PlugWiki
paca logo

Paca MCP Server: Setup for Claude Code, Cursor and Other Apps

OfficialLocal
Getnpm@paca-ai/paca-mcppaca-ai/paca

Lets Claude, Cursor and other assistants manage tasks, sprints, docs and automations in your Paca project board.

Paca MCP is made by the Paca team. Paca is an open-source, self-hosted project board for Scrum teams. The server lets your assistant list and edit projects, tasks, sprints, documents, members, views and automations in your own Paca instance.

It runs on your computer and talks to your Paca server with an API key from your user settings. You need a running Paca instance first. You can also connect as a Paca agent, so the assistant acts under its own identity and can be pinned to one project.

The server lists every tool, and Paca itself decides what your key may do. Use a key for an account with limited roles if you want to cap the damage.

Good for

  • Scrum teams that self-host Paca and want an assistant to triage and update the board
  • Developers who want tasks, comments and docs updated without leaving the editor
  • Project leads who manage sprints, roles and automations by chat

Works in

12 should work

Tap an app to see how to set it up and any known problems.

Install paca MCP

Claude Code

  1. 1

    Copy this prompt.

    Add the paca MCP server to Claude Code. Run this command:
    
    claude mcp add paca -e PACA_API_KEY=<PACA_API_KEY> -- npx -y @paca-ai/paca-mcp
    
    Ask me for PACA_API_KEY and only put the values in that config, nowhere else.
    
    Then check that it loaded and tell me if I need to sign in or restart.
  2. 2

    Paste it into Claude Code. It shows the change and asks before running it.

Requires Node.js.

Built from the package data we hold. Not yet tested by us.

Tools

  • Lists your projects

    Returns the projects you can open in Paca, a page at a time.

    Try: “What projects do I have in Paca?”

    Read · list_projects

  • Shows one project

    Returns the details of a single project.

    Try: “Show me the details of the Website project.”

    Read · get_project

  • Creates a project

    Starts a new project in your Paca workspace.

    Try: “Create a project called Mobile App.”

    Write · create_project

  • Edits a project

    Changes the name or settings of an existing project.

    Try: “Rename the Mobile App project to Mobile v2.”

    Write · update_project

  • Deletes a project

    Removes a whole project from Paca.

    Try: “Delete the old Prototype project.”

    Delete · delete_project

  • Lists tasks, with filters

    Returns the tasks in a project, and you can filter them.

    Try: “Show open tasks assigned to me in Website.”

    Read · list_tasks

  • Shows one task in full

    Returns everything the task page shows: fields, subtasks, attachments and activity.

    Try: “Open task 42 and summarize the history.”

    Read · get_task

  • Finds a task by its number

    Fetches a task by the number it carries inside its project, with the same detail as get_task.

    Try: “Get task number 118 in Website.”

    Read · get_task_by_number

  • Creates a task

    Adds a new task to a project.

    Try: “Add a task "Fix login redirect" to the current sprint.”

    Write · create_task

  • Edits a task

    Changes a task's title, status, assignee, sprint or other fields.

    Try: “Move task 42 to In Review.”

    Write · update_task

  • Deletes a task

    Removes a task from the project.

    Try: “Delete task 77, it is a duplicate.”

    Delete · delete_task

  • Lists sprints

    Returns the sprints in a project, a page at a time.

    Try: “List the sprints in Website.”

    Read · list_sprints

Read from the source code

Permissions

high risk · 4 things to watch

High risk

The assistant can read and change almost everything in your Paca workspace, including deleting projects, tasks and docs. Use an API key from an account whose Paca role allows only what you want it to do.

What it can do

  • Read your data
  • Create and change things
  • Delete things
  • Read-only mode

Watch out for

  • It can delete projects, tasks and docs

    delete_project, delete_task, delete_sprint, delete_doc and others remove data from Paca. Use a key for an account whose role cannot delete, and keep backups of your instance. npmjs.com

  • It can change roles and members

    add_project_member, update_project_member_role and the role tools change who can do what in a project. Use a key from an account without admin rights. npmjs.com

  • It can turn on automations

    create_automation starts as a draft, but update_automation can activate it so it runs on its own. Review what the assistant builds before activating. npmjs.com

  • It can upload local files

    upload_task_attachment reads a file path on your computer and attaches it to a task. Check the path before approving. npmjs.com

Security advisories

No published security advisories for the MCP server as of Nov 1, 2026.

11 other advisories are about the wider paca project, not this MCP server. See them on GitHub

Technical details
Turning on read-onlyNo read-only switch exists. The server lists all tools, and your Paca role decides which calls succeed, so a key held by a read-only member can only read.
Talks toYour Paca instance at PACA_API_URL
Sign-in and keysThe API key is set in the PACA_API_KEY environment variable in your app config and sent to your Paca instance.

Questions

Is the Paca MCP server official?

Yes. It is published by the Paca team under the @paca-ai scope and lives in the Paca repository.

Do I need my own Paca server?

Yes. The server talks to a running Paca instance, local or deployed, and Paca is self-hosted. Set the instance address in the install config.

Where do I get the API key?

Generate it in your Paca user settings. An agent has its own key from the agent setup page in the Paca UI, and regenerating a key invalidates the old one.

Can it run read-only?

Not with a switch. The server lists all tools and Paca decides each call, so an account with read-only roles gets "Permission denied" on writes. Use such an account's key.

Can it delete my data?

Yes. It has delete tools for projects, tasks, sprints, documents, attachments, roles, views and automations. Whether a call works depends on the role of the key's owner.

What is agent mode?

With PACA_AGENT_ID set, calls are made as a Paca agent using that agent's own key. Adding PACA_PROJECT_ID pins every call to one project, which the README recommends for a project agent.

Why do I see 80 tools, not more?

Three repository tools stay hidden unless a repository plugin is set in the environment. Plugins in your Paca instance can add more tools when the server starts.

Information

updated Nov 2, 2026

Publisher
Official
Package
@paca-ai/paca-mcp
Registry
npm
Transport
stdio
Auth
API key
Version
0.19.2
License
Apache-2.0
Last commit
Oct 31, 2026
Open issues
13

WebsiteGitHubnpmChangelogIssues

Sources

Docs, issue trackers and discussions this page is built from. Issues, quotes and findings above link to their own source.

Show all 2
  1. www.npmjs.com · npmjs.com
  2. github.com · github.com

Facts from the official MCP registry, GitHub, npm, PyPI and the Docker catalog. Updated Nov 2, 2026.