AI & API access
TaskFlow can be driven by external tools: connect an AI assistant over the Model Context Protocol (MCP), or call the API from your own scripts. Both use a personal API token.
Get a token
Create a token on your profile page (see Profile & security):
- Choose permissions: full access (everything you can do — API and MCP) or read-only (MCP read tools only).
- Choose an expiry: 30 days, 90 days, 1 year, or never.
- The token is shown once — copy it then.
A token acts as you, with your permissions. For automation, ask an administrator to create a bot account and issue a token to it, so the integration doesn't break when a person leaves.
Connect an AI assistant (MCP)
The Model Context Protocol lets an AI client work with your tracker as a set of tools — searching, creating and updating issues from your assistant.
Point your client at your instance's /mcp endpoint with your token. For example, with Claude:
claude mcp add --transport http taskflow https://<your-host>/mcp \
--header "Authorization: Bearer tfp_..."Any MCP-capable client works the same way: the URL https://<your-host>/mcp and an Authorization: Bearer tfp_... header.
Available tools
| Tool | Access | What it does |
|---|---|---|
me | read | Who the token belongs to |
list_projects | read | List projects you can see |
search_users | read | Find users |
list_sprints | read | List a project's sprints |
list_boards | read | List a project's boards |
search_issues | read | Search issues |
get_issue | read | Fetch one issue with comments and available transitions |
create_issue | write | Create an issue |
update_issue | write | Update an issue |
transition_issue | write | Move an issue to another status |
add_comment | write | Comment on an issue |
Only the read tools are available with a read-only token — or on an instance where an administrator has switched the write tools off. Administrators can also disable the endpoint entirely, and every call is recorded in a journal they can review. See Features & settings → AI & API control.
What the assistant can actually do
A token never grants more than its owner has. An assistant connected with your token sees your projects and no others — so if it reports that a project doesn't exist, check your own access first.
Use the API from scripts
A full access token works directly against the GraphQL API at https://<your-host>/graphql. Send it as a bearer token:
curl https://<your-host>/graphql \
-H "Authorization: Bearer tfp_..." \
-H "Content-Type: application/json" \
-d '{"query":"{ me { email } }"}'From there you can query and mutate the same data you can reach in the app — projects, issues, comments, transitions and more. A read-only token is limited to MCP and cannot use this endpoint.
The API enforces query-complexity limits (depth, node and alias caps) to protect the server; the defaults suit normal use, and an administrator can adjust them.
Outgoing webhooks
To push events out of TaskFlow, an administrator configures outgoing webhooks: a URL, the event types you care about, and a shared secret, with a delivery log and a test button. Automation rules can also call a webhook as an action.
Link issues to your git hosting
With the dev links feature enabled, TaskFlow shows branches, commits and pull requests on the issue they belong to. It reads the issue key (for example TF-123) from branch names, commit messages and pull-request titles, so the convention is all your team has to follow.
Setting it up is an administrator task: enable the feature, make the receiving endpoint reachable from your git hosting, and configure the webhook on the GitHub, GitLab or Bitbucket side. Until the endpoint is published, events never arrive and the panel stays empty.
Security notes
- Treat tokens like passwords — store them in a secret manager.
- Use the narrowest permissions that work, and prefer a real expiry over "never".
- Revoke tokens you no longer use; revocation is immediate.
- Use a bot account for shared automation, not a personal one.
Where to go next
- Profile & security — issue and manage tokens.
- Features & settings — administrators control the MCP endpoint and features.
- Automation — react to events inside TaskFlow.