← Back to search

io.github.crunchtools/workboard

crunchtools Scanned 22d ago

Secure MCP server for WorkBoard OKR and strategy execution platform

C
69.3 / 100

Versions

0.6.1latest
first seen May 19, 2026
PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 22

workboard_get_user_tool
annotations: none low

Get a WorkBoard user by ID, or the current authenticated user. Args: user_id: User ID (positive integer). If not provided, returns the current authenticated user. Returns: User details

user_id string
workboard_list_users_tool
annotations: none low

List all WorkBoard users (requires Data-Admin role). Returns: List of all users

workboard_create_user_tool
annotations: none low

Create a new WorkBoard user (requires Data-Admin role). Args: first_name: User's first name last_name: User's last name email: User's email address designation: User's job title or designation Returns: Created user details

email str last_name str first_name str designation string
workboard_update_user_tool
annotations: none low

Update an existing WorkBoard user. Args: user_id: User ID (positive integer) first_name: User's first name (optional) last_name: User's last name (optional) email: User's email address (optional) designation: User's job title or designation (optional) Returns: Updated user details

email string user_id int last_name string first_name string designation string
workboard_get_teams_tool
annotations: none low

Get all teams the authenticated user belongs to. Returns team IDs, names, and owner user IDs. Use workboard_get_team_members_tool to get the full member list (with user_ids) for a specific team. Returns: List of teams with team_id, team_name, team_owner_id, is_team_owner

workboard_get_team_members_tool
annotations: none low

Get all members of a WorkBoard team, including their user IDs and emails. Use this to resolve a person's name or email to their WorkBoard user_id. Combine with workboard_get_objectives_tool(user_id) to fetch their OKRs. Args: team_id: The WorkBoard team ID (get from workboard_get_teams_tool) Returns: team_id, team_name, and members list with user_id, full_name, email, team_role

team_id int
workboard_get_objectives_tool
annotations: none low

Get objectives owned by a WorkBoard user by their user ID. Returns all objectives the user owns, with full pagination. Also exposes ``workstreams`` and ``status_color`` fields on each objective when present. Use workboard_get_user_tool (no arguments) to find the current user's ID. Use workboard_get_team_members_tool to resolve a name or email to a user ID. Args: user_id: User ID (positive integer). Get this from workboard_get_user_tool. Returns: List of objectives owned by the user, including all key results

user_id int
workboard_get_objective_details_tool
annotations: none low

Get full details for a single objective including all its key results. Returns the objective name, progress, status, dates, and all key results (metrics) with their targets, progress, and update schedules. Use workboard_get_user_tool (no arguments) to find the current user's ID. Args: user_id: User ID (positive integer). Get this from workboard_get_user_tool. objective_id: Objective ID (positive integer). Returns: Full objective details with key results (metrics)

user_id int objective_id int
workboard_get_my_objectives_tool
annotations: none low

Get the current authenticated user's objectives with key results. This is the RECOMMENDED tool when users ask about "my objectives" or "my OKRs". It automatically determines the current user and discovers their objectives from their key results — no IDs needed. Args: objective_ids: Optional list of specific objective IDs to fetch. If not provided, objectives are auto-discovered from the user's key results. Returns: List of objectives with their key results (metrics)

objective_ids string
workboard_get_my_key_results_tool
annotations: none low

List all key results (metrics) the current user owns or has access to. Use this to find metric IDs and see current progress before updating with workboard_update_key_result_tool. Returns metric names, current values, targets, and IDs. By default, only shows current year key results. Set include_prior_years=True to see key results from previous years. Args: include_prior_years: If True, include key results from prior years. Defaults to False (current year only). Returns: List of key results with IDs, names, values, and targets

include_prior_years bool
workboard_get_user_key_results_tool
annotations: none low

List key results (metrics) for a specific WorkBoard user by their user ID. Use this to see KRs owned by or associated with any user — for example, to review a direct report's key results before a 1:1. Skills layer maps organizational roles (e.g. "direct report") to user IDs; this tool only knows about WorkBoard user IDs. Use workboard_get_teams_tool and workboard_get_team_members_tool to resolve a person's name to their user ID. By default, only shows current year key results. Set include_prior_years=True to see key results from previous years. Args: user_id: User ID (positive integer). Get this from workboard_get_team_members_tool. include_prior_years: If True, include key results from prior years. Defaults to False (current year only). Returns: List of key results with IDs, names, values, and targets

user_id int include_prior_years bool
workboard_update_key_result_tool
annotations: none low

Update progress on a key result (metric). This is the primary tool for weekly OKR check-ins — update a key result's value without logging into WorkBoard. Use workboard_get_my_key_results_tool to find metric IDs first. Args: metric_id: Metric ID (positive integer). Get this from workboard_get_my_key_results_tool. value: The new progress value (e.g. "75" for 75%). comment: Optional check-in comment describing what changed. Returns: Updated key result details

value str comment string metric_id int
workboard_create_objective_tool
annotations: none low

Create a new objective with optional key results (requires Data-Admin token). Provide the goal name, owner, dates, and optionally key results with targets. Each key result dict can include: metric_name, metric_start, metric_target, metric_type. Args: name: Objective name (e.g. "Increase customer retention") owner: Owner's email address or user ID start_date: Start date in YYYY-MM-DD format target_date: Target completion date in YYYY-MM-DD format narrative: Optional description/narrative for the objective goal_type: "1" for Team objective (default), "2" for Personal objective permission: Visibility setting (default "internal,team") key_results: Optional list of key result dicts, each with keys like "metric_name", "metric_start", "metric_target", "metric_type" Returns: Created objective details

name str owner str goal_type str narrative string permission str start_date str key_results string target_date str
workboard_get_workstreams_tool
annotations: none low

Get team workstreams accessible to the authenticated user. Returns all team workstreams the user has access to. Personal workstreams are not included. Optionally filter to a single workstream by ID. Args: ws_id: Optional workstream ID to fetch a specific workstream. Returns: List of workstreams with name, owner, health, pace, priority, and dates

ws_id string
workboard_get_workstream_activities_tool
annotations: none low

Get a workstream's full details including all action items. Returns the workstream metadata plus every action item with descriptions, owners, due dates, comments, sub-actions, and attached files. Args: ws_id: Workstream ID (positive integer) Returns: Workstream details with action items

ws_id int
workboard_get_team_workstreams_tool
annotations: none low

Get all workstreams belonging to a specific team. Use workboard_get_teams_tool to find team IDs first. Args: team_id: Team ID (positive integer) Returns: Team info with list of workstreams

team_id int
workboard_create_workstream_tool
annotations: none low

Create a new workstream for a team. Requires team manager or co-manager permissions. Args: ws_name: Name of the workstream team_id: Parent team ID ws_owner: User ID of the team manager or co-manager ws_objective: Optional descriptive narrative or objective statement Returns: Created workstream details

team_id str ws_name str ws_owner str ws_objective string
workboard_update_workstream_tool
annotations: none low

Update an existing workstream's properties. Performs read-before-write to confirm the workstream exists. Requires team manager or co-manager permissions. Pace must be "slow", "fast", or "steady". Health must be "ok", "good", or "risk". Priority must be "p1" through "p5". Args: ws_id: Workstream ID (positive integer) ws_name: New name (optional) ws_start_date: Start date in YYYY-MM-DD (optional) ws_end_date: End date in YYYY-MM-DD (optional) ws_pace: Pace: slow, fast, or steady (optional) ws_health: Health: ok, good, or risk (optional) ws_priority: Priority: p1 through p5 (optional) Returns: Updated workstream details

ws_id int ws_name string ws_pace string ws_health string ws_end_date string ws_priority string ws_start_date string
workboard_list_activities_tool
annotations: none low

List action items accessible to the authenticated user. Returns up to 15 action items by default. Use limit and offset for pagination. Filter by owner, state, priority, or effort to narrow results. Args: ai_owner: Filter by owner user ID or email (optional) ai_state: Filter by state: next, doing, done, or pause (optional) ai_priority: Filter by priority: low, med, or high (optional) ai_effort: Filter by effort: easy, medium, or huge (optional) limit: Maximum number of results (optional) offset: Pagination offset (optional) Returns: List of action items with descriptions, states, owners, and due dates

limit string offset string ai_owner string ai_state string ai_effort string ai_priority string
workboard_get_activity_tool
annotations: none low

Get a single WorkBoard action item by its ID. Args: activity_id: Action item ID (positive integer) Returns: Action item details including description, state, owner, due date, comments, sub-actions, and attached files

activity_id int
workboard_create_activity_tool
annotations: none low

Create a new action item (card) on a WorkBoard workstream. State must be "next", "doing", "done", or "pause". Priority must be "low", "med", or "high". Effort must be "easy", "medium", or "huge". Args: ai_description: Description of the action item — shown as the card title (required) ai_note: Notes or body text for the action item (optional) ai_workstream: Workstream ID to place the action item in (optional) ai_team: Team ID to associate with (optional) ai_owner: Owner user ID or email (optional) ai_state: Initial state: next, doing, done, or pause (optional) ai_priority: Priority: low, med, or high (optional) ai_effort: Effort estimate: easy, medium, or huge (optional) ai_due_date: Due date as UNIX timestamp string (optional) ai_column: Custom Kanban column ID to place the card in (optional). Workstreams can define custom columns within each state (e.g. "Homework", "Interlocks", "Active" within "doing"). Returns: Created action item details

ai_note string ai_team string ai_owner string ai_state string ai_column string ai_effort string ai_due_date string ai_priority string ai_workstream string ai_description str
workboard_update_activity_tool
annotations: none low

Update an existing WorkBoard action item. Performs read-before-write to confirm the action item exists. Only provided fields are updated. State must be "next", "doing", "done", or "pause". Priority must be "low", "med", or "high". Effort must be "easy", "medium", or "huge". Args: activity_id: Action item ID (positive integer) ai_description: New description — shown as the card title (optional) ai_note: New notes or body text (optional) ai_owner: New owner user ID or email (optional) ai_state: New state: next, doing, done, or pause (optional) ai_priority: New priority: low, med, or high (optional) ai_effort: New effort: easy, medium, or huge (optional) ai_due_date: New due date as UNIX timestamp string (optional) ai_column: Custom Kanban column ID to move the card to (optional). Workstreams can define custom columns within each state. Returns: Updated action item details

ai_note string ai_owner string ai_state string ai_column string ai_effort string activity_id int ai_due_date string ai_priority string ai_description string

Permissions 3

network medium
Server uses network capabilities via: httpx
filesystem low
Server uses filesystem capabilities via: open(), os
env_vars low
Server uses env_vars capabilities via: os.environ

Scan Findings 71

low
Tool 'workboard_get_user_tool' has no annotations annotation_checker · 100%
low
Tool 'workboard_list_users_tool' has no annotations annotation_checker · 100%
low
Tool 'workboard_create_user_tool' has no annotations annotation_checker · 100%
low
Tool 'workboard_update_user_tool' has no annotations annotation_checker · 100%
low
Tool 'workboard_get_teams_tool' has no annotations annotation_checker · 100%
low
Tool 'workboard_get_team_members_tool' has no annotations annotation_checker · 100%
low
Tool 'workboard_get_objectives_tool' has no annotations annotation_checker · 100%
low
Tool 'workboard_get_objective_details_tool' has no annotations annotation_checker · 100%
low
Tool 'workboard_get_my_objectives_tool' has no annotations annotation_checker · 100%
low
Tool 'workboard_get_my_key_results_tool' has no annotations annotation_checker · 100%
low
Tool 'workboard_get_user_key_results_tool' has no annotations annotation_checker · 100%
low
Tool 'workboard_update_key_result_tool' has no annotations annotation_checker · 100%
low
Tool 'workboard_create_objective_tool' has no annotations annotation_checker · 100%
low
Tool 'workboard_get_workstreams_tool' has no annotations annotation_checker · 100%
low
Tool 'workboard_get_workstream_activities_tool' has no annotations annotation_checker · 100%
low
Tool 'workboard_get_team_workstreams_tool' has no annotations annotation_checker · 100%
low
Tool 'workboard_create_workstream_tool' has no annotations annotation_checker · 100%
low
Tool 'workboard_update_workstream_tool' has no annotations annotation_checker · 100%
low
Tool 'workboard_list_activities_tool' has no annotations annotation_checker · 100%
low
Tool 'workboard_get_activity_tool' has no annotations annotation_checker · 100%
low
Tool 'workboard_create_activity_tool' has no annotations annotation_checker · 100%
low
Tool 'workboard_update_activity_tool' has no annotations annotation_checker · 100%
medium
OAuth implementation without PKCE auth_checker · 75%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Vulnerable dependency: fastmcp@2.0 (GHSA-5h2m-4q8j-pqpj) dependency_analyzer · 95%
medium
Vulnerable dependency: fastmcp@2.0 (GHSA-c2jp-c369-7pvx) dependency_analyzer · 95%
medium
Vulnerable dependency: fastmcp@2.0 (GHSA-m8x7-r2rg-vh5g) dependency_analyzer · 95%
medium
Vulnerable dependency: fastmcp@2.0 (GHSA-mxxr-jv3v-6pgc) dependency_analyzer · 95%
medium
Vulnerable dependency: fastmcp@2.0 (GHSA-rcfx-77hg-w2wv) dependency_analyzer · 95%
medium
Vulnerable dependency: fastmcp@2.0 (GHSA-rj5c-58rq-j5g5) dependency_analyzer · 95%
medium
Vulnerable dependency: fastmcp@2.0 (GHSA-rww4-4w9c-7733) dependency_analyzer · 95%
medium
Vulnerable dependency: fastmcp@2.0 (GHSA-vv7q-7jx5-f767) dependency_analyzer · 95%
medium
Vulnerable dependency: fastmcp@2.0 (PYSEC-2026-1364) dependency_analyzer · 95%
medium
Vulnerable dependency: fastmcp@2.0 (PYSEC-2026-1365) dependency_analyzer · 95%
medium
Vulnerable dependency: fastmcp@2.0 (PYSEC-2026-2474) dependency_analyzer · 95%
medium
Vulnerable dependency: fastmcp@2.0 (PYSEC-2026-2475) dependency_analyzer · 95%
medium
Vulnerable dependency: fastmcp@2.0 (PYSEC-2026-2476) dependency_analyzer · 95%
medium
Vulnerable dependency: fastmcp@2.0 (PYSEC-2026-338) dependency_analyzer · 95%
medium
Vulnerable dependency: pydantic@2.0 (GHSA-mr82-8j83-vxmv) dependency_analyzer · 95%
medium
Vulnerable dependency: pydantic@2.0 (PYSEC-2026-1812) dependency_analyzer · 95%
info
pyproject.toml metadata manifest_parser · 100%
info
Tool: workboard_get_user_tool manifest_parser · 90%
info
Tool: workboard_list_users_tool manifest_parser · 90%
info
Tool: workboard_create_user_tool manifest_parser · 90%
info
Tool: workboard_update_user_tool manifest_parser · 90%
info
Tool: workboard_get_teams_tool manifest_parser · 90%
info
Tool: workboard_get_team_members_tool manifest_parser · 90%
info
Tool: workboard_get_objectives_tool manifest_parser · 90%
info
Tool: workboard_get_objective_details_tool manifest_parser · 90%
info
Tool: workboard_get_my_objectives_tool manifest_parser · 90%
info
Tool: workboard_get_my_key_results_tool manifest_parser · 90%
info
Tool: workboard_get_user_key_results_tool manifest_parser · 90%
info
Tool: workboard_update_key_result_tool manifest_parser · 90%
info
Tool: workboard_create_objective_tool manifest_parser · 90%
info
Tool: workboard_get_workstreams_tool manifest_parser · 90%
info
Tool: workboard_get_workstream_activities_tool manifest_parser · 90%
info
Tool: workboard_get_team_workstreams_tool manifest_parser · 90%
info
Tool: workboard_create_workstream_tool manifest_parser · 90%
info
Tool: workboard_update_workstream_tool manifest_parser · 90%
info
Tool: workboard_list_activities_tool manifest_parser · 90%
info
Tool: workboard_get_activity_tool manifest_parser · 90%
info
Tool: workboard_create_activity_tool manifest_parser · 90%
info
Tool: workboard_update_activity_tool manifest_parser · 90%
info
Transport: streamable-http manifest_parser · 80%
info
Required env vars (2) manifest_parser · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 90%
low
Permission: filesystem access detected permission_analyzer · 80%
low
Permission: env_vars access detected permission_analyzer · 90%
info
No dependency files found for SBOM generation sbom_generator · 100%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%