todoist-mcp 1.2.2 → 1.2.4

package/README.md

@@ -1,5 +1,5 @@
 <div align="center">
-    <img src="https://static-00.iconduck.com/assets.00/todoist-icon-512x512-v3a6dxo9.png" width="120"/>
+    <img src="https://img.icons8.com/color/200/todoist.png" width="120"/>
     <h1>Todoist MCP Server</h1>
     <p>A Model Context Protocol (MCP) server implementation that integrates Claude and other AI assistants with Todoist, enabling natural language task management.</p>
     <div>

package/dist/tools/tasks.js

@@ -1,5 +1,7 @@
 import { z } from 'zod';
 import { createApiHandler, createBatchApiHandler, createSyncApiHandler, } from '../utils/handlers.js';
+import { createHandler } from '../utils/handlers.js';
+import { todoistApi } from '../clients.js';
 /// Common fields for create and update tasks
 const create_fields = {
     content: z
@@ -15,7 +17,10 @@ const create_fields = {
         .string()
         .optional()
         .describe('Human defined task due date (ex.: "next Monday", "Tomorrow"). Value is set using local (not UTC) time, if not in english provided, due_lang should be set to the language of the string'),
-    due_date: z.string().optional().describe('Date in YYYY-MM-DD format relative to user timezone'),
+    due_date: z
+        .string()
+        .optional()
+        .describe('Due date in YYYY-MM-DD format relative to user timezone (when you plan to work on task)'),
     due_datetime: z.string().optional().describe('Specific date and time in RFC3339 format in UTC'),
     due_lang: z
         .string()
@@ -35,6 +40,11 @@ const create_fields = {
         .enum(['minute', 'day'])
         .optional()
         .describe('The unit of time that the duration field represents. Must be either minute or day'),
+    deadline_date: z
+        .string()
+        .optional()
+        .describe('Deadline date in YYYY-MM-DD format relative to user timezone (fixed date when task must be completed, for tasks with external consequences)'),
+    deadline_lang: z.string().optional().describe('2-letter code specifying language of deadline'),
 };
 createApiHandler({
     name: 'get_tasks_list',
@@ -181,3 +191,40 @@ createSyncApiHandler({
         return { valid: true };
     },
 });
+createHandler('get_completed_tasks', 'Get completed tasks from Todoist with filtering options', {
+    project_id: z.string().optional().describe('Filter by specific project ID'),
+    section_id: z.string().optional().describe('Filter by specific section ID'),
+    parent_id: z.string().optional().describe('Filter by specific parent task ID'),
+    since: z
+        .string()
+        .optional()
+        .describe('Return tasks completed since this date (YYYY-MM-DD format)'),
+    until: z
+        .string()
+        .optional()
+        .describe('Return tasks completed until this date (YYYY-MM-DD format)'),
+    limit: z
+        .number()
+        .int()
+        .min(1)
+        .max(200)
+        .optional()
+        .default(50)
+        .describe('Number of tasks to return (max 200)'),
+    offset: z.number().int().min(0).optional().describe('Offset for pagination'),
+    annotation_type: z.string().optional().describe('Filter by annotation type'),
+}, async (args) => {
+    const params = {};
+    Object.entries(args).forEach(([key, value]) => {
+        if (value !== undefined) {
+            params[key] = typeof value === 'number' ? value.toString() : value;
+        }
+    });
+    const response = await todoistApi.getCompletedTasks(params);
+    return {
+        completed_tasks: response.items || [],
+        projects: response.projects || {},
+        sections: response.sections || {},
+        total: response.items?.length || 0,
+    };
+});

package/dist/utils/TodoistClient.d.ts

@@ -30,4 +30,10 @@ export declare class TodoistClient {
      * @returns API response data
      */
     sync(commands: Array<SyncCommand>): Promise<any>;
+    /**
+     * Get completed tasks using Sync API
+     * @param params - Query parameters for filtering completed tasks
+     * @returns API response data with completed tasks
+     */
+    getCompletedTasks(params?: Record<string, string>): Promise<any>;
 }

package/dist/utils/TodoistClient.js

@@ -100,4 +100,29 @@ export class TodoistClient {
         });
         return this.handleResponse(response);
     }
+    /**
+     * Get completed tasks using Sync API
+     * @param params - Query parameters for filtering completed tasks
+     * @returns API response data with completed tasks
+     */
+    async getCompletedTasks(params = {}) {
+        const url = `${API_SYNC_BASE_URL}/completed/get_all`;
+        log(`Making completed tasks request to: ${url} with params:`, JSON.stringify(params, null, 2));
+        const formData = new URLSearchParams();
+        for (const [key, value] of Object.entries(params)) {
+            if (value) {
+                formData.append(key, value);
+            }
+        }
+        const response = await fetch(url, {
+            method: 'POST',
+            headers: {
+                Authorization: `Bearer ${this.apiToken}`,
+                'Content-Type': 'application/x-www-form-urlencoded',
+                'X-Request-Id': uuidv4(),
+            },
+            body: formData.toString(),
+        });
+        return this.handleResponse(response);
+    }
 }

package/dist/utils/handlers.js

@@ -3,6 +3,25 @@ import { v4 as uuidv4 } from 'uuid';
 import { z } from 'zod';
 import { server, todoistApi } from '../clients.js';
 import { log } from './helpers.js';
+/**
+ * Validates path parameters to prevent path traversal attacks
+ * @param value - The parameter value to validate
+ * @param paramName - The name of the parameter (for error messages)
+ * @returns The URL-encoded safe value
+ * @throws Error if validation fails
+ */
+function validatePathParameter(value, paramName) {
+    const stringValue = String(value);
+    // Check for path traversal characters
+    if (/[/\\]|\.\./.test(stringValue)) {
+        throw new Error(`Invalid characters in path parameter '${paramName}': Path traversal characters are not allowed`);
+    }
+    // Ensure only safe alphanumeric characters, underscores, and hyphens
+    if (!/^[a-zA-Z0-9_-]+$/.test(stringValue)) {
+        throw new Error(`Invalid path parameter '${paramName}': Only alphanumeric characters, underscores, and hyphens are allowed`);
+    }
+    return encodeURIComponent(stringValue);
+}
 export function createHandler(name, description, paramsSchema, handler) {
     const mcpToolCallback = async (args) => {
         try {
@@ -46,9 +65,10 @@ export function createApiHandler(options) {
             if (args[paramName] === undefined) {
                 throw new Error(`Path parameter ${paramName} is required but not provided`);
             }
-            const paramValue = String(args[paramName]);
-            finalPath = finalPath.replace(fullMatch, paramValue);
-            pathParams[paramName] = paramValue;
+            // Validate and encode path parameter using the centralized security function
+            const safeParamValue = validatePathParameter(args[paramName], paramName);
+            finalPath = finalPath.replace(fullMatch, safeParamValue);
+            pathParams[paramName] = String(args[paramName]);
         }
         // Collect non-path parameters for query string or request body
         const otherParams = Object.entries(args).reduce((acc, [key, value]) => {
@@ -151,11 +171,13 @@ export function createBatchApiHandler(options) {
                             item,
                         };
                     }
+                    // Apply security validation to itemId before using in path
+                    const safeItemId = validatePathParameter(itemId, options.idField || 'id');
                     if (options.basePath && options.pathSuffix) {
-                        finalPath = `${options.basePath}${options.pathSuffix.replace('{id}', itemId)}`;
+                        finalPath = `${options.basePath}${options.pathSuffix.replace('{id}', safeItemId)}`;
                     }
                     else if (options.path) {
-                        finalPath = options.path.replace('{id}', itemId);
+                        finalPath = options.path.replace('{id}', safeItemId);
                     }
                     delete apiParams[options.idField];
                     if (options.nameField) {
@@ -285,8 +307,10 @@ export function createSyncApiHandler(options) {
                     });
                     continue;
                 }
-                // Use the provided function to build command args
-                const commandArgs = options.buildCommandArgs(item, itemId);
+                // Apply security validation to itemId before using in sync commands
+                const safeItemId = validatePathParameter(itemId, options.idField);
+                // Use the provided function to build command args with validated ID
+                const commandArgs = options.buildCommandArgs(item, safeItemId);
                 commands.push({
                     type: options.commandType,
                     uuid: uuidv4(),

package/dist/utils/version.d.ts

@@ -1 +1 @@
-export declare const version = "1.2.2";
+export declare const version = "1.2.4";

package/dist/utils/version.js

@@ -1,2 +1,2 @@
 // Auto-generated file, do not edit
-export const version = '1.2.2';
+export const version = '1.2.4';

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "todoist-mcp",
-    "version": "1.2.2",
+    "version": "1.2.4",
     "description": "Todoist MCP Server",
     "type": "module",
     "main": "dist/index.js",