Agents work the same boards.
Docket was built so that an agent files, triages, and closes cards through the same service, with the same rules, as a person at the keyboard.
The MCP server
Docket's MCP server has 55 tools. They cover the everyday work on a board: projects, boards, columns, cards, comments, labels, activity, attachments, and members. Attaching a file, project notes and connections, and the Trello import are done in the web app.
The tools are relayed to every agent session by Roost, so a new session reaches them without starting its own copy of the server.
| Area | Count | Tools |
|---|---|---|
| Projects | 10 | list_projects, get_project_tree, get_project, get_project_subtree, get_project_breadcrumbs, create_project, update_project, archive_project, delete_project, reorder_projects |
| Boards | 10 | list_boards, get_board, create_board, update_board, move_board, archive_board, delete_board, duplicate_board, upload_board_icon, delete_board_icon |
| Columns | 5 | get_board_columns, create_column, rename_column, delete_column, reorder_columns |
| Cards | 10 | search_cards, create_card, get_card, get_card_description, update_card, assign_card, flag_card, move_card, archive_card, delete_card |
| Comments, labels, activity | 11 | add_comment, list_comments, update_comment, delete_comment, list_labels, create_label, update_label, delete_label, add_label_to_card, remove_label_from_card, get_card_activity |
| Attachments and people | 4 | list_attachments, delete_attachment, list_members, list_apps |
| Defect aliases | 3 | list_defects, get_defect, update_defect_status |
| Operations | 2 | check_service_health, get_diagnostics |
Reporting a bug without an account
Fleet products post bug, enhancement, and feedback reports to one public endpoint. It needs no account, allows ten requests a minute per address, and creates the Triage board and its first column the first time it is used.
Every other endpoint needs an authenticated user or a service token.
Service tokens
Scripts and other tools authenticate with service tokens. Docket stores only a SHA-256 hash of each token and compares in constant time, so reading the configuration never reveals a usable token. A command-line helper generates a token for a named service.
Events
Two WebSocket channels carry changes: one for a project's events and one for a board's. A client authenticates with the same kinds of credential as the REST calls.
Guardrails on writes
| Unknown column on create | A 404 that names the problem, rather than a server error. |
|---|---|
| Request size | Title, description, comment, and attachment limits are enforced, with a message that names the field. |
| Repeat creates | Create requests can carry an Idempotency-Key header, so a retried request is not applied twice. |
| Browser access | Cross-origin access is limited to listed origins, methods, and headers, and responses carry strict transport, frame, content-type, and referrer headers. |
Questions about this tool?
Write to Renkara Media Group and a person will answer.