AgentArmorHQ
Sign in

backlog-mcp-server

MCP server · npm · graded 2026-10-28Source linked

[![MCP Toplist](https://mcptoplist.com/badge/glama%2Fnulab%2Fbacklog-mcp-server.svg)](https://mcptoplist.com/server/glama%2Fnulab%2Fbacklog-mcp-server) ![MIT License](https://img.shields.io/badge/license-MIT-green.svg) ![Build](https://github.com/nulab/ba

No outside reports on file

Use this only if you trust the AI system with your Backlog data and have secured your API credentials; start with read-only permissions and monitor what actions the AI takes.

Based on public adoption and transparency signals as of Oct 28, 2026. Our opinion, not a code audit or security guarantee.

Was this verdict for Backlog MCP Server helpful?

What it can access

  • Local filesNo local folder access notedLOW
  • Command executionNo shell command runner notedLOW
  • Network reachConnects to outside service APINOTED
  • CredentialsRequires API key or tokenREVIEW
  • Package sourcenpm (backlog-mcp-server)PUBLIC

Inferred from this listing’s public package details and description. Check the project’s source before installing.

Install

npx -y backlog-mcp-server

All setup options ↓

Check this skillWatch it in my stackCompareREADME badgeView project

Everything known

We found nothing about this project in the sources we read (last checked 2026-10-30). That does not mean it has no problems.

0 incidents · 0 advisories · 0 news articles · 0 community threads · checked 2026-10-30

Popularity grade: D (from public signals such as stars and downloads, not a code review). Graded 2026-10-28.

Sources we read: OSV, GitHub Advisory Database, CISA Known Exploited Vulnerabilities, 44 security news feeds and our incident library. Last checked 2026-10-30.

Check a specific version →

About Backlog MCP Server

This is an MCP server that connects AI assistants to Backlog, a project management and issue-tracking tool. It lets AI read and interact with your Backlog projects, issues, and team data through a standardized interface.

Who it’s for

Development teams and organizations using Backlog who want AI assistants to help with project management tasks like checking issue status or summarizing work. Best for teams comfortable giving AI read/write access to their project data.

Alternatives

  • Jira MCP server (if using Atlassian Jira instead)
  • GitHub Issues integration (if projects are on GitHub)
  • Linear MCP connector (if using Linear for issue tracking)
  • Manual API calls (direct REST requests without an MCP wrapper)

Setup

Check these steps against the project’s own instructions before running anything.

Install via npm with npm install backlog-mcp-server or add to Claude Desktop by including the package in your mcpServers configuration. Follow the project's README for authentication setup using your Backlog API credentials.

Why this grade

DD — High risk signals

Signal-based grade (1/7 points): no public source code found. This reflects adoption and transparency, not a code review.

Popularity and upkeep

34/100
Weekly npm downloads
38.2k
Listing last refreshed
2026-10-30

These are public popularity signals, not a maintenance check. Look at the repository’s commit history and open issues.

Risks to watch for

  • Account access: Needs valid Backlog API credentials, so the AI gains whatever permissions that account has (potentially read/write on all projects)
  • Data exposure: Project details, issues, comments, and user information become available to the AI and could be logged or leaked
  • Prompt injection: Malicious issue titles or descriptions could trick the AI into taking unintended actions if not carefully filtered
  • Credential storage: API keys must be stored somewhere—insecure storage means anyone with system access gets Backlog access
  • Unintended changes: AI could modify or delete issues if given write permissions, especially if prompted ambiguously

How to lower the risk

Least-privilege permissions

  • Create a Backlog API token with read-only access if possible
  • Restrict the token to specific projects, not all projects

Network isolation

  • Keep Backlog credentials in environment variables, not hardcoded
  • Use a dedicated bot account in Backlog instead of a personal account

Monitoring

  • Log all API calls and watch for unusual access patterns
  • Review AI-generated changes to issues before they're saved

Red flags to watch for

  • AI making changes you didn't explicitly request
  • Requests to take actions on unrelated projects
  • Sudden spike in API calls or data exports

Questions

How do I install Backlog MCP Server?

Run npx -y backlog-mcp-server in your terminal, or add the server entry to your claude_desktop_config.json or .cursor/mcp.json as shown in the Setup section on this page.

Are there security reports about Backlog MCP Server?

No reports found for this package in our research (last checked 2026-10-30). Backlog MCP Server currently holds Grade D (High risk signals) based on public adoption and transparency signals. Key risk areas to watch include account access, data exposure, prompt injection.

Is Backlog MCP Server actively maintained?

Backlog MCP Server has 38.2k weekly npm downloads. Our directory data was last refreshed on 2026-10-30. Check recent commit activity, release tags, and open issues before pinning it in production.

What are alternatives to Backlog MCP Server?

Notable alternatives to Backlog MCP Server include Jira MCP server, GitHub Issues integration, Linear MCP connector, Manual API calls. You can also compare Backlog MCP Server side by side with other MCP servers in the Related tools section on this page.

README badge and team notes

Maintain or use Backlog MCP Server? Show its live grade in your GitHub README, docs site, or run a check from the terminal before you install.

AgentArmorHQ Risk Grade D for Backlog MCP Server

GitHub README Markdown:

markdown
[![AgentArmorHQ Risk Grade for Backlog MCP Server](https://agentarmorhq.com/api/badge/nulab-backlog-mcp-server)](https://agentarmorhq.com/skills/nulab-backlog-mcp-server)

HTML embed:

html
<a href="https://agentarmorhq.com/skills/nulab-backlog-mcp-server"><img src="https://agentarmorhq.com/api/badge/nulab-backlog-mcp-server" alt="AgentArmorHQ Risk Grade for Backlog MCP Server" height="20" /></a>

Terminal check:

terminal
curl -fsSL https://agentarmorhq.com/api/cli | node --input-type=module - check "nulab-backlog-mcp-server"

Share with your security lead

Need sign-off to use backlog-mcp-server? Copy this note for Slack, a ticket or a pull request.

### AgentArmorHQ Security Review Memo: backlog-mcp-server
- **Listing URL:** https://agentarmorhq.com/skills/nulab-backlog-mcp-server
- **Type:** App connector
- **Risk Grade:** Grade D (High risk signals)
- **Outside Security Advisories on File:** 0

#### Permission & Blast-Radius Signals
- **Local files:** No local folder access noted
- **Command execution:** No shell command runner noted
- **Network reach:** Connects to outside service API
- **Credentials:** Requires API key or token
- **Package source:** npm (backlog-mcp-server)

#### Recommended Hardened Setup
- **Command:** `npx -y --ignore-scripts backlog-mcp-server`
- **Controls:** Pin an exact version in `.mcp.json`, scope access to a single workspace folder, and use a least-privilege read-only token where supported.

_Based on public adoption and transparency signals as of Oct 28, 2026. Our opinion, not a code audit or security guarantee._

Key facts

Type
App connector
Install command
npm install backlog-mcp-server
Est. context load
~900 tokens / turn (~5 tool schemas, 0.45% of 200k context)
Popularity
38.2k weekly npm downloads
Last updated
2026-10-30
Last graded
2026-10-28

Community

Discussions for Backlog MCP Server

Ask questions or share configuration tips. Governed by our Community Rules & Terms.

No posts match this filter yet.

Be the first to ask a question or share a working tip.

Was this listing for Backlog MCP Server helpful?

Check before you install, in Claude

Your assistant answers Block, Review or No known issues for any package before it installs it.

Get this check inside Claude