MCP, API and webhooks
Built for people. Open to your agents.
Kanroo has no built-in AI and no AI sub-processors. Connect the agent you already use through the Model Context Protocol (MCP), or build on the REST API and signed webhooks.
- Create a task on “Website Relaunch” for each page in the wiki sitemap.
- Tool call: search_pages "sitemap"
- Tool call: get_page "Sitemap"
- Tool call: get_board_context "Website Relaunch"
- Tool call: create_task ×5 → Backlog
- Created 5 tasks in the list “Backlog”.
The agent can do only what your account may do. Your team sees the new tasks appear on the board.
- MCP tools
- 116
- ways to connect: remote or local
- 2
- key scopes: Read, Write, Admin
- 3
- OpenAPI version of the REST API
- 3.1
MCP
Remote or local. Your key decides.
Kanroo includes an MCP server. An agent such as Claude Code, Codex or Cursor can read and change boards, tasks, comments, checklists and wiki pages, with the rights of your personal API key.
Remote endpoint
Your Kanroo address plus /mcp. Nothing to install. The agent sends your key as a Bearer token.
Local server
Built from the repository and started by your agent with Node.js 24 on Linux or macOS. It adds file tools for one folder you choose.
Scoped keys
Read, Write or Admin. Every call still checks your roles, so a key never opens a board you cannot open yourself.
No built-in AI. No AI sub-processors.
- Kanroo runs no language model and sends your workspace to no AI vendor.
- Nothing in Kanroo is billed in AI credits.
- You choose the agent. Its provider sees what the agent reads, under your agreement with that provider.
- Revoke the key, and the agent loses access at once.
Setup
Connect your agent in three steps.
These examples use the remote endpoint of Kanroo Cloud. For a self-hosted server, use your own address plus /mcp.
- 1Open Settings, then API keys, and create a key with the scope the agent needs.
- 2Add Kanroo to your agent with one of the snippets. Replace <api-key> with your key.
- 3Start the agent and ask it to call get_context.
Keep the key in your personal agent configuration or in an environment variable. Never commit it to a repository.
Full MCP guide, with the local serverclaude mcp add --scope user --transport http kanroo https://cloud.kanroo.app/mcp --header "Authorization: Bearer <api-key>"[mcp_servers.kanroo]
url = "https://cloud.kanroo.app/mcp"
bearer_token_env_var = "KANROO_API_KEY"{
"mcpServers": {
"kanroo": {
"url": "https://cloud.kanroo.app/mcp",
"headers": {
"Authorization": "Bearer <api-key>"
}
}
}
}Tools
116 tools.
The tools cover the same work as the app. A client sees only the tools that its key scope allows.
Context and Home
- get_context
- get_my_agenda
- get_my_feed
Boards and lists
- list_boards
- get_board_context
- create_board
- create_list
- move_list
Tasks
- search_tasks
- get_task
- create_task
- move_task
- edit_task_description
Comments and checklists
- create_comment
- create_checklist
- update_checklist_item
Wiki
- search_pages
- get_page
- create_page
- edit_page_body
- restore_page_revision
Sharing and access
- set_board_visibility
- create_page_share
- create_board_access_grant
Imports and exports
- create_import
- execute_import
- export_board
- export_space
Teams and members
- list_organization_members
- create_invitation
- add_team_member
A selection. The local server has 115 of the tools, the remote endpoint 108: file tools work only locally, and the remote endpoint offers get_file_transfer instead.
What each scope allowsAPI keys
One personal key for the agent, the API and scripts.
Create a key in your settings, choose the smallest scope that works, and set an expiry date if you like. Kanroo shows the key once.
Three scopes
Read only reads. Write also creates, changes and deletes. Admin adds members, teams, access and publishing.
Fair rate limits
API-key requests per minute for each organization: Free 60, Team 1,000, Enterprise 2,000. Work in the browser never counts.
Rules for SSO teams
With single sign-on, the organization decides if members may use personal API keys.
REST API
A REST API with a real contract.
The REST API under /api/v1 is contract-first. The OpenAPI 3.1 file is generated from the same contracts as the code, so the two cannot drift apart.
OpenAPI 3.1
Download the spec from /api/openapi.json and generate a client in your language.
Reference in the app
An interactive API reference at /api/docs, on Kanroo Cloud and on your own server when you turn it on.
The same keys
Send your personal API key in the X-API-Key header. The scopes are the same as for MCP.
curl -H "X-API-Key: <api-key>" \
https://cloud.kanroo.app/api/v1/users/me/contextWebhooks
Signed webhooks that stop on their own.
A webhook sends a signed HTTPS request to your server when something changes on one board. Kanroo webhooks are strict on purpose.
Proven endpoint
Your endpoint must answer a challenge before it gets any board event.
Standard Webhooks signatures
Every request carries webhook-id, webhook-timestamp and webhook-signature headers.
Safe targets only
HTTPS on port 443, no redirects, no private or internal addresses.
Retries and a log
5 attempts: at once, then after 1, 5, 15 and 30 minutes. A delivery log shows each one. After 3 failed deliveries in a row, the webhook turns itself off.
Events for tasks, lists, comments, checklists, checklist items and wiki pages. On every Kanroo Cloud plan; on your own server, webhooks are part of the Enterprise Edition.
Set up a webhookEvery feature on every Kanroo Cloud plan.
Start for free, no card required. Add your team when you need it.