Todoist MCP (official, remote)
Capped at 70: no passing tool call yet; the tests add up to 75. Why scores are capped
Test points add up to 75; the score is capped at 70 until a tool call passes. Not a quality or security rating. Methodology
Test points before the cap (75/100)
- Install20/20
- Handshake5/30
- Maintenance25/25
- Docs15/15
- License10/10
What we probed (2026-11-09 UTC, no credentials): an MCP initialize POST to https://ai.todoist.net/mcp returned HTTP 401 with an OAuth challenge (WWW-Authenticate resource_metadata https://ai.todoist.net/.well-known/oauth-protected-resource/mcp); that metadata lists authorization server https://todoist.com and resource https://ai.todoist.net/mcp. We did not sign in, so no tools were listed or called. Source: Doist/todoist-mcp (MIT; 563 GitHub stars when tested), also published as npm @doist/todoist-mcp 13.11.1 for local use — the local server exits at startup with "TODOIST_API_KEY is not set" without a key, so we list the hosted endpoint. Official MCP registry entry net.todoist/mcp 1.0.1 ("Official Todoist MCP server. Manage tasks and projects. Hosted, no API key needed."). Already on Glama (Todoist AI MCP Server by Doist).
Claude Code 2.1.321 fixed MCP OAuth requests sending secrets such as refresh tokens to another host when a server redirected them. Claude Code changelog
Transport: Streamable HTTP · not tested
Token cost (estimate): the figure is pending. We have no tools/list capture to estimate from.
Permissions: tool permissions pending · Auth: OAuth · Rate limit: unknown · Pricing unit: unknown
Auth: OAuth. Rate limit: unknown. Pricing unit: unknown.
HTTP 401, WWW-Authenticate resource_metadata https://ai.todoist.net/.well-known/oauth-protected-resource/mcp, OAuth metadata lists authorization server https://todoist.com
Existing test evidence only. We did not run a new OAuth sign-in or client compatibility test for this card. Claude Code changelog
Score 70/100 · Tools 0 · Token cost pending · Compare · Last tested 2026-11-09 · Server version not reported · Remote endpoint https://ai.todoist.net/mcp (streamable-http) · Repo Doist/todoist-mcp
Summary: Todoist MCP (official, remote) requires credentials or a backing service before it will list tools.
Evidence summary
- Handshake
- auth-gated
- Tools listed
- 0
- Context cost
- Pending The token cost figure is pending. ranking
- Login
- Needs OAuth sign-in
- Tested
- 2026-11-09
Test results
| Test | Result | Points | Evidence |
|---|---|---|---|
| install | pass | 20 | Endpoint https://ai.todoist.net/mcp reachable over streamable-http (HTTP 401) in 0.0s; no install step for remote servers. |
| handshake | auth-gated | 5 | Auth-gated: HTTP 401 without credentials; OAuth challenge (WWW-Authenticate, resource_metadata https://ai.todoist.net/.well-known/oauth-protected-resource/mcp). We do not sign in; not counted as working. |
| maintenance | pass | 25 | Repo pushed 0 days before test; 563 GitHub stars. |
| docs | pass | 15 | README over 3,000 chars; install instructions present; mcpServers config example present. Check of the package's own README (vendor repo README (github.com/Doist/todoist-mcp)). |
| license | pass | 10 | MIT (OSI-approved). |
Local-model readiness
Not tested
Not yet tested (no tools/list response without credentials).
What we tested and what we didn't
Tested on 2026-11-09
- Install from the registry (remote endpoint: connection only)
- We attempted an MCP initialize with no credentials and got HTTP 401, so we never reached the tool list (Method details:
initializePOST answered 401;tools/listnot sent) - Maintenance signals (last push, archived/deprecated status)
- Docs (README length, install and config example)
- License (OSI-approved or not)
- Token cost (estimate)
Not tested
- Security: not audited (no code review, no permission or data-flow analysis)
- Real tasks (no functional task runs yet)
- Behaviour with real credentials or a real account
- Performance, rate limits or load
- Correctness of results beyond the listed tasks
Methodology: how we test. A high score means it installs and responds, not that giving it access to your data carries no risk.
Known security issues
Not checked (remote-only): hosted endpoint, version unknown.
Monthly roundup: MCP security issues, October 2026.
Tool list changes
No tool list: this server did not list tools without credentials in our test, so tool changes are not tracked.
Raw test record (JSON)
{
"name": "todoist-remote",
"version": null,
"registry": "remote",
"status": "auth-gated",
"tested": "2026-11-09",
"tools_count": null,
"deprecated": false,
"archived": false,
"tests": {
"install": [
"pass",
20,
"Endpoint https://ai.todoist.net/mcp reachable over streamable-http (HTTP 401) in 0.0s; no install step for remote servers."
],
"handshake": [
"auth-gated",
5,
"Auth-gated: HTTP 401 without credentials; OAuth challenge (WWW-Authenticate, resource_metadata https://ai.todoist.net/.well-known/oauth-protected-resource/mcp). We do not sign in; not counted as working."
],
"maintenance": [
"pass",
25,
"Repo pushed 0 days before test; 563 GitHub stars."
],
"docs": [
"pass",
15,
"README over 3,000 chars; install instructions present; `mcpServers` config example present. Check of the package's own README (vendor repo README (github.com/Doist/todoist-mcp))."
],
"license": [
"pass",
10,
"MIT (OSI-approved)."
]
}
}Install
https://ai.todoist.net/mcp
Tools listed
Not available (handshake did not complete without credentials).
Quick config
{
"mcpServers": {
"todoist-mcp-remote": {
"type": "http",
"url": "https://ai.todoist.net/mcp"
}
}
}Add to config Opens the config generator with this server selected.
Setup
Without credentials it said (verbatim): HTTP 401 without credentials; OAuth challenge (WWW-Authenticate, resource_metadata https://ai.todoist.net/.well-known/oauth-protected-resource/mcp)
- Install. No install step: it is a remote server at https://ai.todoist.net/mcp.
- Configure. Add the mcpServers entry below to your MCP client config.
- Verify. Restart the client and check that tools/list returns tools. In our test it did not list tools without credentials.
{
"mcpServers": {
"todoist-mcp-remote": {
"type": "http",
"url": "https://ai.todoist.net/mcp"
}
}
}Not tested with credentials We have not tested this with real credentials.
Test history
- 2026-11-09: New
Related: Best productivity MCP servers · Troubleshooting: 401 Unauthorized on remote servers · MCP servers that need an OAuth sign-in · How to protect AI API keys
FAQ
Is Todoist MCP deprecated?
No. todoist-remote was not deprecated or archived when we last tested it on 2026-11-09.
What replaces Todoist MCP?
Nothing; Todoist MCP (official, remote) is not deprecated as of 2026-11-09.
Does Todoist MCP need an API key?
Not an API key: it needs an OAuth sign-in. Without signing in, the endpoint returned HTTP 401 with an OAuth challenge and did not list tools.
Embed the badge
Every tested server gets a free embeddable badge. It shows the current score and test date and expires after 90 days. Testing is free; payment never changes a score.