OmniFocus MCP

Findings (21)

• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  @modelcontextprotocol/sdk@1.8.0: 5 known vulnerabilities

  GHSA-46jr-4wx8-v453, GHSA-6prh-2h8m-c8cw, GHSA-8r9q-7v3j-jr4g, GHSA-rvq5-wwqv-78pq, GHSA-w48q-cv73-mx4w

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  body-parser@2.2.0: 3 known vulnerabilities

  GHSA-27r3-jxmh-p828, GHSA-v422-hmwv-36x6, GHSA-wqch-xfxh-vrr4

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  nanoid@3.3.11: 3 known vulnerabilities

  GHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8, GHSA-xwg4-73v4-xw9w

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  path-to-regexp@8.2.0: 2 known vulnerabilities

  GHSA-27v5-c462-wpq7, GHSA-j3q9-mxjg-w52f

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  postcss@8.5.8: 4 known vulnerabilities

  GHSA-6g55-p6wh-862q, GHSA-fxqj-rqcc-2cmp, GHSA-qx2v-qp2m-jg93, GHSA-r28c-9q8g-f849

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  source-map-js@1.2.1: 1 known vulnerability

  GHSA-68fv-2mgg-jv7q

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  vite@8.0.3: 10 known vulnerabilities

  GHSA-4w7w-66w2-5vf9, GHSA-587h-7wmj-h5pm, GHSA-698v-4r3x-3vcv, GHSA-9jrq-w75r-8gcw, GHSA-fx2h-pf6j-xcff +5 more

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  zod@3.24.2: 1 known vulnerability

  GHSA-mrhx-c7xc-m3w5

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).

  src/tools/__tests__/queryOmnifocus.test.ts:768
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).

  src/utils/__tests__/repetitionRule.test.ts:133
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).

  src/utils/__tests__/reviewInterval.test.ts:36
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).

  src/utils/__tests__/reviewInterval.test.ts:89
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).

  src/utils/__tests__/taskMove.test.ts:117
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).

  src/utils/__tests__/taskMove.test.ts:274
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).

  src/utils/dateSerialization.test.ts:72
• lowLow. Minor, or common in normal tools. Shown for information.
  @vitest/mocker@4.1.2: 2 known vulnerabilities

  GHSA-82fw-gwwq-j7x9, GHSA-qxg6-89mg-rqv8

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  qs@6.13.0: 5 known vulnerabilities

  GHSA-4mjr-xmp4-gh2g, GHSA-6pq8-jhm2-2vcw, GHSA-6rw7-vpxm-498p, GHSA-q8mj-m7cp-5q26, GHSA-w7fw-mjwx-w883

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  qs@6.14.0: 5 known vulnerabilities

  GHSA-4mjr-xmp4-gh2g, GHSA-6pq8-jhm2-2vcw, GHSA-6rw7-vpxm-498p, GHSA-q8mj-m7cp-5q26, GHSA-w7fw-mjwx-w883

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  vitest@4.1.2: 1 known vulnerability

  GHSA-82fw-gwwq-j7x9

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  No manifest declaring network access and environment variables (agent.json)

Network activity

Tools exposed (12)

• dump_database

  Gets the current state of your OmniFocus database

• add_omnifocus_task

  Create a NEW task. If a matching task already exists (e.g. in the Inbox), do NOT create a duplicate — MOVE it with edit_item + newProjectName. When unsure, check with query_omnifocus first.

• add_project

  Add a new project to OmniFocus

• remove_item

  Remove a task or project from OmniFocus

• edit_item

  Edit an existing task or project. Also how you MOVE a task: set newProjectName (or "" / "inbox"). Prefer moving an existing task over re-creating it — never make duplicates.

• batch_add_items

  Add multiple tasks or projects to OmniFocus in a single operation

• batch_remove_items

  Remove multiple tasks or projects from OmniFocus in a single operation

• query_omnifocus

  Query tasks, projects, or folders with filters (project, folder, tags, status, dates). Much faster and lighter than dump_database for targeted lookups.

• list_perspectives

  List built-in and custom perspectives (custom is a Pro feature)

• get_perspective_view

  Get the items visible in a named OmniFocus perspective

• list_tags

  List all tags with their hierarchy

• create_tag

  Create a new tag in OmniFocus, optionally nested under an existing parent tag