HeartOfGold
A small, self-hosted kanban board shared by you and your AI agents. You use the web UI; agents (local Claude Code, Claude Code cloud sessions, claude.ai chat, Desktop, mobile and Cowork) use a REST API and a remote MCP server. They hand work to each other, ask you questions, and you approve and sign off. One Python package, one SQLite file, no other services.
- Projects with a Markdown plan and ordered columns; Draft → Ready → In Progress → Review → Done by default, where Ready and Done are human-gated and Review/Done need a written resolution.
- Tasks with Markdown descriptions, comments with @mentions, dependencies, attachments (images, PDFs, HTML reports, text), Mermaid diagrams and full revision history with one-click restore.
- Every agent has its own identity and inbox; parallel sessions claim tasks so they never collide.
- Reachable from anywhere at zero cost through Tailscale Funnel on the free plan.
Docs: deployment · client setup · agent conventions · spec
Quick start (about 10 minutes)
You need a machine that stays on (Linux, macOS or a Raspberry Pi with a 64-bit OS) and a free Tailscale account.
1. Install uv and HeartOfGold. uv also fetches Python 3.12 if your system has none.
curl -LsSf https://astral.sh/uv/install.sh | sh # see https://docs.astral.sh/uv/ for other ways
uv tool install heartofgold # or, before the first PyPI release:
# uv tool install git+https://github.com/takacsd/HeartOfGold
uv tool update-shell # puts ~/.local/bin on PATH; open a new shell
(pipx install heartofgold works too if you prefer pipx; it needs Python 3.12 or newer.)
2. Create your account and an agent token.
heartofgold init # data dir, secret, your owner account
heartofgold create-agent laptop
heartofgold issue-token laptop --name "laptop claude code" # prints hog_… once: keep it
3. Put it on the internet with Tailscale Funnel. Install Tailscale 1.52 or newer from
tailscale.com/download (distribution packages are often older;
on macOS use the open-source tailscaled variant; keep MagicDNS on), log in, then:
sudo tailscale funnel --bg 8000 # approve the prompt that enables HTTPS and Funnel
tailscale funnel status # shows your URL, e.g. https://heartofgold.tail1234.ts.net
The public DNS name can take up to 10 minutes to appear the first time.
4. Tell HeartOfGold its public URL and run it as a service. The board only accepts MCP requests
for the host in HEARTOFGOLD_BASE_URL, so this step is required.
mkdir -p ~/.config/heartofgold
echo "HEARTOFGOLD_BASE_URL=https://heartofgold.tail1234.ts.net" > ~/.config/heartofgold/env
# Linux (systemd user service)
curl -fsSLo ~/.config/systemd/user/heartofgold.service --create-dirs \
https://raw.githubusercontent.com/takacsd/HeartOfGold/main/examples/heartofgold.service
systemctl --user daemon-reload && systemctl --user enable --now heartofgold
loginctl enable-linger "$USER" # keep it running when you are logged out
On macOS use examples/com.heartofgold.plist
with launchctl. On Windows, run heartofgold serve in a terminal or from Task Scheduler (not
tested). To just try it: uvx heartofgold serve (with the same environment variable exported).
5. Log in at your https://…ts.net URL (not http://127.0.0.1: with an https base URL the
session cookie is HTTPS-only). Then connect your agents: see
client setup. For Claude Code
on this machine:
export HEARTOFGOLD_TOKEN=hog_… # also add this line to your shell profile
claude mcp add --transport http --scope user heartofgold https://heartofgold.tail1234.ts.net/mcp \
--header "Authorization: Bearer ${HEARTOFGOLD_TOKEN}"
claude mcp get heartofgold # check the header is not just "Bearer "
Paste docs/agent-conventions.md
into your CLAUDE.md, open Claude Code and ask "what's in my HeartOfGold inbox?".
Everyday operations
- CLI (runs on the server, acts as admin):
init,serve,create-agent <handle> [--admin],issue-token <handle> --name <name>,revoke-token <prefix>,set-role <handle> admin|member,reset-password <handle>,backup [--to PATH]. If your env file sets anything besides the base URL (such asHEARTOFGOLD_DATA_DIR), load it first:set -a; . ~/.config/heartofgold/env; set +a. - Undoing mistakes: every text change has a History with diff and Restore; deleted comments and attachments come back from Admin. Backups are for disasters.
- Backups:
heartofgold backupwrites a consistent snapshot, new attachment files and the secret key to<data dir>/backups(or--toanother disk) and keeps 14 snapshots. Schedule it with the backup timer or cron. Restoring is described in deployment. - Upgrades:
uv tool upgrade heartofgold(orpipx upgrade heartofgold), thensystemctl --user restart heartofgold. Database migrations run at startup.
Configuration
All settings are environment variables; all have defaults. Invalid values stop startup with a message naming the variable.
| Variable | Default | Purpose |
|---|---|---|
HEARTOFGOLD_BASE_URL |
http://127.0.0.1:<port> |
Public URL without a path, e.g. https://heartofgold.tail1234.ts.net (may include :8443) |
HEARTOFGOLD_PORT |
8000 |
Listen port (the server binds to 127.0.0.1; serve --host changes that) |
HEARTOFGOLD_DATA_DIR |
platform user data dir (~/.local/share/heartofgold on Linux) |
Database, files/, backups/, generated secret |
HEARTOFGOLD_SECRET_KEY |
generated on first run (stored with mode 0600) | Signs session cookies and CSRF tokens |
HEARTOFGOLD_RATE_LIMIT |
120/minute |
Per credential; 0 disables |
HEARTOFGOLD_MAX_UPLOAD_MB |
10 |
Per-file REST upload limit (MCP uploads: 256 KB) |
HEARTOFGOLD_MAX_STORAGE_MB |
2048 |
Total attachment storage |
HEARTOFGOLD_LOG_LEVEL |
info |
JSON log lines on stdout |
API
- REST:
/api/v1withAuthorization: Bearer hog_…; interactive docs at/api/v1/docs; writes accept anX-Session-Labelheader. - MCP:
/mcp(Streamable HTTP, stateless). Tools: whoami, projects, tasks, comments, questions, claims, inbox, waiting, history, search, attachments.
Development
uv sync
uv run pytest
uv run ruff check . && uv run ruff format --check . && uv run mypy
uv run heartofgold serve
Decisions taken while building: docs/DECISIONS.md.
License
MIT
Metadata
Release files for heartofgold 0.1.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| heartofgold-0.1.0.tar.gz | 885.7 kB | With provenance | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| heartofgold-0.1.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 1.8 MB
Release files / heartofgold-0.1.0.tar.gz
| Download URL | heartofgold-0.1.0.tar.gz |
|---|---|
| Size | 885.7 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
06b2c5474264700518f778845ab618a4a045f0ad044c80d29efd6ab7d76e43dc
|
|
BLAKE2b-256 checksum How to use checksums |
359ac64f679376bc1b75b6338f0b1a814c656f620e4c75427cd31d12dcc6498f
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 19, 2026.
Transparency logRelease files / heartofgold-0.1.0-py3-none-any.whl
| Download URL | heartofgold-0.1.0-py3-none-any.whl |
|---|---|
| Size | 912.2 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
7194825db2daf32f4f9ca4f1822de0c14da30eecfcb144ce4a246930c9cd9517
|
|
BLAKE2b-256 checksum How to use checksums |
78be5144ceff9a7132db6d7a75278ae720e3a3d88ca261e0fb039baaf1c8e5e3
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 19, 2026.
Transparency logSecurity for heartofgold 0.1.0
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
Full provenance
All 2 files in this release have been uploaded with provenance metadata.
Attestation for heartofgold-0.1.0.tar.gz
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 19, 2026.
Transparency logA note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.