From b31ad1cb48958c48ca25e428611a72e3cb18e205 Mon Sep 17 00:00:00 2001 From: johnxie Date: Fri, 5 Jun 2026 04:22:25 -0700 Subject: [PATCH 1/3] docs+fix: add Privacy/Security policy and use globalThis.fetch - runtime.ts: window['fetch'] -> globalThis.fetch (standard global on Node 20+ and browsers; also clears the SafeSkill bracket-notation false positive). tools.generated.ts regenerated (single inlined-runtime line changed). - SECURITY.md: add private vulnerability reporting + disclosure SLA, a never-commit-secrets section with a pre-commit grep, and a Privacy pointer. - README: add a Privacy & Security section linking the Taskade Privacy Policy (Claude Connectors Directory requirement) and SECURITY.md. --- README.md | 10 ++++++ SECURITY.md | 44 ++++++++++++++++++++++--- packages/openapi-codegen/src/runtime.ts | 2 +- packages/server/src/tools.generated.ts | 2 +- 4 files changed, 51 insertions(+), 7 deletions(-) diff --git a/README.md b/README.md index 83a7d8b..743c2a0 100644 --- a/README.md +++ b/README.md @@ -496,6 +496,16 @@ See [open issues](https://github.com/taskade/mcp/issues) for planned features an --- +## Privacy & Security + +Your Taskade API token authorizes the MCP server to call the Taskade public API on your behalf. The server talks **only** to `https://www.taskade.com/api/v1` and sends your data to no third party. + +- **Privacy** — see the [Taskade Privacy Policy](https://www.taskade.com/privacy). +- **Security & vulnerability reporting** — see [SECURITY.md](./SECURITY.md). +- Store your token in an environment variable; never commit it. + +--- + ## Contributing Help us improve MCP tools, OpenAPI workflows, and agent capabilities. diff --git a/SECURITY.md b/SECURITY.md index 91fa471..64b5229 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -2,17 +2,51 @@ ## Reporting a Vulnerability -Do not disclose security vulnerabilities publicly. Email [hello@taskade.com](mailto:hello@taskade.com) with details. +**Please report security issues privately — do not open a public issue or PR.** + +- Preferred: open a [GitHub private security advisory](https://github.com/taskade/mcp/security/advisories/new) (Security → Report a vulnerability). +- Or email [hello@taskade.com](mailto:hello@taskade.com) with details and reproduction steps. + +We aim to acknowledge reports within **3 business days** and to provide a remediation +timeline after triage. Please give us a reasonable window to ship a fix before any +public disclosure. We're happy to credit reporters who request it. ## Token Handling -- Store API tokens in environment variables only — never hardcode in source files. +- Store API tokens in environment variables only — never hardcode them in source files. - `.env` files are gitignored — never commit tokens to version control. - Rotate tokens immediately if compromised. - Generate tokens at [taskade.com/settings/api](https://www.taskade.com/settings/api). ## Transport Security -- Use HTTPS/TLS for HTTP/SSE mode in production. -- Tokens passed via query parameters in HTTP mode may be logged by proxies or web servers. -- The stdio transport (default for Claude Desktop / Cursor) does not expose tokens over the network. +- The stdio transport (default for Claude Desktop / Cursor / VS Code) does not expose tokens over the network. +- Use HTTPS/TLS for any HTTP-based transport in production. +- Avoid passing tokens in URL query parameters — they can be logged by proxies and web servers. Prefer the `Authorization` header or environment variables. + +## Never Commit Secrets + +This is a public repository. Never commit: + +``` +.env, .env.* # environment files +*.key, *.pem # private keys / certificates +*credentials*, *secret* # credential dumps +.mcpregistry_* # MCP registry auth tokens +``` + +These patterns are covered by `.gitignore` and `packages/server/.npmignore`. Before committing, sanity-check your staged changes: + +```bash +git diff --cached | grep -iE "(token|key|secret|password|credential)" | grep -v placeholder +``` + +If you accidentally commit a secret: **do not push** (or if already pushed, rotate the +credential immediately), then remove it from history and notify a maintainer. See +[GitHub: removing sensitive data](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/removing-sensitive-data-from-a-repository). + +## Privacy + +Taskade's data practices are described in the [Taskade Privacy Policy](https://www.taskade.com/privacy). +The MCP server sends requests only to the Taskade public API (`https://www.taskade.com/api/v1`) +using the token you provide; it does not transmit your data to any third party. diff --git a/packages/openapi-codegen/src/runtime.ts b/packages/openapi-codegen/src/runtime.ts index 870d5bf..c21e4d6 100644 --- a/packages/openapi-codegen/src/runtime.ts +++ b/packages/openapi-codegen/src/runtime.ts @@ -168,7 +168,7 @@ export class OpenAPIToolRuntimeConfig { } get fetch() { - const fetch = this.config.fetch ?? window['fetch']; + const fetch = this.config.fetch ?? globalThis.fetch; if (!fetch) { throw new Error('fetch is not defined'); diff --git a/packages/server/src/tools.generated.ts b/packages/server/src/tools.generated.ts index 33b6b74..be02955 100644 --- a/packages/server/src/tools.generated.ts +++ b/packages/server/src/tools.generated.ts @@ -175,7 +175,7 @@ export class OpenAPIToolRuntimeConfig { } get fetch() { - const fetch = this.config.fetch ?? window['fetch']; + const fetch = this.config.fetch ?? globalThis.fetch; if (!fetch) { throw new Error('fetch is not defined'); From 7c4dd62b889c0ad09fedc350466afd235c413796 Mon Sep 17 00:00:00 2001 From: johnxie Date: Fri, 5 Jun 2026 04:32:53 -0700 Subject: [PATCH 2/3] fix(security): actually gitignore .env.* and correct SECURITY.md claim Addresses Copilot review: .gitignore covered .env/.env.test but not .env.* (.env.local, .env.production, ...). Add .env.* with a !.env.example negation, and reword SECURITY.md to only claim what's truly auto-ignored (.env*), framing key/credential patterns as a pre-commit check. --- .gitignore | 3 ++- SECURITY.md | 2 +- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index abd7c3b..217df44 100644 --- a/.gitignore +++ b/.gitignore @@ -64,7 +64,8 @@ typings/ # dotenv environment variables file .env -.env.test +.env.* +!.env.example # parcel-bundler cache (https://parceljs.org/) .cache diff --git a/SECURITY.md b/SECURITY.md index 64b5229..e50c893 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -35,7 +35,7 @@ This is a public repository. Never commit: .mcpregistry_* # MCP registry auth tokens ``` -These patterns are covered by `.gitignore` and `packages/server/.npmignore`. Before committing, sanity-check your staged changes: +`.env*` files are gitignored (except `.env.example`) and excluded from the npm package; the other patterns above are **not** auto-ignored, so sanity-check your staged changes before committing: ```bash git diff --cached | grep -iE "(token|key|secret|password|credential)" | grep -v placeholder From 141190029ede0761a243c00f15f7d348ff923bf1 Mon Sep 17 00:00:00 2001 From: johnxie Date: Fri, 5 Jun 2026 04:51:08 -0700 Subject: [PATCH 3/3] docs(security): correct HTTP/SSE token, .mcpregistry_*, and third-party wording Addresses Copilot review: - Transport: acknowledge HTTP/SSE currently passes the token as an access_token query param (may be logged); recommend stdio instead of implying a header is used. - Never-commit: clarify .env* AND .mcpregistry_* are gitignored (only the key/credential patterns are not auto-ignored). - Privacy (SECURITY.md + README): scope the claim to 'no other third-party services' and note the HTTP/SSE URL-token logging caveat. --- README.md | 2 +- SECURITY.md | 7 ++++--- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index 743c2a0..4de1870 100644 --- a/README.md +++ b/README.md @@ -498,7 +498,7 @@ See [open issues](https://github.com/taskade/mcp/issues) for planned features an ## Privacy & Security -Your Taskade API token authorizes the MCP server to call the Taskade public API on your behalf. The server talks **only** to `https://www.taskade.com/api/v1` and sends your data to no third party. +Your Taskade API token authorizes the MCP server to call the Taskade public API on your behalf. The server talks **only** to `https://www.taskade.com/api/v1` and does not send your data to other third-party services. - **Privacy** — see the [Taskade Privacy Policy](https://www.taskade.com/privacy). - **Security & vulnerability reporting** — see [SECURITY.md](./SECURITY.md). diff --git a/SECURITY.md b/SECURITY.md index e50c893..cd05095 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -22,7 +22,7 @@ public disclosure. We're happy to credit reporters who request it. - The stdio transport (default for Claude Desktop / Cursor / VS Code) does not expose tokens over the network. - Use HTTPS/TLS for any HTTP-based transport in production. -- Avoid passing tokens in URL query parameters — they can be logged by proxies and web servers. Prefer the `Authorization` header or environment variables. +- The HTTP/SSE transport currently passes the token as an `access_token` URL query parameter, which proxies and servers may log. Until a header-based transport is available, prefer **stdio** (token via the `TASKADE_API_KEY` environment variable), especially in production. ## Never Commit Secrets @@ -35,7 +35,7 @@ This is a public repository. Never commit: .mcpregistry_* # MCP registry auth tokens ``` -`.env*` files are gitignored (except `.env.example`) and excluded from the npm package; the other patterns above are **not** auto-ignored, so sanity-check your staged changes before committing: +`.env*` files (except `.env.example`) and `.mcpregistry_*` are gitignored and excluded from the npm package; the key/credential patterns above are **not** auto-ignored, so sanity-check your staged changes before committing: ```bash git diff --cached | grep -iE "(token|key|secret|password|credential)" | grep -v placeholder @@ -49,4 +49,5 @@ credential immediately), then remove it from history and notify a maintainer. Se Taskade's data practices are described in the [Taskade Privacy Policy](https://www.taskade.com/privacy). The MCP server sends requests only to the Taskade public API (`https://www.taskade.com/api/v1`) -using the token you provide; it does not transmit your data to any third party. +using the token you provide; it does not send your data to other third-party services. (In +HTTP/SSE mode the token travels in the request URL and may be logged — prefer stdio.)