Verified

Mcpgoogletasks MCP Server

Google Tasks API integration to list, create, update, and delete tasks and task lists.

Data last scanned today · Reviewed today

44 1 dangerous tool7 tools★ 0TypeScriptAGPL-3.0

Overview

Mcpgoogletasks MCP Server allows AI assistants to interface directly with Google Tasks. It provides a set of tools to manage task lists and specific items within them, enabling creation, retrieval, updates, and deletion through the Google Tasks API. Setup requires a Google Cloud project with OAuth 2.0 credentials and the Tasks API enabled. Users perform an initial authentication flow using a provided tool to generate a local token file, which subsequently authorizes the server to perform actions on their behalf.

Our verdict

This server is assigned a high risk level with a security score of 24/100. The score reflects that the project is community-maintained rather than official, has not been editorially reviewed, and relies on a single contributor. Users should exercise caution as the authentication method and read-only capabilities have not been subject to a formal security audit. It is suitable for testing environments but not recommended for sensitive production workflows where reliability and maintenance oversight are required.

Small dependency surface with only 7 direct packages
Comprehensive README documentation for setup and usage
Uses standard OAuth 2.0 for account authentication

High security risk due to lack of editorial review
Single-contributor project with no official vendor maintenance
Last code commit occurred over 300 days ago
Authentication and read-only status have not been verified

Setup

Claude Desktop

{
  "mcpServers": {
    "mcpgoogletasks": {
      "args": [
        "-y",
        "mcp-google-tasks"
      ],
      "command": "npx"
    }
  }
}

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows), then restart Claude Desktop. Some servers require API keys or tokens as environment variables — check the project's README and add an "env" object if needed.

No read-only mode — running this grants full read/write access.
No built-in authentication — anyone with access to this config can invoke every tool it exposes.

Tools

Tool	Description	Risk
get_auth_url	Get the OAuth 2.0 authorization URL	low
list_task_lists	List all task lists	low
create_task_list	Create a new task list	medium
list_tasks	List tasks in a task list	low
create_task	Create a new task	medium
update_task	Update an existing task	medium
delete_task	Delete a task	high

Compatibility

Client	Local	Docker	Remote	Read-only
ChatGPT
Claude Desktop
Cursor
VS Code
Windsurf

Frequently asked questions

›What are the prerequisites for setting up this MCP server?

You need Node.js 18 or higher, a Google Cloud Project with the Google Tasks API enabled, and your own OAuth 2.0 Client ID and Client Secret.

›How do I authenticate the server with my Google account?

The server provides a get_auth_url tool that generates an authorization URL. You must visit this URL in your browser, authorize the application, and use the provided code to generate a local token.json file.

›Does the server support both local and remote MCP clients?

Yes, it supports Stdio transport for local clients like Claude Desktop and HTTP/SSE transport for integrations like OpenAI via services such as ngrok.

›Are there any specific security precautions for managing credentials?

You should never commit your .env file or the token.json file to version control, as they contain sensitive OAuth credentials and authentication tokens.

›Can I run tests for the server without needing actual Google account credentials?

Yes, the project includes unit tests using Jest with mocks, allowing you to test functionality without requiring real credentials or API tokens.

›What is the default security behavior when running the server in HTTP mode?

When using the HTTP/SSE transport, the server runs in a read-only mode by default, includes rate limiting, and implements security headers via Helmet.js.