Grafizum

npx add-mcp 'https://mcp.grafizum.com/mcp'

Your agent, meet your command center

The MCP server is the bridge between your AI client — Claude Code, or anything else that speaks MCP — and the dashboard. Sign in once, approve the connection, and the agent works on the projects you can see, with the access you granted, and a receipt for every write.

No API key to paste, so there is also nothing for an agent to leak into your shell history.

Server endpoint

https://mcp.grafizum.com/mcp

Set it up

1

Add the server

In Claude Code, run the command below. Any MCP client: use the endpoint above as the server URL (Streamable HTTP, OAuth 2.1). If it speaks MCP, it finds its way here.

claude mcp add --transport http grafizum https://mcp.grafizum.com/mcp

https://mcp.grafizum.com/mcp

2

Approve the connection

Your client opens a one-card approval page on the dashboard. Sign in, choose the agent it acts as, and authorize. Projects and access default to the whole agent and stay editable afterwards.

3

Work

The agent can now read projects, tasks, calendar and memory — and write within its scopes. Every write lands in the activity log.

Switching sync mode

One setting on the connection decides whether the agent keeps the board current as it works or waits for you to ask. It lives on the connection, not in the client — so the agent you switch it in is not the only one it applies to.

Auto

Default

Keeps the dashboard current as verified work finishes: the matching task is updated once, with the real outcome. No duplicate tasks, no invented progress.

/gz-auto

Manual

On request

Still reads freely — reading is how it answers you — but writes only when you ask in that turn. Otherwise it says what it would sync and waits.

/gz-manual

Three ways to say it

/gz-auto Claude Code CLI: the skill the Grafizum installer adds. /gz-manual is the other direction.

/grafizum:auto Any client that lists the server's prompts. /grafizum:manual exists too.

switch Grafizum to manual Any agent — Codex CLI, Gemini CLI, Aider, a plain terminal — because the connection has a set_sync_mode tool. Say "back to auto" to return.

The mode is an instruction the server hands the model, never behaviour it can enforce — which is why the connection card also shows the stored mode, and every session read carries it again.

Add a custom MCP client

Claude Code is the shortest path. Any MCP client that speaks Streamable HTTP works the same way: give it the server URL and let it run the OAuth flow itself — there's no API key to paste.

Portable format —.mcp.json, Cursor, Copilot

{
  "mcpServers": {
    "grafizum": { "type": "http", "url": "https://mcp.grafizum.com/mcp" }
  }
}

VS Code keeps the same two fields under a top-level "servers" object in.vscode/mcp.json.

Discovery

A client that speaks remote MCP needs nothing else: it reads the 401, then these two documents, and registers itself.

OAuth server metadata

https://mcp.grafizum.com/.well-known/oauth-authorization-server

Protected resource metadata

https://mcp.grafizum.com/.well-known/oauth-protected-resource/mcp

What a connection can do

Read

• Projects, status and progress
• Tasks and to-do lists
• Calendar and due dates
• Project memory and the global handbook
• Activity summaries (never raw secret payloads)

Write

• Create and update tasks
• Report project status
• Record events and calendar entries
• Write project knowledge (within its scopes)

Never

• Vault secrets, GitHub tokens or SSH keys
• Projects the connection wasn't granted
• Your review decisions

The tools it exposes

The exact names your client lists, and what each one does. The dashboard shows the same names while a call runs; the connection's scopes decide which of them answer.

Session

3

get_session The handbook, the projects, the memory file and the current mode

declare_project Says which project the session is working on, before the first write

set_sync_mode Records auto or manual for this connection

Read

13

get_changes What moved since the last read

list_projects Every project the connection may see

get_project One project, with its tasks and documents

get_project_status One project's state and its recent status reports

get_project_progress Task counts and progress for a project

list_tasks The queue, filterable by project, status or review state

get_task One task, with its history

list_activity Recent writes, without payloads or credentials

list_calendar Due dates and calendar entries

list_memory The global knowledge documents it may read

get_memory One knowledge document

list_project_documents A project's memory file

get_project_document A project's memory file, PROJECT_GUIDE.md

Write

11

create_task A new task, with the owner's answers and no invented priority

update_task Changes a task's status, date or description

move_task Moves a task within its project's queue

create_project A project or subproject, after explicit confirmation

update_project Changes a project, after explicit confirmation

report_project_status Records a project's progress and health

put_project_document Writes the project's memory file

delete_project_document Deletes a knowledge document, with confirmation

create_event Records an event in the activity log

create_calendar_event Adds a dated entry, with confirmation

record_sync_run Records one sync run, with confirmation

Manage connections

Every connection shows up under MCP in the dashboard, named after the agent it acts as. Rename it, narrow it to fewer projects, drop write access, or revoke it — changes apply to the next request, no reconnect needed. A connection lasts 30 days before it needs approving again; access tokens last 15 minutes and refresh on their own.

Open the MCP tab

How it's kept safe

• OAuth 2.1 authorization code with PKCE. Tokens are stored hashed, access tokens last 15 minutes, and refresh tokens rotate — a reused one revokes the whole connection.
• A connection is a ceiling, never a widening: it can never carry more scopes or projects than the acting agent already has, and vault, GitHub and delete scopes are never available.
• Registration and authorization are rate-limited, and every write is checked against the connection's scopes and project list before it's accepted.
• Approving shows the exact address the authorization code goes to, so a familiar-sounding client name can't hide where your access is heading.