Collaboard

A lightweight, self-hosted kanban board built for human-agent collaboration. Single executable. No database server. No containers. No cloud accounts. Download, run, and open your browser.

---

The board. Drag cards between lanes, reorder on the fly, and watch every change land live for everyone connected.

What is Collaboard?

Most kanban tools are either too heavy (Jira), too locked-in (Trello), or don't speak the same language as AI agents. Collaboard is purpose-built for small teams where humans and AI agents collaborate side-by-side on a shared board.

Download a single binary, run it, and open your browser. There's no database server to provision, no container runtime, no cloud account. The data lives in a SQLite file next to the executable, and every change streams to every connected client in real time.

Two primary audiences. A person runs Collaboard from the browser — a familiar kanban board with drag-and-drop, markdown, search, and dark mode. An agent runs Collaboard through a built-in MCP server — the same board, exposed as tools over Streamable HTTP. Create a card from the UI or from Claude Code; move work, comment, label, archive. Humans and agents share one board, one auth model, and one source of truth, and they see each other's changes the instant they happen.

If you're building an AI harness, agent framework, or multi-agent system that needs a shared task board, Collaboard is the surface your agents and your humans can both reach. See [For Agents](#for-agents) for MCP setup.

Features

• First-class AI agent support — a built-in MCP endpoint exposes the full board as tools. Agents create cards, move work, comment, label, archive, search, and manage attachments — see [For Agents](#for-agents).
• Real-time collaboration — Server-Sent Events stream every change to every connected client. An agent moves a card and you see it move; no refresh.
• Outbound webhooks — POST board events to any URL across a 22-event catalog (cards, comments, labels, attachments, lanes, boards). Manage subscriptions from a built-in admin screen, the REST API, or MCP — each with its own event selection, optional HMAC signing, and a delivery log. See [Webhooks](#webhooks).
• Drag-and-drop — reorder cards within a lane, move them between lanes, and reorder whole lanes across the board.
• Rich Markdown rendering — descriptions and comments render GitHub-flavored Markdown and then some: syntax-highlighted code blocks, Mermaid diagrams (flowcharts, sequence, and more, rendered inline), emoji shortcodes (:rocket: → 🚀), a safe subset of inline HTML (`, /, , and friends), plus tables, task lists, and #42` card auto-linking. See the [card tour](#a-tour) for a live example.
• Cross-board search — find cards by name, description, or number (#42) across every board. Open it with / or Ctrl+K.
• Attachments — paste screenshots straight from the clipboard or drag files onto a card (up to 5 MB in the browser; larger files up to 50 MB via the API).
• Multi-board — run as many boards as you like from a single instance.
• Board-scoped labels — color-coded labels with a full color picker (spectrum, hex input, eyedropper).
• Archive — hide finished cards from the board without deleting them; restore any time.
• Deep linking — direct URLs to boards and cards (/boards/my-board/cards/42).
• Dark and light themes — toggle and it's remembered per browser.

Quick Start

macOS / Linux

curl -sSL https://raw.githubusercontent.com/MrBildo/collaboard/main/install.sh | bash
~/.collaboard/Collaboard.Api

Windows (PowerShell)

irm https://raw.githubusercontent.com/MrBildo/collaboard/main/install.ps1 | iex
& "$env:LOCALAPPDATA\Collaboard\Collaboard.Api.exe"

Open http://localhost:8080 in your browser. The admin auth key is printed to the console on first run — copy it and paste it on the login screen.

[INF] Admin auth key: 01JQXYZ...

> For detailed installation options — manual download, macOS Gatekeeper, upgrades — see the [Installation Guide](docs/installation.md). For day-to-day usage, see the [User Guide](docs/user-guide.md).

A Tour

Card detail. Rich Markdown — Mermaid diagrams, syntax-highlighted code, tables, and emoji all render inline — alongside comments, labels, size, and attachments in one panel.

Search. Press / or Ctrl+K to find any card across every board, grouped by board.

Board settings. Add and reorder lanes, define card sizes, and manage labels with a visual color picker.

Dark mode. Toggle between light and dark themes; the choice is remembered per browser.

Deployment Shapes

Collaboard supports two production deployment shapes. The Quick Start above gives you the first one; the second is for teams that want the API and Portal hosted as separate processes (typically behind a reverse proxy).

• LAN single-process (default). One self-contained executable serves both the JSON API and the embedded React Portal from the same origin. The SQLite database file lives next to the binary. No reverse proxy, no CORS, no static-site host required — just the one process listening on a port. This is the shape the Quick Start sets up, and the recommended path for small teams on a trusted network.

• Portal + API hosted separately. The headless API (Collaboard.Api with Hosting:ServeSpa=false) runs as one process; the React Portal is built (frontend/dist/) and served by any static-file host on its own origin. The Portal reads a runtime config.json from its own origin to learn the API base URL, and the API allows the Portal's origin via Cors:AllowedOrigins. Collabhost is one worked example; any static-site host paired with a process supervisor that can run a self-contained .NET binary works the same way.

See the [Installation Guide](docs/installation.md) for the LAN walkthrough and [INSTALL.md](INSTALL.md) for the hosted-separately walkthrough.

Host Configuration

Collaboard ships with sensible defaults. Edit appsettings.json next to the executable to override them — your edits are preserved across upgrades via the installer's smart three-way merge (operator edits preserved, untouched defaults refreshed, new shipped keys added). Environment variables override appsettings.json for ad-hoc tweaks.

Port and Bind Address

// appsettings.json
{
  "Urls": "http://0.0.0.0:9090"
}

Or via environment variable:

export Urls=http://0.0.0.0:9090

Admin Auth Key

By default, a random auth key is generated on first run and printed to the console. To set a known key:

// appsettings.json
{
  "Admin": {
    "AuthKey": "my-secret-admin-key"
  }
}

Database Location

The database path is required configuration with no default — the app never derives a path from the working or binary directory. The installer writes an absolute path into appsettings.json for you; to relocate the database, edit it there (use an absolute path) — your edit is preserved by the smart-merge on the next upgrade:

// appsettings.json
{
  "ConnectionStrings": {
    "Board": "Data Source=/srv/collaboard/data/collaboard.db"
  }
}

Full Settings Reference

| Setting | Default | Description | |---------|---------|-------------| | Urls | (unset) | Convenience override for bind address and port. When set (or ASPNETCORE_URLS is set), it wins over the structured Hosting:ListenAddress/Hosting:ListenPort pair below. | | Hosting:ListenAddress | 0.0.0.0 | Bind address. Combined with Hosting:ListenPort to build the bind URL when Urls/ASPNETCORE_URLS is unset. | | Hosting:ListenPort | 8080 | Bind port. Combined with Hosting:ListenAddress to build the bind URL when Urls/ASPNETCORE_URLS is unset. | | Hosting:ServeSpa | true | When true, the API also serves the embedded React Portal from wwwroot/ (LAN single-process shape). Set to false for headless hosted-separately deployments — unmatched routes return 404 instead of the SPA shell. | | Cors:AllowedOrigins | [] (empty) | List of allowed cross-origin Portal hosts. Empty disallows all cross-origin requests; same-origin LAN deployments do not need this. Set to the Portal's origin(s) for hosted-separately deployments (e.g. ["https://collaboard.example.com"]). | | ConnectionStrings:Board | (required — no default) | SQLite database path. Must be an absolute path; the installer writes this into appsettings.json. Startup fails loud if unset or unwritable. | | Admin:AuthKey | (auto-generated) | Override the admin auth key. | | Webhooks:Endpoint | (unset) | Deprecated — migration seed only. The single delivery URL from earlier versions. On the first startup after upgrading it is migrated into a managed subscription and is no longer read for delivery; manage delivery targets through the API instead (see [Webhooks](#webhooks) below). Unset it once the upgrade is done so it can't seed again. | | Webhooks:Secret | (unset) | Deprecated — migration seed only. The shared signing secret from earlier versions, carried into the migrated subscription on first startup. No longer read for delivery — each subscription now carries its own secret. | | Webhooks:Enabled | true | Global master switch for all webhook delivery. Set to false to pause every subscription at once, regardless of each one's own enabled state. | | Webhooks:DeliveryTimeout | 00:00:05 | Per-POST timeout. A slow endpoint is treated as a failed attempt, not waited on. | | Webhooks:MaxAttempts | 3 | Delivery attempts per event (initial try plus retries) before the event is dropped. | | Webhooks:RetryBackoffBase | 00:00:02 | Wait before the first retry. Later retries grow it (roughly 4× per step) with a little jitter. | | Webhooks:AllowPrivateNetworkTargets | false | Security control for outbound delivery. When false, deliveries to private, internal, loopback, and link-local addresses are blocked, and such URLs are rejected when a subscription is created. Setting true re-permits the private LAN ranges only (RFC1918 and IPv6 unique-local); loopback, link-local, and the cloud-metadata endpoint (169.254.169.254) stay blocked regardless. It's a single global all-or-nothing switch, takes effect on restart, and Tailscale 100.x targets work without it. This is a breaking change when upgrading — see [Webhooks](#webhooks) below. | | Webhooks:DeliveryLogRetentionDays | 30 | Delivery-attempt log rows older than this many days are deleted on a daily sweep. Set to 0 to keep the log forever. |

Webhooks

Collaboard can POST a structured event to a URL of your choice whenever something happens on a board — a card created, moved, or labeled; a comment posted; a lane reordered; and more, across a 22-event catalog — a poll-free way to drive automation (a workflow tool, a script, an agent) off board activity.

Delivery targets are managed as subscriptions. You can register more than one, and each carries its own URL, an optional signing secret, an enabled/disabled state, and a selection of which events it wants to receive. Manage them from the built-in Webhooks admin screen (in the Admin panel), the REST API, or — for agents — the MCP tools. See the [Webhooks Integration Guide](docs/integrating-webhooks.md) for the walkthrough and the [API Reference](docs/api-reference.md#webhooks) for the exact endpoints and the full event catalog.

The Webhooks:Enabled setting in the table above is the global master switch — set it to false to pause every subscription at once. The other Webhooks:* settings are global delivery policy (per-POST timeout, retries, and how long the delivery log is kept) and apply to all subscriptions.

> Upgrading from an earlier version? If you previously configured a single endpoint > with Webhooks:Endpoint (and optionally Webhooks:Secret), it is migrated > automatically into a subscription the first time this version starts — you don't lose > your webhook. After the upgrade, unset Webhooks:Endpoint so it isn't seeded again if > you later delete that subscription. From then on, manage delivery targets through the > API rather than these settings.

> Breaking change on upgrade — private-network targets are blocked by default. > This version adds a security control, Webhooks:AllowPrivateNetworkTargets (default > false), that blocks webhook deliveries to private and internal addresses. If your > webhook endpoint resolves to one of the blocked ranges, its deliveries stop after the > upgrade until you set Webhooks__AllowPrivateNetworkTargets=true and restart. The > migrated subscription still exists and is visible through the API; only its deliveries > are paused. > > The blocked ranges fall into two tiers. Setting AllowPrivateNetworkTargets=true > re-permits the private LAN tier — the RFC1918 ranges (10.0.0.0/8, > 172.16.0.0/12, 192.168.0.0/16) and IPv6 unique-local (fc00::/7) — so you can > reach a self-hosted tool on your LAN. An always-blocked tier stays blocked no > matter what the flag is set to: loopback (127.0.0.0/8, ::1), link-local > (169.254.0.0/16 — which carries the cloud-metadata endpoint 169.254.169.254 — > and fe80::/10), and the unspecified and multicast ranges. So turning the flag on to > reach a LAN host can never also expose your own loopback services or a cloud > provider's metadata service. The flag is a single global all-or-nothing switch — it > is not per-subscription. > > Ordinary public endpoints are unaffected — and so is the carrier-grade NAT range > 100.64.0.0/10, which includes Tailscale 100.x addresses: a webhook pointed at > a Tailscale 100.x host keeps delivering without the flag.

For the full event contract, the recursion guard you'll want before pointing this at anything that creates cards, and a step-by-step walkthrough, see the [Webhooks Integration Guide](docs/integrating-webhooks.md).

Version

./Collaboard.Api --version

Board Configuration

Fresh Install Defaults

On first run, Collaboard creates:

• An Admin user (auth key printed to the console — save this!)
• A Default board with three lanes: Backlog, In Progress, Done
• Four card sizes: S, M, L, XL

Admin Customization

Admins can configure boards via the Board Settings panel:

• Lanes — add, rename, reorder (drag-and-drop), or delete lanes
• Sizes — define card size options with custom ordinals
• Labels — create color-coded labels with a visual color picker
• Prune — bulk-archive old cards by age, lane, or label filters

Managing Users

Create users via the Admin panel or the API:

# Create a human user
curl -X POST http://localhost:8080/api/v1/users \
  -H "X-User-Key: " \
  -H "Content-Type: application/json" \
  -d '{"name": "Alice", "role": 1}'

The response includes the new user's authKey. Share it — they enter it on the login screen.

| Role | Value | Permissions | |------|-------|-------------| | Administrator | 0 | Full access — boards, lanes, users, labels, all cards | | HumanUser | 1 | Create/edit/delete own cards, comments, attachments | | AgentUser | 2 | Same as Human, but cannot delete cards. Can delete own comments/attachments | | AgentAdministrator | 3 | Agent role with administrator-level board management (lanes, sizes, labels, prune, bulk operations) |

For Agents

Collaboard exposes an MCP (Model Context Protocol) server so agents can operate the board directly — no custom HTTP client, no REST adapter. If your agent speaks MCP, it speaks Collaboard.

Endpoint

| | | |---|---| | URL | http://localhost:8080/mcp | | Transport | Streamable HTTP (the client config type for this is http — see below) | | Auth | Per-call authKey argument carrying a user's ULID key. The /mcp connectio

…

Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: MrBildo
• Source: MrBildo/collaboard
• License: MIT
• Homepage: https://github.com/MrBildo/collaboard/releases/latest

Install and usage instructions live in the source repository linked above.