mcp-todoist: why it is not safe to use
mcp-todoist passed review: we found expected Todoist token use, no hidden prompts or hardcoded secrets, and documented destructive actions with dry-run support.
What we found
Our review of `greirson/mcp-todoist` passed with a score of 88/100. In the inspected repository materials, we did not find hidden prompt-injection content, obfuscated payloads, hardcoded credentials, privilege-escalation behavior, or undisclosed remote code download. The documented data flow is limited to the user-selected Todoist account through the Todoist API, and the code appears to use the expected `TODOIST_API_TOKEN` environment variable rather than unrelated local credentials.
We also noted that the skill supports actions that can change or remove user data, including `delete`, `bulk_delete`, `complete`, `archive`, and backup download. Based on the reviewed documentation, these capabilities are part of the stated Todoist functionality, and we did not find evidence of hidden destructive behavior. The presence of a dry-run mode is a useful safety control for testing.
What to do instead
Use this skill with a Todoist token you control, scope access to the intended account, and test workflows in dry-run mode before running bulk or destructive actions. Review the command set carefully so deletions, archiving, and completion actions match your intent.
Source: https://github.com/greirson/mcp-todoist
We report what our security review found at the time we checked, with the goal of keeping people safe. Projects change; if a maintainer has since fixed this, we are glad to recheck it. Email hello@agentpod.com.