Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

FronyBoard

PYPI · FRONYBOARD · SCANNED SEP 20

Project tracker for AI agents: roadmap, periods, tasks and a validation gate, in one SQLite file

Available components

+2 this week 71 Trust /100
Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security100
  • No malware found by supply-chain analysis.Pass
  • No known CVEs affecting this package version or its production dependencies.Pass
  • Runs hatchling.build at install time, a recognised native-build step with no shell scripting around it. View diagnostics → Pass
  • 4 of 39 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
Schema Quality & AI Usability64
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 4074 tokens (~214/item across 19 items; 19 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management33
  • Stability check failed: the tool surface changed between 0.29.0 and 0.39.0: 1 tool removals, 1 breaking changes, 0 additions. See how to fix → Fail
Tool Coverage67
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 0% of tool parameters carry a description.Fail
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • We read all 19 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
  • An AI judge read all 20 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a current MCP spec version (2026-07-28).Pass
Install

How do I install the FronyBoard MCP server?

FronyBoard runs locally as a PyPI package, launched with uvx fronyboard. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

pypi · fronyboard

# add to Claude Code
claude mcp add cafelatte1-fronyboard -- uvx fronyboard
// .cursor/mcp.json
{
  "mcpServers": {
    "cafelatte1-fronyboard": {
      "command": "uvx",
      "args": [
        "fronyboard"
      ]
    }
  }
}
// .vscode/mcp.json
{
  "servers": {
    "cafelatte1-fronyboard": {
      "command": "uvx",
      "args": [
        "fronyboard"
      ]
    }
  }
}
# add to Codex CLI
codex mcp add cafelatte1-fronyboard -- uvx fronyboard
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "cafelatte1-fronyboard": {
      "type": "local",
      "command": [
        "uvx",
        "fronyboard"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add cafelatte1-fronyboard --command uvx --arg fronyboard
# ~/.hermes/config.yaml
mcp_servers:
  cafelatte1-fronyboard:
    command: "uvx"
    args: ["fronyboard"]
// ~/.netclaw/config/netclaw.json
{
  "McpServers": {
    "cafelatte1-fronyboard": {
      "Transport": "stdio",
      "Command": "uvx",
      "Arguments": [
        "fronyboard"
      ]
    }
  }
}
# add to Vellum
assistant mcp add cafelatte1-fronyboard -t stdio -c uvx -a fronyboard
// mcp.json
{
  "mcpServers": {
    "cafelatte1-fronyboard": {
      "command": "uvx",
      "args": [
        "fronyboard"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 20 Sept 26 +1
    • Package version: 0.32.1 → 0.39.0 functional
  • 18 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 22 to 26.

  • 17 Sept 26 0
    • Stability: fail → unverified security
    • Tool safety: pass → unverified security
    • Capabilities: pass → unverified functional
    • Tool coverage: 100 → unverified functional
    • Package version: 0.38.0 → 0.39.0 functional
  • 16 Sept 26 +1
    • Stability: fail → unverified security
    • Tool safety: pass → unverified security
    • Schema quality: 189 → 214 functional
    • Capabilities: pass → unverified functional
    • Tool coverage: 100 → unverified functional
    • Package version: 0.34.1 → 0.38.0 functional
  • 15 Sept 26 +15
    • Malware scan: unverified → pass security
  • 14 Sept 26 −16
    • Malware scan: pass → unverified security
    • Stability: 0.17 → fail security
    • Schema quality: 4050 → 3607 functional
    • Package version: 0.32.1 → 0.34.1 functional
    • Package version: 0.32.1 → 0.33.1 functional
    • Package version: 0.32.1 → 0.33.0 functional
  • 13 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 13 to 17. That category is still filling its 30-day observation window: 4 days of observed history at the previous scan, 5 at this one. The score rises as the window fills, whether or not the server changes.

  • 12 Sept 26 +29
    • Injection markers: unverified → pass security
    • Tool coverage: unverified → 100 functional
    • Stability: unverified → 0.13 functional
    • MCP protocol: unverified → pass functional
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 20 Sept 2026 · Analysed pypi/fronyboard@0.39.0

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem pypi

Background: How many MCP packages publish verified provenance →

Install scripts 1 script
Hook Tier Command
build_backend allowlisted hatchling.build

Background: Why install scripts are a supply-chain risk →

Dependencies 39 packages
Packages resolved 39
Stale 3
No linked repository 1
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 19 exposed · ~3,275 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
close_period ~145

Close a period (YYYYQn) and record its retrospective — call when its work is over. Refuses while any task is still todo or in_progress. Stores `result_markdown` as the period's `result` and marks the milestone done. The retrospective is written in the user's language, stays under ~30 lines and holds judgment and reasons only — summary vs goal, what landed and what did not, carried-over tasks (old id -> new id), lessons. Calling it again on a closed period rewrites the retrospective and changes nothing else.

NameTypeReqDescription
keystringyes
periodstringyes
result_markdownstringyes

No output schema declared.

No examples provided.

create_project ~145

Register a new project — once per codebase, before any planning happens. `key` is the task-id prefix (2-5 uppercase letters, e.g. DLY); `description` is one line saying what the project is, in the user's language (shown on the dashboard cards); `repo` is where its code lives (owner/name or a URL). Status starts as active. A fresh project holds nothing yet: set_overview (year) -> upsert_milestone (quarter) -> open_period must run before create_task will accept a task.

NameTypeReqDescription
description
keystringyes
name
repo

No output schema declared.

No examples provided.

create_task ~430

Create a task — one issue/branch-sized unit of work — with status todo. The id is assigned from the project-global sequence and never reused. `period` is YYYYQn and must be open; nothing else has to exist first. `title` is a short English imperative ("Add multi-select status filter") — it is what every reader sees, so it has to say the whole thing. `content` is optional: one line, at most 300 characters, English. It answers **why this task exists** — the pressure that made it necessary, the reading you chose where the spec allowed several, or the scope you deliberately left out. It is written now, before the work, so it cannot describe the result; what proves the work done is `check`, which transition_task takes when you finish. Do not restate the title here: a note that only rephrases it tells the next agent nothing. Line breaks are folded into spaces; a longer text is rejected, not cut. Rationale beyond one line goes in the commit. `tags` are free-form labels ("frontend", "bug", "infra"): up to 8 per task, 24 characters each, no commas. Reuse the wording already in use on the project (list_tasks shows it) instead of coining a new spelling for the same thing. `depends_on` lists the task ids this one builds on — the *earlier* work whose result it needs, or the task that handed it this scope. Full ids, other projects allowed. It points backwards only: there is no forward list, so a task never has to be updated because a later one appeared. It is a pointer, not a lock — nothing is blocked, and `list_tasks` / `get_status` merely flag the entries not yet done as `waiting_on`.

NameTypeReqDescription
content
depends_on
keystringyes
periodstringyes
tags
titlestringyes

No output schema declared.

No examples provided.

get_retrospective ~63

Read a closed period's (YYYYQn) retrospective — the `result` markdown close_period wrote. Errors while the period is still open; get_status says which ones are closed.

NameTypeReqDescription
keystringyes
periodstringyes

No output schema declared.

No examples provided.

get_roadmap ~94

Read a project's plan as written: yearly overviews (goal, now, target, checklist), quarterly milestones, and the names of its periods. Goals only, no counts — get_status for progress and the current period, list_tasks for the tasks themselves. Timestamps (`meta`) are left out unless `include_meta` is set.

NameTypeReqDescription
include_metaboolean
keystringyes

No output schema declared.

No examples provided.

get_status ~222

The resume: everything an agent needs to pick a project up cold, in one call. The latest year's overview (goal / now / target / checklist); per period its milestone goal and status, task counts by status, whether it is closed, and `open_tasks` — every todo / blocked / in_progress task with its title, tags, branch, one-line content and `waiting_on`; and `recent_done` — the ten most recently finished tasks across every period, newest first, each with its content, its `check` and when it completed. Closed periods are included. `recent_done` is what the project already has, in the words of whoever built it, and `check` is what they said proves it. Both are claims: confirm against the code before building on one. Older finished work and cancelled tasks are list_tasks; the plan as written is get_roadmap. Call it once at the start of a session; there is nothing to poll for afterwards.

NameTypeReqDescription
keystringyes

No output schema declared.

No examples provided.

get_task ~90

Read one task in full by id (DLY-042) — the project comes from the prefix, so no key is needed. Returns the record with its period. Use this instead of list_tasks whenever you already know the id; search_tasks when you only know a word from it. The record also carries `waiting_on` when it applies.

NameTypeReqDescription
task_idstringyes

No output schema declared.

No examples provided.

list_projects ~112

List every project (key, name, description, repo, status, meta) — how to find out which keys exist. Archived ones are left out unless `include_archived` is set. Each entry carries a `summary`: its open periods, task counts by status and `last_activity` (the newest task update). No milestones or task detail: get_roadmap for the plan, get_status for per-period progress, list_tasks for the tasks.

NameTypeReqDescription
include_archivedboolean

No output schema declared.

No examples provided.

list_tasks ~250

List one project's tasks, optionally narrowed by period, status, tags or recency. get_status already lists the open ones; use this for done or cancelled tasks, a closed period, or a tag cut. get_task when you know the id, search_tasks for text across projects. `period` is YYYYQn (all periods, closed ones included, when omitted), `status` is one of todo | in_progress | done | blocked | cancelled. `tags` narrows to the tasks carrying *all* of the given labels; pass one tag to match on it alone, and call again per tag when you want the union. `updated_since` keeps tasks touched after a duration ("24h", "7d") or ISO timestamp. A row carries `waiting_on` (the ids from its `depends_on` not yet done) only when there are any. Cancelled tasks are excluded unless `include_cancelled` is set or `status` is 'cancelled'.

NameTypeReqDescription
include_cancelledboolean
keystringyes
period
status
tags
updated_since

No output schema declared.

No examples provided.

open_period ~80

Start working in a quarter: opens its period and flips a planned milestone to active. Required before create_task will accept that period. `period` is YYYYQn (e.g. 2026Q3) and its roadmap milestone must already exist — upsert_milestone first.

NameTypeReqDescription
keystringyes
periodstringyes

No output schema declared.

No examples provided.

recent_activity ~198

What changed recently and who did it: the tool calls recorded in tools.jsonl, newest first — `ts`, `tool`, `caller` (key:<name> / session:<user> / oauth:… / stdio / local), `project`, `task` and `args` (argument names; prose fields appear as `<name>_len`); `ok: false` marks a rejected call. This is the mutation history; task records themselves keep only timestamps. `since` is a duration ("24h" default, "7d", "90m") or an ISO timestamp; `key` narrows to one project; `limit` caps the rows (default 50) while `count` reports the total. Read-only calls are dropped unless `writes_only=False`.

NameTypeReqDescription
key
limitinteger
since
writes_onlyboolean

No output schema declared.

No examples provided.

search_tasks ~199

Find tasks by text across all projects, with the dashboard's rules: case-insensitive substring over project key, task id, title and content (not branch or tags); a matching project key returns all of its tasks. Closed periods are included; cancelled tasks only with `include_cancelled` (or `status='cancelled'`). Hits are compact, ordered by project, then in_progress -> blocked -> todo -> done -> cancelled, then id; `match` says which field hit; a task's one-line `content` is included when it has one. `key` narrows to one project, `limit` (default 20) caps the hits while `count` still reports the total. Follow up with get_task for the full record.

NameTypeReqDescription
include_cancelledboolean
key
limitinteger
querystringyes
status

No output schema declared.

No examples provided.

set_check ~94

Tick or untick one item of a year's overview checklist: `index` is its 0-based position in get_roadmap's `checklist`, `done` the new state. Returns the updated overview. To add, remove or reword items use set_overview.

NameTypeReqDescription
doneboolean
indexintegeryes
keystringyes
yearstringyes

No output schema declared.

No examples provided.

set_overview ~227

Create or replace a year's overview: the one-line yearly `goal`, plus the three blocks the dashboard shows for the current year — `now` (what is being worked on), `target` (what that work is meant to reach) and `checklist` (the concrete steps to get there, ticked off as they land). A year needs an overview before upsert_milestone will add a quarter to it. `year` is YYYY. All prose here is in the user's language. `now` and `target` are one short line each. `checklist` items are strings (not done yet) or {text, done} maps, in display order. Calling it again replaces the whole overview — resend the checklist to keep it; use set_check to tick a single item. Quarterly goals belong in upsert_milestone, not here.

NameTypeReqDescription
checklist
goalstringyes
keystringyes
now
target
yearstringyes

No output schema declared.

No examples provided.

transition_task ~343

Move a task to a new status: todo | in_progress | done | blocked | cancelled. The only tool that changes status — title, content and tags are update_task. `task_id` is the full id, e.g. DLY-042; the project is derived from that prefix, so `key` may be omitted (if given it must match). Call when work starts (in_progress, ideally with the branch name) and when it finishes (done); the server stamps started_at and completed_at itself. `done` requires `check`: one line, at most 300 characters, saying **what proves the work done** — the command you ran and what it printed ("uv run pytest -q: 96 passed"), or the observable a reader can go and see ("GET /healthz returns 200 on the deployed host"). You are the only one who can write it; by the next session the run is gone and all that is left is your word. A restatement of the title proves nothing, so do not write one. get_status shows it beside the finished task, and reopening a task drops it. `cancelled` is the soft delete — there is no hard one: the record is kept but hidden from queries by default, and `reason` is required. Use blocked for work that may resume, cancelled for work that will not happen. Transitioning a cancelled task to any other status restores it.

NameTypeReqDescription
branch
check
key
reason
statusstringyes
task_idstringyes

No output schema declared.

No examples provided.

update_project ~146

Update a project's own fields — pass at least one of name, description, repo, status. The key (and with it the task id prefix) never changes, and nothing here touches the roadmap, periods or tasks. `name` and `description` follow create_project's language rule. `status`: active | paused | archived. paused only changes the badge; archived hides the project from list_projects and refuses every other mutation until it is set back to active. Archived is as far as removal goes — there is no hard delete.

NameTypeReqDescription
description
keystringyes
name
repo
status

No output schema declared.

No examples provided.

update_task ~250

Update a task's fields — everything except status, which is transition_task. `branch` records the working branch name; `content` replaces the one-line note (same rule as create_task: one line, at most 300 characters). `check` corrects the proof recorded at completion and is only accepted on a task that is already done. `tags` replaces the whole label list — pass the tags the task should end up with, not just the new ones. `depends_on` likewise replaces the whole predecessor list. Omitted fields are left as they are. To remove an optional field pass an empty value: `content=""`, `branch=""`, `tags=[]`, `depends_on=[]`, `check=""` (title cannot be removed). `task_id` is the full id including the project prefix, e.g. DLY-042 — the project is derived from that prefix, so `key` may be omitted (if given it must match).

NameTypeReqDescription
branch
check
content
depends_on
key
tags
task_idstringyes
title

No output schema declared.

No examples provided.

upsert_milestone ~120

Create or update a quarterly milestone — a year's goal for one quarter. `year` is YYYY (its overview must exist), `quarter` is Q1-Q4, `goal` is one line in the user's language, `status` is planned | active | done (open_period flips planned to active, close_period sets done). Omitted fields keep their current value.

NameTypeReqDescription
goal
keystringyes
quarterstringyes
status
yearstringyes

No output schema declared.

No examples provided.

validate ~67

Check a project's stored data against the FronyBoard schema and rules, returning errors and warnings. Rarely needed on its own — every mutation runs this same gate and refuses to write when it fails. Use it after the store was edited outside these tools.

NameTypeReqDescription
keystringyes

No output schema declared.

No examples provided.

Common questions

What is the FronyBoard MCP server?

FronyBoard is an MCP server listed in the public MCP registry as io.github.Cafelatte1/fronyboard. Project tracker for AI agents: roadmap, periods, tasks and a validation gate, in one SQLite file. This page covers its PyPI package (fronyboard).

Is the FronyBoard MCP server safe to use?

FronyBoard scores 71 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the FronyBoard MCP server expose?

FronyBoard exposes 19 tools: create_project, update_project, list_projects, get_roadmap, set_overview, and 14 more. Their descriptions and schemas cost roughly 3,275 tokens of context every time the server is loaded.

Is the FronyBoard MCP server still maintained?

FronyBoard is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the FronyBoard MCP server under?

FronyBoard declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.