Connection
Connect over Streamable HTTP.
Use an agent access token created inside TaskPort. Never use your TaskPort password. Select Streamable HTTP (or HTTP) in your MCP client—not stdio or legacy SSE.
- MCP URL
https://abafbnwpzdqxyhtrkdsg.supabase.co/functions/v1/taskport-mcp- Transport
MCP Streamable HTTP- Authorization
Bearer <YOUR_TASKPORT_TOKEN>- Accept
application/json, text/event-stream
Common client configuration
{
"mcpServers": {
"taskport": {
"url": "https://abafbnwpzdqxyhtrkdsg.supabase.co/functions/v1/taskport-mcp",
"headers": {
"Authorization": "Bearer tp_live_REPLACE_WITH_TOKEN",
"Accept": "application/json, text/event-stream"
}
}
}
}Prefer your client’s secret or environment-variable reference instead of pasting the raw token into a configuration file.
Authentication
Get a token from TaskPort.
- 1
Open TaskPort → Settings → Manage Agent Access.
- 2
Choose New Agent, name it, and select a permission level.
- 3
Copy the one-time token beginning with
tp_live_. - 4
Add it to your MCP client and call
list_liststo verify.
TaskPort stores only a secure hash. If you lose the token, revoke it and create a new one.
Your first connection
Start with a read-only check before letting an agent change tasks
- 1
Create a token
In Settings → Manage Agent Access → New Agent, choose Read Only. Store the token in your client’s secret settings, never in a chat prompt - 2
Configure the client
Use remote MCP with Streamable HTTP and the endpoint and headers above. The client must support bearer authorization - 3
Verify the account
Ask: “Call list_lists in TaskPort and show the list names. Do not create, update or delete anything.” Confirm these are the lists you intended to connect - 4
Read a task list
Ask: “Call list_tasks for the list ID I choose and summarize its open tasks. Make no changes.” An empty list is valid; an authentication error is not
Create a separate Read & Write token only when you intend to allow changes. Revoking it stops future requests but does not undo previous changes
Access control
Know what the token allows
Write tools are not advertised to a read-only token. Each token belongs to exactly one user, and every operation verifies ownership.
A token can read the lists owned by its TaskPort account. Read & Write also permits changes across that account. Tokens do not currently restrict access to one list or require approval before each write
An “Agent Inbox” is a workflow convention, not a security boundary. Use Read Only when you want suggestions without allowing changes
Tool reference
Available MCP tools.
list_listsreadReturns every list owned by the connected TaskPort user. No arguments.
list_tasksreadReturns top-level tasks. Optionally filter by list_id, due_on (YYYY-MM-DD), or completed.
get_taskreadReturns one task with its ordered subtasks, notes, and ready attachment metadata. Requires task_id.
list_attachmentsreadReturns ready attachment metadata for one task. Requires task_id. Private Storage paths are never returned.
get_attachment_download_urlreadCreates a private 60-second link for one ready attachment. Requires attachment_id; download is optional.
create_listwriteCreates a list. Requires title; emoji is optional.
update_listwriteRenames a list or changes its emoji. Requires list_id and at least one change.
delete_listwritePermanently deletes a list, its tasks, and all associated attachments. Use only after a clear user request.
create_taskwriteCreates a top-level task or direct subtask. Requires list_id and title. Supports parent_task_id, due_on, and priority.
update_taskwriteChanges a task title, completion status, due date, or priority. Requires task_id and at least one change.
delete_taskwritePermanently deletes a task, its child lines, and all associated attachments.
add_notewriteAdds a paragraph to a top-level task. Requires task_id and text.
prepare_attachment_uploadwriteReserves quota and starts an upload. Requires task_id, file_name, mime_type, and byte_size.
upload_attachment_chunkwriteUploads one zero-based raw-file chunk as canonical base64. Requires attachment_id, chunk_index, and data_base64.
complete_attachment_uploadwriteAssembles and validates the file after every chunk arrives. Requires attachment_id.
cancel_attachment_uploadwriteCancels an unfinished upload, removes its chunks, and releases reserved quota.
delete_attachmentwritePermanently deletes one attachment and reclaims its quota. Requires attachment_id.
Files
Attachments and MCP.
TaskPort tasks can contain multiple images and files. Users add them from TaskPort on iPhone, iPad, or Mac, or by sharing a supported file to TaskPort from another app.
Read-only agents can list attachments and request short-lived download links. Read & Write agents can also upload, cancel, and permanently delete them. Completing a task keeps its attachments; permanently deleting a task or list removes the associated files.
Upload a file from an agent
- 1
Call
prepare_attachment_uploadwith the targettask_id, exactfile_name,mime_type, and rawbyte_size. Keep the returnedattachment.id,chunk_size, andchunk_count. - 2
Split the raw file into blocks of at most 4,194,304 bytes. Base64-encode each block separately, then call
upload_attachment_chunkfor indexes0throughchunk_count - 1. Do not send a data-URL prefix or split one already-encoded string. - 3
Call
complete_attachment_upload. TaskPort assembles the chunks, verifies their exact size, validates the actual file contents, stores the final object privately, and accounts for quota. - 4
Use
list_attachmentsorget_taskto read its metadata. Callget_attachment_download_urlonly when the agent needs the bytes; the signed link expires after 60 seconds.
prepare_attachment_upload({
"task_id": "TASK_UUID",
"file_name": "brief.pdf",
"mime_type": "application/pdf",
"byte_size": 842119
})
upload_attachment_chunk({
"attachment_id": "ATTACHMENT_UUID",
"chunk_index": 0,
"data_base64": "JVBERi0xLjcK..."
})
complete_attachment_upload({
"attachment_id": "ATTACHMENT_UUID"
})Chunk uploads are retry-safe: sending the same index again replaces that temporary chunk. If the workflow cannot finish, call cancel_attachment_upload to release the reservation immediately; otherwise it expires after two hours.
Executables, scripts, generic archives, SVG, encrypted documents, and Office files containing macros are rejected. TaskPort validates file content in addition to its filename and declared media type.
Dates and time zone
Use the user’s local calendar date.
Due dates are calendar dates in YYYY-MM-DD format, not timestamps. The server does not expose the user’s time zone. Determine “today” from the user’s profile or ask, then pass the matching local date.
Troubleshooting
Expected errors.
| Situation | Result |
|---|---|
| Missing, invalid, or revoked token | HTTP 401 · Invalid TaskPort agent token |
| Request carries a browser Origin | HTTP 403 · Browser origins are not allowed |
| Write with a read-only token | Tool is not advertised |
| Missing list or another user’s list | List not found |
| Missing task or another user’s task | Task not found |
| Delete while an attachment upload is finishing | An attachment operation is still finishing; retry shortly |
| File exceeds 25 MB | Files are limited to 25 MiB |
| Account would exceed 100 MB | Attachment storage limit reached |
| Content does not match its declared type | The file contents do not match the allowed type |
| Upload reservation is older than two hours | Upload reservation expired |
| Account at its list or task limit | Limit message with support contact |
Free accounts support up to 3 lists and 500 tasks. Need more? support@megacubos.com.
Still stuck? Visit TaskPort Support.