v2.5.1

v2.5.1 — schema fix

The attachments tool schema now advertises data.filePath — the engine has accepted it since
2.5.0, but the property was missing from the advertised data.properties, so agents discovering
tools via tools/list never saw it. No behavior changes otherwise.

Full Changelog: v2.5.0...v2.5.1

v2.5.0

v2.5.0 — agent-first files and card workflows

MCP tool arguments are JSON-only, so the server now does all the encoding work — the agent never
touches base64:

• Upload from a path: data.filePath — the server reads the local file (≤ 10 MB) and infers
  name + MIME from the extension (.png, .jpg, .webp, .gif, .svg, .pdf, .doc/.docx, .xls/.xlsx,
  .ppt/.pptx, .txt, .md, .csv, .json, .yaml, archives, audio/video, …). text and
  contentBase64 still work for inline content.
• Downloads agents can use directly: images come back as a rendered MCP image content block,
  text files as decoded text, other binary as contentBase64.
• Minimal card creation: cards { action: "create", data: { name } } — type and position
  are defaulted instead of erroring.
• cards.find: board-wide, case-insensitive card search with list names — no more walking
  lists to locate a card.

Verified end to end against live Planka 2.0.3 and 1.26.2 (154/154 tests, including byte-exact
image round-trips through the real MCP JSON-RPC wire). Docs: new CLAUDE.md, compacted README
with per-version auth blocks.

Full Changelog: v2.4.0...v2.5.0

v2.4.0

v2.4.0 — attachments, end to end

Agents can now move files in and out of cards on any Planka version (verified live against
2.0.3 and 1.26.2):

• cards.get returns the full context: description, tasks, task lists, attachments, and the
  activity log (actions) — one call instead of five.
• Create cards with files: cards { action: "create", data: { ..., attachments: [{ name, text | contentBase64, mimeType? }] } }.
• New attachments tool: upload (file bytes as base64/text, or a url link on v2),
  download (exact bytes back as base64, ≤ 10 MB), rename, delete.
• Downloads ride Planka's cookie-authenticated file route (accessToken cookie); they need
  PLANKA_USERNAME/PLANKA_PASSWORD auth since Planka rejects Bearer/API keys there.
• Attachment metadata is normalized across Planka versions (v2's nested data.url flattened to
  url, size, mimeType).

Tests: 10 new hermetic edge tests (multipart shape, cookie auth, size cap, API-key refusal,
create-chaining) + a 13-case attachment e2e suite run against both Planka majors — 140/140.

Full Changelog: v2.3.1...v2.4.0

v2.3.1

v2.3.1 — docs release

Install examples now cover both Planka generations:

• Planka v1 (≤ 1.26.x): PLANKA_USERNAME/PLANKA_PASSWORD — the only supported auth (v1 has
  no API keys; X-Api-Key returns 401, verified against a live 1.26.2). The server logs in
  automatically, caches the token, and silently re-logins on expiry.
• Planka v2: username/password works too, or generate an API key in your Planka user
  settings → API keys and use PLANKA_API_KEY.

Copy-paste blocks for Claude Code, Codex, and opencode in both variants.

Full Changelog: v2.3.0...v2.3.1

v2.3.0

v2.3.0 — first release on the new distribution

Install

npx -y @denisixnpm/planka-mcp          # Claude Code / Codex / opencode (stdio)
docker pull denisix/planka-mcp:2.3.0   # SSE multi-client mode

Release pipeline

• npm publish via trusted publishing (OIDC) from GitHub Actions — no token secret; triggers on v* tags and published GitHub Releases, with an already-published guard.
• Docker Hub image denisix/planka-mcp — multi-arch (amd64/arm64), tags 2.3.0 / 2.3 / 2 / latest, README-synced description, SBOM attached to the build.
• Automatic GitHub Release creation from this file.
• package.json normalized for npm (bin without ./ — npm silently dropped the bin entry otherwise, breaking npx; git+https repository URL).

Features shipping in this release (from 2.2.0)

• Working context (context tool): select project/board/list/card once; scoped tools fill omitted ids (set returns an overview of what you opened). Per SSE session; higher levels reset deeper ones.
• Condensed agent output (default on): whitelisted fields, included sidecars reduced, secrets/audit metadata stripped, long text truncated. Escape hatches: per-call raw: true, PLANKA_CONDENSED_OUTPUT=false.
• Security hardening: 0 npm audit findings; loopback-only SSE default, timing-safe bearer auth, no wildcard CORS, validated login responses, single-flight login, per-request timeouts with bounded retries.
• Planka ≤ 1.26.x compatibility: renamed v1 routes retried transparently on 404 (memberships incl. query-param remove, project managers, card labels); v2-only features fail with clean 404s.
• Engine fixes: data values win over generic id in path params; plural /custom-field-values/ path.
• Lean runtime: one production dependency (MCP SDK), built-in fetch, compiled Bun binary on distroless, --healthcheck CLI mode.
• 117 tests: live E2E against real Planka 2.0.3 and 1.26.2 stacks, SSE protocol round-trips, engine/context/condense edge suites.