Workflow discipline for AI agents: work items, gates, role-scoped tool profiles and runs
Connect Runs on your machine
claude mcp add task-orchestrator -e DATABASE_PATH=<DATABASE_PATH> -e AGENT_CONFIG_DIR=<AGENT_CONFIG_DIR> -e MCP_TRANSPORT=<MCP_TRANSPORT> -e MCP_HTTP_PORT=<MCP_HTTP_PORT> -e MCP_SESSION_IDLE_TIMEOUT_MINUTES=<MCP_SESSION_IDLE_TIMEOUT_MINUTES> -e LOG_LEVEL=<LOG_LEVEL> -e LOG_FILE=<LOG_FILE> -e API_ALLOW_QUERY_TOKEN_FOR_SSE=<API_ALLOW_QUERY_TOKEN_FOR_SSE> -e API_ALLOW_UNAUTHENTICATED=<API_ALLOW_UNAUTHENTICATED> -e API_AUTH_MODE=<API_AUTH_MODE> -e API_ENABLED=<API_ENABLED> -e API_JWKS_ALGORITHMS=<API_JWKS_ALGORITHMS> -e API_JWKS_ALLOW_INSECURE_URL=<API_JWKS_ALLOW_INSECURE_URL> -e API_JWKS_AUDIENCE=<API_JWKS_AUDIENCE> -e API_JWKS_CACHE_TTL_SECONDS=<API_JWKS_CACHE_TTL_SECONDS> -e API_JWKS_ISSUER=<API_JWKS_ISSUER> -e API_JWKS_MAX_STALE_SECONDS=<API_JWKS_MAX_STALE_SECONDS> -e API_JWKS_MAX_TOKEN_LIFETIME_SECONDS=<API_JWKS_MAX_TOKEN_LIFETIME_SECONDS> -e API_JWKS_URL=<API_JWKS_URL> -e API_REDACT_NOTE_ATTRIBUTION=<API_REDACT_NOTE_ATTRIBUTION> -e API_SSE_AUTH_CHECK_INTERVAL_SECONDS=<API_SSE_AUTH_CHECK_INTERVAL_SECONDS> -e API_SSE_BUFFER_SIZE=<API_SSE_BUFFER_SIZE> -e API_TOKENS_PATH=<API_TOKENS_PATH> -e CORS_ALLOWED_HEADERS=<CORS_ALLOWED_HEADERS> -e CORS_ALLOWED_METHODS=<CORS_ALLOWED_METHODS> -e CORS_ALLOWED_ORIGINS=<CORS_ALLOWED_ORIGINS> -e CORS_EXPOSE_HEADERS=<CORS_EXPOSE_HEADERS> -e CORS_MAX_AGE_SECONDS=<CORS_MAX_AGE_SECONDS> -e DATABASE_BUSY_TIMEOUT_MS=<DATABASE_BUSY_TIMEOUT_MS> -e DATABASE_MAX_CONNECTIONS=<DATABASE_MAX_CONNECTIONS> -e DATABASE_SHOW_SQL=<DATABASE_SHOW_SQL> -e DB_COMPACT_ON_UPGRADE=<DB_COMPACT_ON_UPGRADE> -e FLYWAY_REPAIR=<FLYWAY_REPAIR> -e FTS_INTEGRITY=<FTS_INTEGRITY> -e MCP_ALLOWED_HOSTS=<MCP_ALLOWED_HOSTS> -e MCP_ALLOW_UNAUTHENTICATED=<MCP_ALLOW_UNAUTHENTICATED> -e MCP_HTTP_HOST=<MCP_HTTP_HOST> -e MCP_SERVER_NAME=<MCP_SERVER_NAME> -e MCP_TOOL_PROFILE=<MCP_TOOL_PROFILE> -e READINESS_FILE=<READINESS_FILE> -e RESOURCE_LEASES_ENFORCED=<RESOURCE_LEASES_ENFORCED> -e RETENTION_AUDIT_EVENTS_DAYS=<RETENTION_AUDIT_EVENTS_DAYS> -e RETENTION_CALL_LOG_DAYS=<RETENTION_CALL_LOG_DAYS> -e RETENTION_EVENTS_DAYS=<RETENTION_EVENTS_DAYS> -e RETENTION_LEASE_HISTORY_DAYS=<RETENTION_LEASE_HISTORY_DAYS> -e SCHEMA_MODE=<SCHEMA_MODE> -e UPGRADE_BACKUP=<UPGRADE_BACKUP> -- docker run -i --rm ghcr.io/jpicklyk/task-orchestrator:4.0.2
{
"mcpServers": {
"task-orchestrator": {
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"ghcr.io/jpicklyk/task-orchestrator:4.0.2"
],
"env": {
"DATABASE_PATH": "<DATABASE_PATH>",
"AGENT_CONFIG_DIR": "<AGENT_CONFIG_DIR>",
"MCP_TRANSPORT": "<MCP_TRANSPORT>",
"MCP_HTTP_PORT": "<MCP_HTTP_PORT>",
"MCP_SESSION_IDLE_TIMEOUT_MINUTES": "<MCP_SESSION_IDLE_TIMEOUT_MINUTES>",
"LOG_LEVEL": "<LOG_LEVEL>",
"LOG_FILE": "<LOG_FILE>",
"API_ALLOW_QUERY_TOKEN_FOR_SSE": "<API_ALLOW_QUERY_TOKEN_FOR_SSE>",
"API_ALLOW_UNAUTHENTICATED": "<API_ALLOW_UNAUTHENTICATED>",
"API_AUTH_MODE": "<API_AUTH_MODE>",
"API_ENABLED": "<API_ENABLED>",
"API_JWKS_ALGORITHMS": "<API_JWKS_ALGORITHMS>",
"API_JWKS_ALLOW_INSECURE_URL": "<API_JWKS_ALLOW_INSECURE_URL>",
"API_JWKS_AUDIENCE": "<API_JWKS_AUDIENCE>",
"API_JWKS_CACHE_TTL_SECONDS": "<API_JWKS_CACHE_TTL_SECONDS>",
"API_JWKS_ISSUER": "<API_JWKS_ISSUER>",
"API_JWKS_MAX_STALE_SECONDS": "<API_JWKS_MAX_STALE_SECONDS>",
"API_JWKS_MAX_TOKEN_LIFETIME_SECONDS": "<API_JWKS_MAX_TOKEN_LIFETIME_SECONDS>",
"API_JWKS_URL": "<API_JWKS_URL>",
"API_REDACT_NOTE_ATTRIBUTION": "<API_REDACT_NOTE_ATTRIBUTION>",
"API_SSE_AUTH_CHECK_INTERVAL_SECONDS": "<API_SSE_AUTH_CHECK_INTERVAL_SECONDS>",
"API_SSE_BUFFER_SIZE": "<API_SSE_BUFFER_SIZE>",
"API_TOKENS_PATH": "<API_TOKENS_PATH>",
"CORS_ALLOWED_HEADERS": "<CORS_ALLOWED_HEADERS>",
"CORS_ALLOWED_METHODS": "<CORS_ALLOWED_METHODS>",
"CORS_ALLOWED_ORIGINS": "<CORS_ALLOWED_ORIGINS>",
"CORS_EXPOSE_HEADERS": "<CORS_EXPOSE_HEADERS>",
"CORS_MAX_AGE_SECONDS": "<CORS_MAX_AGE_SECONDS>",
"DATABASE_BUSY_TIMEOUT_MS": "<DATABASE_BUSY_TIMEOUT_MS>",
"DATABASE_MAX_CONNECTIONS": "<DATABASE_MAX_CONNECTIONS>",
"DATABASE_SHOW_SQL": "<DATABASE_SHOW_SQL>",
"DB_COMPACT_ON_UPGRADE": "<DB_COMPACT_ON_UPGRADE>",
"FLYWAY_REPAIR": "<FLYWAY_REPAIR>",
"FTS_INTEGRITY": "<FTS_INTEGRITY>",
"MCP_ALLOWED_HOSTS": "<MCP_ALLOWED_HOSTS>",
"MCP_ALLOW_UNAUTHENTICATED": "<MCP_ALLOW_UNAUTHENTICATED>",
"MCP_HTTP_HOST": "<MCP_HTTP_HOST>",
"MCP_SERVER_NAME": "<MCP_SERVER_NAME>",
"MCP_TOOL_PROFILE": "<MCP_TOOL_PROFILE>",
"READINESS_FILE": "<READINESS_FILE>",
"RESOURCE_LEASES_ENFORCED": "<RESOURCE_LEASES_ENFORCED>",
"RETENTION_AUDIT_EVENTS_DAYS": "<RETENTION_AUDIT_EVENTS_DAYS>",
"RETENTION_CALL_LOG_DAYS": "<RETENTION_CALL_LOG_DAYS>",
"RETENTION_EVENTS_DAYS": "<RETENTION_EVENTS_DAYS>",
"RETENTION_LEASE_HISTORY_DAYS": "<RETENTION_LEASE_HISTORY_DAYS>",
"SCHEMA_MODE": "<SCHEMA_MODE>",
"UPGRADE_BACKUP": "<UPGRADE_BACKUP>"
}
}
}
}
{
"mcpServers": {
"task-orchestrator": {
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"ghcr.io/jpicklyk/task-orchestrator:4.0.2"
],
"env": {
"DATABASE_PATH": "<DATABASE_PATH>",
"AGENT_CONFIG_DIR": "<AGENT_CONFIG_DIR>",
"MCP_TRANSPORT": "<MCP_TRANSPORT>",
"MCP_HTTP_PORT": "<MCP_HTTP_PORT>",
"MCP_SESSION_IDLE_TIMEOUT_MINUTES": "<MCP_SESSION_IDLE_TIMEOUT_MINUTES>",
"LOG_LEVEL": "<LOG_LEVEL>",
"LOG_FILE": "<LOG_FILE>",
"API_ALLOW_QUERY_TOKEN_FOR_SSE": "<API_ALLOW_QUERY_TOKEN_FOR_SSE>",
"API_ALLOW_UNAUTHENTICATED": "<API_ALLOW_UNAUTHENTICATED>",
"API_AUTH_MODE": "<API_AUTH_MODE>",
"API_ENABLED": "<API_ENABLED>",
"API_JWKS_ALGORITHMS": "<API_JWKS_ALGORITHMS>",
"API_JWKS_ALLOW_INSECURE_URL": "<API_JWKS_ALLOW_INSECURE_URL>",
"API_JWKS_AUDIENCE": "<API_JWKS_AUDIENCE>",
"API_JWKS_CACHE_TTL_SECONDS": "<API_JWKS_CACHE_TTL_SECONDS>",
"API_JWKS_ISSUER": "<API_JWKS_ISSUER>",
"API_JWKS_MAX_STALE_SECONDS": "<API_JWKS_MAX_STALE_SECONDS>",
"API_JWKS_MAX_TOKEN_LIFETIME_SECONDS": "<API_JWKS_MAX_TOKEN_LIFETIME_SECONDS>",
"API_JWKS_URL": "<API_JWKS_URL>",
"API_REDACT_NOTE_ATTRIBUTION": "<API_REDACT_NOTE_ATTRIBUTION>",
"API_SSE_AUTH_CHECK_INTERVAL_SECONDS": "<API_SSE_AUTH_CHECK_INTERVAL_SECONDS>",
"API_SSE_BUFFER_SIZE": "<API_SSE_BUFFER_SIZE>",
"API_TOKENS_PATH": "<API_TOKENS_PATH>",
"CORS_ALLOWED_HEADERS": "<CORS_ALLOWED_HEADERS>",
"CORS_ALLOWED_METHODS": "<CORS_ALLOWED_METHODS>",
"CORS_ALLOWED_ORIGINS": "<CORS_ALLOWED_ORIGINS>",
"CORS_EXPOSE_HEADERS": "<CORS_EXPOSE_HEADERS>",
"CORS_MAX_AGE_SECONDS": "<CORS_MAX_AGE_SECONDS>",
"DATABASE_BUSY_TIMEOUT_MS": "<DATABASE_BUSY_TIMEOUT_MS>",
"DATABASE_MAX_CONNECTIONS": "<DATABASE_MAX_CONNECTIONS>",
"DATABASE_SHOW_SQL": "<DATABASE_SHOW_SQL>",
"DB_COMPACT_ON_UPGRADE": "<DB_COMPACT_ON_UPGRADE>",
"FLYWAY_REPAIR": "<FLYWAY_REPAIR>",
"FTS_INTEGRITY": "<FTS_INTEGRITY>",
"MCP_ALLOWED_HOSTS": "<MCP_ALLOWED_HOSTS>",
"MCP_ALLOW_UNAUTHENTICATED": "<MCP_ALLOW_UNAUTHENTICATED>",
"MCP_HTTP_HOST": "<MCP_HTTP_HOST>",
"MCP_SERVER_NAME": "<MCP_SERVER_NAME>",
"MCP_TOOL_PROFILE": "<MCP_TOOL_PROFILE>",
"READINESS_FILE": "<READINESS_FILE>",
"RESOURCE_LEASES_ENFORCED": "<RESOURCE_LEASES_ENFORCED>",
"RETENTION_AUDIT_EVENTS_DAYS": "<RETENTION_AUDIT_EVENTS_DAYS>",
"RETENTION_CALL_LOG_DAYS": "<RETENTION_CALL_LOG_DAYS>",
"RETENTION_EVENTS_DAYS": "<RETENTION_EVENTS_DAYS>",
"RETENTION_LEASE_HISTORY_DAYS": "<RETENTION_LEASE_HISTORY_DAYS>",
"SCHEMA_MODE": "<SCHEMA_MODE>",
"UPGRADE_BACKUP": "<UPGRADE_BACKUP>"
}
}
}
}
{
"servers": {
"task-orchestrator": {
"type": "stdio",
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"ghcr.io/jpicklyk/task-orchestrator:4.0.2"
],
"env": {
"DATABASE_PATH": "<DATABASE_PATH>",
"AGENT_CONFIG_DIR": "<AGENT_CONFIG_DIR>",
"MCP_TRANSPORT": "<MCP_TRANSPORT>",
"MCP_HTTP_PORT": "<MCP_HTTP_PORT>",
"MCP_SESSION_IDLE_TIMEOUT_MINUTES": "<MCP_SESSION_IDLE_TIMEOUT_MINUTES>",
"LOG_LEVEL": "<LOG_LEVEL>",
"LOG_FILE": "<LOG_FILE>",
"API_ALLOW_QUERY_TOKEN_FOR_SSE": "<API_ALLOW_QUERY_TOKEN_FOR_SSE>",
"API_ALLOW_UNAUTHENTICATED": "<API_ALLOW_UNAUTHENTICATED>",
"API_AUTH_MODE": "<API_AUTH_MODE>",
"API_ENABLED": "<API_ENABLED>",
"API_JWKS_ALGORITHMS": "<API_JWKS_ALGORITHMS>",
"API_JWKS_ALLOW_INSECURE_URL": "<API_JWKS_ALLOW_INSECURE_URL>",
"API_JWKS_AUDIENCE": "<API_JWKS_AUDIENCE>",
"API_JWKS_CACHE_TTL_SECONDS": "<API_JWKS_CACHE_TTL_SECONDS>",
"API_JWKS_ISSUER": "<API_JWKS_ISSUER>",
"API_JWKS_MAX_STALE_SECONDS": "<API_JWKS_MAX_STALE_SECONDS>",
"API_JWKS_MAX_TOKEN_LIFETIME_SECONDS": "<API_JWKS_MAX_TOKEN_LIFETIME_SECONDS>",
"API_JWKS_URL": "<API_JWKS_URL>",
"API_REDACT_NOTE_ATTRIBUTION": "<API_REDACT_NOTE_ATTRIBUTION>",
"API_SSE_AUTH_CHECK_INTERVAL_SECONDS": "<API_SSE_AUTH_CHECK_INTERVAL_SECONDS>",
"API_SSE_BUFFER_SIZE": "<API_SSE_BUFFER_SIZE>",
"API_TOKENS_PATH": "<API_TOKENS_PATH>",
"CORS_ALLOWED_HEADERS": "<CORS_ALLOWED_HEADERS>",
"CORS_ALLOWED_METHODS": "<CORS_ALLOWED_METHODS>",
"CORS_ALLOWED_ORIGINS": "<CORS_ALLOWED_ORIGINS>",
"CORS_EXPOSE_HEADERS": "<CORS_EXPOSE_HEADERS>",
"CORS_MAX_AGE_SECONDS": "<CORS_MAX_AGE_SECONDS>",
"DATABASE_BUSY_TIMEOUT_MS": "<DATABASE_BUSY_TIMEOUT_MS>",
"DATABASE_MAX_CONNECTIONS": "<DATABASE_MAX_CONNECTIONS>",
"DATABASE_SHOW_SQL": "<DATABASE_SHOW_SQL>",
"DB_COMPACT_ON_UPGRADE": "<DB_COMPACT_ON_UPGRADE>",
"FLYWAY_REPAIR": "<FLYWAY_REPAIR>",
"FTS_INTEGRITY": "<FTS_INTEGRITY>",
"MCP_ALLOWED_HOSTS": "<MCP_ALLOWED_HOSTS>",
"MCP_ALLOW_UNAUTHENTICATED": "<MCP_ALLOW_UNAUTHENTICATED>",
"MCP_HTTP_HOST": "<MCP_HTTP_HOST>",
"MCP_SERVER_NAME": "<MCP_SERVER_NAME>",
"MCP_TOOL_PROFILE": "<MCP_TOOL_PROFILE>",
"READINESS_FILE": "<READINESS_FILE>",
"RESOURCE_LEASES_ENFORCED": "<RESOURCE_LEASES_ENFORCED>",
"RETENTION_AUDIT_EVENTS_DAYS": "<RETENTION_AUDIT_EVENTS_DAYS>",
"RETENTION_CALL_LOG_DAYS": "<RETENTION_CALL_LOG_DAYS>",
"RETENTION_EVENTS_DAYS": "<RETENTION_EVENTS_DAYS>",
"RETENTION_LEASE_HISTORY_DAYS": "<RETENTION_LEASE_HISTORY_DAYS>",
"SCHEMA_MODE": "<SCHEMA_MODE>",
"UPGRADE_BACKUP": "<UPGRADE_BACKUP>"
}
}
}
}
Replace the values in angle brackets with your own. Keys stay on your machine; we never see them.
Tools
This server runs locally, so its tools are listed by your MCP client once it starts.
Environment variables
| Name | Description |
|---|---|
DATABASE_PATHOptional | SQLite database file path (default: data/current-tasks.db) |
AGENT_CONFIG_DIROptional | Directory containing .taskorchestrator/config.yaml for workflow schemas (default: working dir) |
MCP_TRANSPORTOptional | Transport mode: stdio (default) or http |
MCP_HTTP_PORTOptional | HTTP port when using http transport (default: 3001) |
MCP_SESSION_IDLE_TIMEOUT_MINUTESOptional | Minutes without a request before an HTTP MCP session is closed; the client re-initializes on its next call (default: 120) |
LOG_LEVELOptional | Logging level: DEBUG, INFO, WARN, ERROR (default: INFO) |
LOG_FILEOptional | Optional log file path. Unset (default) disables file logging; logs are always JSON on stderr. |
API_ALLOW_QUERY_TOKEN_FOR_SSEOptional | Allow ?token= auth for SSE (browser EventSource workaround) (default: false) |
API_ALLOW_UNAUTHENTICATEDOptional | Confirm flag required alongside API_AUTH_MODE=none (default: false) |
API_AUTH_MODEOptional | REST API auth mode: bearer, jwks, or none (with API_ALLOW_UNAUTHENTICATED=true). Required when API_ENABLED=true |
API_ENABLEDOptional | Master REST API switch; set true to register /api/v1/* routes (default: false) |
API_JWKS_ALGORITHMSOptional | Comma-separated JWT algorithm allowlist for jwks mode (e.g. RS256,EdDSA) |
API_JWKS_ALLOW_INSECURE_URLOptional | Loopback-only opt-in to fetch API_JWKS_URL over plaintext http (default: false) |
API_JWKS_AUDIENCEOptional | Expected aud claim value in JWTs (jwks mode) |
API_JWKS_CACHE_TTL_SECONDSOptional | JWKS key cache TTL in seconds (default: 300) |
API_JWKS_ISSUEROptional | Expected iss claim value in JWTs (jwks mode) |
API_JWKS_MAX_STALE_SECONDSOptional | Oldest a cached key set may be and still be served after a failed refresh (default: max(3600, TTL)) |
API_JWKS_MAX_TOKEN_LIFETIME_SECONDSOptional | Maximum accepted token lifetime in seconds (default: 86400) |
API_JWKS_URLOptional | JWKS endpoint URL (jwks mode); must be https and resolve to public addresses |
API_REDACT_NOTE_ATTRIBUTIONOptional | Redact actor/verification on notes for non-admin callers (default: true) |
API_SSE_AUTH_CHECK_INTERVAL_SECONDSOptional | Interval for token-expiry checks on open SSE connections (default: 30) |
API_SSE_BUFFER_SIZEOptional | Last-Event-ID replay window in event ids (default: 1000; 0 = no replay) |
API_TOKENS_PATHOptional | Path to the bearer token YAML secret file (default: /run/secrets/api-tokens.yaml) |
CORS_ALLOWED_HEADERSOptional | Comma-separated CORS request headers allowlist |
CORS_ALLOWED_METHODSOptional | Comma-separated CORS methods allowlist |
CORS_ALLOWED_ORIGINSOptional | Comma-separated allowed CORS origins; empty means no cross-origin access |
CORS_EXPOSE_HEADERSOptional | Comma-separated response headers browser clients may read |
CORS_MAX_AGE_SECONDSOptional | CORS preflight cache duration in seconds (default: 3600) |
DATABASE_BUSY_TIMEOUT_MSOptional | SQLite busy timeout for startup paths in milliseconds (default: 5000, floor 100) |
DATABASE_MAX_CONNECTIONSOptional | Read-pool connection count (default: 10, clamped to 1-64) |
DATABASE_SHOW_SQLOptional | Log every SQL statement at DEBUG (default: false) |
DB_COMPACT_ON_UPGRADEOptional | Run the one-time post-upgrade startup compaction (default: true; false opts out) |
FLYWAY_REPAIROptional | Run Flyway repair and exit (default: false) |
FTS_INTEGRITYOptional | FTS5 integrity check at startup: startup (default) or off |
MCP_ALLOWED_HOSTSOptional | Comma-separated Host header allowlist extending the loopback defaults (HTTP transport) |
MCP_ALLOW_UNAUTHENTICATEDOptional | Opt in to MCP_TRANSPORT=http with API_ENABLED=false, serving /mcp as the local principal (default: false) |
MCP_HTTP_HOSTOptional | Bind address when using http transport (default: 0.0.0.0) |
MCP_SERVER_NAMEOptional | Service name reported in MCP identity and REST service metadata (default: mcp-task-orchestrator-current) |
MCP_TOOL_PROFILEOptional | Tool profile over stdio: orchestration (default), knowledge, or director |
READINESS_FILEOptional | Readiness marker file touched once startup succeeds (default: /tmp/mcp-task-orchestrator.ready) |
RESOURCE_LEASES_ENFORCEDOptional | Deployment-wide kill switch for the resource-lease gate (default: true) |
RETENTION_AUDIT_EVENTS_DAYSOptional | Days to keep audit-class events rows (default: 0 = forever) |
RETENTION_CALL_LOG_DAYSOptional | Days to keep folded call_log rows (default: 90) |
RETENTION_EVENTS_DAYSOptional | Days to keep activity-class events rows (default: 180) |
RETENTION_LEASE_HISTORY_DAYSOptional | Days to keep closed resource_lease_history intervals (default: 365) |
SCHEMA_MODEOptional | Schema phase: migrate (default) applies pending migrations; validate refuses pending or future versions |
UPGRADE_BACKUPOptional | Verified pre-upgrade copy of a 3.x database (<db>.pre-4.0.<yyyyMMddTHHmmssZ>.bak) taken before its first 4.0 migration; a failed copy fails startup. Set false to skip (default: true) |
Details
| Package | ghcr.io/jpicklyk/task-orchestrator:4.0.2 (OCI, stdio) |
| First published | 11 Nov 2026 |
| Last updated | 11 Nov 2026 |
| Registry name | io.github.jpicklyk/task-orchestrator |
More productivity servers See all
Listing data from the official MCP registry. Status and tools from NestDaddy's daily check. Browse all MCP servers.
