altiplano 0.1.0

Minimal MCP server for Vikunja (server-side filtering, no fluff)

altiplano

A small, dependable MCP server for Vikunja. Named after the Andean altiplano, the high plateau that is the Vicuña's native habitat.

Filtering and sorting are passed straight to the Vikunja API (server-side), so there is no client-side filtering engine and no paginate-then-filter pitfall.

Tools

• list_projects
• list_tasks (project_id, filter, sort_by, page, per_page)
• get_task (task_id)
• create_task (project_id, title, description?, priority?, due_date?)
• update_task (task_id, title?, description?, done?, priority?)
• list_labels
• add_label (task_id, label_id)
• remove_label (task_id, label_id)

Credentials (no secrets in mcp.json)

The server resolves two values, in order:

1. Environment variables VIKUNJA_URL and VIKUNJA_API_TOKEN.
2. A per-device file of KEY=VALUE lines, default ~/.config/altiplano/env (override the path with ALTIPLANO_CONFIG).

VIKUNJA_URL is the base API URL including /api/v1 (e.g. https://todo.example.com/api/v1).

Recommended so the shared mcp.json carries no secret:

• Drop a per-device file and lock it down:

  mkdir -p ~/.config/altiplano
  printf 'VIKUNJA_URL=https://todo.example.com/api/v1\nVIKUNJA_API_TOKEN=tk_xxx\n' > ~/.config/altiplano/env
  chmod 600 ~/.config/altiplano/env
  

• Or inject via the launcher's environment (e.g. a systemd unit EnvironmentFile= pointing at a chmod 600 file), which the server inherits.
• For stronger setups, source the token from a secret manager/keychain at launch and export it into the environment.

Then mcp.json only needs the command, no env block with secrets:

{
  "altiplano": {
    "command": "uvx",
    "args": ["altiplano"]
  }
}

Run

uv run altiplano                                  # dev, from this directory
uvx --from /mnt/settings/MCP/altiplano altiplano  # local path
uvx altiplano                                     # from PyPI

Notes

• Vikunja priority scale: 0 Unset, 1 Low, 2 Medium, 3 High, 4 Urgent, 5 DO NOW.
• The UI shows tasks by their project-local identifier (e.g. #49), which is not the global id the API uses.
• Endpoint shapes (create via PUT /projects/{id}/tasks, update via POST /tasks/{id}) follow current Vikunja; adjust if your instance differs.