app.cnvs/whiteboard

Est-ce que app.cnvs/whiteboard est sûr ?

Au dernier audit MCP Hub, le serveur MCP « app.cnvs/whiteboard » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 25 outils

• add_image≈ 336 tokens

  Place a raster or SVG image on the board at (x, y) with explicit width/height in board pixels. `data_url` MUST be a `data:image/(png|jpeg|gif|webp|svg+xml);base64,...` string ≤ ~900 kB; hosted URLs are not accepted. Strongly recommended: also pass a tiny `thumb_data_url` (≤8 kB JPEG/PNG/WebP, ~64 px on the long edge) — it is embedded into the SVG preview so OTHER AI viewers (and you, on later `get_preview` calls) can actually see the image instead of a placeholder box.

  Paramètres, retour & exemple (10)

  Paramètres

  • x · number · requis
  • y · number · requis
  • id · string · optionnel
  • width · number · requis
  • author · string · optionnel
  • height · number · requis
  • board_id · string · requis
  • data_url · string · requis
  • access_key · string · optionnel
    8-character lowercase alphanumeric board access key when the board is locked (legacy 6-character lowercase alphanumeric keys are also accepted). Equivalent to setting the `X-Board-Key` HTTP header on the JSON-RPC POST. Omit for unlocked boards. Obtain via POST /api/boards/<id>/lock.
  • thumb_data_url · string · optionnel

  Exemple d'appel

  {"name": "add_image", "arguments": {"x": 1, "y": 1, "width": 1, "height": 1, "board_id": "texte", "data_url": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• add_link≈ 244 tokens

  Drop a URL capsule onto the board — rendered as a clickable pill showing the hostname. Use this instead of `add_text` when the node is just a link; the capsule styling signals clickability to humans. Same coordinate rules as `add_text` (+x right, +y down).

  Paramètres, retour & exemple (6)

  Paramètres

  • x · number · requis
  • y · number · requis
  • url · string · requis
  • author · string · optionnel
  • board_id · string · requis
  • access_key · string · optionnel
    8-character lowercase alphanumeric board access key when the board is locked (legacy 6-character lowercase alphanumeric keys are also accepted). Equivalent to setting the `X-Board-Key` HTTP header on the JSON-RPC POST. Omit for unlocked boards. Obtain via POST /api/boards/<id>/lock.

  Exemple d'appel

  {"name": "add_link", "arguments": {"x": 1, "y": 1, "url": "texte", "board_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• add_text≈ 594 tokens

  Create a NEW text node, or update an existing one (pass the same `id` to overwrite content/position in place — preferred over creating a duplicate). Supports cnvs markup (Markdown-ish) and Mermaid diagrams in the content. When using Mermaid, the ENTIRE content of this text node must be a single Mermaid diagram (one ```mermaid fenced block and nothing else — no heading, no prose before or after). If you need prose + a diagram, create two separate text nodes. `postit: true` renders as a yellow sticky; `diagram: true` renders as a framed box (2px border in the text colour, centred text) — the two are mutually exclusive. Coordinates are in board-world pixels, +x right, +y DOWN; pick a spot that does not overlap existing items (check `get_preview` first). Default width auto-fits content up to ~320 px; pass `width` for explicit wrapping (160–4096). Keep content under 100 000 chars.

  Paramètres, retour & exemple (11)

  Paramètres

  • x · number · requis
  • y · number · requis
  • id · string · optionnel
    Optional stable id; generated when omitted.
  • color · string · optionnel
    Named ink only (no hex). Accepted (case-insensitive): 'auto'/''/'black'/omitted for theme-aware ink, or 'red', 'blue', 'green', 'orange', 'yellow', 'pink', 'purple', 'maroon', 'brown', 'gray', 'lightgray', 'teal', 'sage', 'sky', 'lavender'. Anything else (including a literal hex) silently clamps to auto.
  • width · number · optionnel
    Explicit width in px (160–4096).
  • author · string · optionnel
    Author tag, defaults to ai:claude.
  • postit · boolean · optionnel
  • content · string · requis
  • diagram · boolean · optionnel
    Render as a framed diagram box (2px border in the text colour, centred text). Mutually exclusive with postit.
  • board_id · string · requis
  • access_key · string · optionnel
    8-character lowercase alphanumeric board access key when the board is locked (legacy 6-character lowercase alphanumeric keys are also accepted). Equivalent to setting the `X-Board-Key` HTTP header on the JSON-RPC POST. Omit for unlocked boards. Obtain via POST /api/boards/<id>/lock.

  Exemple d'appel

  {"name": "add_text", "arguments": {"x": 1, "y": 1, "content": "texte", "board_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• create_board≈ 1181 tokens

  Create a fresh board in ONE call — optionally pre-filled with content, auto-laid-out, and/or PIN-locked at create time. Mirrors the extended `POST /api/boards` REST body exactly (same server-side implementation). With no arguments it returns a blank draw board; `mode: 'todo'` (+ optional `template`) seeds a kanban board. `content` imports initial items atomically: everything is validated FIRST and the board is created only if every item passes — on any invalid item you get a structured error naming its kind + index and NOTHING is created. `autolayout: true` (draw mode) fills in x/y for texts/images that omit them (deterministic masonry grid; explicit coordinates are never touched). `lock: 'write'|'all'` locks the board atomically with creation and returns the plaintext `access_key` ONCE — there is no recovery. The response's `imported` counts confirm what was created, `ids` returns the server-minted item ids per kind in the order you supplied them (index i of `ids.texts` is the id created for `content.texts[i]`; `ids.columns` is empty when the columns came from the template seed, and lanes have no id — they are keyed by board + lane index), and `embed_url` (the `?embed=1#<id>` iframe view) is returned for any board readable without a key — it is omitted for `lock:'all'` boards, whose embed frame can't read the board anonymously. Prefer this over open_board + N per-item calls when you are building a whole board from scratch.

  Paramètres, retour & exemple (6)

  Paramètres

  • lock · string · optionnel · write | all
    PIN-lock the board atomically at create time; the plaintext key is returned ONCE as `access_key`.
  • mode · string · optionnel · draw | todo
    Board mode. Defaults to 'draw'.
  • author · string · optionnel
    Author tag stamped on every created item (e.g. 'ai:plai'). Defaults to 'ai:import'.
  • content · object · optionnel
    Initial board content, applied atomically at create time. Draw mode: `texts` [{x?, y?, content, color?, width?, postit?, diagram?, kind?, author?, sourceId?}], `lines` [{points, color?, anchors?, author?}] (alias `strokes`), `images` [{x?, y?, dataUrl, width, height, author?, sourceId?}]. Todo mode: `columns` [{title, lane?, color?, author?}] (array order = sort order), `tasks` [{columnIndex, name, description?, due_date?, priority?, assignee?, done?, color?, author?}] (columnIndex indexes into content.columns, or into the template-seeded columns when content.columns is empty), `lanes` [{lane, title, author?}], `colWidth`. Every item's optional `author` is its CREATOR tag (same 1-80 char [A-Za-z0-9:_-.] rule as elsewhere) and is never rewritten later — omit it to inherit the top-level `author`, or set it per item to preserve the original authorship when restoring somebody else's board. Item ids are ALWAYS minted server-side and returned in `ids`; you cannot choose them. To keep anchored strokes, give a text/image an optional `sourceId` (unique string, <=128 chars, write-only — never stored, never the row id) and reference it from `lines[].anchors.start.id` / `.end.id`: matching ids are rewritten to the minted id, unmatched ids are left as-is and render as a free stroke end. Kanban structures with a non-todo mode (or draw items with mode 'todo') are rejected with `content_mode_mismatch`. The combined input arrays may contain at most 2550 entries. At most 10 lane-title entries are accepted, every title must reference a lane used by a created column, and each lane index may be named AT MOST ONCE — a second entry for the same lane is rejected (naming that second entry's index) instead of collapsing last-write-wins, which would overwrite the first entry's author. `tasks[].done` must be a real boolean (or omitted/null for not-done): a truthy stand-in such as the string "false" is rejected rather than coerced, so a card is never imported as completed by accident. Standard per-board quotas also apply, and the 5 MB request-body cap is the real ceiling for image-heavy imports. A valid X-Import-Token selects higher REST/MCP and board-create rate tiers, but never changes these content limits.
  • template · string · optionnel · kanban | sprint | bugs
    Starter column set when mode is 'todo' and content.columns is empty/absent. Defaults to 'kanban'.
  • autolayout · boolean · optionnel
    Draw mode only: fill x/y for texts/images that omit them (deterministic masonry). Without it, items missing coordinates are rejected. No-op in todo mode.

  Exemple d'appel

  {"name": "create_board", "arguments": {"lock": "write", "mode": "draw", "author": "texte", "content": {}, "template": "kanban", "autolayout": true}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• create_column≈ 354 tokens

  Add a kanban column (swimlane) to a 'todo' board. Generates and returns a stable column id. `sort` is a float ordering key (ascending); omit to default to 0. `lane` is an integer row index for multi-row layouts (defaults to 0). `color` is an optional title color ('red' / 'blue' / 'green', or 'auto' / omit for default). To rename, reorder, recolor or move between lanes later use `update_column`.

  Paramètres, retour & exemple (7)

  Paramètres

  • lane · integer · optionnel
    Row index for multi-row layouts. Defaults to 0.
  • sort · number · optionnel
    Float ordering key (ascending). Defaults to 0.
  • color · string · optionnel
    Title color: 'red', 'blue', 'green', or 'auto' (default).
  • title · string · requis
  • author · string · optionnel
    Author tag, defaults to ai:claude.
  • board_id · string · requis
  • access_key · string · optionnel
    8-character lowercase alphanumeric board access key when the board is locked (legacy 6-character lowercase alphanumeric keys are also accepted). Equivalent to setting the `X-Board-Key` HTTP header on the JSON-RPC POST. Omit for unlocked boards. Obtain via POST /api/boards/<id>/lock.

  Exemple d'appel

  {"name": "create_column", "arguments": {"title": "texte", "board_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• create_task≈ 413 tokens

  Create a task (card) in a column on a 'todo' board. Generates and returns a stable task id. `column_id` must reference an existing column (see `list_tasks`). `description` is free-form prose stored on the card; `priority` is one of 'H' | 'M' | 'L' (omit for none); `due_date` is an ISO 8601 date string; `assignee` is free text (name / initials / email). `sort` is a float ordering key within the column (ascending), defaulting to 0.

  Paramètres, retour & exemple (11)

  Paramètres

  • done · boolean · optionnel
    Whether the task is completed (checked off). Defaults to false.
  • name · string · requis
  • sort · number · optionnel
    Float ordering key within the column. Defaults to 0.
  • author · string · optionnel
    Author tag, defaults to ai:claude.
  • assignee · string · optionnel
  • board_id · string · requis
  • due_date · string · optionnel
    ISO 8601 date.
  • priority · string · optionnel · H | M | L
    High / Medium / Low. Omit for none.
  • column_id · string · requis
  • access_key · string · optionnel
    8-character lowercase alphanumeric board access key when the board is locked (legacy 6-character lowercase alphanumeric keys are also accepted). Equivalent to setting the `X-Board-Key` HTTP header on the JSON-RPC POST. Omit for unlocked boards. Obtain via POST /api/boards/<id>/lock.
  • description · string · optionnel

  Exemple d'appel

  {"name": "create_task", "arguments": {"name": "texte", "board_id": "texte", "column_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• create_tasks≈ 404 tokens

  Bulk-create multiple task cards in one call — far cheaper than calling `create_task` N times. Pass `tasks`: an array of task objects, each with `column_id` (required) + the same fields `create_task` accepts (`name`, `description`, `due_date`, `priority`, `assignee`, `done`, `sort`). Returns the array of created ids in order. Stops at the first invalid item and reports its index; items before it are still created (not transactional).

  Paramètres, retour & exemple (4)

  Paramètres

  • tasks · array · requis
    Array of task objects to create.
  • author · string · optionnel
    Author tag applied to every task, defaults to ai:claude.
  • board_id · string · requis
  • access_key · string · optionnel
    8-character lowercase alphanumeric board access key when the board is locked (legacy 6-character lowercase alphanumeric keys are also accepted). Equivalent to setting the `X-Board-Key` HTTP header on the JSON-RPC POST. Omit for unlocked boards. Obtain via POST /api/boards/<id>/lock.

  Exemple d'appel

  {"name": "create_tasks", "arguments": {"tasks": [], "board_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• delete_column≈ 184 tokens

  Delete a kanban column by id. Tasks in the column are removed with it. Get the id from `list_tasks`.

  Paramètres, retour & exemple (3)

  Paramètres

  • id · string · requis
  • board_id · string · requis
  • access_key · string · optionnel
    8-character lowercase alphanumeric board access key when the board is locked (legacy 6-character lowercase alphanumeric keys are also accepted). Equivalent to setting the `X-Board-Key` HTTP header on the JSON-RPC POST. Omit for unlocked boards. Obtain via POST /api/boards/<id>/lock.

  Exemple d'appel

  {"name": "delete_column", "arguments": {"id": "texte", "board_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• delete_task≈ 172 tokens

  Delete a task (card) by id. Get the id from `list_tasks`.

  Paramètres, retour & exemple (3)

  Paramètres

  • id · string · requis
  • board_id · string · requis
  • access_key · string · optionnel
    8-character lowercase alphanumeric board access key when the board is locked (legacy 6-character lowercase alphanumeric keys are also accepted). Equivalent to setting the `X-Board-Key` HTTP header on the JSON-RPC POST. Omit for unlocked boards. Obtain via POST /api/boards/<id>/lock.

  Exemple d'appel

  {"name": "delete_task", "arguments": {"id": "texte", "board_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• draw_stroke≈ 433 tokens

  Draw a freehand stroke on the board. Use for arrows, underlines, connector lines, annotations, or simple shapes — a straight line needs two points, a rough circle wants ~20. Stroke width is fixed at 3 px; `color` is a NAME, not hex (case-insensitive): 'auto'/''/'black'/omitted for theme-aware ink, or 'red', 'blue', 'green', 'orange', 'yellow', 'pink', 'purple', 'maroon', 'brown', 'gray', 'lightgray', 'teal', 'sage', 'sky', 'lavender' — anything else (including a literal hex like '#ff0000') silently clamps to auto. Accepts three equivalent point formats — pick whichever your MCP client serialises cleanly: nested `[[x,y],[x,y],...]`, flat `[x1,y1,x2,y2,...]`, or a JSON string of either. Some clients (Claude Code as of 2026-04) drop nested arrays during tool-call serialisation, so prefer the flat form or the JSON-string form when in doubt. To delete a stroke later, use `erase` with `kind: 'line'` and the id returned here.

  Paramètres, retour & exemple (6)

  Paramètres

  • id · string · optionnel
  • color · string · optionnel
  • author · string · optionnel
  • points · ? · requis
    Points as [[x,y],...], flat [x1,y1,x2,y2,...], or a JSON string of either.
  • board_id · string · requis
  • access_key · string · optionnel
    8-character lowercase alphanumeric board access key when the board is locked (legacy 6-character lowercase alphanumeric keys are also accepted). Equivalent to setting the `X-Board-Key` HTTP header on the JSON-RPC POST. Omit for unlocked boards. Obtain via POST /api/boards/<id>/lock.

  Exemple d'appel

  {"name": "draw_stroke", "arguments": {"points": "texte", "board_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• erase≈ 260 tokens

  Delete a single item by id. `kind` MUST match the item type: 'text' for text nodes, 'line' for freehand strokes, 'image' for images — the wrong kind silently targets the wrong table and is a common mistake. Get the id + type from `get_board` (texts[], lines[], images[]). There is no bulk/erase-all tool: loop if you need to delete multiple items.

  Paramètres, retour & exemple (4)

  Paramètres

  • id · string · requis
  • kind · string · requis · text | line | image
  • board_id · string · requis
  • access_key · string · optionnel
    8-character lowercase alphanumeric board access key when the board is locked (legacy 6-character lowercase alphanumeric keys are also accepted). Equivalent to setting the `X-Board-Key` HTTP header on the JSON-RPC POST. Omit for unlocked boards. Obtain via POST /api/boards/<id>/lock.

  Exemple d'appel

  {"name": "erase", "arguments": {"id": "texte", "kind": "text", "board_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• export_tasks≈ 258 tokens

  Export a 'todo' board's columns + tasks as a single text document. `format` is 'markdown' (a checklist grouped by column, the default) or 'csv' (one row per task with column/name/priority/assignee/due_date/done). Returns the rendered text. Same data as the GET /api/boards/<id>/tasks.md and tasks.csv REST endpoints.

  Paramètres, retour & exemple (3)

  Paramètres

  • format · string · optionnel · markdown | csv
    Output format. Defaults to 'markdown'.
  • board_id · string · requis
  • access_key · string · optionnel
    8-character lowercase alphanumeric board access key when the board is locked (legacy 6-character lowercase alphanumeric keys are also accepted). Equivalent to setting the `X-Board-Key` HTTP header on the JSON-RPC POST. Omit for unlocked boards. Obtain via POST /api/boards/<id>/lock.

  Exemple d'appel

  {"name": "export_tasks", "arguments": {"board_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_board≈ 276 tokens

  Full structured JSON state of a board: texts (id, x, y, content, color, width, postit, author), strokes (id, points, color, author), images (id, x, y, width, height, dataUrl, thumbDataUrl, author; heavy base64 >8 kB elided to dataUrl:null, tiny images inlined). Use this for EXACT ids/coordinates/content (needed for `move`, `erase`, editing a text by id). For visual layout (where is empty space? what overlaps?) call `get_preview` instead — it's much cheaper for spatial reasoning than a huge JSON dump.

  Paramètres, retour & exemple (2)

  Paramètres

  • board_id · string · requis
  • access_key · string · optionnel
    8-character lowercase alphanumeric board access key when the board is locked (legacy 6-character lowercase alphanumeric keys are also accepted). Equivalent to setting the `X-Board-Key` HTTP header on the JSON-RPC POST. Omit for unlocked boards. Obtain via POST /api/boards/<id>/lock.

  Exemple d'appel

  {"name": "get_board", "arguments": {"board_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_preview≈ 267 tokens

  Compact schematic SVG render of the board (typically a few kB even for dense boards). Returns both an image/svg+xml content block (you can SEE it) and the raw SVG text. CALL THIS any time you need to understand where things are — before placing new items, before deciding whether the canvas is crowded, before picking a free region. AI-authored items get a purple border so you can tell which contributions were yours. For precise text content prefer `get_board`.

  Paramètres, retour & exemple (2)

  Paramètres

  • board_id · string · requis
  • access_key · string · optionnel
    8-character lowercase alphanumeric board access key when the board is locked (legacy 6-character lowercase alphanumeric keys are also accepted). Equivalent to setting the `X-Board-Key` HTTP header on the JSON-RPC POST. Omit for unlocked boards. Obtain via POST /api/boards/<id>/lock.

  Exemple d'appel

  {"name": "get_preview", "arguments": {"board_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• list_tasks≈ 237 tokens

  Read the full kanban state of a 'todo' board: `{ mode, columns, tasks }`, both ordered by their `sort` key (ascending). Each task carries its hot fields (name, due_date, priority, assignee, done, column_id, sort) plus an opaque `content` JSON string (holds the description). Use this to get exact column/task ids before updating, moving or deleting.

  Paramètres, retour & exemple (2)

  Paramètres

  • board_id · string · requis
  • access_key · string · optionnel
    8-character lowercase alphanumeric board access key when the board is locked (legacy 6-character lowercase alphanumeric keys are also accepted). Equivalent to setting the `X-Board-Key` HTTP header on the JSON-RPC POST. Omit for unlocked boards. Obtain via POST /api/boards/<id>/lock.

  Exemple d'appel

  {"name": "list_tasks", "arguments": {"board_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• move≈ 334 tokens

  Reposition an existing item to a new (x, y) without retyping its content. Works for every item kind: `text` and `link` set the top-left to (x, y); `line` translates every point so the stroke's bounding box top-left lands at (x, y); `image` sets the top-left like text. `kind` defaults to `text` for backward compat with older callers. Find the id + kind via `get_board`. Prefer `move` over re-creating an item when only the location changes — it preserves the id, content, author and avoids a round-trip of base64 bytes for images.

  Paramètres, retour & exemple (6)

  Paramètres

  • x · number · requis
  • y · number · requis
  • id · string · requis
  • kind · string · optionnel · text | link | line | image
    Item kind. Defaults to `text`.
  • board_id · string · requis
  • access_key · string · optionnel
    8-character lowercase alphanumeric board access key when the board is locked (legacy 6-character lowercase alphanumeric keys are also accepted). Equivalent to setting the `X-Board-Key` HTTP header on the JSON-RPC POST. Omit for unlocked boards. Obtain via POST /api/boards/<id>/lock.

  Exemple d'appel

  {"name": "move", "arguments": {"x": 1, "y": 1, "id": "texte", "board_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• move_task≈ 224 tokens

  Move a task to a column at a given sort position — the kanban drag-and-drop primitive. `column_id` is the destination column and `sort` its float order key (ascending) within that column.

  Paramètres, retour & exemple (5)

  Paramètres

  • id · string · requis
  • sort · number · requis
  • board_id · string · requis
  • column_id · string · requis
  • access_key · string · optionnel
    8-character lowercase alphanumeric board access key when the board is locked (legacy 6-character lowercase alphanumeric keys are also accepted). Equivalent to setting the `X-Board-Key` HTTP header on the JSON-RPC POST. Omit for unlocked boards. Obtain via POST /api/boards/<id>/lock.

  Exemple d'appel

  {"name": "move_task", "arguments": {"id": "texte", "sort": 1, "board_id": "texte", "column_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• open_board≈ 272 tokens

  ALWAYS call this first when given a board URL or ID. Resolves the canonical board id and auto-creates the board row if it does not exist yet. Returns a summary (item counts, authors). After this, call BOTH `get_preview` and `get_board` before editing so you can see the layout visually AND know the exact ids/coordinates — do not skip `get_preview`, otherwise you will place new items blindly on top of existing ones.

  Paramètres, retour & exemple (2)

  Paramètres

  • url_or_id · string · requis
    Full board URL (https://cnvs.app/#<id>) or bare UUID.
  • access_key · string · optionnel
    8-character lowercase alphanumeric board access key when the board is locked (legacy 6-character lowercase alphanumeric keys are also accepted). Equivalent to setting the `X-Board-Key` HTTP header on the JSON-RPC POST. Omit for unlocked boards. Obtain via POST /api/boards/<id>/lock.

  Exemple d'appel

  {"name": "open_board", "arguments": {"url_or_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• query_tasks≈ 372 tokens

  Read tasks from a 'todo' board with server-side filtering — handy for 'what's overdue?' / 'what's assigned to X?' without pulling the whole board. All filters are optional and AND together: `assignee` (exact match), `priority` ('H'|'M'|'L'), `done` (boolean), `overdue` (true → due_date strictly before today, not done), `due_before` / `due_after` (ISO date window on due_date). Returns `{ boardId, mode, tasks }` — tasks ordered by sort, each with the same fields as `list_tasks`.

  Paramètres, retour & exemple (8)

  Paramètres

  • done · boolean · optionnel
  • overdue · boolean · optionnel
    Only tasks past due and not done.
  • assignee · string · optionnel
    Exact-match assignee filter.
  • board_id · string · requis
  • priority · string · optionnel · H | M | L
  • due_after · string · optionnel
    ISO date; due_date > this.
  • access_key · string · optionnel
    8-character lowercase alphanumeric board access key when the board is locked (legacy 6-character lowercase alphanumeric keys are also accepted). Equivalent to setting the `X-Board-Key` HTTP header on the JSON-RPC POST. Omit for unlocked boards. Obtain via POST /api/boards/<id>/lock.
  • due_before · string · optionnel
    ISO date; due_date < this.

  Exemple d'appel

  {"name": "query_tasks", "arguments": {"board_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• set_board_mode≈ 401 tokens

  Choose whether this board is a freeform whiteboard ('draw', the default) or a kanban task board ('todo'). Mode is switchable WHENEVER the board is empty of real content: drawings (text/strokes/images) and tasks. Empty or seeded columns DON'T count (switching to 'draw' clears them), so a cleared board can be switched again, and you can flip draw<->todo freely until the first stroke/text/image or task lands. Setting 'todo' auto-seeds three starter columns (To do / In progress / Done). Returns `{ mode, columns }`. Use the task/column tools (`create_task`, `create_column`, …) once the board is in 'todo' mode.

  Paramètres, retour & exemple (4)

  Paramètres

  • mode · string · requis · draw | todo
    Board mode.
  • board_id · string · requis
  • template · string · optionnel
    Optional starter column template when mode is 'todo': 'kanban' (To do / In progress / Done, the default), 'sprint' (Backlog / Sprint / Review / Done), or 'bugs' (Triage / Confirmed / In progress / Fixed). Unknown/omitted falls back to 'kanban'.
  • access_key · string · optionnel
    8-character lowercase alphanumeric board access key when the board is locked (legacy 6-character lowercase alphanumeric keys are also accepted). Equivalent to setting the `X-Board-Key` HTTP header on the JSON-RPC POST. Omit for unlocked boards. Obtain via POST /api/boards/<id>/lock.

  Exemple d'appel

  {"name": "set_board_mode", "arguments": {"mode": "draw", "board_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• set_column_width≈ 220 tokens

  Set the shared kanban column width in pixels for a 'todo' board (all columns share one width). Clamped to [200, 480]. Read the current value as `colWidth` from `list_tasks`.

  Paramètres, retour & exemple (3)

  Paramètres

  • width · number · requis
    Column width in px, clamped to [200, 480].
  • board_id · string · requis
  • access_key · string · optionnel
    8-character lowercase alphanumeric board access key when the board is locked (legacy 6-character lowercase alphanumeric keys are also accepted). Equivalent to setting the `X-Board-Key` HTTP header on the JSON-RPC POST. Omit for unlocked boards. Obtain via POST /api/boards/<id>/lock.

  Exemple d'appel

  {"name": "set_column_width", "arguments": {"width": 1, "board_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• set_lane≈ 285 tokens

  Set (or clear) the title of a kanban row (lane). Lanes group columns into horizontal swimlanes; a lane is identified by its integer `lane` index (the same index columns carry). Pass a `title` to name the row, or an empty string to clear it. Read current lane titles + the shared column width via `list_tasks`.

  Paramètres, retour & exemple (5)

  Paramètres

  • lane · integer · requis
    Row index (>= 0).
  • title · string · optionnel
    Row title; empty string clears it.
  • author · string · optionnel
    Author tag, defaults to ai:claude.
  • board_id · string · requis
  • access_key · string · optionnel
    8-character lowercase alphanumeric board access key when the board is locked (legacy 6-character lowercase alphanumeric keys are also accepted). Equivalent to setting the `X-Board-Key` HTTP header on the JSON-RPC POST. Omit for unlocked boards. Obtain via POST /api/boards/<id>/lock.

  Exemple d'appel

  {"name": "set_lane", "arguments": {"lane": 1, "board_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• update_column≈ 294 tokens

  Rename, reorder, recolor or move an existing kanban column. Requires the column `id` (from `list_tasks`). Pass `title`, `sort`, `lane` and/or `color` to change them.

  Paramètres, retour & exemple (8)

  Paramètres

  • id · string · requis
  • lane · integer · optionnel
    Row index for multi-row layouts.
  • sort · number · optionnel
    Float ordering key (ascending).
  • color · string · optionnel
    Title color: 'red', 'blue', 'green', or 'auto' (default).
  • title · string · optionnel
  • author · string · optionnel
    Author tag, defaults to ai:claude.
  • board_id · string · requis
  • access_key · string · optionnel
    8-character lowercase alphanumeric board access key when the board is locked (legacy 6-character lowercase alphanumeric keys are also accepted). Equivalent to setting the `X-Board-Key` HTTP header on the JSON-RPC POST. Omit for unlocked boards. Obtain via POST /api/boards/<id>/lock.

  Exemple d'appel

  {"name": "update_column", "arguments": {"id": "texte", "board_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• update_task≈ 352 tokens

  Update an existing task by `id` (from `list_tasks`). Pass only the fields you want to change: `name`, `description`, `due_date`, `priority` ('H'|'M'|'L'), `assignee`, `done` (true once completed), `column_id` (to reassign), `sort`. To move a card between columns while setting its order, `move_task` is the dedicated tool.

  Paramètres, retour & exemple (12)

  Paramètres

  • id · string · requis
  • done · boolean · optionnel
    Whether the task is completed (checked off).
  • name · string · optionnel
  • sort · number · optionnel
  • author · string · optionnel
    Author tag, defaults to ai:claude.
  • assignee · string · optionnel
  • board_id · string · requis
  • due_date · string · optionnel
    ISO 8601 date.
  • priority · string · optionnel · H | M | L
  • column_id · string · optionnel
  • access_key · string · optionnel
    8-character lowercase alphanumeric board access key when the board is locked (legacy 6-character lowercase alphanumeric keys are also accepted). Equivalent to setting the `X-Board-Key` HTTP header on the JSON-RPC POST. Omit for unlocked boards. Obtain via POST /api/boards/<id>/lock.
  • description · string · optionnel

  Exemple d'appel

  {"name": "update_task", "arguments": {"id": "texte", "board_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• wait_for_update≈ 521 tokens

  Long-poll: blocks until the next edit lands on this board, then returns. WHEN TO CALL THIS: if your MCP client does NOT surface `notifications/resources/updated` events from `resources/subscribe` back to the model (most chat clients do not — they receive the SSE event but don't inject it into your context), this tool is how you 'wait for the human' inside a single turn. Typical flow: you draw / write what you were asked to, then instead of ending your turn you call `wait_for_update(board_id)`. When the human adds, moves, or erases something, the call returns and you refresh with `get_preview` / `get_board` and continue the collaboration. Great for turn-based interactions (games like tic-tac-toe, brainstorming where you respond to each sticky the user drops, sketch-and-feedback loops, etc.). If your client DOES deliver resource notifications natively, prefer `resources/subscribe` — it's cheaper and has no timeout ceiling. BEHAVIOUR: resolves ~3 s after the edit burst settles (same debounce as the push notifications — this is intentional so drags and long strokes collapse into one wake-up). Returns `{ updated: true, timedOut: false }` on a real edit, or `{ updated: false, timedOut: true }` if nothing happened within `timeout_ms`. On timeout, just call it again to keep waiting; chaining calls is cheap. `timeout_ms` is clamped to [1000, 55000]; default 25000 (leaves headroom under typical 60 s proxy timeouts).

  Paramètres, retour & exemple (3)

  Paramètres

  • board_id · string · requis
  • access_key · string · optionnel
    8-character lowercase alphanumeric board access key when the board is locked (legacy 6-character lowercase alphanumeric keys are also accepted). Equivalent to setting the `X-Board-Key` HTTP header on the JSON-RPC POST. Omit for unlocked boards. Obtain via POST /api/boards/<id>/lock.
  • timeout_ms · number · optionnel

  Exemple d'appel

  {"name": "wait_for_update", "arguments": {"board_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://cnvs.app/mcp