com.qretro/retro

com.qretro/retroqretro.comstreamable-httpv1.3.0Scanned 23 hours ago

QRetro retrospectives and planning poker over MCP: boards, action items, poker games, estimates.

29 tools: 1 can delete or cancel things, 12 change things and 16 only read.

Reads private data · 2
Reads text others write · 3
Can send data out · 1
No findings

Tools listed without sign-in. Remote posture

Anlyon alternative

13 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

29 tools

Deletes or cancels 1Removes, cancels or revokes something.Claude Code: deny

retro.board.messages.delete_ownDeletes a single board message.No findings
Why it is in this group
- The name "retro.board.messages.delete_own" says "delete": a word for removing or ending something.
Description, as the server wrote it
Deletes a single board message. Access is strictly governed by API policies: users can delete their own messages, or any message if they have board update rights (requires mcp:write scope for the latter).

Changes things 12Creates or changes something that can be changed back.Claude Code: ask

poker.game.task.revealReveals the cards of a task and computes its estimate from the votes cast — this is the only way an estimate appears, there is no way to set a number directly.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Reveals the cards of a task and computes its estimate from the votes cast — this is the only way an estimate appears, there is no way to set a number directly. Pass reveal=false to hide the cards again and drop the estimate, which also clears the votes for a re-vote. Only the team owner can change a game. Requires mcp:write scope.
poker.game.task.selectPuts a task on the table: everyone looking at the game sees it as the one being estimated right now.No findings
Why it is in this group
- The name "poker.game.task.select" says "select": a word for a change.
Description, as the server wrote it
Puts a task on the table: everyone looking at the game sees it as the one being estimated right now. Only the team owner can change a game. Requires mcp:write scope.
poker.game.task.syncWrites the agreed estimate back to the issue tracker — Jira story points, Linear estimate.No findings
Why it is in this group
- The name "poker.game.task.sync" says "sync": a word for a change.
Description, as the server wrote it
Writes the agreed estimate back to the issue tracker — Jira story points, Linear estimate. Works only for tasks imported from a tracker and only when the integration was connected with write permissions; poker.sources.list shows whether it was. Only the team owner can change a game. Requires mcp:write scope.
poker.game.tasks.addAdds tasks to a poker game by hand — for work that lives outside an issue tracker, or when no tracker is connected.No findings
Why it is in this group
- The name "poker.game.tasks.add" says "add": a word for a change.
Description, as the server wrote it
Adds tasks to a poker game by hand — for work that lives outside an issue tracker, or when no tracker is connected. To pull tasks from Jira or Linear use poker.game.tasks.import instead. Requires mcp:write scope.
poker.game.tasks.importPulls tasks from a connected issue tracker into a poker game.No findings
Why it is in this group
- The name "poker.game.tasks.import" says "import": a word for a change.
Description, as the server wrote it
Pulls tasks from a connected issue tracker into a poker game. Give it either iteration_ref from poker.iterations.list to take a whole sprint, or query to search by text and issue key. Tasks already in the game are skipped. Only the team owner can change a game. Requires mcp:write scope.
poker.games.createCreates a planning poker game for a team and returns the link participants join with.No findings
Why it is in this group
- The name "poker.games.create" says "create": a word for a change.
Description, as the server wrote it
Creates a planning poker game for a team and returns the link participants join with. Pick a ready-made scale — fibonacci, modified_fibonacci, tshirts, powers_of_two — or pass your own values in scale_values. Requires mcp:write scope.
retro.actions.completeMarks an action item as completed.No findings
Why it is in this group
- The description's first verb is "mark": a word for a change.
Description, as the server wrote it
Marks an action item as completed. Requires mcp:write scope.
retro.actions.createCreates a new action item on a retrospective board.No findings
Why it is in this group
- The name "retro.actions.create" says "create": a word for a change.
Description, as the server wrote it
Creates a new action item on a retrospective board. Requires mcp:write scope.
retro.actions.updateUpdates an existing action item: text, priority, due date, or assignee.No findings
Why it is in this group
- The name "retro.actions.update" says "update": a word for a change.
Description, as the server wrote it
Updates an existing action item: text, priority, due date, or assignee. Requires mcp:write scope.
retro.board.messages.updateUpdates the text of an existing board message created by the current MCP user.Can send data outNo findings
Why it is in this group
- The name "retro.board.messages.update" says "update": a word for a change.
What it can reach
- outboundThe name "retro.board.messages.update" says "update" and "message": it writes something other people read.
Description, as the server wrote it
Updates the text of an existing board message created by the current MCP user.
retro.board.suggested_actions.promoteTurns a pending suggested action from retro.board.insights.list into a real action item on the board and marks the suggestion accepted, keeping the wording and the link to its clus…No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Turns a pending suggested action from retro.board.insights.list into a real action item on the board and marks the suggestion accepted, keeping the wording and the link to its cluster. Requires mcp:write scope.
retro.board.suggested_actions.rejectRejects a pending suggested action from retro.board.insights.list: the suggestion moves to rejected and no action item is created.No findings
Why it is in this group
- The name "retro.board.suggested_actions.reject" says "reject": a word for a change.
Description, as the server wrote it
Rejects a pending suggested action from retro.board.insights.list: the suggestion moves to rejected and no action item is created. Requires mcp:write scope.

Only reads 16Looks things up and changes nothing.Show 16 read-only tools

poker.game.getReturns one planning poker game: its estimation scale, progress, the task currently on the table and the link participants use to join.Reads private dataNo findings
Why it is in this group
- The name "poker.game.get" says "get": a word for reading.
What it can reach
- private-dataThe description's first sentence says "return" and "table": it reads databases.
Description, as the server wrote it
Returns one planning poker game: its estimation scale, progress, the task currently on the table and the link participants use to join. Use poker.game.tasks.list for the tasks themselves.
Annotations the server declares
- readOnlyHint: true
poker.game.tasks.listReturns the tasks of a poker game with their estimate, individual votes, tracker key and link.No findings
Why it is in this group
- The name "poker.game.tasks.list" says "list": a word for reading.
Description, as the server wrote it
Returns the tasks of a poker game with their estimate, individual votes, tracker key and link. needs_sync tells whether the agreed estimate still differs from the one stored in the tracker — feed those tasks to poker.game.task.sync. Filter with estimated to see what is done or what is left.
Annotations the server declares
- readOnlyHint: true
poker.games.listReturns the planning poker games of a team, newest first, with how many tasks each of them has and how many already carry an estimate.No findings
Why it is in this group
- The name "poker.games.list" says "list": a word for reading.
Description, as the server wrote it
Returns the planning poker games of a team, newest first, with how many tasks each of them has and how many already carry an estimate. Personal games outside a team are not exposed over MCP.
Annotations the server declares
- readOnlyHint: true
poker.iterations.listReturns the iterations of a connected issue tracker — Jira sprints (active and upcoming), and whatever a future tracker calls the same thing.Reads text others writeNo findings
Why it is in this group
- The name "poker.iterations.list" says "list": a word for reading.
What it can reach
- untrusted-inputThe description's first sentence says "return" and "issue": it reads issues, which other people can write.
Description, as the server wrote it
Returns the iterations of a connected issue tracker — Jira sprints (active and upcoming), and whatever a future tracker calls the same thing. Filter by name with query, for example "AFT 50". Pass the ref of the iteration you want to poker.game.tasks.import to pull its tasks into a game. Trackers without iteration support (currently Linear) return an empty list — search by text instead.
Annotations the server declares
- readOnlyHint: true
poker.sources.listReturns the issue trackers connected to a team (Jira, Linear) and what each of them can do: search for tasks, list iterations (sprints, cycles), write estimates back.Reads text others writeNo findings
Why it is in this group
- The name "poker.sources.list" says "list": a word for reading.
What it can reach
- untrusted-inputThe description's first sentence says "return" and "issue": it reads issues, which other people can write.
Description, as the server wrote it
Returns the issue trackers connected to a team (Jira, Linear) and what each of them can do: search for tasks, list iterations (sprints, cycles), write estimates back. Call this first — the other poker tools depend on what is connected. An empty list means tasks can only be added manually with poker.game.tasks.add.
Annotations the server declares
- readOnlyHint: true
retro.actions.listReturns action items across all retrospectives at once — the answer to "what did we agree on and never finish".No findings
Why it is in this group
- The name "retro.actions.list" says "list": a word for reading.
Description, as the server wrote it
Returns action items across all retrospectives at once — the answer to "what did we agree on and never finish". Covers every team available unless team_id narrows it down; filters by status, assignee and date. Use this instead of walking boards one by one with retro.board.actions.list.
Annotations the server declares
- readOnlyHint: true
retro.board.actions.listReturns action items from a retrospective board, including status, priority, assignee, and due date.No findings
Why it is in this group
- The name "retro.board.actions.list" says "list": a word for reading.
Description, as the server wrote it
Returns action items from a retrospective board, including status, priority, assignee, and due date.
Annotations the server declares
- readOnlyHint: true
retro.board.health.getReturns the health check of a retrospective: score per category on a 0-10 scale, alignment between participants, turnout, and the same score across the previous retrospectives of t…No findings
Why it is in this group
- The name "retro.board.health.get" says "get": a word for reading.
Description, as the server wrote it
Returns the health check of a retrospective: score per category on a 0-10 scale, alignment between participants, turnout, and the same score across the previous retrospectives of the team. Returns health_check: null when the team did not run a health check on this board.
Annotations the server declares
- readOnlyHint: true
retro.board.insights.listReturns insights (clusters) and suggested actions for a retrospective board.No findings
Why it is in this group
- The name "retro.board.insights.list" says "list": a word for reading.
Description, as the server wrote it
Returns insights (clusters) and suggested actions for a retrospective board. Insights include topic clusters with sentiment, urgency, and category analysis.
Annotations the server declares
- readOnlyHint: true
retro.board.messages.listReturns all participant messages (cards) for a retrospective board, organized by template columns (e.g.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "retro.board.messages.list" says "list": a word for reading.
What it can reach
- private-dataThe name "retro.board.messages.list" says "list" and "message": it reads messages.
- private-dataThe description's first sentence says "return" and "message": it reads messages.
- untrusted-inputThe name "retro.board.messages.list" says "list" and "message": it reads messages, which other people can write.
- untrusted-inputThe description's first sentence says "return" and "message": it reads messages, which other people can write.
Description, as the server wrote it
Returns all participant messages (cards) for a retrospective board, organized by template columns (e.g. "What went well", "What didn't go well"). Includes text, sentiment, category, grouping, and vote counts.
Annotations the server declares
- readOnlyHint: true
retro.board.roti.getReturns ROTI (Return on Time Invested) voting metrics for a retrospective board, including average score, distribution, and trend across previous retrospectives.No findings
Why it is in this group
- The name "retro.board.roti.get" says "get": a word for reading.
Description, as the server wrote it
Returns ROTI (Return on Time Invested) voting metrics for a retrospective board, including average score, distribution, and trend across previous retrospectives.
Annotations the server declares
- readOnlyHint: true
retro.board.summary.getReturns the summary of a retrospective with participant info and metadata.No findings
Why it is in this group
- The name "retro.board.summary.get" says "get": a word for reading.
Description, as the server wrote it
Returns the summary of a retrospective with participant info and metadata. Works for unfinished boards too — summary is null until the retro is wrapped up, so check is_finished.
Annotations the server declares
- readOnlyHint: true
retro.boards.listReturns retrospectives (boards) of a team, newest first.No findings
Why it is in this group
- The name "retro.boards.list" says "list": a word for reading.
Description, as the server wrote it
Returns retrospectives (boards) of a team, newest first. Unfinished boards are included unless finished_only is set — otherwise check the is_finished flag. Filters by period via since/until. Pass team_id when several teams are available; with a single team it can be omitted.
Annotations the server declares
- readOnlyHint: true
retro.boards.searchSearch across retrospectives by keyword: board summaries, action items and participant cards.No findings
Why it is in this group
- The name "retro.boards.search" says "search": a word for reading.
Description, as the server wrote it
Search across retrospectives by keyword: board summaries, action items and participant cards. Cards hidden by private writing during an ongoing retro are excluded. Optionally filter by team.
Annotations the server declares
- readOnlyHint: true
retro.team.members.listReturns the members of a team with their id, name and role (owner, admin, facilitator, member).No findings
Why it is in this group
- The name "retro.team.members.list" says "list": a word for reading.
Description, as the server wrote it
Returns the members of a team with their id, name and role (owner, admin, facilitator, member). Use the id as assign_to in retro.actions.create, retro.actions.update and retro.board.suggested_actions.promote. This is the team roster, the same one people see in team settings — it says nothing about who wrote which card. Pass team_id when several teams are available; with a single team it can be omitted.
Annotations the server declares
- readOnlyHint: true
retro.teams.listReturns the list of teams the user belongs to.No findings
Why it is in this group
- The name "retro.teams.list" says "list": a word for reading.
Description, as the server wrote it
Returns the list of teams the user belongs to. boards_count is the total number of boards in a team, finished and unfinished alike — use retro.boards.list to tell them apart.
Annotations the server declares
- readOnlyHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

6 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 1 outbound tool breaks every one.

Reads private data2: Reads files, mail, messages, databases, secrets, calendars or repositories.; poker.game.get
retro.board.messages.list
Reads text others write3: Brings in text someone else can write: web pages, inbound email, messages, issues and comments.; poker.iterations.list
poker.sources.list
retro.board.messages.list
Can send data out1: Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.; retro.board.messages.update

deny to break every path

{
  "permissions": {
    "deny": [
      "mcp__retro__retro_board_messages_update"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Tools listed without sign-in

Looked at Oct 22, 2026, 14:39 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable: yes
HTTP status of an anonymous initialize: 200
tools/list served without credentials: yes
Tools that change things, listed without credentials: 13
Protocol version: 2025-06-18
WWW-Authenticate on 401: not observed
resource_metadata in WWW-Authenticate: not observed
RFC 9728 protected resource metadata: https://mcp.qretro.com/.well-known/oauth-protected-resource
Authorization servers: https://api.qretro.com
Legacy HTTP+SSE transport: no
Dynamic client registration: yes
Client ID metadata documents: no

HighThe whole server
The endpoint served tools/list without credentials, and the list has 13 tools that change things (1 destructive, 12 write). Whether a call also works without credentials was not tested: tools are never called.
Matched text
https://mcp.qretro.com: tools/list returned 29 tools to an anonymous client, including retro.board.messages.delete_own (destructive), retro.board.messages.update (write), retro.actions.create (write), retro.actions.update (write), retro.actions.complete (write) and 8 more
What this check looks for

Findings

Matches of fixed checks, with the text they matched.

No check matched anything in these tool definitions. That is not a safety guarantee.

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 1.3.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http retro https://mcp.qretro.com

claude mcp add --transport http retro https://mcp.qretro.com

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__retro__retro_teams_list",
      "mcp__retro__retro_team_members_list",
      "mcp__retro__retro_boards_list",
      "mcp__retro__retro_actions_list",
      "mcp__retro__retro_board_messages_list",
      "mcp__retro__retro_board_summary_get",
      "mcp__retro__retro_board_actions_list",
      "mcp__retro__retro_board_insights_list",
      "mcp__retro__retro_board_health_get",
      "mcp__retro__retro_board_roti_get",
      "mcp__retro__retro_boards_search",
      "mcp__retro__poker_sources_list",
      "mcp__retro__poker_iterations_list",
      "mcp__retro__poker_games_list",
      "mcp__retro__poker_game_get",
      "mcp__retro__poker_game_tasks_list"
    ],
    "ask": [
      "mcp__retro__retro_board_messages_update",
      "mcp__retro__retro_actions_create",
      "mcp__retro__retro_actions_update",
      "mcp__retro__retro_actions_complete",
      "mcp__retro__retro_board_suggested_actions_promote",
      "mcp__retro__retro_board_suggested_actions_reject",
      "mcp__retro__poker_games_create",
      "mcp__retro__poker_game_tasks_add",
      "mcp__retro__poker_game_tasks_import",
      "mcp__retro__poker_game_task_select",
      "mcp__retro__poker_game_task_reveal",
      "mcp__retro__poker_game_task_sync"
    ],
    "deny": [
      "mcp__retro__retro_board_messages_delete_own"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as retro. Review it before you use it.

Capability tags behind 5 rules

mcp__retro__retro_board_messages_list private-data, untrusted-input
mcp__retro__retro_board_messages_update outbound
mcp__retro__poker_sources_list untrusted-input
mcp__retro__poker_iterations_list untrusted-input
mcp__retro__poker_game_get private-data

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/com.qretro/retro/verify?hash=d86e409fbf1e9123b04d5937fe74b1d31e3eca357cc3f7a91213d7bbaa577102" | jq -e '.changed == false'

Pinned hash d86e409fbf1e, from Oct 21, 2026, 18:54 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/com.qretro/retro/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

[![anlyon.dev](https://anlyon.dev/badge/com.qretro/retro.svg)](https://anlyon.dev/servers/com.qretro/retro)

Source: MCP Registry. Synced Oct 21, 2026, 18:01 UTC.