@kaneo/mcp 0.1.4 → 0.1.6

package/README.md

@@ -1,8 +1,10 @@
 # Kaneo MCP server
 
-`@kaneo/mcp` is a local MCP server for Kaneo.
+`@kaneo/mcp` is a local stdio MCP server for Kaneo.
 
-It runs over stdio, signs in with Kaneo's device flow, and then calls the Kaneo API with a bearer token. The package lives in `apps/mcp` in this monorepo and exposes the `kaneo-mcp` CLI.
+It runs over stdio, signs in with Kaneo's device flow, and then calls the Kaneo API with a bearer token. The package lives in `packages/mcp` in this monorepo and exposes the `kaneo-mcp` CLI.
+
+> **Tip:** Every Kaneo instance also ships a built-in HTTP MCP endpoint at `/api/mcp`. If your MCP client supports Streamable HTTP transport (e.g. Claude Code), you can connect directly without this package. See the [MCP docs](https://docs.kaneo.app/core/integrations/mcp) for details.
 
 ## Prerequisites
 
@@ -23,6 +25,7 @@ DEVICE_AUTH_CLIENT_IDS=kaneo-cli,kaneo-mcp,your-client-id
 |----------|-------------|
 | `KANEO_API_URL` | Kaneo API origin (default `http://localhost:1337`). Do not include `/api`. |
 | `KANEO_MCP_CLIENT_ID` | Device-flow client id (default `kaneo-mcp`). Must match `DEVICE_AUTH_CLIENT_IDS` on the server. |
+| `KANEO_API_KEY` | **Optional.** A Kaneo API key (create one under Settings → Account → Developer). When set, the server authenticates with it as a Bearer token and skips the interactive device flow. Use this for headless/Docker setups. |
 
 ## Install
 
@@ -69,7 +72,7 @@ See all options:
 kaneo-mcp install --help
 ```
 
-If you are currently inside the local `apps/mcp` package directory, npm may resolve the local workspace package instead of the published one and fail to expose the bin. In that case, either run `npx` from outside `apps/mcp`, or use a local build:
+If you are currently inside the local `packages/mcp` package directory, npm may resolve the local workspace package instead of the published one and fail to expose the bin. In that case, either run `npx` from outside `packages/mcp`, or use a local build:
 
 ```bash
 node dist/index.js
@@ -91,7 +94,7 @@ pnpm --filter @kaneo/mcp run test
 Or run it from the package directory:
 
 ```bash
-pnpm -C apps/mcp run build
+pnpm -C packages/mcp run build
 ```
 
 The CLI entry points to `./dist/index.js`. Use `npx @kaneo/mcp` or `kaneo-mcp` after a global install so your IDE config points at the resolved path.
@@ -106,10 +109,21 @@ On the first tool call that needs Kaneo, the server:
 4. Polls `POST /api/auth/device/token` until approved
 5. Stores the access token at `~/.config/kaneo-mcp/credentials.json` with mode `0600`
 
+### Non-interactive (API key)
+
+For headless or sandboxed environments where opening a browser is impractical, set `KANEO_API_KEY` to a key created under Settings → Account → Developer. The server sends it as a Bearer token on every request and skips the device flow entirely, so no token is cached to disk.
+
 ## Tools
 
 - Session: `whoami`, `list_workspaces`
 - Projects: `list_projects`, `get_project`, `create_project`, `update_project`
 - Tasks: `list_tasks`, `get_task`, `create_task`, `update_task`, `move_task`, `update_task_status`
-- Comments: `list_task_comments`, `create_task_comment`
-- Labels: `list_workspace_labels`, `create_label`, `attach_label_to_task`, `detach_label_from_task`
+- Comments: `list_task_comments`, `create_task_comment`, `update_task_comment`, `delete_task_comment`
+- Labels: `list_workspace_labels`, `create_label`, `attach_label_to_task`, `detach_label_from_task`, `delete_label`
+- Task relations: `create_task_relation`, `get_task_relations`, `delete_task_relation`
+
+## Releasing
+
+Bump `version` in `packages/mcp/package.json` and merge to `main`. The [publish workflow](../../.github/workflows/publish-mcp.yml) runs the package tests, publishes the new version to npm, and creates a `mcp-v<version>` GitHub release. Nothing is published while the version stays the same, so tool changes reach npm only once the version is bumped.
+
+Publishing a GitHub release manually also works: tag it `mcp-v<version>` with the tag version matching `packages/mcp/package.json` on the tagged commit.

package/dist/auth/auth-service.d.ts

@@ -0,0 +1,24 @@
+export type AuthServiceOptions = {
+    baseUrl: string;
+    clientId: string;
+    apiKey?: string;
+};
+export declare class AuthService {
+    readonly baseUrl: string;
+    readonly clientId: string;
+    private readonly apiKey?;
+    private activeGetAccessTokenPromise?;
+    constructor(options: AuthServiceOptions);
+    /**
+     * True when a pre-created Kaneo API key is used instead of the interactive
+     * device flow. Callers use this to avoid clearing/retrying auth on a 401.
+     */
+    get usingApiKey(): boolean;
+    clearToken(): Promise<void>;
+    private validateAccessToken;
+    private log;
+    /**
+     * Returns a valid access token, running the device authorization flow if needed.
+     */
+    getAccessToken(): Promise<string>;
+}

package/dist/auth/auth-service.js

@@ -4,17 +4,32 @@ import { clearCredentials, loadCredentials, saveCredentials, } from "./token-sto
 export class AuthService {
     baseUrl;
     clientId;
+    apiKey;
+    activeGetAccessTokenPromise;
     constructor(options) {
         this.baseUrl = options.baseUrl;
         this.clientId = options.clientId;
+        this.apiKey = options.apiKey;
+    }
+    /**
+     * True when a pre-created Kaneo API key is used instead of the interactive
+     * device flow. Callers use this to avoid clearing/retrying auth on a 401.
+     */
+    get usingApiKey() {
+        return Boolean(this.apiKey);
     }
     async clearToken() {
+        // Nothing to clear for API-key auth; the key is static config.
+        if (this.apiKey)
+            return;
         await clearCredentials();
     }
     async validateAccessToken(token) {
         try {
+            const signal = AbortSignal.timeout(10_000);
             const res = await fetch(`${this.baseUrl}/api/auth/get-session`, {
                 headers: { Authorization: `Bearer ${token}` },
+                signal,
             });
             if (res.status === 401) {
                 return "invalid";
@@ -36,38 +51,55 @@ export class AuthService {
      * Returns a valid access token, running the device authorization flow if needed.
      */
     async getAccessToken() {
-        const cached = await loadCredentials();
-        if (cached &&
-            cached.baseUrl === this.baseUrl &&
-            cached.clientId === this.clientId &&
-            cached.accessToken) {
-            const validation = await this.validateAccessToken(cached.accessToken);
-            // Fail-open for "unknown": validateAccessToken returns "unknown" on transient HTTP/network
-            // errors or ambiguous responses. Treating "unknown" like "valid" avoids clearToken() and a full
-            // device re-auth so flaky connectivity does not wipe cached.accessToken; only "invalid" forces
-            // a fresh login. Tests should cover both unknown and invalid paths.
-            if (validation === "valid" || validation === "unknown") {
-                return cached.accessToken;
-            }
-            await this.clearToken();
+        // Non-interactive auth: a pre-created Kaneo API key (KANEO_API_KEY) is sent
+        // as a Bearer token, which the REST API already accepts. This skips the
+        // device flow so the MCP server works in headless/Docker environments.
+        if (this.apiKey) {
+            return this.apiKey;
+        }
+        if (this.activeGetAccessTokenPromise) {
+            return await this.activeGetAccessTokenPromise;
         }
-        const code = await requestDeviceCode(this.baseUrl, this.clientId);
-        const verifyUrl = code.verification_uri_complete || code.verification_uri;
-        this.log(`Open ${verifyUrl} and approve this device. User code: ${code.user_code}`);
+        this.activeGetAccessTokenPromise = (async () => {
+            const cached = await loadCredentials();
+            if (cached &&
+                cached.baseUrl === this.baseUrl &&
+                cached.clientId === this.clientId &&
+                cached.accessToken) {
+                const validation = await this.validateAccessToken(cached.accessToken);
+                // Fail-open for "unknown": validateAccessToken returns "unknown" on transient HTTP/network
+                // errors or ambiguous responses. Treating "unknown" like "valid" avoids clearToken() and a full
+                // device re-auth so flaky connectivity does not wipe cached.accessToken; only "invalid" forces
+                // a fresh login. Tests should cover both unknown and invalid paths.
+                if (validation === "valid" || validation === "unknown") {
+                    return cached.accessToken;
+                }
+                await this.clearToken();
+            }
+            const code = await requestDeviceCode(this.baseUrl, this.clientId);
+            const verifyUrl = code.verification_uri_complete || code.verification_uri;
+            this.log(`Open ${verifyUrl} and approve this device. User code: ${code.user_code}`);
+            try {
+                await open(verifyUrl);
+            }
+            catch {
+                this.log("Could not open a browser automatically; use the URL above.");
+            }
+            const accessToken = await pollDeviceAccessToken(this.baseUrl, this.clientId, code.device_code, code.interval, { log: (m) => this.log(m) });
+            const toStore = {
+                version: 1,
+                baseUrl: this.baseUrl,
+                clientId: this.clientId,
+                accessToken,
+            };
+            await saveCredentials(toStore);
+            return accessToken;
+        })();
         try {
-            await open(verifyUrl);
+            return await this.activeGetAccessTokenPromise;
         }
-        catch {
-            this.log("Could not open a browser automatically; use the URL above.");
+        finally {
+            this.activeGetAccessTokenPromise = undefined;
         }
-        const accessToken = await pollDeviceAccessToken(this.baseUrl, this.clientId, code.device_code, code.interval, { log: (m) => this.log(m) });
-        const toStore = {
-            version: 1,
-            baseUrl: this.baseUrl,
-            clientId: this.clientId,
-            accessToken,
-        };
-        await saveCredentials(toStore);
-        return accessToken;
     }
 }

package/dist/auth/device-flow.d.ts

@@ -0,0 +1,21 @@
+export type DeviceCodeResponse = {
+    device_code: string;
+    user_code: string;
+    verification_uri: string;
+    verification_uri_complete?: string;
+    interval: number;
+    expires_in: number;
+};
+export type DeviceTokenErrorBody = {
+    error?: string;
+    error_description?: string;
+};
+export declare function requestDeviceCode(baseUrl: string, clientId: string): Promise<DeviceCodeResponse>;
+/**
+ * Polls `/api/auth/device/token` until success or terminal error.
+ * First attempt is immediate; subsequent attempts wait `interval` seconds (increased on `slow_down`).
+ */
+export declare function pollDeviceAccessToken(baseUrl: string, clientId: string, deviceCode: string, initialIntervalSec: number, options?: {
+    maxWaitMs?: number;
+    log?: (msg: string) => void;
+}): Promise<string>;

package/dist/auth/device-flow.js

@@ -1,17 +1,49 @@
+const REQUEST_TIMEOUT_MS = 10_000;
 function sleep(ms) {
     return new Promise((r) => setTimeout(r, ms));
 }
+function isAbortError(err) {
+    return err instanceof DOMException
+        ? err.name === "AbortError"
+        : err instanceof Error && err.name === "AbortError";
+}
+function isObjectRecord(value) {
+    return value !== null && typeof value === "object";
+}
+async function fetchWithTimeout(input, init, timeoutMs = REQUEST_TIMEOUT_MS) {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        return await fetch(input, { ...init, signal: controller.signal });
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
 export async function requestDeviceCode(baseUrl, clientId) {
-    const res = await fetch(`${baseUrl}/api/auth/device/code`, {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ client_id: clientId }),
-    });
-    const body = (await res.json().catch(() => ({})));
+    let res;
+    try {
+        res = await fetchWithTimeout(`${baseUrl}/api/auth/device/code`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ client_id: clientId }),
+        });
+    }
+    catch (err) {
+        if (isAbortError(err)) {
+            throw new Error("device/code request timed out after 10s.");
+        }
+        throw err;
+    }
+    const parsedBody = await res.json().catch(() => ({}));
+    if (!isObjectRecord(parsedBody)) {
+        throw new Error(`device/code: unexpected response ${JSON.stringify(parsedBody)}`);
+    }
+    const body = parsedBody;
     if (!res.ok) {
         throw new Error(`device/code failed (${res.status}): ${JSON.stringify(body)}`);
     }
-    if (!("device_code" in body) || typeof body.device_code !== "string") {
+    if (typeof body.device_code !== "string") {
         throw new Error(`device/code: unexpected response ${JSON.stringify(body)}`);
     }
     if (typeof body.user_code !== "string" ||
@@ -53,24 +85,41 @@ export async function pollDeviceAccessToken(baseUrl, clientId, deviceCode, initi
     for (let attempt = 0; Date.now() - started < maxWait; attempt++) {
         if (attempt > 0) {
             await sleep(intervalMs);
+            if (Date.now() - started >= maxWait) {
+                break;
+            }
         }
-        const res = await fetch(`${baseUrl}/api/auth/device/token`, {
-            method: "POST",
-            headers: { "Content-Type": "application/json" },
-            body: JSON.stringify({
-                grant_type: "urn:ietf:params:oauth:grant-type:device_code",
-                device_code: deviceCode,
-                client_id: clientId,
-            }),
-        });
-        if (Date.now() - started > maxWait) {
+        let res;
+        try {
+            res = await fetchWithTimeout(`${baseUrl}/api/auth/device/token`, {
+                method: "POST",
+                headers: { "Content-Type": "application/json" },
+                body: JSON.stringify({
+                    grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+                    device_code: deviceCode,
+                    client_id: clientId,
+                }),
+            });
+        }
+        catch (err) {
+            if (isAbortError(err)) {
+                log("Device token poll request timed out; retrying.");
+                continue;
+            }
+            throw err;
+        }
+        if (Date.now() - started >= maxWait) {
             throw new Error("Device authorization timed out waiting for approval.");
         }
-        const body = (await res.json().catch(() => ({})));
+        const parsedBody = await res.json().catch(() => ({}));
+        if (!isObjectRecord(parsedBody)) {
+            throw new Error(`device/token failed (${res.status}): ${JSON.stringify(parsedBody)}`);
+        }
+        const body = parsedBody;
         if (res.ok && typeof body.access_token === "string") {
             return body.access_token;
         }
-        const err = body.error;
+        const err = typeof body.error === "string" ? body.error : undefined;
         if (err === "authorization_pending") {
             log("Waiting for device approval…");
             continue;

package/dist/auth/token-store.d.ts

@@ -0,0 +1,10 @@
+export type StoredCredentials = {
+    version: 1;
+    baseUrl: string;
+    clientId: string;
+    accessToken: string;
+};
+export declare function credentialsPath(): string;
+export declare function loadCredentials(): Promise<StoredCredentials | null>;
+export declare function saveCredentials(data: StoredCredentials): Promise<void>;
+export declare function clearCredentials(): Promise<void>;

package/dist/cli.d.ts

@@ -0,0 +1 @@
+export declare function runCli(): Promise<void>;

package/dist/cli.js

@@ -35,7 +35,7 @@ async function startMcpServer() {
     await server.connect(transport);
 }
 function printMainHelp() {
-    console.log(`kaneo-mcp — Kaneo MCP server (stdio transport)
+    console.log(`kaneo-mcp: Kaneo MCP server (stdio transport)
 
 Usage:
   npx @kaneo/mcp         Interactive installer (terminal only; no global install)

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/install/index.d.ts

@@ -0,0 +1,11 @@
+export type ParsedInstallArgs = {
+    target?: string;
+    output?: string;
+    name: string;
+    yes: boolean;
+    apiUrl?: string;
+    projectDir: string;
+    help: boolean;
+};
+export declare function parseInstallArgs(argv: string[]): ParsedInstallArgs;
+export declare function runInstall(argv: string[]): Promise<void>;

package/dist/install/index.js

@@ -1,4 +1,4 @@
-import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { chmod, mkdir, readFile, writeFile } from "node:fs/promises";
 import { dirname } from "node:path";
 import { stdin as input, stdout as output } from "node:process";
 import { mergeMcpServerEntry } from "./merge-config.js";
@@ -254,6 +254,12 @@ export async function runInstall(argv) {
     for (const w of mergedWrites) {
         await mkdir(dirname(w.configPath), { recursive: true });
         await writeFile(w.configPath, w.merged, { encoding: "utf8", mode: 0o600 });
+        try {
+            await chmod(w.configPath, 0o600);
+        }
+        catch {
+            /* ignore chmod failures on some FS */
+        }
         writtenPaths.push(w.configPath);
     }
     if (writtenPaths.length === 0) {
@@ -267,7 +273,7 @@ export async function runInstall(argv) {
     console.log("\nRestart your MCP client (or reload the window) if needed.");
 }
 function printInstallHelp() {
-    console.log(`kaneo-mcp install — register Kaneo in an MCP client config
+    console.log(`kaneo-mcp install: register Kaneo in an MCP client config
 
 Usage:
   kaneo-mcp install [options]

package/dist/install/merge-config.d.ts

@@ -0,0 +1,10 @@
+export type McpServerEntry = {
+    command: string;
+    args: string[];
+    env?: Record<string, string>;
+};
+/**
+ * Merges or replaces `mcpServers[serverName]` and returns formatted JSON.
+ * Preserves other top-level keys and other MCP server entries.
+ */
+export declare function mergeMcpServerEntry(existingJson: string | null, serverName: string, serverConfig: McpServerEntry): string;

package/dist/install/resolve-entry.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Absolute path to this package's `dist/index.js` (the MCP stdio entry).
+ * Resolved from `dist/install/resolve-entry.js` at runtime.
+ */
+export declare function resolvePackageEntryPath(): string;

package/dist/install/targets.d.ts

@@ -0,0 +1,39 @@
+export type InstallTargetId = "cursor-user" | "cursor-project" | "claude-desktop" | "custom";
+export type InstallTarget = {
+    id: InstallTargetId;
+    label: string;
+    description: string;
+};
+/**
+ * Validates a non-interactive custom MCP config path (same rules as the install wizard).
+ * Returns the trimmed absolute path on success.
+ */
+export declare function validateCustomConfigPathInput(raw: string): {
+    ok: true;
+    path: string;
+} | {
+    ok: false;
+    message: string;
+};
+export declare const INSTALL_TARGETS: readonly [{
+    readonly id: "cursor-user";
+    readonly label: "Cursor (user-wide)";
+    readonly description: "~/.cursor/mcp.json, available in all projects";
+}, {
+    readonly id: "cursor-project";
+    readonly label: "Cursor (this project only)";
+    readonly description: ".cursor/mcp.json in the current directory";
+}, {
+    readonly id: "claude-desktop";
+    readonly label: "Claude Desktop";
+    readonly description: "claude_desktop_config.json for the Claude app";
+}, {
+    readonly id: "custom";
+    readonly label: "Custom file path";
+    readonly description: "Any JSON file you choose (advanced)";
+}];
+export declare function getClaudeDesktopConfigPath(): string;
+export declare function resolveTargetConfigPath(id: InstallTargetId, options: {
+    cwd: string;
+    customPath?: string;
+}): string;

package/dist/install/targets.js

@@ -21,7 +21,7 @@ export const INSTALL_TARGETS = [
     {
         id: "cursor-user",
         label: "Cursor (user-wide)",
-        description: "~/.cursor/mcp.json — available in all projects",
+        description: "~/.cursor/mcp.json, available in all projects",
     },
     {
         id: "cursor-project",

package/dist/install/wizard.d.ts

@@ -0,0 +1,4 @@
+import { type InstallTargetId } from "./targets.js";
+export declare function promptTargetSelect(): Promise<InstallTargetId[]>;
+export declare function promptCustomConfigPath(): Promise<string>;
+export declare function promptConfirmOverwrite(serverName: string, configPath: string): Promise<boolean>;

package/dist/kaneo/client.d.ts

@@ -0,0 +1,14 @@
+import type { AuthService } from "../auth/auth-service.js";
+export type Json = null | boolean | number | string | Json[] | {
+    [key: string]: Json;
+};
+export declare class KaneoClient {
+    readonly baseUrl: string;
+    private readonly auth;
+    constructor(options: {
+        baseUrl: string;
+        auth: AuthService;
+    });
+    private authorizedFetch;
+    json<T = Json>(path: string, init?: RequestInit): Promise<T>;
+}

package/dist/kaneo/client.js

@@ -13,8 +13,14 @@ export class KaneoClient {
             headers.set("Content-Type", "application/json");
         }
         const url = `${this.baseUrl}${path.startsWith("/") ? path : `/${path}`}`;
-        const res = await fetch(url, { ...init, headers });
-        if (res.status === 401 && !didRetry) {
+        const timeoutSignal = AbortSignal.timeout(10_000);
+        const signal = init?.signal
+            ? AbortSignal.any([init.signal, timeoutSignal])
+            : timeoutSignal;
+        const res = await fetch(url, { ...init, headers, signal });
+        // With a static API key there is nothing to refresh, so surface the 401
+        // instead of looping back into the interactive device flow.
+        if (res.status === 401 && !didRetry && !this.auth.usingApiKey) {
             await this.auth.clearToken();
             return this.authorizedFetch(path, init, true);
         }

package/dist/kaneo/task-helpers.d.ts

@@ -0,0 +1,19 @@
+declare const PRIORITIES: readonly ["no-priority", "low", "medium", "high", "urgent"];
+export type TaskPriority = (typeof PRIORITIES)[number];
+export declare function isTaskPriority(v: string): v is TaskPriority;
+export type TaskUpdatePatch = {
+    title?: string;
+    description?: string | null;
+    status?: string;
+    priority?: TaskPriority;
+    projectId?: string;
+    position?: number;
+    startDate?: string | null;
+    dueDate?: string | null;
+    userId?: string | null;
+};
+/**
+ * Builds the JSON body for `PUT /api/task/:id` from an existing task plus a patch.
+ */
+export declare function buildFullTaskUpdateBody(existing: Record<string, unknown>, patch: TaskUpdatePatch): Record<string, string | number | undefined>;
+export {};

package/dist/server.d.ts

@@ -0,0 +1,2 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+export declare function createMcpServer(): McpServer;

package/dist/server.js

@@ -9,7 +9,8 @@ const { version: packageVersion } = require("../package.json");
 export function createMcpServer() {
     const baseUrl = normalizeBaseUrl(process.env.KANEO_API_URL || "http://localhost:1337");
     const clientId = process.env.KANEO_MCP_CLIENT_ID || "kaneo-mcp";
-    const auth = new AuthService({ baseUrl, clientId });
+    const apiKey = process.env.KANEO_API_KEY || undefined;
+    const auth = new AuthService({ baseUrl, clientId, apiKey });
     const client = new KaneoClient({ baseUrl, auth });
     const server = new McpServer({
         name: "kaneo-mcp",

package/dist/tools/register.d.ts

@@ -0,0 +1,5 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import type { KaneoClient } from "../kaneo/client.js";
+export declare function registerTools(server: McpServer, ctx: {
+    client: KaneoClient;
+}): void;

package/dist/tools/register.js

@@ -93,9 +93,9 @@ export function registerTools(server, ctx) {
             }
             const icon = patch.icon !== undefined
                 ? patch.icon
-                : existing.icon != null
-                    ? String(existing.icon)
-                    : "";
+                : typeof existing.icon === "string"
+                    ? existing.icon
+                    : "Layout";
             const slug = patch.slug ??
                 (typeof existing.slug === "string" ? existing.slug : "");
             if (!slug) {
@@ -108,16 +108,13 @@ export function registerTools(server, ctx) {
                     : "";
             const isPublic = patch.isPublic !== undefined
                 ? patch.isPublic
-                : Boolean(existing.isPublic);
+                : typeof existing.isPublic === "boolean"
+                    ? existing.isPublic
+                    : false;
+            const body = { name, icon, slug, description, isPublic };
             return client.json(`/api/project/${encodeURIComponent(id)}`, {
                 method: "PUT",
-                body: JSON.stringify({
-                    name,
-                    icon,
-                    slug,
-                    description,
-                    isPublic,
-                }),
+                body: JSON.stringify(body),
             });
         });
     });
@@ -258,6 +255,22 @@ export function registerTools(server, ctx) {
         method: "POST",
         body: JSON.stringify({ content: args.content }),
     })));
+    server.registerTool("update_task_comment", {
+        description: "Update one of your comments on a task.",
+        inputSchema: z.object({
+            commentId: nonEmptyString,
+            content: nonEmptyString,
+        }),
+    }, async (args) => run(() => client.json(`/api/comment/${encodeURIComponent(args.commentId)}`, {
+        method: "PUT",
+        body: JSON.stringify({ content: args.content }),
+    })));
+    server.registerTool("delete_task_comment", {
+        description: "Delete one of your comments from a task.",
+        inputSchema: z.object({ commentId: nonEmptyString }),
+    }, async (args) => run(() => client.json(`/api/comment/${encodeURIComponent(args.commentId)}`, {
+        method: "DELETE",
+    })));
     server.registerTool("list_workspace_labels", {
         description: "List labels defined in a workspace.",
         inputSchema: z.object({ workspaceId: nonEmptyString }),
@@ -295,4 +308,43 @@ export function registerTools(server, ctx) {
     }, async (args) => run(() => client.json(`/api/label/${encodeURIComponent(args.labelId)}/task`, {
         method: "DELETE",
     })));
+    server.registerTool("create_task_relation", {
+        description: "Create a relation between two tasks. relationType: 'subtask' (sourceTaskId is the parent, targetTaskId the child), 'blocks' (sourceTaskId blocks targetTaskId), or 'related' (bidirectional).",
+        inputSchema: z.object({
+            sourceTaskId: nonEmptyString,
+            targetTaskId: nonEmptyString,
+            relationType: z.enum(["subtask", "blocks", "related"]),
+        }),
+    }, async (args) => run(() => client.json("/api/task-relation", {
+        method: "POST",
+        body: JSON.stringify({
+            sourceTaskId: args.sourceTaskId,
+            targetTaskId: args.targetTaskId,
+            relationType: args.relationType,
+        }),
+    })));
+    server.registerTool("get_task_relations", {
+        description: "List all relations (subtask/blocks/related) involving a task.",
+        inputSchema: z.object({ taskId: nonEmptyString }),
+    }, async (args) => run(() => client.json(`/api/task-relation/${encodeURIComponent(args.taskId)}`, {
+        method: "GET",
+    })));
+    server.registerTool("delete_task_relation", {
+        description: "Delete a task relation by its relation ID.",
+        inputSchema: z.object({ id: nonEmptyString }),
+    }, async (args) => run(() => client.json(`/api/task-relation/${encodeURIComponent(args.id)}`, {
+        method: "DELETE",
+    })));
+    server.registerTool("delete_label", {
+        description: "Delete a label by ID. Only task-associated labels can be deleted; workspace-level labels (taskId null) are rejected by the API.",
+        inputSchema: z.object({ id: nonEmptyString }),
+    }, async (args) => run(async () => {
+        const label = (await client.json(`/api/label/${encodeURIComponent(args.id)}`, { method: "GET" }));
+        if (!label?.taskId) {
+            throw new Error("Label is not associated with a task and cannot be deleted (workspace-level labels are not deletable via this endpoint).");
+        }
+        return client.json(`/api/label/${encodeURIComponent(args.id)}`, {
+            method: "DELETE",
+        });
+    }));
 }

package/dist/utils/mcp-result.d.ts

@@ -0,0 +1,3 @@
+import type { CallToolResult } from "@modelcontextprotocol/sdk/types.js";
+export declare function textResult(data: unknown, isError?: boolean): CallToolResult;
+export declare function errorResult(message: string): CallToolResult;

package/dist/utils/normalize-base-url.d.ts

@@ -0,0 +1,4 @@
+/**
+ * Kaneo API base URL without trailing slash and without `/api` suffix.
+ */
+export declare function normalizeBaseUrl(raw: string): string;

package/package.json

@@ -1,17 +1,24 @@
 {
 	"name": "@kaneo/mcp",
-	"version": "0.1.4",
-	"description": "Model Context Protocol (stdio) server for Kaneo — tasks, projects, labels, and device authorization",
+	"version": "0.1.6",
+	"description": "Model Context Protocol (stdio) server for Kaneo: tasks, projects, labels, and device authorization",
 	"license": "MIT",
 	"homepage": "https://github.com/usekaneo/kaneo/",
 	"repository": {
 		"type": "git",
-		"url": "https://github.com/usekaneo/kaneo/"
+		"url": "https://github.com/usekaneo/kaneo/",
+		"directory": "packages/mcp"
 	},
 	"type": "module",
 	"bin": {
 		"kaneo-mcp": "dist/index.js"
 	},
+	"exports": {
+		".": {
+			"import": "./dist/server.js",
+			"types": "./dist/server.d.ts"
+		}
+	},
 	"publishConfig": {
 		"access": "public"
 	},
@@ -36,17 +43,17 @@
 		"test:watch": "vitest --config vitest.config.ts"
 	},
 	"dependencies": {
-		"@modelcontextprotocol/sdk": "^1.26.0",
+		"@modelcontextprotocol/sdk": "^1.29.0",
 		"open": "^11.0.0",
 		"prompts": "^2.4.2",
-		"zod": "^4.3.6"
+		"zod": "^4.4.3"
 	},
 	"devDependencies": {
 		"@kaneo/typescript-config": "workspace:*",
 		"@types/node": "^25.3.5",
 		"@types/prompts": "^2.4.9",
-		"tsx": "^4.21.0",
+		"tsx": "^4.23.1",
 		"typescript": "^5.9.3",
-		"vitest": "^4.1.2"
+		"vitest": "^4.1.10"
 	}
 }