# OmniFocus (npm · @scardis/omnifocus-mcp)

Full CRUD MCP server for OmniFocus via Omni Automation — tasks, projects, folders, tags, recurrence.

- Trust score: 63/100 (medium)
- Change this week: +20
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `@scardis/omnifocus-mcp`: 63/100 (this document), [markdown](https://verifymcp.io/servers/steveardis-omnifocus/scardis-omnifocus-mcp.md), [page](https://verifymcp.io/servers/steveardis-omnifocus/scardis-omnifocus-mcp)

## Channel facts

- Registry: `npm`
- Package: `@scardis/omnifocus-mcp`
- Version: `0.1.2`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 87/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 114 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 77/100
  - AI-judged instruction clarity (excellent).
  - Tool/resource definitions use about 2245 tokens (~83/item across 27 items; 27 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 77/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 30% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### Claude

```bash
claude mcp add steveardis-omnifocus -- npx -y @scardis/omnifocus-mcp
```

### Codex

```bash
codex mcp add steveardis-omnifocus -- npx -y @scardis/omnifocus-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "steveardis-omnifocus": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@scardis/omnifocus-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add steveardis-omnifocus --command npx --arg -y --arg @scardis/omnifocus-mcp
```

### Hermes

```yaml
mcp_servers:
  steveardis-omnifocus:
    command: "npx"
    args: ["-y", "@scardis/omnifocus-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "steveardis-omnifocus": {
      "command": "npx",
      "args": [
        "-y",
        "@scardis/omnifocus-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-02 (score 63, +39)

- [security regression] Provenance: unverified → fail
- [security improvement] Install scripts: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Malware scan: unverified → pass
- [security] Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet.
- [functional regression] Capabilities: pass → unverified
- [functional improvement] Schema quality: unverified → excellent
- [functional improvement] License: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional] Licence: MIT

### 2026-08-01 (score 24, +5)

- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] MCP protocol: unverified → pass

### 2026-07-31 (score 19, −24)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-27 (score 43)

First indexed and scored.

## MCP tools (27)

### `list_projects` (~135 tokens)

List projects in OmniFocus. By default, done and dropped projects are excluded — pass filter.status to override. Optional filter fields: status (array of status strings), folderId (restricts to that folder's subtree), flagged (boolean). Results are capped at limit (default 100). Each project includes folderId and flagged in addition to id, name, folderPath, status, and type.

Input parameters:

- `filter` (object): Optional filters. All fields combine as AND. When status is omitted, done and dropped projects are excluded by default.
- `limit` (integer): Maximum number of projects to return. Defaults to 100.

### `get_project` (~50 tokens)

Get full detail for a project by its stable ID. Returns note, folder path, status, type, dates, review metadata, and tag IDs.

Input parameters:

- `id` (string, required): The project's id.primaryKey

### `list_folders` (~131 tokens)

List folders in OmniFocus. By default, all folders (active and dropped) are returned. Optional filter.status ('active' | 'dropped') restricts to that status. Results are capped at limit (default 200). Each folder includes id, name, full path (ancestors joined with ▸), parentId, and status.

Input parameters:

- `filter` (object): Optional filter. When status is provided, only folders with that status are returned. When omitted, all folders (active and dropped) are returned.
- `limit` (integer): Maximum number of folders to return. Defaults to 200.

### `get_folder` (~49 tokens)

Get full detail for a folder by its stable ID. Returns path, parentId, status, child folder IDs, and immediate project IDs.

Input parameters:

- `id` (string, required): The folder's id.primaryKey

### `list_tasks` (~192 tokens)

List tasks in OmniFocus within a scope. Provide exactly one of: projectId (tasks in a project), folderId (tasks across all projects in a folder), inbox (inbox tasks), or all (every task). By default, complete and dropped tasks are excluded — pass filter.status to override. Optional filter fields: flagged (boolean), status (array of status strings), tagId (string), dueBeforeDate (ISO datetime). Results are capped at limit (default 200). Each returned task includes dueDate and tagIds.

Input parameters:

- `filter` (object): Optional filters. All fields combine as AND. When status is omitted, complete and dropped tasks are excluded by default.
- `limit` (integer): Maximum number of tasks to return. Defaults to 200.
- `scope` (object, required): Exactly one of: projectId (string), folderId (string), inbox (true), or all (true)

### `get_task` (~77 tokens)

Get full detail for a task by its stable ID. Returns note, status, flagged, defer/due/completion dates, estimated minutes, container info, tag IDs, and parentTaskId (null for top-level tasks, set to the parent task's ID for subtasks).

Input parameters:

- `id` (string, required): The task's id.primaryKey

### `list_tags` (~143 tokens)

List tags in OmniFocus. By default, all tags (active, onHold, and dropped) are returned. Optional filter.status ('active' | 'onHold' | 'dropped') restricts to that status. Results are capped at limit (default 200). Each tag includes id, name, full path (ancestors joined with ▸), parentId, and status.

Input parameters:

- `filter` (object): Optional filter. When status is provided, only tags with that status are returned. When omitted, all tags (active, onHold, and dropped) are returned.
- `limit` (integer): Maximum number of tags to return. Defaults to 200.

### `get_tag` (~45 tokens)

Get full detail for a tag by its stable ID. Returns path, parentId, status, and child tag IDs.

Input parameters:

- `id` (string, required): The tag's id.primaryKey

### `resolve_name` (~110 tokens)

Resolve an entity name to its stable ID(s). Returns ALL matches — never silently picks one. If multiple candidates are returned, ask the user or caller to disambiguate using the path field before proceeding with a write operation.

Input parameters:

- `query` (string, required): Exact name to search for
- `scope` (string): Optional path prefix to narrow results, e.g. "Work ▸ Clients"
- `type` (string, required): The entity type to search: task, project, folder, tag, or perspective

### `create_task` (~140 tokens)

Create a new task. Placement: omit projectId and parentTaskId for inbox; provide projectId to add to a project; provide parentTaskId to create a subtask. Providing both projectId and parentTaskId is an error.

Input parameters:

- `deferDate` (string)
- `dueDate` (string)
- `estimatedMinutes` (integer)
- `flagged` (boolean)
- `name` (string, required)
- `note` (string)
- `parentTaskId`
- `plannedDate` (string)
- `projectId` (string)
- `repetitionRule` (object)
- `tagIds` (array)

### `edit_task` (~127 tokens)

Edit an existing task by its stable ID. Only fields included in the call are changed; omitted fields are left unchanged. When tagIds is provided it replaces the full tag set. Pass null for deferDate, dueDate, or estimatedMinutes to clear those fields.

Input parameters:

- `deferDate`
- `dueDate`
- `estimatedMinutes`
- `flagged` (boolean)
- `id` (string, required)
- `name` (string)
- `note` (string)
- `plannedDate`
- `repetitionRule`
- `tagIds` (array)

### `complete_task` (~36 tokens)

Mark a task complete by its stable ID. Returns the updated task detail.

Input parameters:

- `id` (string, required): The task's id.primaryKey

### `drop_task` (~36 tokens)

Mark a task dropped by its stable ID. Returns the updated task detail.

Input parameters:

- `id` (string, required): The task's id.primaryKey

### `delete_task` (~72 tokens)

Permanently delete a task and all its subtasks. THIS ACTION CANNOT BE UNDONE. Before calling this tool you MUST ask the user to explicitly confirm they want to permanently delete the task, and inform them that all subtasks will also be deleted.

Input parameters:

- `id` (string, required): The task's id.primaryKey

### `create_project` (~135 tokens)

Create a new OmniFocus project. Omit folderId to create at the top level; provide folderId to place it inside a folder. Optionally set type (parallel/sequential/singleActions), status (active/onHold), review interval, and tags.

Input parameters:

- `deferDate` (string)
- `dueDate` (string)
- `flagged` (boolean)
- `folderId` (string)
- `name` (string, required)
- `note` (string)
- `reviewInterval` (object)
- `status` (string)
- `tagIds` (array)
- `type` (string)

### `edit_project` (~117 tokens)

Edit an existing project. Only provided fields are changed. Pass null for deferDate, dueDate, or reviewInterval to clear them. When tagIds is provided it replaces the full tag set.

Input parameters:

- `deferDate`
- `dueDate`
- `flagged` (boolean)
- `id` (string, required)
- `name` (string)
- `note` (string)
- `reviewInterval` (object)
- `status` (string)
- `tagIds` (array)
- `type` (string)

### `complete_project` (~34 tokens)

Mark a project as done (complete). Returns the updated project detail.

Input parameters:

- `id` (string, required): The project's id.primaryKey

### `drop_project` (~32 tokens)

Mark a project as dropped. Returns the updated project detail.

Input parameters:

- `id` (string, required): The project's id.primaryKey

### `delete_project` (~72 tokens)

Permanently delete a project and ALL its tasks. THIS ACTION CANNOT BE UNDONE. Before calling this tool you MUST ask the user to explicitly confirm they want to permanently delete the project, and inform them that all tasks within the project will also be deleted.

Input parameters:

- `id` (string, required): The project's id.primaryKey

### `create_folder` (~55 tokens)

Create a new OmniFocus folder. Omit parentFolderId to create at the top level; provide parentFolderId to nest it inside an existing folder.

Input parameters:

- `name` (string, required)
- `parentFolderId` (string)

### `edit_folder` (~32 tokens)

Rename an existing OmniFocus folder by its ID.

Input parameters:

- `id` (string, required)
- `name` (string, required)

### `delete_folder` (~88 tokens)

Permanently and recursively delete an OmniFocus folder. THIS ACTION CANNOT BE UNDONE. The ENTIRE subtree is destroyed: all child folders, all projects within those folders, and all tasks within those projects. Before calling this tool you MUST ask the user to explicitly confirm they want to permanently delete the folder and all of its contents.

Input parameters:

- `id` (string, required): The folder's id.primaryKey

### `create_tag` (~55 tokens)

Create a new OmniFocus tag. Omit parentTagId to create at the top level; provide parentTagId to nest it under an existing tag.

Input parameters:

- `name` (string, required)
- `parentTagId` (string)

### `edit_tag` (~55 tokens)

Edit an existing OmniFocus tag. Provide id plus any combination of name (rename) and status (active/onHold/dropped).

Input parameters:

- `id` (string, required)
- `name` (string)
- `status` (string)

### `delete_tag` (~82 tokens)

Permanently delete an OmniFocus tag. THIS ACTION CANNOT BE UNDONE. All child tags are also deleted, and all tasks/projects that held this tag have it removed automatically. Before calling this tool you MUST ask the user to explicitly confirm they want to permanently delete the tag and all its child tags.

Input parameters:

- `id` (string, required): The tag's id.primaryKey

### `move_task` (~78 tokens)

Move a task to a different project (making it a top-level task) or make it a subtask of another task. Exactly one of projectId or parentTaskId must be provided. Throws a not-found error if any ID does not exist.

Input parameters:

- `id` (string, required)
- `parentTaskId`
- `projectId`

### `move_project` (~67 tokens)

Move a project to a different folder or to the top level. Pass folderId as a string to move into a folder, or null to move to the top level. Throws a not-found error if either ID does not exist.

Input parameters:

- `folderId` (required)
- `id` (string, required)

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/steveardis-omnifocus/scardis-omnifocus-mcp#diagnostics

## Score history

- 2026-08-03: 63
- 2026-08-02: 63
- 2026-08-01: 24
- 2026-07-31: 19
- 2026-07-30: 43
- 2026-07-28: 43
- 2026-07-27: 43

## Links

- npm package: https://www.npmjs.com/package/@scardis/omnifocus-mcp
- Socket report: https://socket.dev/npm/package/@scardis/omnifocus-mcp
- Repository: https://github.com/steveardis/omnifocus-mcp
- Changelog RSS feed: https://verifymcp.io/servers/steveardis-omnifocus/scardis-omnifocus-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/steveardis-omnifocus/scardis-omnifocus-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/steveardis-omnifocus/scardis-omnifocus-mcp