MCP Task Orchestrator

Package (oci)

docker run -i --rm ghcr.io/jpicklyk/task-orchestrator:4.0.2

Or add to your MCP client config:

{
  "mcpServers": {
    "task-orchestrator": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/jpicklyk/task-orchestrator:4.0.2"
      ]
    }
  }
}

• DATABASE_PATH — SQLite database file path (default: data/current-tasks.db)
• AGENT_CONFIG_DIR — Directory containing .taskorchestrator/config.yaml for workflow schemas (default: working dir)
• MCP_TRANSPORT — Transport mode: stdio (default) or http
• MCP_HTTP_PORT — HTTP port when using http transport (default: 3001)
• MCP_SESSION_IDLE_TIMEOUT_MINUTES — Minutes without a request before an HTTP MCP session is closed; the client re-initializes on its next call (default: 120)
• LOG_LEVEL — Logging level: DEBUG, INFO, WARN, ERROR (default: INFO)
• LOG_FILE — Optional log file path. Unset (default) disables file logging; logs are always JSON on stderr.
• API_ALLOW_QUERY_TOKEN_FOR_SSE — Allow ?token= auth for SSE (browser EventSource workaround) (default: false)
• API_ALLOW_UNAUTHENTICATED — Confirm flag required alongside API_AUTH_MODE=none (default: false)
• API_AUTH_MODE — REST API auth mode: bearer, jwks, or none (with API_ALLOW_UNAUTHENTICATED=true). Required when API_ENABLED=true
• API_ENABLED — Master REST API switch; set true to register /api/v1/* routes (default: false)
• API_JWKS_ALGORITHMS — Comma-separated JWT algorithm allowlist for jwks mode (e.g. RS256,EdDSA)
• API_JWKS_ALLOW_INSECURE_URL — Loopback-only opt-in to fetch API_JWKS_URL over plaintext http (default: false)
• API_JWKS_AUDIENCE — Expected aud claim value in JWTs (jwks mode)
• API_JWKS_CACHE_TTL_SECONDS — JWKS key cache TTL in seconds (default: 300)
• API_JWKS_ISSUER — Expected iss claim value in JWTs (jwks mode)
• API_JWKS_MAX_STALE_SECONDS — Oldest a cached key set may be and still be served after a failed refresh (default: max(3600, TTL))
• API_JWKS_MAX_TOKEN_LIFETIME_SECONDS — Maximum accepted token lifetime in seconds (default: 86400)
• API_JWKS_URL — JWKS endpoint URL (jwks mode); must be https and resolve to public addresses
• API_REDACT_NOTE_ATTRIBUTION — Redact actor/verification on notes for non-admin callers (default: true)
• API_SSE_AUTH_CHECK_INTERVAL_SECONDS — Interval for token-expiry checks on open SSE connections (default: 30)
• API_SSE_BUFFER_SIZE — Last-Event-ID replay window in event ids (default: 1000; 0 = no replay)
• API_TOKENS_PATH — Path to the bearer token YAML secret file (default: /run/secrets/api-tokens.yaml)
• CORS_ALLOWED_HEADERS — Comma-separated CORS request headers allowlist
• CORS_ALLOWED_METHODS — Comma-separated CORS methods allowlist
• CORS_ALLOWED_ORIGINS — Comma-separated allowed CORS origins; empty means no cross-origin access
• CORS_EXPOSE_HEADERS — Comma-separated response headers browser clients may read
• CORS_MAX_AGE_SECONDS — CORS preflight cache duration in seconds (default: 3600)
• DATABASE_BUSY_TIMEOUT_MS — SQLite busy timeout for startup paths in milliseconds (default: 5000, floor 100)
• DATABASE_MAX_CONNECTIONS — Read-pool connection count (default: 10, clamped to 1-64)
• DATABASE_SHOW_SQL — Log every SQL statement at DEBUG (default: false)
• DB_COMPACT_ON_UPGRADE — Run the one-time post-upgrade startup compaction (default: true; false opts out)
• FLYWAY_REPAIR — Run Flyway repair and exit (default: false)
• FTS_INTEGRITY — FTS5 integrity check at startup: startup (default) or off
• MCP_ALLOWED_HOSTS — Comma-separated Host header allowlist extending the loopback defaults (HTTP transport)
• MCP_ALLOW_UNAUTHENTICATED — Opt in to MCP_TRANSPORT=http with API_ENABLED=false, serving /mcp as the local principal (default: false)
• MCP_HTTP_HOST — Bind address when using http transport (default: 0.0.0.0)
• MCP_SERVER_NAME — Service name reported in MCP identity and REST service metadata (default: mcp-task-orchestrator-current)
• MCP_TOOL_PROFILE — Tool profile over stdio: orchestration (default), knowledge, or director
• READINESS_FILE — Readiness marker file touched once startup succeeds (default: /tmp/mcp-task-orchestrator.ready)
• RESOURCE_LEASES_ENFORCED — Deployment-wide kill switch for the resource-lease gate (default: true)
• RETENTION_AUDIT_EVENTS_DAYS — Days to keep audit-class events rows (default: 0 = forever)
• RETENTION_CALL_LOG_DAYS — Days to keep folded call_log rows (default: 90)
• RETENTION_EVENTS_DAYS — Days to keep activity-class events rows (default: 180)
• RETENTION_LEASE_HISTORY_DAYS — Days to keep closed resource_lease_history intervals (default: 365)
• SCHEMA_MODE — Schema phase: migrate (default) applies pending migrations; validate refuses pending or future versions
• UPGRADE_BACKUP — Verified pre-upgrade copy of a 3.x database (<db>.pre-4.0.<yyyyMMddTHHmmssZ>.bak) taken before its first 4.0 migration; a failed copy fails startup. Set false to skip (default: true)

This server takes extra arguments — see its repository.