OpenProject CE

OpenProject CE MCP

An MCP server for OpenProject that lets local AI agents read and manage project data through structured, guarded tools.

The server runs as a local subprocess of your MCP client over stdio. It wraps OpenProject API v3 and exposes typed tools for projects, work packages, memberships, versions, boards, meetings, time entries, and more.

Reading this on PyPI? All links below point to the GitHub repository — the docs/ pages and images ship in the git repo and source distribution, not in the installed package itself.

Why use this MCP

• Context-frugal by design — compact, agent-shaped responses instead of raw HAL payloads (~21 fields + ~46 links per item in the raw API). Measured up to −99% tokens per response with select; see Context efficiency for the full numbers.
• Guarded writes — every write follows a preview-then-confirm pattern; there is no way to bypass it.
• Defense-in-depth project scope — MCP read/write allowlists restrict the token's effective scope in addition to OpenProject's own server-side permissions.
• Typed tools, not a raw REST client — one call per intent (list, search, create, update) instead of hand-built HAL requests and link-following.

What you can do

Projects

• List, create, copy, update, and delete projects
• Read project configurations, lifecycle phases, and admin context
• Create, update, and delete memberships and versions; list roles

Work packages

• List and search work packages with structured filters
• Create, update, and delete work packages; create subtasks; create, update, and delete relations; add comments (no edit or delete)
• Upload, read (images and text inlined for the model), and delete attachments; add and remove watchers; read activity logs
• Log, update, and delete time entries

Boards and views

• Create, read, update, and delete saved boards (queries); read views

Meetings

• Create, read, update, and delete meetings with their agenda items, sections, and outcomes
• Manage recurring meetings: create, update, and delete series; list occurrences; initialize or cancel a single occurrence

Administration and schedules (opt-in)

• Read user accounts and group memberships
• Create, update, lock, unlock, and delete users; add and remove group members
• Read and manage file storage connections (e.g. Nextcloud)
• Read and manage users' non-working times and working hours

Supporting data

• Fetch individual wiki pages by id; create, update, and delete news; read and update documents
• Read and mark notifications; read help texts, working days, and instance configuration
• Create and inspect grids; inspect custom options

All write operations follow a preview-then-confirm pattern: call a tool once to get a validated preview, then again with confirm=true to execute. There is no way to bypass this.

Scope: Community Edition

This MCP server targets OpenProject Community Edition only. It does not support Enterprise Edition features such as:

• Placeholder Users
• Portfolios
• Programs
• Custom Actions
• Baseline Comparisons

Note: OpenProject Enterprise Edition includes its own MCP server. If you have an Enterprise license, use the official Enterprise MCP instead of this one.

How it works

• Communicates with the MCP client over stdio — no remote server, no persistent storage
• The core read groups (projects, work packages, memberships, versions, boards, meetings) are on by default, but until OPENPROJECT_READ_PROJECTS lists a project, only project-independent tools such as list_statuses, list_types and get_current_user are registered. Personal, admin, user-schedule, and extended metadata tools are opt-in
• The project-scoped write categories are on by default, but their tools are registered only when both OPENPROJECT_READ_PROJECTS and OPENPROJECT_WRITE_PROJECTS list a project, and a write reaches only projects in both. The allowlists, not the category flags, are the real gate. Personal-data, admin, and user-schedule writes are opt-in
• Create and update operations validate the payload against OpenProject form endpoints before writing; delete and other simple operations execute directly once confirmed
• Project scope is enforced server-side: the MCP only exposes what the configured allowlists permit
• Responses are bounded and paginated — compact summaries, not raw HAL payloads

A core reason to use this MCP instead of calling the OpenProject REST API directly: it returns context-frugal responses instead of raw HAL payloads — and not just for listing. The numbers below are measured against the same three representative work packages (real tiktoken counts, not a bytes/4 approximation); read/search/write/batch calls all land in the same −85% to −98% range. For the full per-call-type breakdown, the tool-catalog size numbers, and how to reproduce them, see Context efficiency.

Install

This quickstart requires pipx; see Installation if it isn't installed yet.

pipx install openproject-ce-mcp
openproject-ce-mcp configure
openproject-ce-mcp --version

Already use uv? uv tool install openproject-ce-mcp works the same way. See Installation for when plain pip install is appropriate instead, and for uvx (a zero-install, run-on-demand alternative to installing at all).

configure collects your OpenProject URL, API token, and project scope, then writes the config for the MCP client(s) you choose. Project-scoped is recommended: the server is then available only in the current project. Global makes it available everywhere. Restart your MCP client afterward, then ask it to call get_current_user or list_projects to verify.

See Installation for requirements, updating, source installs, and uninstalling, and Clients for per-client setup guides.

Documentation

Full documentation lives in docs/, starting at the documentation hub:

• Setup: Installation · Clients · Configuration · Troubleshooting
• Using the tools: Tool reference · Work package filters · Field hiding
• Client guides: Claude / Claude Code · Claude Desktop · Codex · Cursor · VS Code / GitHub Copilot
• Contributing: Development · Architecture · Context efficiency

Configuration essentials

Your client config (.mcp.json, .codex/config.toml, or .vscode/mcp.json) contains your API token — treat it like a password and keep it out of version control; choose your client-specific guide from Clients for the exact .gitignore step. configure writes a minimal config: only the values that differ from a safe default. The core read groups and the project-scoped write categories are enabled by default, but their project-bound tools are registered, and project access is granted, only once you list projects in OPENPROJECT_READ_PROJECTS (and, for writes, in OPENPROJECT_WRITE_PROJECTS too); that allowlist pair, not the category flags, is the real gate.

See Configuration for the full environment variable reference and what configure --quick vs. --advanced ask.

Security

Prompt Injection

User-provided text (work-package descriptions, comments, news, wiki content) is marked with <user-content> tags and flagged in server instructions as untrusted. Agents should treat this content as data, not as instructions.

See SECURITY.md for the full security model, including prompt injection mitigations, reporting procedures, and supported versions.

Questions and bug reports

Ask questions in GitHub Discussions. Report bugs and request features in GitHub Issues. Report security vulnerabilities privately as described in SECURITY.md.

Development

main is a frozen snapshot of the last release, not the active development branch. See CONTRIBUTING.md for which branch to clone (active development vs. bugfixes) and the full test suite (unit, integration, and Docker test instances).

License

MIT — see LICENSE. A single top-level license file covers the whole project; individual source files don't carry per-file copyright headers, matching common practice for MIT-licensed Python packages.