Task Management MCP

MCP server for Star Perkasa Technology Task Management.

Package ini membantu AI agent membaca, membuat, memperbarui, memantau, dan merangkum task melalui Task Management API dengan permission sesuai user aktif.

Server ini menyimpan auth context secara aman di runtime/persistent local store agar agent tidak perlu meminta login berulang selama token masih valid. Token tidak pernah dikembalikan ke output tool.

Requirements

• Node.js 20+
• Access to a running Starasia Task Management API instance

Features

• List spaces, projects, project members, workflow statuses, and tasks
• Get project and task detail
• Create single or bulk tasks
• Update task fields, status, and assignees
• Monitor overdue and stale tasks
• Summarize project progress, workload, and work reports
• Dry-run-first write tools for safer agent workflows

Install

Install global:

npm install -g @starasia/task-management-mcp

Run manually for smoke test:

task-management-mcp

Or run without global install:

npx -y @starasia/task-management-mcp

Quick start for users

You do not need to know every MCP tool name to use this package. In most AI agents, ask in natural language and let the agent choose the right tool.

Start by asking the agent to log in:

Login to Task Management MCP

The agent should call start_web_sso_login, show you a secure SSO login URL, then ask you to open the URL and log in through the browser. Do not paste your SSO password into chat. After login, the agent will call check_web_sso_login. If your account has access to multiple organizations, the agent should show organization names and ask which one to use.

After login, try prompts like:

Show my Task Management spaces

What projects exist in the Ofa Lite space?

Create a task in the MVP Generate Cycle project for implementing fleet settings

Assign this task to Bayu

Summarize my overdue tasks

Agents should preview write actions first. For example, when creating or updating tasks, the agent should show the planned title, description, status, priority, dates, and assignees before calling write tools with dryRun: false.

Claude Code

Install global lalu daftarkan ke Claude Code:

npm install -g @starasia/task-management-mcp
claude mcp add --scope user task-management -- task-management-mcp

Alternatif tanpa install global:

claude mcp add --scope user task-management -- npx -y @starasia/task-management-mcp

Verifikasi:

claude mcp list
claude mcp get task-management

Codex CLI

Quick command:

codex mcp add task-management --command npx --args -y --args @starasia/task-management-mcp

Fallback via ~/.codex/config.toml:

[mcp_servers.task_management]
command = "npx"
args = ["-y", "@starasia/task-management-mcp"]

JSON MCP Config

Untuk client lain yang memakai format JSON mcpServers:

{
  "mcpServers": {
    "task-management": {
      "command": "npx",
      "args": ["-y", "@starasia/task-management-mcp"]
    }
  }
}

Tools

Auth/session

• sso_login
• select_sso_organization
• start_web_sso_login
• check_web_sso_login
• cancel_web_sso_login
• set_auth_context
• get_auth_context_status
• clear_auth_context

Read-only

• list_spaces
• list_projects
• get_project
• list_statuses
• list_space_members
• get_my_space_membership
• list_project_members
• get_my_project_membership
• list_tasks
• get_task
• resolve_task_ticket
• list_task_assignees
• summarize_my_tasks
• summarize_project_progress

Write tools

Write tools default to dryRun: true. Set dryRun: false only when the user has approved the action.

• create_space
• update_space
• delete_space
• create_project
• update_project
• delete_project
• move_project
• archive_project
• restore_project
• create_task
• bulk_create_tasks
• update_task
• change_task_status
• delete_task
• duplicate_task
• add_space_members
• join_space
• set_space_member_role
• remove_space_member
• add_project_members
• bulk_add_project_members
• remove_project_member
• assign_task
• unassign_task
• replace_task_assignees
• reassign_task_assignee

Member-management tools use user ids from HRIS/SSO. Task assignee tools use project member ids from list_project_members.

Monitoring/reporting

• monitor_overdue_tasks
• monitor_stale_tasks
• workload_by_user
• generate_work_report

Auth model

Before using task tools, the agent should check whether an auth context is configured. If not, prefer SSO login instead of asking for a raw bearer token.

Recommended flow for chat-based agents:

1. Call get_auth_context_status.
2. If not configured, prefer start_web_sso_login and present the returned login URL/button to the user.
3. The user enters email/password in the browser form, not in chat.
4. Poll or call check_web_sso_login with the returned session id.
5. When completed, the MCP activates and persists the auth context without returning the token.
6. Use the task tools.

CLI/local fallback flow:

1. Call sso_login with the user's SSO email/password only when the platform can handle secrets safely.
2. If sso_login returns multiple organizations, present organization names in a human-friendly list and ask which organization should be used. Do not ask the user to copy an organization ID.
3. Call select_sso_organization with the user's typed organization name. The MCP supports normalized/fuzzy matching, so close inputs such as star perkasa can match PT Star Perkasa Technology.
4. Use the task tools.

Manual fallback remains available through set_auth_context when explicitly needed.

The MCP stores auth context in an encrypted local store and process memory, returns masked auth status, and never returns the bearer token from any tool. The persisted context is reused until its configured expiry.

Call clear_auth_context when the session is done; it clears process state, pending SSO sessions, web login sessions, and the persisted auth store.

SSO configuration

For SSO login, provide the Task Management module client ID via environment:

TASK_MANAGEMENT_SSO_CLIENT_ID=APP-xxxxxxxx

Optional SSO API base URL override, mainly for local/dev testing:

TASK_MANAGEMENT_SSO_API_BASE_URL=https://api.starasia.tech/sso

Auth persistence TTL defaults to 30 days. Override it with a millisecond value when a shorter or longer auth-context lifetime is required:

TASK_MANAGEMENT_AUTH_TTL_MS=2592000000

Use a stable TASK_MANAGEMENT_AUTH_STORE_KEY in deployment so the encrypted auth store remains readable after MCP restarts.

Passwords are accepted only by sso_login; the resulting token stays in MCP process memory and is never returned.

Safety notes

• The MCP does not bypass application permissions.
• All API actions are performed using the active user's permission context.
• Write tools use dry-run mode by default.
• Bulk task creation supports idempotency by normalized title.
• Use this MCP only in trusted local agent sessions.

Development

npm test
npm run typecheck
npm run lint
npm run build
npm run pack:check