the background, policies are re-evaluated on each refresh, and the user only re-authenticates every couple of weeks.

  • Add an interactive rule (One-Time PIN or an IdP) to the application's policy. A Service Auth rule can't satisfy a browser login, so it can't carry the OAuth leg — you want both rules on the app, Service Auth for header-based clients and an interactive one for chat clients.

Since the two paths yield different identity claims for the same person, set up Identity mapping before connecting the second client.

Running under pm2

On a box that already runs other services under pm2 (e.g. alongside MagicMirror), start org-mcp the same way rather than introducing a second process manager or an ecosystem file:

export CF_ACCESS_TEAM_DOMAIN=myteam.cloudflareaccess.com
export CF_ACCESS_AUD=<access-app-audience-tag>
pm2 start npm --name org-mcp --cwd ~/org-mcp -- start
pm2 save

pm2 save snapshots the resolved environment (including the two exported vars above) into ~/.pm2/dump.pm2, so pm2 resurrect — run automatically by the pm2-<user> systemd service set up via pm2 startup — brings it back with the same config after a reboot. No separate .env file or ecosystem config needed.

Redeploying

deploy.sh pulls, installs, builds, runs the tests, and restarts the pm2 process — aborting before the restart if any step fails, so a broken build never replaces a working one. Run it from your own machine in one shot:

ssh pi 'cd ~/org-mcp && ./deploy.sh'

Worth aliasing, since that's the whole deploy. It pulls from origin, so push your commits to GitHub first — otherwise it'll cheerfully redeploy the code that's already running.

The script sources nvm itself before doing anything. ssh host 'cmd' runs a non-interactive shell, which returns early from ~/.bashrc before nvm's setup — so node, npm, and pm2 are all off PATH even though they work fine in an interactive session. If node is installed some other way on your box, the script says which command it couldn't find and where to add it.

Two things it deliberately refuses to do:

  • Deploy over uncommitted changes. If the working tree on the Pi has modifications, it stops rather than pulling over them. Commit, stash, or discard them there first.

  • Refresh the process environment. pm2 restart runs without --update-env, so the CF_ACCESS_* vars the process was started with survive the restart. Passing --update-env from a plain SSH session would replace them with that shell's empty environment and silently drop Access authentication. If you do need to change those vars, restart it by hand with them exported and re-run pm2 save.

Local development (no Cloudflare)

npm run dev   # runs src/server.ts directly via tsx, dev-mode auth

Without CF_ACCESS_TEAM_DOMAIN/CF_ACCESS_AUD set, identity comes from an unauthenticated X-Org-User header (defaulting to "default" if omitted) — useful for testing multi-user isolation locally, e.g.:

curl -s http://127.0.0.1:3000/mcp \
  -H 'content-type: application/json' -H 'accept: application/json, text/event-stream' \
  -H 'x-org-user: alice' \
  -H 'mcp-session-id: ...' \
  -d '{"jsonrpc":"2.0", ...}'

GET /healthz returns {"ok":true} unauthenticated, for uptime checks.

Tools

Tool

Purpose

org_capture

Append a new entry (task, note, or event) to a file, org-capture style. Supports parent_id to nest under an existing entry.

org_agenda

Org-agenda style view: entries scheduled/due in a date range, plus overdue open items.

org_list_todos

List open TODO-like entries, sorted by priority/due date, filterable by state/tag/priority.

org_search

Full-text search across headlines, body, and tags.

org_get_entry

Fetch one entry's full details by id.

org_update_state

Change an entry's TODO keyword (e.g. mark DONE); stamps/clears CLOSED.

org_schedule

Set/change/clear SCHEDULED and/or DEADLINE.

org_add_note

Append a timestamped note to an entry's body.

org_refile

Move an entry and its subtree under another entry or into another file.

org_edit_entry

Change an entry's headline, body, or priority.

org_set_tags

Replace an entry's tags.

org_list_tags

List every tag in use, with counts.

org_archive_entry

Move an entry's subtree to <file>_archive.org.

org_read_file

Read the raw text of one tracked org file.

org_list_files

List tracked org files (for the requesting user).

Capture fast, organize later

The tools are built around org's two-phase habit rather than forcing structure at capture time. During a brain dump, org_capture everything flat into the inbox — no deciding where things belong mid-thought. Later, an "organize my inbox" pass uses org_refile to cluster entries under project headlines, org_set_tags to apply a consistent vocabulary, and org_edit_entry to rework anything captured in a hurry. Refiling carries a whole subtree and re-levels it, so a project moves with its tasks intact.

org_list_tags exists to stop tag drift. Across many sessions and several clients, an LLM with no view of the existing vocabulary will invent :work:, then :job:, then :career: for one concept, and tag-filtered searches quietly stop finding things. The tool descriptions tell it to check first.

A corollary worth knowing when you use this: not everything should be a TODO. Entries with no todo keyword are plain notes, and standing context ("training for a half marathon in March", "Sarah prefers text over calls") is what makes this a memory layer instead of a task list.

Development

npm run dev    # run server.ts directly via tsx
npm test       # run the store's functional test suite (uses a temp dir)

npm test exercises OrgStore directly (parsing, capture, agenda, scheduling, archiving, lazy ID assignment) — it doesn't cover the HTTP/auth layer in server.ts, so changes there are worth a manual smoke test against a running server.

Available Tools

11 tools
org_add_noteAdd a timestamped noteA

Append a timestamped note/log line to an existing entry's body.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYesThe entry's id.
noteYesNote text to append.

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the burden. It states the action (append) and the nature of the note (timestamped), implying mutation. It does not disclose whether it modifies the entry in place, affects timestamps, or requires specific permissions. This is a mutation that could have side effects, so more disclosure would be helpful, but the core behavior is clear.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence, no waste, and the key action (append) is front-loaded. It communicates the action and target efficiently. Could be slightly more descriptive but is appropriately concise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple tool with two fully described parameters and no output schema, the description is nearly sufficient. The main gap is lack of behavioral details (e.g., whether it creates a new line with a timestamp, whether it is reversible). Since it is a simple mutation, the description is close to complete, but omits the timestamp format and the fact that it is an append-to-body operation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so both parameters (id and note) are adequately described in the schema. The description adds 'timestamped' and 'append' context but does not go beyond the schema for the parameters themselves. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action (append a note/log line) and the resource (an existing entry). It is distinct from siblings like org_capture which creates new entries anno or org_update_state which changes state. However, it could be more specific about what 'body' means and how this differs from editing the body via other means.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'to an existing entry' indicates the tool requires an existing entry, implying it should not be used for new entries (which would use org_capture). Yet it does not explicitly mention when to use this over org_update_state or org_schedule, nor does it warn against using it for initial creation. Clear context but no exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

org_agendaAgenda viewA

Get an org-agenda style view: entries scheduled or due within a date range, plus overdue open items when the range covers today. Defaults to today only. Entries with neither SCHEDULED nor DEADLINE never appear here — use org_list_todos for unscheduled open work.

ParametersJSON Schema
NameRequiredDescriptionDefault
endNoRange end date (YYYY-MM-DD). Defaults to start.
startNoRange start date (YYYY-MM-DD). Defaults to today.
include_doneNoInclude DONE/CANCELLED entries. Default false.

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses key behavioral traits: inclusion of overdue open items when range covers today, default range, and exclusion of unscheduled entries. It does not mention return format or ordering, but for a read-only query tool this is reasonably transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, zero waste. The core purpose is front-loaded, followed by the critical exclusion and alternative. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple query tool with no required parameters and no output schema, the description covers the main behavior, default, and alternative. It lacks a description of the return format, but the inclusion rules and exclusions are clearly specified, making it adequate for an agent to call correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and all parameters already have descriptions. The tool description adds no additional semantic meaning beyond what the schema provides (e.g., no elaboration on date format or include_done behavior). Baseline of 3 is appropriate since the schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool provides an org-agenda style view, specifies the inclusion criteria (scheduled or due within a date range, plus overdue open items when range covers today), and explicitly distinguishes it from org_list_todos by excluding entries without SCHEDULED or DEADLINE. This is a specific verb+resource with clear differentiation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly names the alternative (org_list_todos) and the condition that selects it: entries without SCHEDULED or DEADLINE. Also states the default range (today only), giving the agent clear context for when to invoke this tool versus siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

org_archive_entryArchive an entryA

Move an entry (and its subtree) out of its source file into a companion <file>_archive.org file. Use this to clean up completed or stale items while keeping a record.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYesThe entry's id.

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description must carry the full behavioral burden. It clearly describes the core action (moving an entry and its subtree to an archive file) and the intent (keeping a record). However, it does not disclose potential side effects such as whether the operation is reversible, whether permissions are required, or what happens to the original file beyond being removed. These details are missing, so the score is limited to 3.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise, two sentences, with the primary action and destination front-loaded. It contains no filler or redundancy. Every sentence contributes value, making it well-structured and efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with a single parameter, no output schema, and a clear purpose, the description is reasonably complete. It explains the operation and its use case. However, it omits details such as whether the archive file is automatically created if missing, or what the result of the operation is (e.g., no return value). Given the simplicity, this is a minor gap, so a 4 is appropriate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema describes the single parameter 'id' as 'The entry's id.' This provides 100% schema description coverage. The description itself adds no additional meaning about the parameter, so the baseline score of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb (move), a precise resource (an entry and its subtree), and the destination (a companion archive file). It also conveys the intent (clean up completed or stale items while keeping a record). This clearly distinguishes it from sibling tools like org_get_entry (read), org_capture (add), or org_update_state (modify state) – archiving is a distinct operation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to use the tool: 'clean up completed or stale items while keeping a record.' This gives a clear context. However, it does not explicitly mention when not to use it or name alternative tools for other scenarios, so it falls short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

org_captureCapture a new org entryA

Append a new entry (headline) to a local org file, org-capture style. Use this to jot down tasks, notes, or events. Defaults to file "inbox.org" if none given. Pass parent_id to nest the new entry under an existing entry instead of appending at top level.

ParametersJSON Schema
NameRequiredDescriptionDefault
bodyNoFree-text notes/body under the headline.
fileNoTarget org filename within the org directory, e.g. "inbox.org" or "projects.org". Defaults to "inbox.org".
tagsNoOrg tags, without colons.
todoNoTODO keyword, omit for a plain note/heading.
deadlineNoDEADLINE date/time for the entry.
headlineYesThe entry title (no stars, state, or tags).
priorityNoPriority cookie.
parent_idNoID of an existing entry to nest this one under.
scheduledNoSCHEDULED date/time for the entry.

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden of behavioral disclosure. It states key behaviors: appending to a file, defaulting to inbox.org, and using parent_id for nesting. It does not mention return values, whether the file is created if missing, or what happens on invalid parent_id; these gaps keep it at a minimal-viable 3.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, each earning its place: the core action, the typical use case, and the two important behaviors (default file and parent nesting). No filler or redundant restatement of the schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a creation tool with 9 parameters and no output schema, the description plus the fully-covered schema is mostly complete. It explains the default file and nesting, which are the non-obvious behaviors. It could still mention return/error behavior, but the high schema coverage mitigates this gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description adds real value beyond the schema by explaining the default file behavior ('Defaults to file "inbox.org" if none given') and the semantic of parent_id ('nest the new entry under an existing entry instead of appending at top level').

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states a specific action ('Append a new entry (headline)') and a specific resource ('a local org file'), and it mentions the org-capture style. It does not explicitly differentiate from siblings like org_add_note, though 'new entry' versus note-adding implies a distinction; this keeps it at a 4 rather than a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear usage context: 'Use this to jot down tasks, notes, or events.' It also explains default behavior and parent nesting, so an agent knows when this tool fits. It does not give explicit when-not-to-use guidance or name alternatives, which stops it from being a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

org_get_entryGet a single entryA

Fetch full details of one entry by its id, including its body text.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYesThe entry's id (returned by capture/agenda/search/etc.).

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

'Fetch' clearly signals a non-mutating read operation名家 and 'including its body text' gives useful behavioral detail about the response. It does not cover edge cases like missing ids or permissions, but for a simple single-entry read that is acceptable.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single crisp sentence with the key information up front: the verb, the resource, the lookup key, and the main content type returned. No fluff or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter read operation, the description tells the agent what is returned and why id matters. It does not enumerate all possible fields or failure modes, but the tool is simple enough that this is not a major gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already documents id thoroughly, including where ids come from. The tool description adds no additional parameter-level meaning, which is fine because no extra detail is needed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies a specific operation: fetching one entry by its idhol. Mentioning 'full details' and 'body text' distinguishes it from search/list/capture operations.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use it—when an id is already known and full entry content is needed—but it does not explicitly contrast org_get_entry with siblings like org_search or explain when another tool would be more appropriate.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

org_list_filesList org filesC

List the org files currently tracked in the org data directory.

ParametersJSON Schema
NameRequiredDescriptionDefault
include_archiveNoAlso list archive files. Default false.

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations at all, the description carries the full burden of conveying safety and behavior. The verb 'list' strongly implies a read-only operation, but the description does not explicitly say it doesn't modify state or require special permissions, and it doesn't hint at whether the return is a simple name list or a richer structure. Since there are no annotations, this is a notable gap for a tool that may be expected to be side-effect free.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, clear sentence with no filler words. It front-loads the action, resource, and scope. It could be slightly more informative, but it earns its place as a concise and well-structured line.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple, but it has no output schema, so the description should indicate what the return value looks like (file names, paths, etc.). It doesn't, and it also does not mention the default behavior of include_archive or what 'currently tracked' refers to. These are gaps an agent needs to call the tool correctly, making it incomplete despite low complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The only parameter, include_archive, has a complete description in the input schema (schema coverage is 100%). The description doesn't add any extra nuance beyond the schema, but also doesn't need to since the schema is sufficient. Baseline of 3 is appropriate here.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states what tool does: 'List the org files currently tracked in the org data directory.' It names a specific resource (org files) and location (org data directory), which helps distinguish it from siblings like org_list_todos or org_agenda. However, it doesn't explicitly name a sibling or call out what it is not, so it misses the highest level of distinction.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to use this tool instead of alternatives. It neither explains what kind of listing this returns (e.g., file names vs full paths) nor mentions whether the agent should consider modular or filtering options such as the include_archive parameter. The description also doesn't indicate scenarios where a sibling like org_read_file or org_list_todos would be more appropriate.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

org_list_todosList TODO entriesA

List open TODO-like entries across all org files (excludes DONE/CANCELLED by default), sorted by priority then due date. Optionally filter by exact state, tag, or priority.

ParametersJSON Schema
NameRequiredDescriptionDefault
tagNoFilter to entries carrying this tag.
stateNoFilter to an exact TODO keyword.
priorityNoFilter to this priority.

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the burden. It discloses default filtering (excludes DONE/CANCELLED), sorting behavior, and optional filters. However, it doesn't mention whether the tool is read-only, whether it returns full entries or summaries, or any side effects. For a listing tool, the disclosed behavior is adequate but not rich.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loads the core purpose, and packs useful details (default exclusions, sorting, optional filters) without waste. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only listing tool with no output schema and no annotations, the description covers the main behavior: what is listed, default exclusions, sorting, and available filters. It doesn't describe the return format or pagination, but for a simple list tool this is a minor gap. The tool is adequately specified for an agent to call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all three parameters. The description adds context that filters are optional and that state filtering uses exact TODO keywords, but it doesn't add significant meaning beyond the schema. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool lists TODO entries, specifies the default exclusion of DONE/CANCELLED, and mentions sorting by priority then due date. It also distinguishes itself from siblings like org_search and org_agenda by focusing on TODO-like entries across org files.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use this tool: to list open TODO entries across files, with optional filters. It doesn't explicitly name alternatives or exclusions, but the context of sibling tools and the phrase 'across all org files' helps an agent understand it's a broad listing tool rather than a search or agenda tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

org_read_fileRead a raw org fileA

Read the raw text of one tracked org file, exactly as it is on disk. Useful for showing the user their actual file, including any hand-edited content the structured tools don't surface.

ParametersJSON Schema
NameRequiredDescriptionDefault
fileYesFilename to read, e.g. "inbox.org". See org_list_files for available files.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It clearly indicates a non-mutating read ('Read', 'exactly as it is on disk') and adds the 'tracked' constraint. It doesn't cover failure modes or output format explicitly, but the raw-read intent makes side effects unlikely and behavior clear.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences front-load the core action and value. No filler words, and the second sentence adds one concrete use case rather than repeating implementation details.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter read-only tool, the description is nearly complete. It explains what it returns semantically ('raw text'), when it is useful, and which context it covers. It lacks explicit error/edge-case notes, but those are likely not necessary for such a simple operation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the file parameter already has an example and a pointer to org_list_files. The tool description adds almost nothing beyond the schema for this parameter, so the schema handles the meaning; baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'Read the raw text of one tracked org file, exactly as it is on disk.' It explicitly distinguishes itself from structured tools by mentioning that it surfaces hand-edited content those tools don't, so an agent can tell this from siblings like org_get_entry or org_search.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives clear context: use this when the user needs their actual file text or hand-edited content not covered by structured tools. It doesn't explicitly name alternatives or provide a when-not-to-use list, but the intended use case is stated well enough for an agent to decide.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

org_scheduleSet SCHEDULED/DEADLINEA

Set, change, or clear the SCHEDULED and/or DEADLINE timestamps on an entry. Omit a field to leave it unchanged; pass null to clear it.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYesThe entry's id.
deadlineNoNew DEADLINE date/time, or null to clear.
scheduledNoNew SCHEDULED date/time, or null to clear.

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It clearly explains the two key behavioral nuances: omitting a field leaves it unchanged, while passing null clears it. This is essential for correct invocation and goes beyond a simple 'update' statement, though it doesn't mention side effects or error conditions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single, front-loaded sentence that states the action, the target, and the two key behaviors (set/clear) and the omission rule. No fluff; every clause earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with three parameters (one required) and no output schema, the description covers all necessary call semantics: what the tool does, how to set or clear, and the meaning of omission. An agent can invoke it correctly without needing additional documentation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and each parameter already includes 'or null to clear' in its description. The tool description adds the crucial distinction between omitting a field (leave unchanged) and passing null (clear), which is not in the schema. This adds meaningful semantic value beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('set, change, or clear') and a clear resource ('SCHEDULED and/or DEADLINE timestamps on an entry'), making the tool's purpose unambiguous. It distinguishes itself from siblings like org_update_state by focusing on timestamp fields specifically.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies this tool is used for managing scheduling timestamps but does not explicitly state when to use it versus alternatives, nor does it mention any exclusions. It gives the operation but no guidance on when to prefer this over org_capture or org_update_state.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

org_update_stateChange an entry's TODO stateA

Change the TODO keyword of an entry, e.g. mark it DONE, TODO, NEXT, WAITING, or CANCELLED. Moving into DONE/CANCELLED stamps a CLOSED timestamp; moving out of one clears it.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYesThe entry's id.
stateYesNew TODO keyword, or null to remove the keyword entirely.

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description must carry full behavioral burden. It does disclose a key side effect: 'Moving into DONE/CANCELLED stamps a CLOSED timestamp; moving out of one clears it.' This goes beyond the basic action. However, it omits other potential behaviors like whether transitions are restricted (e.g., DONE to TODO), reversibility, or return values, leaving some gaps.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences. The first states the primary action and examples; the second immediately covers the important side effect. No filler or redundant information. Front-loaded with the main purpose, making it efficient for an agent to parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple two-parameter mutation tool with no output schema, the description covers the core purpose, parameter examples, and a key behavioral side effect. It does not explain the return value, but that is not required given no output schema. It could mention transition constraints, but overall it is sufficiently complete for an agent to invoke correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already describes both parameters comprehensively (id and state with enum values and null semantics). The description adds examples of state values and mentions the null removal implicitly, but it does not provide new syntactic details beyond the schema. Since schema coverage is 100%, a baseline of 3 is appropriate; the description adds minimal extra value.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action: 'Change the TODO keyword of an entry' with concrete examples of states (DONE, TODO, NEXT, WAITING, CANCELLED). It distinguishes this tool from siblings like org_capture (creating) or org_archive_entry (archiving) by focusing on state mutation, making its purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use it (when an entry's TODO state needs changing) and provides context on state transitions via the timestamp behavior. However, it does not explicitly name alternative tools or state conditions for when not to use it, though the sibling set makes the intent clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 11 tool updatesv0.1.0
    • First observedorg_add_note
    • First observedorg_agenda
    • First observedorg_archive_entry
    • First observedorg_capture
    • First observedorg_get_entry
    • First observedorg_list_files
    • First observedorg_list_todos
    • First observedorg_read_file
    • First observedorg_schedule
    • First observedorg_search
    • First observedorg_update_state

TDQS

A3.7/5.0

Scored across 11 tools

Disambiguation4/5

Most tools have clearly distinct purposes: capture creates, get_entry reads one entry, search/list_todos/agenda query in different ways, update_state/schedule/archive/add_note mutate different aspects. org_agenda and org_list_todos both surface open work but are differentiated by scheduled/due vs unscheduled, and descriptions explicitly call out the distinction.

Naming Consistency4/5

All tools use the org_ prefix with verb_noun naming (get_entry, capture, agenda, list_todos, search, update_state, archive_entry, schedule, add_note, read_file, list_files). Minor inconsistency: org_capture and org_agenda are noun/verb-less compared to the verb_noun pattern, but they are conventional org-mode terms and the pattern is otherwise consistent.

Tool Count5/5

11 tools is well-scoped for an org-mode server. Each tool covers a distinct operation needed to interact with org files: querying, capturing, editing state, scheduling, archiving, and file access. No redundant or excessive tools.

Completeness4/5

The surface covers the core org-mode workflows: capture, list/search/agenda views, state changes, scheduling, notes, archiving, and raw file access. Minor gaps: no tool to edit/rewrite headline text or delete entries outright, and no explicit tool to create a new file, but archiving and raw file read mitigate some of these.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    D
    maintenance
    Enables interaction with org-roam knowledge bases, allowing search, retrieval, creation, and linking of notes while respecting org-roam's file structure and conventions.
    15
    MIT
  • F
    license
    Not graded
    quality
    D
    maintenance
    A privacy-first, local-first MCP server that provides 15 ADHD/second-brain tools for capturing, prioritizing, and resurfacing tasks with context from calendar, mail, and messages.
    1
    -
  • A
    license
    Not graded
    quality
    C
    maintenance
    Enables AI assistants to read and write to a personal knowledge vault of markdown notes, projects, and tasks, with tooling for search, capture, daily logs, and project management across different AI tools.
    MIT
  • A
    license
    Not graded
    quality
    B
    maintenance
    Enables agents to capture and manage notes, tasks, events, and links in a private, file-first workspace, with tools for viewing today's agenda and searching Markdown notes.
    25 npm
    MIT