FronyBoard
PYPI · FRONYBOARD · SCANNED SEP 20
Project tracker for AI agents: roadmap, periods, tasks and a validation gate, in one SQLite file
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security100
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- Runs hatchling.build at install time, a recognised native-build step with no shell scripting around it. View diagnostics → Pass
- 4 of 39 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 3 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability64
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 4074 tokens (~214/item across 19 items; 19 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management33
- Stability check failed: the tool surface changed between 0.29.0 and 0.39.0: 1 tool removals, 1 breaking changes, 0 additions. See how to fix → Fail
Tool Coverage67
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 0% of tool parameters carry a description.Fail
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 19 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 20 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
How do I install the FronyBoard MCP server?
FronyBoard runs locally as a PyPI package, launched with uvx fronyboard. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
pypi · fronyboard
claude mcp add cafelatte1-fronyboard -- uvx fronyboard
{
"mcpServers": {
"cafelatte1-fronyboard": {
"command": "uvx",
"args": [
"fronyboard"
]
}
}
} {
"servers": {
"cafelatte1-fronyboard": {
"command": "uvx",
"args": [
"fronyboard"
]
}
}
} codex mcp add cafelatte1-fronyboard -- uvx fronyboard
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"cafelatte1-fronyboard": {
"type": "local",
"command": [
"uvx",
"fronyboard"
],
"enabled": true
}
}
} openclaw mcp add cafelatte1-fronyboard --command uvx --arg fronyboard
mcp_servers:
cafelatte1-fronyboard:
command: "uvx"
args: ["fronyboard"] {
"McpServers": {
"cafelatte1-fronyboard": {
"Transport": "stdio",
"Command": "uvx",
"Arguments": [
"fronyboard"
]
}
}
} assistant mcp add cafelatte1-fronyboard -t stdio -c uvx -a fronyboard
{
"mcpServers": {
"cafelatte1-fronyboard": {
"command": "uvx",
"args": [
"fronyboard"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 +1
- Package version: 0.32.1 → 0.39.0 functional
- 18 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 22 to 26.
- 17 Sept 26 0
- Stability: fail → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Package version: 0.38.0 → 0.39.0 functional
- 16 Sept 26 +1
- Stability: fail → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Schema quality: 189 → 214 ▼ functional
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Package version: 0.34.1 → 0.38.0 functional
- 15 Sept 26 +15
- Malware scan: unverified → pass ▲ security
- 14 Sept 26 −16
- Malware scan: pass → unverified ▼ security
- Stability: 0.17 → fail ▼ security
- Schema quality: 4050 → 3607 ▲ functional
- Package version: 0.32.1 → 0.34.1 functional
- Package version: 0.32.1 → 0.33.1 functional
- Package version: 0.32.1 → 0.33.0 functional
- 13 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 13 to 17. That category is still filling its 30-day observation window: 4 days of observed history at the previous scan, 5 at this one. The score rises as the window fills, whether or not the server changes.
- 12 Sept 26 +29
- Injection markers: unverified → pass ▲ security
- Tool coverage: unverified → 100 ▲ functional
- Stability: unverified → 0.13 ▲ functional
- MCP protocol: unverified → pass ▲ functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed pypi/fronyboard@0.39.0
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | pypi |
Background: How many MCP packages publish verified provenance →
Install scripts 1 script
| Hook | Tier | Command |
|---|---|---|
| build_backend | allowlisted | hatchling.build |
Background: Why install scripts are a supply-chain risk →
Dependencies 39 packages
| Packages resolved | 39 |
|---|---|
| Stale | 3 |
| No linked repository | 1 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
close_period ~145
Close a period (YYYYQn) and record its retrospective — call when its work is over. Refuses while any task is still todo or in_progress. Stores `result_markdown` as the period's `result` and marks the milestone done. The retrospective is written in the user's language, stays under ~30 lines and holds judgment and reasons only — summary vs goal, what landed and what did not, carried-over tasks (old id -> new id), lessons. Calling it again on a closed period rewrites the retrospective and changes nothing else.
| Name | Type | Req | Description |
|---|---|---|---|
| key | string | yes | – |
| period | string | yes | – |
| result_markdown | string | yes | – |
No output schema declared.
No examples provided.
create_project ~145
Register a new project — once per codebase, before any planning happens. `key` is the task-id prefix (2-5 uppercase letters, e.g. DLY); `description` is one line saying what the project is, in the user's language (shown on the dashboard cards); `repo` is where its code lives (owner/name or a URL). Status starts as active. A fresh project holds nothing yet: set_overview (year) -> upsert_milestone (quarter) -> open_period must run before create_task will accept a task.
| Name | Type | Req | Description |
|---|---|---|---|
| description | – | – | – |
| key | string | yes | – |
| name | – | – | – |
| repo | – | – | – |
No output schema declared.
No examples provided.
create_task ~430
Create a task — one issue/branch-sized unit of work — with status todo. The id is assigned from the project-global sequence and never reused. `period` is YYYYQn and must be open; nothing else has to exist first. `title` is a short English imperative ("Add multi-select status filter") — it is what every reader sees, so it has to say the whole thing. `content` is optional: one line, at most 300 characters, English. It answers **why this task exists** — the pressure that made it necessary, the reading you chose where the spec allowed several, or the scope you deliberately left out. It is written now, before the work, so it cannot describe the result; what proves the work done is `check`, which transition_task takes when you finish. Do not restate the title here: a note that only rephrases it tells the next agent nothing. Line breaks are folded into spaces; a longer text is rejected, not cut. Rationale beyond one line goes in the commit. `tags` are free-form labels ("frontend", "bug", "infra"): up to 8 per task, 24 characters each, no commas. Reuse the wording already in use on the project (list_tasks shows it) instead of coining a new spelling for the same thing. `depends_on` lists the task ids this one builds on — the *earlier* work whose result it needs, or the task that handed it this scope. Full ids, other projects allowed. It points backwards only: there is no forward list, so a task never has to be updated because a later one appeared. It is a pointer, not a lock — nothing is blocked, and `list_tasks` / `get_status` merely flag the entries not yet done as `waiting_on`.
| Name | Type | Req | Description |
|---|---|---|---|
| content | – | – | – |
| depends_on | – | – | – |
| key | string | yes | – |
| period | string | yes | – |
| tags | – | – | – |
| title | string | yes | – |
No output schema declared.
No examples provided.
get_retrospective ~63
Read a closed period's (YYYYQn) retrospective — the `result` markdown close_period wrote. Errors while the period is still open; get_status says which ones are closed.
| Name | Type | Req | Description |
|---|---|---|---|
| key | string | yes | – |
| period | string | yes | – |
No output schema declared.
No examples provided.
get_roadmap ~94
Read a project's plan as written: yearly overviews (goal, now, target, checklist), quarterly milestones, and the names of its periods. Goals only, no counts — get_status for progress and the current period, list_tasks for the tasks themselves. Timestamps (`meta`) are left out unless `include_meta` is set.
| Name | Type | Req | Description |
|---|---|---|---|
| include_meta | boolean | – | – |
| key | string | yes | – |
No output schema declared.
No examples provided.
get_status ~222
The resume: everything an agent needs to pick a project up cold, in one call. The latest year's overview (goal / now / target / checklist); per period its milestone goal and status, task counts by status, whether it is closed, and `open_tasks` — every todo / blocked / in_progress task with its title, tags, branch, one-line content and `waiting_on`; and `recent_done` — the ten most recently finished tasks across every period, newest first, each with its content, its `check` and when it completed. Closed periods are included. `recent_done` is what the project already has, in the words of whoever built it, and `check` is what they said proves it. Both are claims: confirm against the code before building on one. Older finished work and cancelled tasks are list_tasks; the plan as written is get_roadmap. Call it once at the start of a session; there is nothing to poll for afterwards.
| Name | Type | Req | Description |
|---|---|---|---|
| key | string | yes | – |
No output schema declared.
No examples provided.
get_task ~90
Read one task in full by id (DLY-042) — the project comes from the prefix, so no key is needed. Returns the record with its period. Use this instead of list_tasks whenever you already know the id; search_tasks when you only know a word from it. The record also carries `waiting_on` when it applies.
| Name | Type | Req | Description |
|---|---|---|---|
| task_id | string | yes | – |
No output schema declared.
No examples provided.
list_projects ~112
List every project (key, name, description, repo, status, meta) — how to find out which keys exist. Archived ones are left out unless `include_archived` is set. Each entry carries a `summary`: its open periods, task counts by status and `last_activity` (the newest task update). No milestones or task detail: get_roadmap for the plan, get_status for per-period progress, list_tasks for the tasks.
| Name | Type | Req | Description |
|---|---|---|---|
| include_archived | boolean | – | – |
No output schema declared.
No examples provided.
list_tasks ~250
List one project's tasks, optionally narrowed by period, status, tags or recency. get_status already lists the open ones; use this for done or cancelled tasks, a closed period, or a tag cut. get_task when you know the id, search_tasks for text across projects. `period` is YYYYQn (all periods, closed ones included, when omitted), `status` is one of todo | in_progress | done | blocked | cancelled. `tags` narrows to the tasks carrying *all* of the given labels; pass one tag to match on it alone, and call again per tag when you want the union. `updated_since` keeps tasks touched after a duration ("24h", "7d") or ISO timestamp. A row carries `waiting_on` (the ids from its `depends_on` not yet done) only when there are any. Cancelled tasks are excluded unless `include_cancelled` is set or `status` is 'cancelled'.
| Name | Type | Req | Description |
|---|---|---|---|
| include_cancelled | boolean | – | – |
| key | string | yes | – |
| period | – | – | – |
| status | – | – | – |
| tags | – | – | – |
| updated_since | – | – | – |
No output schema declared.
No examples provided.
open_period ~80
Start working in a quarter: opens its period and flips a planned milestone to active. Required before create_task will accept that period. `period` is YYYYQn (e.g. 2026Q3) and its roadmap milestone must already exist — upsert_milestone first.
| Name | Type | Req | Description |
|---|---|---|---|
| key | string | yes | – |
| period | string | yes | – |
No output schema declared.
No examples provided.
recent_activity ~198
What changed recently and who did it: the tool calls recorded in tools.jsonl, newest first — `ts`, `tool`, `caller` (key:<name> / session:<user> / oauth:… / stdio / local), `project`, `task` and `args` (argument names; prose fields appear as `<name>_len`); `ok: false` marks a rejected call. This is the mutation history; task records themselves keep only timestamps. `since` is a duration ("24h" default, "7d", "90m") or an ISO timestamp; `key` narrows to one project; `limit` caps the rows (default 50) while `count` reports the total. Read-only calls are dropped unless `writes_only=False`.
| Name | Type | Req | Description |
|---|---|---|---|
| key | – | – | – |
| limit | integer | – | – |
| since | – | – | – |
| writes_only | boolean | – | – |
No output schema declared.
No examples provided.
search_tasks ~199
Find tasks by text across all projects, with the dashboard's rules: case-insensitive substring over project key, task id, title and content (not branch or tags); a matching project key returns all of its tasks. Closed periods are included; cancelled tasks only with `include_cancelled` (or `status='cancelled'`). Hits are compact, ordered by project, then in_progress -> blocked -> todo -> done -> cancelled, then id; `match` says which field hit; a task's one-line `content` is included when it has one. `key` narrows to one project, `limit` (default 20) caps the hits while `count` still reports the total. Follow up with get_task for the full record.
| Name | Type | Req | Description |
|---|---|---|---|
| include_cancelled | boolean | – | – |
| key | – | – | – |
| limit | integer | – | – |
| query | string | yes | – |
| status | – | – | – |
No output schema declared.
No examples provided.
set_check ~94
Tick or untick one item of a year's overview checklist: `index` is its 0-based position in get_roadmap's `checklist`, `done` the new state. Returns the updated overview. To add, remove or reword items use set_overview.
| Name | Type | Req | Description |
|---|---|---|---|
| done | boolean | – | – |
| index | integer | yes | – |
| key | string | yes | – |
| year | string | yes | – |
No output schema declared.
No examples provided.
set_overview ~227
Create or replace a year's overview: the one-line yearly `goal`, plus the three blocks the dashboard shows for the current year — `now` (what is being worked on), `target` (what that work is meant to reach) and `checklist` (the concrete steps to get there, ticked off as they land). A year needs an overview before upsert_milestone will add a quarter to it. `year` is YYYY. All prose here is in the user's language. `now` and `target` are one short line each. `checklist` items are strings (not done yet) or {text, done} maps, in display order. Calling it again replaces the whole overview — resend the checklist to keep it; use set_check to tick a single item. Quarterly goals belong in upsert_milestone, not here.
| Name | Type | Req | Description |
|---|---|---|---|
| checklist | – | – | – |
| goal | string | yes | – |
| key | string | yes | – |
| now | – | – | – |
| target | – | – | – |
| year | string | yes | – |
No output schema declared.
No examples provided.
transition_task ~343
Move a task to a new status: todo | in_progress | done | blocked | cancelled. The only tool that changes status — title, content and tags are update_task. `task_id` is the full id, e.g. DLY-042; the project is derived from that prefix, so `key` may be omitted (if given it must match). Call when work starts (in_progress, ideally with the branch name) and when it finishes (done); the server stamps started_at and completed_at itself. `done` requires `check`: one line, at most 300 characters, saying **what proves the work done** — the command you ran and what it printed ("uv run pytest -q: 96 passed"), or the observable a reader can go and see ("GET /healthz returns 200 on the deployed host"). You are the only one who can write it; by the next session the run is gone and all that is left is your word. A restatement of the title proves nothing, so do not write one. get_status shows it beside the finished task, and reopening a task drops it. `cancelled` is the soft delete — there is no hard one: the record is kept but hidden from queries by default, and `reason` is required. Use blocked for work that may resume, cancelled for work that will not happen. Transitioning a cancelled task to any other status restores it.
| Name | Type | Req | Description |
|---|---|---|---|
| branch | – | – | – |
| check | – | – | – |
| key | – | – | – |
| reason | – | – | – |
| status | string | yes | – |
| task_id | string | yes | – |
No output schema declared.
No examples provided.
update_project ~146
Update a project's own fields — pass at least one of name, description, repo, status. The key (and with it the task id prefix) never changes, and nothing here touches the roadmap, periods or tasks. `name` and `description` follow create_project's language rule. `status`: active | paused | archived. paused only changes the badge; archived hides the project from list_projects and refuses every other mutation until it is set back to active. Archived is as far as removal goes — there is no hard delete.
| Name | Type | Req | Description |
|---|---|---|---|
| description | – | – | – |
| key | string | yes | – |
| name | – | – | – |
| repo | – | – | – |
| status | – | – | – |
No output schema declared.
No examples provided.
update_task ~250
Update a task's fields — everything except status, which is transition_task. `branch` records the working branch name; `content` replaces the one-line note (same rule as create_task: one line, at most 300 characters). `check` corrects the proof recorded at completion and is only accepted on a task that is already done. `tags` replaces the whole label list — pass the tags the task should end up with, not just the new ones. `depends_on` likewise replaces the whole predecessor list. Omitted fields are left as they are. To remove an optional field pass an empty value: `content=""`, `branch=""`, `tags=[]`, `depends_on=[]`, `check=""` (title cannot be removed). `task_id` is the full id including the project prefix, e.g. DLY-042 — the project is derived from that prefix, so `key` may be omitted (if given it must match).
| Name | Type | Req | Description |
|---|---|---|---|
| branch | – | – | – |
| check | – | – | – |
| content | – | – | – |
| depends_on | – | – | – |
| key | – | – | – |
| tags | – | – | – |
| task_id | string | yes | – |
| title | – | – | – |
No output schema declared.
No examples provided.
upsert_milestone ~120
Create or update a quarterly milestone — a year's goal for one quarter. `year` is YYYY (its overview must exist), `quarter` is Q1-Q4, `goal` is one line in the user's language, `status` is planned | active | done (open_period flips planned to active, close_period sets done). Omitted fields keep their current value.
| Name | Type | Req | Description |
|---|---|---|---|
| goal | – | – | – |
| key | string | yes | – |
| quarter | string | yes | – |
| status | – | – | – |
| year | string | yes | – |
No output schema declared.
No examples provided.
validate ~67
Check a project's stored data against the FronyBoard schema and rules, returning errors and warnings. Rarely needed on its own — every mutation runs this same gate and refuses to write when it fails. Use it after the store was edited outside these tools.
| Name | Type | Req | Description |
|---|---|---|---|
| key | string | yes | – |
No output schema declared.
No examples provided.
What is the FronyBoard MCP server?
FronyBoard is an MCP server listed in the public MCP registry as io.github.Cafelatte1/fronyboard. Project tracker for AI agents: roadmap, periods, tasks and a validation gate, in one SQLite file. This page covers its PyPI package (fronyboard).
Is the FronyBoard MCP server safe to use?
FronyBoard scores 71 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the FronyBoard MCP server expose?
FronyBoard exposes 19 tools: create_project, update_project, list_projects, get_roadmap, set_overview, and 14 more. Their descriptions and schemas cost roughly 3,275 tokens of context every time the server is loaded.
Is the FronyBoard MCP server still maintained?
FronyBoard is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the FronyBoard MCP server under?
FronyBoard declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.