Creme Tasks MCP Server

A local Model Context Protocol server that exposes Creme Tasks to AI assistants (Claude Code, Cursor, Zed, Continue, etc.) so they can read, create, and update tasks during your work.

The server runs on your machine over stdio and authenticates to Supabase using your own session token — so every action respects the same Row-Level Security policies the app enforces. An AI assistant connected through this server can only do what you can already do.

What it exposes

Tools

| Name | Purpose | |------|---------| | list_tasks | Filter tasks by project, sprint, assignee, status, priority, search term | | get_task | Fetch one task (by id or display_id) with joins and recent comments | | create_task | Create a task — created_by is set from your session | | update_task | Partial update (status, assignee, due date, etc.) | | soft_delete_task | Set deleted_at = now() | | list_projects / get_project | Read-only project queries | | list_sprints / get_sprint | Read-only sprint queries, with status counts on get_sprint | | list_task_comments / create_task_comment | Read and post comments |

Resources

• creme-tasks://sprints/current — active sprints across all non-archived projects
• creme-tasks://tasks/assigned-to-me — your open tasks, priority then due date

Install

The server is published to npm as @creme-digital/creme-tasks-mcp. You do not need to clone this repo — your MCP client will download and run it via npx (see the wiring sections below).

cd mcp-server
npm install
npm run build

Produces dist/mcp-server/src/index.js. Use this path as command: node / args: [<path>] in your MCP client config instead of the npx invocation shown below.

Auth setup

The server reads two env vars as a one-time bootstrap:

• SUPABASE_ACCESS_TOKEN
• SUPABASE_REFRESH_TOKEN

After first launch the server persists the rotating session to ~/.config/creme-tasks-mcp/ (chmod 0600) and handles refresh on its own. Restarts re-use the stored session — you don't need to re-paste tokens unless you sign out of the app or the session is revoked server-side.

Recommended: log into the Creme Tasks app, open Settings → Integrations, and click Copy MCP Tokens. This puts a ready-to-paste snippet on your clipboard:

SUPABASE_ACCESS_TOKEN=...
SUPABASE_REFRESH_TOKEN=...

Drop those values into the env block of the config below.

If the Settings button is unavailable (older build, remote session, etc.):

1. Log into the Creme Tasks app.
2. Open DevTools → Application → Local Storage → the Supabase entry (key looks like sb-ujktrbyersevttfqcbzd-auth-token).
3. Copy access_token and refresh_token out of the JSON.

Wire into Claude Code

Add this to your ~/.claude.json (or project-level .mcp.json):

{
  "mcpServers": {
    "creme-tasks": {
      "command": "npx",
      "args": ["-y", "@creme-digital/creme-tasks-mcp"],
      "env": {
        "SUPABASE_ACCESS_TOKEN": "<paste>",
        "SUPABASE_REFRESH_TOKEN": "<paste>"
      }
    }
  }
}

Restart Claude Code and run /mcp — you should see creme-tasks: connected.

Wire into Cursor

Add to ~/.cursor/mcp.json (or the project .cursor/mcp.json):

{
  "mcpServers": {
    "creme-tasks": {
      "command": "npx",
      "args": ["-y", "@creme-digital/creme-tasks-mcp"],
      "env": {
        "SUPABASE_ACCESS_TOKEN": "<paste>",
        "SUPABASE_REFRESH_TOKEN": "<paste>"
      }
    }
  }
}

Smoke test

Use the official MCP inspector:

SUPABASE_ACCESS_TOKEN=... SUPABASE_REFRESH_TOKEN=... \
  npx @modelcontextprotocol/inspector npx -y @creme-digital/creme-tasks-mcp

A browser UI opens — pick list_tasks, run it with no args, and you should see your recent tasks.

Releasing (maintainers)

Manual publish from a clean checkout of main:

cd mcp-server
npm version patch   # or minor / major
npm publish         # prepublishOnly runs the build; publishConfig sets access: public
git push --follow-tags

You need to be logged in (npm whoami) and a member of the @creme-digital org with publish rights.

What's NOT here (yet)

• Hosted/remote MCP (would need OAuth + an edge function).
• Mutations on projects, sprints, teams.
• Wrappers for the AI edge functions (generate-task-prompt, generate-tasks-from-text) — candidates for v2.

How RLS applies

Because the server authenticates as you, the Supabase RLS policies on tasks / task_comments enforce the same rules you see in the app:

• SELECT: any authenticated user, active rows only
• INSERT tasks: must set created_by = auth.uid() (the server does this for you)
• UPDATE tasks: assignee, creator, manager, or admin
• DELETE (soft): manager or admin

If an AI tries something you can't do, the Supabase error is returned verbatim and no change is made.