OpenProject CE

Name: OpenProject CE
Author: jtauschl

by jtauschlversion 0.4.4i★ –iRuns on your computer

Registry nameio.github.jtauschl/openproject-ce-mcp

Install

Overview

Description from the maker (original English)

MCP server for OpenProject Community Edition with guarded read/write support.

PopNx MCP’s three pillars

These three are never merged into one score: opinions, measurements and popularity are different things.

User voiceiNo reviews yetReviews open together with accounts in a later step
Our basic checksi1 of 1 passedChecked from public information; code not scanned yet
UsageiNot measured yet★ –

What you can do with it

We have not written a plain-language summary for this one yet. Below are the facts we read from the registry.

Connection: Runs on your computer
Transport: stdio
Category: Other
You need to fill in: OPENPROJECT_BASE_URL, OPENPROJECT_API_TOKEN

Install

Pick the AI app you use, then copy the settings.

Before you install

Basic checks: 1 of 1 passed
Runs on your computer with your user’s permissions (files, network, apps).
You fill in yourself: OPENPROJECT_BASE_URL, OPENPROJECT_API_TOKEN, OPENPROJECT_READ_PROJECTS, OPENPROJECT_WRITE_PROJECTS

Values marked secret are keys to your account. Never share them or paste them into a chat.

You need

PyPIPython’s uv installed (for the uvx command)

Which app do you use?

ClaudeClaude CodeCursorVS CodeChatGPT

Pick your app above. We remember it, so next time the button says “Install in …”.

Open Claude Desktop → Settings → Developer → Edit Config, and paste this into claude_desktop_config.json

{
  "mcpServers": {
    "openproject-ce": {
      "command": "uvx",
      "args": [
        "openproject-ce-mcp"
      ],
      "env": {
        "OPENPROJECT_BASE_URL": "your-value",
        "OPENPROJECT_API_TOKEN": "your-value",
        "OPENPROJECT_READ_PROJECTS": "your-value",
        "OPENPROJECT_WRITE_PROJECTS": "your-value"
      }
    }
  }
}

Run this in your terminal

claude mcp add openproject-ce --env OPENPROJECT_BASE_URL=your-value --env OPENPROJECT_API_TOKEN=your-value --env OPENPROJECT_READ_PROJECTS=your-value --env OPENPROJECT_WRITE_PROJECTS=your-value -- uvx openproject-ce-mcp

Fill in the empty values before running it.

Open in Cursor

Or copy the settings yourself

Paste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json

{
  "mcpServers": {
    "openproject-ce": {
      "command": "uvx",
      "args": [
        "openproject-ce-mcp"
      ],
      "env": {
        "OPENPROJECT_BASE_URL": "your-value",
        "OPENPROJECT_API_TOKEN": "your-value",
        "OPENPROJECT_READ_PROJECTS": "your-value",
        "OPENPROJECT_WRITE_PROJECTS": "your-value"
      }
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

Open in VS Code

Or copy the settings yourself

Paste into .vscode/mcp.json in your project

{
  "servers": {
    "openproject-ce": {
      "type": "stdio",
      "command": "uvx",
      "args": [
        "openproject-ce-mcp"
      ],
      "env": {
        "OPENPROJECT_BASE_URL": "your-value",
        "OPENPROJECT_API_TOKEN": "your-value",
        "OPENPROJECT_READ_PROJECTS": "your-value",
        "OPENPROJECT_WRITE_PROJECTS": "your-value"
      }
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

This one runs on your computer, and ChatGPT can only connect to servers on the internet. Pick another app.

Your choice stays on this device in a cookie; no account needed.

Values you fill in

OPENPROJECT_BASE_URL required env
Base URL of the OpenProject instance
OPENPROJECT_API_TOKEN secret required env
OpenProject API token
OPENPROJECT_READ_PROJECTS env
Comma-separated project identifiers or glob patterns that may be read, * for all; unset allows none
OPENPROJECT_WRITE_PROJECTS env
Comma-separated project identifiers or glob patterns that may be written, * for all; unset allows none

These settings are generated from the maker’s registry entry. If the README says otherwise, follow the README.

What it can do

Runs on your computer; the tool list appears in your AI app after you install it.

Basic checksi

We check information anyone can see; we have not read the code. Checks that do not apply are left out of the count. · Checked Nov 7, 2026

✓ Pass
Maker matches the repo
The registry name was verified with the GitHub account jtauschl, which owns the repo
… Not checked yet
Still maintained
We have not read this repo from GitHub yet
… Not checked yet
Has a licence
We have not read this repo from GitHub yet
– Not applicable
Endpoint responds
This one runs on your computer; there is no internet endpoint
– Not applicable
Sign-in with OAuth
Runs on your computer and uses local settings instead
… Not checked yet
No hidden instructions in tool descriptions
Runs on your computer; we can only read tool lists from internet endpoints

Compared with others in Otheri

More stars than 0% of the other 18360 servers in this category
Published to the registry more recently than 80% of the other 18360 servers in this category
Basic checks equal to or better than 100% of the other 18360 servers in this category

Compared with every active server in this category in the registry. Stars count only when the publisher owns the repo.

Common questions

Is OpenProject CE safe?

It passed 1 of 1 applicable basic checks. We have not read the code. Before adding a key or token, see what access the server asks for and use a key with only the permissions you need.

What keys or codes does it need?

You need to fill in: OPENPROJECT_BASE_URL, OPENPROJECT_API_TOKEN

Does it run on my computer or in the cloud?

It runs on your computer. Your AI app starts it when needed, and data does not pass through the maker’s servers (unless it calls an online service itself).

Is it still maintained?

The GitHub repo last changed –, and the latest version (0.4.4) reached the registry 10 days ago.

Which apps can use it?

Apps that support MCP, such as Claude Desktop, Claude Code, Cursor and VS Code. You also need Python (uv) on your computer.

What can I use instead?

In the same category: Spec Driven Development, Remote Desktop Commander, Tool Guardian

Alternatives

Servers in the same category from other makers, sorted by stars.

Reading a card:★ GitHub starsiThree pillars: reviews · checks · usageiUpdated = latest version published to the registryi

Spec Driven Development

by formulahendry

MCP Server that facilitates spec-driven development workflows, not just Vibe Coding.

Runs on your computer★ 440MITUpdated 14 months ago

Install

Remote Desktop Commander

by desktop-commander

Remote Desktop Commander: use files, terminal and processes on your own computers from any AI app.

Runs in the cloud★ 211Updated 2 days ago

Install

Tool Guardian

by LuminariSoftwares

Too many MCP servers eating your context? A router that loads each tool's schema only when needed.

Runs on your computerUpdated today

Install

README from the maker

Open the README

Copied from the maker’s repo as written. PopNx MCP has not reviewed or endorsed it. HTML, images and scripts are removed. Links lead off this site.

OpenProject CE MCP

An MCP server for OpenProject that lets local AI agents read and manage project data through structured, guarded tools.

The server runs as a local subprocess of your MCP client over stdio. It wraps OpenProject API v3 and exposes typed tools for projects, work packages, memberships, versions, boards, meetings, time entries, and more.

Reading this on PyPI? All links below point to the GitHub repository —

the docs/ pages and images ship in the git repo and source distribution,

not in the installed package itself.

Why use this MCP

Context-frugal by design — compact, agent-shaped responses instead of raw HAL payloads (~21 fields + ~46 links per item in the raw API). Measured up to −99% tokens per response with select; see Context efficiency for the full numbers.
Guarded writes — every write follows a preview-then-confirm pattern; there is no way to bypass it.
Defense-in-depth project scope — MCP read/write allowlists restrict the token's effective scope in addition to OpenProject's own server-side permissions.
Typed tools, not a raw REST client — one call per intent (list, search, create, update) instead of hand-built HAL requests and link-following.

What you can do

Projects

List, create, copy, update, and delete projects
Read project configurations, lifecycle phases, and admin context
Create, update, and delete memberships and versions; list roles

Work packages

List and search work packages with structured filters
Create, update, and delete work packages; create subtasks; create, update, and delete relations; add comments (no edit or delete)
Upload, read (images and text inlined for the model), and delete attachments; add and remove watchers; read activity logs
Log, update, and delete time entries

Boards and views

Create, read, update, and delete saved boards (queries); read views

Meetings

Create, read, update, and delete meetings with their agenda items, sections, and outcomes
Manage recurring meetings: create, update, and delete series; list occurrences; initialize or cancel a single occurrence

Administration and schedules (opt-in)

Read user accounts and group memberships
Create, update, lock, unlock, and delete users; add and remove group members
Read and manage file storage connections (e.g. Nextcloud)
Read and manage users' non-working times and working hours

Supporting data

Fetch individual wiki pages by id; create, update, and delete news; read and update documents
Read and mark notifications; read help texts, working days, and instance configuration
Create and inspect grids; inspect custom options

All write operations follow a preview-then-confirm pattern: call a tool once to get a validated preview, then again with confirm=true to execute. There is no way to bypass this.

Scope: Community Edition

This MCP server targets OpenProject Community Edition only. It does not support Enterprise Edition features such as:

Placeholder Users
Portfolios
Programs
Custom Actions
Baseline Comparisons

Note: OpenProject Enterprise Edition includes its own MCP server. If you have an Enterprise license, use the official Enterprise MCP instead of this one.

How it works

Communicates with the MCP client over stdio — no remote server, no persistent storage
The core read groups (projects, work packages, memberships, versions, boards, meetings) are on by default, but until OPENPROJECT_READ_PROJECTS lists a project, only project-independent tools such as list_statuses, list_types and get_current_user are registered. Personal, admin, user-schedule, and extended metadata tools are opt-in
The project-scoped write categories are on by default, but their tools are registered only when both OPENPROJECT_READ_PROJECTS and OPENPROJECT_WRITE_PROJECTS list a project, and a write reaches only projects in both. The allowlists, not the category flags, are the real gate. Personal-data, admin, and user-schedule writes are opt-in
Create and update operations validate the payload against OpenProject form endpoints before writing; delete and other simple operations execute directly once confirmed
Project scope is enforced server-side: the MCP only exposes what the configured allowlists permit
Responses are bounded and paginated — compact summaries, not raw HAL payloads

A core reason to use this MCP instead of calling the OpenProject REST API directly: it returns context-frugal responses instead of raw HAL payloads — and not just for listing. The numbers below are measured against the same three representative work packages (real tiktoken counts, not a bytes/4 approximation); read/search/write/batch calls all land in the same −85% to −98% range. For the full per-call-type breakdown, the tool-catalog size numbers, and how to reproduce them, see Context efficiency.

Response	Tokens	vs. raw API
Raw OpenProject REST API v3 (HAL)	~9,992	baseline
`list_work_packages` (MCP)	~861	−91%
`list_work_packages` with `select` (5 fields)	~174	−98%

Install

This quickstart requires pipx; see Installation if it isn't installed yet.

pipx install openproject-ce-mcp

openproject-ce-mcp configure openproject-ce-mcp --version

Already use uv? uv tool install openproject-ce-mcp works the same way. See Installation for when plain pip install is appropriate instead, and for uvx (a zero-install, run-on-demand alternative to installing at all).

configure collects your OpenProject URL, API token, and project scope, then writes the config for the MCP client(s) you choose. Project-scoped is recommended: the server is then available only in the current project. Global makes it available everywhere. Restart your MCP client afterward, then ask it to call get_current_user or list_projects to verify.

See Installation for requirements, updating, source installs, and uninstalling, and Clients for per-client setup guides.

Documentation

Full documentation lives in docs/, starting at the documentation hub:

Setup: Installation · Clients · Configuration · Troubleshooting
Using the tools: Tool reference · Work package filters · Field hiding
Client guides: Claude / Claude Code · Claude Desktop · Codex · Cursor · VS Code / GitHub Copilot
Contributing: Development · Architecture · Context efficiency

Configuration essentials

Your client config (.mcp.json, .codex/config.toml, or .vscode/mcp.json) contains your API token — treat it like a password and keep it out of version control; choose your client-specific guide from Clients for the exact .gitignore step. configure writes a minimal config: only the values that differ from a safe default. The core read groups and the project-scoped write categories are enabled by default, but their project-bound tools are registered, and project access is granted, only once you list projects in OPENPROJECT_READ_PROJECTS (and, for writes, in OPENPROJECT_WRITE_PROJECTS too); that allowlist pair, not the category flags, is the real gate.

See Configuration for the full environment variable reference and what configure --quick vs. --advanced ask.

Security

Prompt Injection

User-provided text (work-package descriptions, comments, news, wiki content) is marked with tags and flagged in server instructions as untrusted. Agents should treat this content as data, not as instructions.

See SECURITY.md for the full security model, including prompt injection mitigations, reporting procedures, and supported versions.

Questions and bug reports

Ask questions in GitHub Discussions. Report bugs and request features in GitHub Issues. Report security vulnerabilities privately as described in SECURITY.md.

Development

main is a frozen snapshot of the last release, not the active development branch. See CONTRIBUTING.md for which branch to clone (active development vs. bugfixes) and the full test suite (unit, integration, and Docker test instances).

License

MIT — see LICENSE. A single top-level license file covers the whole project; individual source files don't carry per-file copyright headers, matching common practice for MIT-licensed Python packages.

OpenProject CE

Overview

PopNx MCP’s three pillars

What you can do with it

Install

Before you install

Values you fill in

What it can do

Basic checksi

Maker matches the repo

Still maintained

Has a licence

Endpoint responds

Sign-in with OAuth

No hidden instructions in tool descriptions

Compared with others in Otheri

Common questions

Alternatives

Spec Driven Development

Remote Desktop Commander

Tool Guardian

README from the maker

OpenProject CE MCP

Why use this MCP

What you can do

Scope: Community Edition

How it works

Install

Documentation

Configuration essentials

Security

Prompt Injection

Questions and bug reports

Development

License