[johnxie]

Summary

The published @taskade/mcp-server package runs over stdio only. Two docs still describe an HTTP path that users cannot get from npm:

• SECURITY.md describes an HTTP/SSE transport. Only the source dev script has that transport.
• examples/README.md sends HTTP users to a closed issue and does not mention the hosted server.

This PR points HTTP users to the hosted server at https://www.taskade.com/mcp. It follows the README change in #96, which removes the --http section.

Changes

• SECURITY.md, "Transport Security":
  • The published package runs over stdio only. It reads the token from TASKADE_API_KEY.
  • The HTTP/SSE mode exists only in the source dev script (yarn start:server in packages/server). The npm package does not contain it.
  • The dev script reads the token from the access_token query parameter and serves plain HTTP on every network interface (port 3000 by default). A proxy can log the token and a network observer can read it. Run it only on a trusted machine and network, and put it behind HTTPS/TLS if other machines can reach it. This keeps the TLS advice that the startup note of the script prints.
  • For remote use, connect to the hosted server. It uses OAuth 2.0.
• SECURITY.md, "Privacy": the note about the token in the URL now names the source dev script as the only place with that mode.
• examples/README.md: the n8n note keeps the stdio setup and replaces the closed-issue link with the hosted server. It says that the hosted server needs a paid plan on the workspace, and it names the Bearer token option for a client that cannot do OAuth.

The reporting instructions in SECURITY.md do not change. No code, workflow or package.json changes. No changeset: the change is docs only and does not touch a package.

How I checked the facts

Fact	Evidence
The npm package is stdio only	The 0.1.2 tarball holds one program, bin/cli.mjs. It contains new StdioServerTransport() and no --http, startHTTPServer or access_token. .npmignore excludes src.
The HTTP/SSE mode is the dev script	start:server runs tsx src/http.ts, which calls startHTTPServer from mcp-proxy with PORT (default 3000).
It listens on every interface	mcp-proxy 3.2.0 calls listen(port, "::"). A local run of yarn start:server with PORT=38791 showed TCP *:38791 (LISTEN).
The hosted server uses OAuth	curl https://www.taskade.com/mcp returns 401, which starts the OAuth sign-in (see the README "Taskade MCP server: quick start").

Risk and rollback

• Risk: low. Two Markdown files change.
• Merge order: fix(release): Pin npm 11 and support a GitHub App token for the version PR (#95) #96 merged on 2026-10-19, so main no longer shows the old --http section.
• Rollback: revert the commits of this PR.

Tests

• yarn lint: exit 0.
• npx prettier --check SECURITY.md examples/README.md: all files pass.
• Links: https://www.taskade.com/mcp returns 401 (expected), https://github.com/taskade/mcp returns 200. The anchor #taskade-mcp-server-quick-start exists in README.md on main (the live repo page renders id="user-content-taskade-mcp-server-quick-start"). feat(plugin): Ship the Taskade agent plugin with a front-door skill, six outcome skills, and manifests for Claude Code, Codex, Copilot and Gemini #105 renamed the old #quick-start-hosted-server heading, so commit f275e3c moves both links to the new anchor.
• Dev script smoke: PORT=38791 yarn start:server answered GET /ping with pong. I stopped it by PID after the check.

Closes #98

[changeset-bot]

⚠️ No Changeset found

Latest commit: f275e3c

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[Copilot]

🟢 Approval recommended

The documentation-only changes match the stated requirements, with no unresolved findings.

No open issues 🎉

What changed in this PR

Updates transport documentation to direct HTTP users to the hosted server, addressing #98 and complementing #96’s README cleanup.

Changes:

• Clarifies that the published package supports stdio only.
• Documents the source-only HTTP dev script and its security risks.
• Replaces the outdated issue link with hosted-server authentication guidance.

File	Description
SECURITY.md	Distinguishes published, development, and hosted transports and their security implications.
examples/​README.md	Directs HTTP users to the hosted server with OAuth or Bearer authentication.

_{Review effort: Balanced}

[johnxie]

@deanzaka for review. Docs only: SECURITY.md and examples/README.md.

Impact

• A reader of SECURITY.md now learns that the npm package runs over stdio only. The HTTP/SSE mode is a source-only dev script for local use.
• A reader who wants HTTP (for example from n8n) now goes to the hosted server at https://www.taskade.com/mcp, not to a closed issue.
• The security text keeps the real risks of the dev script: the token travels in the URL, the script serves plain HTTP, and it listens on every interface.
• The reporting instructions do not change.

Reader flow, before

examples/README.md (n8n note)
  "Need HTTP?"
     |
     v
  "HTTP/SSE transport is not yet exposed, track issue #6"
     |
     v
  issue #6 -> CLOSED (dead end, no hosted server link)

SECURITY.md (Transport Security)
  "The HTTP/SSE transport passes the token in the URL"
     |
     v
  reader assumes `npx @taskade/mcp-server` has an HTTP mode
     |
     v
  runs it -> stdio only, no HTTP mode (confusion)

Reader flow, after

examples/README.md (n8n note)
  "Need HTTP?"
     |
     v
  hosted server https://www.taskade.com/mcp
  (Streamable HTTP, OAuth 2.0, paid plan, Bearer token fallback)
     |
     v
  README "Taskade MCP server: quick start"

SECURITY.md (Transport Security)
  npm package ---------> stdio only, token from TASKADE_API_KEY
  source dev script ---> `yarn start:server` in packages/server
                         token in URL, plain HTTP, every interface,
                         port 3000, trusted machine only, TLS if reachable
  remote use ----------> hosted server, OAuth 2.0

QA

Step	Action	Expected result
1	Open SECURITY.md on the PR branch and read "Transport Security".	Four bullets: npm package is stdio only, HTTP/SSE is a source-only dev script, the dev script risks and TLS advice, the hosted server for remote use.
2	Read "Reporting a Vulnerability" in SECURITY.md.	The text is the same as on main.
3	Read the "Privacy" section in SECURITY.md.	The note says that only the source dev script puts the token in the URL. The published package uses stdio.
4	Open examples/README.md and read the n8n note.	The stdio setup stays. The HTTP paragraph points to the hosted server and does not link issue #6.
5	Select the "Taskade MCP server: quick start" link in both files.	Each link opens the README section "Taskade MCP server: quick start".
6	Run curl -s -o /dev/null -w "%{http_code}" https://www.taskade.com/mcp.	401 (the hosted server asks for OAuth).
7	Regression: run git diff --stat origin/main... on the PR branch.	Only SECURITY.md and examples/README.md change. No code, workflow or package.json change.
8	Regression: run yarn lint and npx prettier --check SECURITY.md examples/README.md.	Both pass.
9	Rollback: revert the PR commits.	The two files return to their main text. Nothing else changes.

Merge order: #96 merged on 2026-10-19, so main no longer shows the old --http section. #105 renamed the README heading, and commit f275e3c moves both links to #taskade-mcp-server-quick-start.

[Copilot]

🟢 Approval recommended

The documentation-only changes align with the stated requirements and have no unresolved findings.

No open issues 🎉

_{Review effort: Balanced}

[johnxie]

Code review

No issues found. Checked for bugs and CLAUDE.md compliance.