# io.github.spranab/saga-mcp (npm · saga-mcp)

Jira-like project tracker for AI agents with SQLite, full task hierarchy, and dashboard

- Trust score: 77/100 (medium)
- Change this week: +33
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `saga-mcp`: 77/100 (this document), [markdown](https://verifymcp.io/servers/spranab-saga-mcp/saga-mcp.md), [page](https://verifymcp.io/servers/spranab-saga-mcp/saga-mcp)

## Channel facts

- Registry: `npm`
- Package: `saga-mcp`
- Version: `1.5.5`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 87/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (129 of 133), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (129 of 133), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 97/100
  - Source repository is publicly reachable at the declared URL.
  - Cryptographically verified build provenance (signed, bound to spranab/saga-mcp).
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 103 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 70/100
  - AI-judged instruction clarity (good).
  - Tool/resource definitions use about 2087 tokens (~67/item across 31 items; 31 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 23/100
  - Stability observed for 7 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 86/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 57% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add spranab-saga-mcp -- npx -y saga-mcp
```

### Codex

```bash
codex mcp add spranab-saga-mcp -- npx -y saga-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "spranab-saga-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "saga-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add spranab-saga-mcp --command npx --arg -y --arg saga-mcp
```

### Hermes

```yaml
mcp_servers:
  spranab-saga-mcp:
    command: "npx"
    args: ["-y", "saga-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "spranab-saga-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "saga-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 77, +57)

- [security improvement] Install scripts: unverified → pass
- [security improvement] Provenance: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [security] The attested source repository moved: spranab/saga-mcp
- [functional regression] Security disclosure: unverified → fail
- [functional improvement] Tool coverage: unverified → 100
- [functional improvement] License: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Stability: unverified → 0.23
- [functional improvement] Schema quality: unverified → good
- [functional] Licence: MIT

### 2026-08-02 (score 20, 0)

- [security improvement] Malware scan: unverified → pass
- [functional regression] Security disclosure: fail → unverified
- [functional regression] Tool coverage: 100 → unverified

### 2026-07-31 (score 20, +12)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 8, −36)

- [security regression] Malware scan: pass → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional improvement] Dependency health: unverified → partial
- [functional] First check of Schema quality: unverified

### 2026-07-27 (score 44)

First indexed and scored.

## MCP tools (31)

### `project_create` (~61 tokens)

Create a new project. Projects are the top-level container for all work.

Input parameters:

- `description` (string): Project description
- `name` (string, required): Project name
- `status` (string): Project status
- `tags` (array): Tags for categorization

### `project_list` (~35 tokens)

List all projects with epic/task counts and completion percentages. Optionally filter by status.

Input parameters:

- `status` (string): Filter by status

### `project_update` (~69 tokens)

Update a project. Pass only the fields you want to change. Set status to "archived" to soft-delete.

Input parameters:

- `description` (string)
- `id` (integer, required): Project ID
- `name` (string)
- `status` (string)
- `tags` (array)

### `epic_create` (~77 tokens)

Create an epic within a project. Epics group related tasks into a feature or workstream.

Input parameters:

- `description` (string): Epic description
- `name` (string, required): Epic name
- `priority` (string)
- `project_id` (integer, required): Parent project ID
- `status` (string)
- `tags` (array)

### `epic_list` (~53 tokens)

List epics for a project with task counts and completion stats. Optionally filter by status or priority.

Input parameters:

- `priority` (string)
- `project_id` (integer, required): Project ID
- `status` (string)

### `epic_update` (~84 tokens)

Update an epic. Pass only the fields you want to change. Set status to "cancelled" to soft-delete.

Input parameters:

- `description` (string)
- `id` (integer, required): Epic ID
- `name` (string)
- `priority` (string)
- `sort_order` (integer)
- `status` (string)
- `tags` (array)

### `task_create` (~135 tokens)

Create a task within an epic. Tasks are the primary unit of work.

Input parameters:

- `assigned_to` (string): Assignee name
- `depends_on` (array): Task IDs this task depends on
- `description` (string): Task description
- `due_date` (string): Due date (YYYY-MM-DD)
- `epic_id` (integer, required): Parent epic ID
- `estimated_hours` (number): Estimated hours
- `priority` (string)
- `source_ref` (object): Link to source code location
- `status` (string)
- `tags` (array)
- `title` (string, required): Task title

### `task_list` (~129 tokens)

List tasks with optional filters. If no epic_id given, lists across ALL epics. Includes subtask counts and dependency info.

Input parameters:

- `assigned_to` (string): Filter by assignee
- `epic_id` (integer): Filter by epic (omit for all tasks)
- `limit` (integer): Max results
- `priority` (string)
- `sort_by` (string): Sort order: priority (critical first), created (newest first), due_date (earliest first), status (actionable first)
- `status` (string)
- `tag` (string): Filter by tag

### `task_get` (~37 tokens)

Get a single task with full details including all subtasks, related notes, comments, and dependencies.

Input parameters:

- `id` (integer, required): Task ID

### `task_update` (~143 tokens)

Update a task. Pass only fields to change. Status transitions are automatically logged in the activity log.

Input parameters:

- `actual_hours` (number)
- `assigned_to` (string)
- `depends_on` (array): Task IDs this task depends on (replaces existing)
- `description` (string)
- `due_date` (string)
- `estimated_hours` (number)
- `id` (integer, required): Task ID
- `priority` (string)
- `sort_order` (integer)
- `source_ref` (object): Link to source code location
- `status` (string)
- `tags` (array)
- `title` (string)

### `subtask_create` (~56 tokens)

Create one or more subtasks (checklist items) for a task. Accepts a single title string or an array of title strings for batch creation.

Input parameters:

- `task_id` (integer, required): Parent task ID
- `titles` (required)

### `subtask_update` (~53 tokens)

Update a subtask title, status, or sort order.

Input parameters:

- `id` (integer, required): Subtask ID
- `sort_order` (integer)
- `status` (string)
- `title` (string)

### `subtask_delete` (~31 tokens)

Delete one or more subtasks. Accepts a single ID or array of IDs.

Input parameters:

- `ids` (required)

### `note_save` (~131 tokens)

Create or update a note. Notes capture decisions, context, progress, meeting notes, blockers, technical details, or release info. If "id" is provided, updates the existing note; otherwise creates a new one.

Input parameters:

- `content` (string, required): Full note content (markdown supported)
- `id` (integer): Note ID (omit to create new)
- `note_type` (string)
- `related_entity_id` (integer): ID of the related entity
- `related_entity_type` (string): Link note to an entity
- `tags` (array)
- `title` (string, required): Note title

### `note_list` (~67 tokens)

List notes with optional filters. Returns notes sorted by most recent first.

Input parameters:

- `limit` (integer)
- `note_type` (string)
- `related_entity_id` (integer)
- `related_entity_type` (string)
- `tag` (string): Filter by a single tag

### `note_search` (~41 tokens)

Search across note titles and content by keyword.

Input parameters:

- `limit` (integer)
- `note_type` (string)
- `query` (string, required): Search keywords

### `note_delete` (~23 tokens)

Delete a note by ID.

Input parameters:

- `id` (integer, required): Note ID

### `comment_add` (~62 tokens)

Add a comment to a task. Comments create a chronological discussion thread — useful for leaving breadcrumbs across sessions.

Input parameters:

- `author` (string): Author name (optional)
- `content` (string, required): Comment text
- `task_id` (integer, required): Task ID to comment on

### `comment_list` (~28 tokens)

List all comments on a task in chronological order.

Input parameters:

- `task_id` (integer, required): Task ID

### `template_create` (~75 tokens)

Create a reusable task template. Templates define a set of tasks that can be instantiated into any epic. Use {variable} placeholders for dynamic values.

Input parameters:

- `description` (string): Template description
- `name` (string, required): Template name (must be unique)
- `tasks` (array, required): Task definitions. Use {variable} for placeholders.

### `template_list` (~14 tokens)

List all available task templates.

### `template_apply` (~77 tokens)

Apply a template to create tasks in an epic. Replaces {variable} placeholders with provided values.

Input parameters:

- `epic_id` (integer, required): Epic to create tasks in
- `template_id` (integer, required): Template ID to apply
- `variables` (object): Key-value pairs for {variable} substitution (e.g., {"feature": "auth"})

### `template_delete` (~22 tokens)

Delete a task template.

Input parameters:

- `id` (integer, required): Template ID

### `tracker_dashboard` (~80 tokens)

Get a comprehensive project overview in a single call. Returns: project info, all epics with task counts, overall stats (total/done/blocked/in_progress), recent activity, and recent notes. This is the best first tool to call when starting work on a project.

Input parameters:

- `project_id` (integer): Project ID (omit if only one project exists)

### `tracker_init` (~72 tokens)

Initialize the tracker for a project. If the database is empty, creates a project with the given name. If a project already exists, returns its info.

Input parameters:

- `project_description` (string): Description for the new project
- `project_name` (string): Name for a new project (only used if DB is empty)

### `tracker_search` (~68 tokens)

Search across ALL entities (projects, epics, tasks, notes) by keyword. Returns categorized results.

Input parameters:

- `entity_types` (array): Limit search to specific entity types (omit for all)
- `limit` (integer): Max results per entity type
- `query` (string, required): Search keywords

### `activity_log` (~93 tokens)

View the activity log showing what changed and when. Useful for understanding recent progress or reviewing what happened since the last session.

Input parameters:

- `action` (string): Filter by action type
- `entity_id` (integer): Filter by specific entity
- `entity_type` (string): Filter by entity type
- `limit` (integer)
- `since` (string): ISO 8601 datetime - show only activity after this time

### `tracker_session_diff` (~86 tokens)

Show what changed since a given timestamp. Returns aggregated summary with counts by action and entity type, plus highlights of key changes. Call this at the start of a session to understand what happened since the last one.

Input parameters:

- `since` (string, required): ISO 8601 datetime — show changes after this time (e.g. "2026-02-21T15:00:00")

### `task_batch_update` (~72 tokens)

Update multiple tasks at once. Useful for changing status of several tasks (e.g., mark 3 tasks as done) or reassigning tasks.

Input parameters:

- `assigned_to` (string)
- `ids` (array, required): Task IDs to update
- `priority` (string)
- `status` (string)

### `tracker_export` (~62 tokens)

Export a full project as nested JSON. Includes all epics, tasks, subtasks, comments, dependencies, and related notes. Useful for backup, migration, or sharing.

Input parameters:

- `project_id` (integer): Project ID to export (omit if only one project exists)

### `tracker_import` (~51 tokens)

Import a project from JSON (matching tracker_export format). Creates all entities with new IDs and remaps references. Uses a transaction for atomicity.

Input parameters:

- `data` (object, required): Full export JSON object from tracker_export

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/spranab-saga-mcp/saga-mcp#diagnostics

## Score history

- 2026-08-03: 77
- 2026-08-02: 20
- 2026-08-01: 20
- 2026-07-31: 20
- 2026-07-30: 8
- 2026-07-28: 44
- 2026-07-27: 44

## Links

- npm package: https://www.npmjs.com/package/saga-mcp
- Socket report: https://socket.dev/npm/package/saga-mcp
- Repository: https://github.com/spranab/saga-mcp
- Changelog RSS feed: https://verifymcp.io/servers/spranab-saga-mcp/saga-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/spranab-saga-mcp/saga-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/spranab-saga-mcp/saga-mcp