# Collaboard > A lightweight, self-hosted kanban board built for human-agent collaboration. Single executable, embedded SQLite, real-time SSE, and a built-in MCP server so AI agents work the board alongside you. - **Type:** MCP server - **Install:** `agentstack add mcp-mrbildo-collaboard` - **Verified:** Pending review - **Seller:** [MrBildo](https://agentstack.voostack.com/s/mrbildo) - **Installs:** 0 - **Category:** [Databases](https://agentstack.voostack.com/c/databases) - **Latest version:** 0.1.0 - **License:** MIT - **Upstream author:** [MrBildo](https://github.com/MrBildo) - **Source:** https://github.com/MrBildo/collaboard - **Website:** https://github.com/MrBildo/collaboard/releases/latest ## Install ```sh agentstack add mcp-mrbildo-collaboard ``` Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent. ## About A lightweight, self-hosted kanban board built for human-agent collaboration. Single executable. No database server. No containers. No cloud accounts. Download, run, and open your browser. --- The board. Drag cards between lanes, reorder on the fly, and watch every change land live for everyone connected. ## What is Collaboard? Most kanban tools are either too heavy (Jira), too locked-in (Trello), or don't speak the same language as AI agents. Collaboard is purpose-built for small teams where humans and AI agents collaborate side-by-side on a shared board. Download a single binary, run it, and open your browser. There's no database server to provision, no container runtime, no cloud account. The data lives in a SQLite file next to the executable, and every change streams to every connected client in real time. **Two primary audiences.** A person runs Collaboard from the browser — a familiar kanban board with drag-and-drop, markdown, search, and dark mode. An agent runs Collaboard through a built-in MCP server — the same board, exposed as tools over Streamable HTTP. Create a card from the UI or from Claude Code; move work, comment, label, archive. Humans and agents share one board, one auth model, and one source of truth, and they see each other's changes the instant they happen. If you're building an AI harness, agent framework, or multi-agent system that needs a shared task board, Collaboard is the surface your agents and your humans can both reach. See [For Agents](#for-agents) for MCP setup. ## Features - **First-class AI agent support** — a built-in MCP endpoint exposes the full board as tools. Agents create cards, move work, comment, label, archive, search, and manage attachments — see [For Agents](#for-agents). - **Real-time collaboration** — Server-Sent Events stream every change to every connected client. An agent moves a card and you see it move; no refresh. - **Outbound webhooks** — POST board events to any URL across a 22-event catalog (cards, comments, labels, attachments, lanes, boards). Manage subscriptions from a built-in admin screen, the REST API, or MCP — each with its own event selection, optional HMAC signing, and a delivery log. See [Webhooks](#webhooks). - **Drag-and-drop** — reorder cards within a lane, move them between lanes, and reorder whole lanes across the board. - **Rich Markdown rendering** — descriptions and comments render GitHub-flavored Markdown and then some: **syntax-highlighted code blocks**, **Mermaid diagrams** (flowcharts, sequence, and more, rendered inline), **emoji** shortcodes (`:rocket:` → 🚀), a safe **subset of inline HTML** (``, ``/``, ``, and friends), plus tables, task lists, and `#42` card auto-linking. See the [card tour](#a-tour) for a live example. - **Cross-board search** — find cards by name, description, or number (`#42`) across every board. Open it with `/` or `Ctrl+K`. - **Attachments** — paste screenshots straight from the clipboard or drag files onto a card (up to 5 MB in the browser; larger files up to 50 MB via the API). - **Multi-board** — run as many boards as you like from a single instance. - **Board-scoped labels** — color-coded labels with a full color picker (spectrum, hex input, eyedropper). - **Archive** — hide finished cards from the board without deleting them; restore any time. - **Deep linking** — direct URLs to boards and cards (`/boards/my-board/cards/42`). - **Dark and light themes** — toggle and it's remembered per browser. ## Quick Start ### macOS / Linux ```bash curl -sSL https://raw.githubusercontent.com/MrBildo/collaboard/main/install.sh | bash ~/.collaboard/Collaboard.Api ``` ### Windows (PowerShell) ```powershell irm https://raw.githubusercontent.com/MrBildo/collaboard/main/install.ps1 | iex & "$env:LOCALAPPDATA\Collaboard\Collaboard.Api.exe" ``` Open **http://localhost:8080** in your browser. The admin auth key is printed to the console on first run — copy it and paste it on the login screen. ``` [INF] Admin auth key: 01JQXYZ... ``` > For detailed installation options — manual download, macOS Gatekeeper, upgrades — see the [Installation Guide](docs/installation.md). For day-to-day usage, see the [User Guide](docs/user-guide.md). ## A Tour Card detail. Rich Markdown — Mermaid diagrams, syntax-highlighted code, tables, and emoji all render inline — alongside comments, labels, size, and attachments in one panel. Search. Press / or Ctrl+K to find any card across every board, grouped by board. Board settings. Add and reorder lanes, define card sizes, and manage labels with a visual color picker. Dark mode. Toggle between light and dark themes; the choice is remembered per browser. ## Deployment Shapes Collaboard supports two production deployment shapes. The Quick Start above gives you the first one; the second is for teams that want the API and Portal hosted as separate processes (typically behind a reverse proxy). - **LAN single-process (default).** One self-contained executable serves both the JSON API and the embedded React Portal from the same origin. The SQLite database file lives next to the binary. No reverse proxy, no CORS, no static-site host required — just the one process listening on a port. This is the shape the Quick Start sets up, and the recommended path for small teams on a trusted network. - **Portal + API hosted separately.** The headless API (`Collaboard.Api` with `Hosting:ServeSpa=false`) runs as one process; the React Portal is built (`frontend/dist/`) and served by any static-file host on its own origin. The Portal reads a runtime `config.json` from its own origin to learn the API base URL, and the API allows the Portal's origin via `Cors:AllowedOrigins`. [Collabhost](https://github.com/MrBildo/collabhost) is one worked example; any static-site host paired with a process supervisor that can run a self-contained .NET binary works the same way. See the [Installation Guide](docs/installation.md) for the LAN walkthrough and [INSTALL.md](INSTALL.md) for the hosted-separately walkthrough. ## Host Configuration Collaboard ships with sensible defaults. Edit `appsettings.json` next to the executable to override them — your edits are preserved across upgrades via the installer's smart three-way merge (operator edits preserved, untouched defaults refreshed, new shipped keys added). Environment variables override `appsettings.json` for ad-hoc tweaks. ### Port and Bind Address ```jsonc // appsettings.json { "Urls": "http://0.0.0.0:9090" } ``` Or via environment variable: ```bash export Urls=http://0.0.0.0:9090 ``` ### Admin Auth Key By default, a random auth key is generated on first run and printed to the console. To set a known key: ```jsonc // appsettings.json { "Admin": { "AuthKey": "my-secret-admin-key" } } ``` ### Database Location The database path is **required** configuration with no default — the app never derives a path from the working or binary directory. The installer writes an absolute path into `appsettings.json` for you; to relocate the database, edit it there (use an absolute path) — your edit is preserved by the smart-merge on the next upgrade: ```jsonc // appsettings.json { "ConnectionStrings": { "Board": "Data Source=/srv/collaboard/data/collaboard.db" } } ``` ### Full Settings Reference | Setting | Default | Description | |---------|---------|-------------| | `Urls` | *(unset)* | Convenience override for bind address and port. When set (or `ASPNETCORE_URLS` is set), it wins over the structured `Hosting:ListenAddress`/`Hosting:ListenPort` pair below. | | `Hosting:ListenAddress` | `0.0.0.0` | Bind address. Combined with `Hosting:ListenPort` to build the bind URL when `Urls`/`ASPNETCORE_URLS` is unset. | | `Hosting:ListenPort` | `8080` | Bind port. Combined with `Hosting:ListenAddress` to build the bind URL when `Urls`/`ASPNETCORE_URLS` is unset. | | `Hosting:ServeSpa` | `true` | When `true`, the API also serves the embedded React Portal from `wwwroot/` (LAN single-process shape). Set to `false` for headless hosted-separately deployments — unmatched routes return 404 instead of the SPA shell. | | `Cors:AllowedOrigins` | `[]` (empty) | List of allowed cross-origin Portal hosts. Empty disallows all cross-origin requests; same-origin LAN deployments do not need this. Set to the Portal's origin(s) for hosted-separately deployments (e.g. `["https://collaboard.example.com"]`). | | `ConnectionStrings:Board` | *(required — no default)* | SQLite database path. Must be an **absolute** path; the installer writes this into `appsettings.json`. Startup fails loud if unset or unwritable. | | `Admin:AuthKey` | *(auto-generated)* | Override the admin auth key. | | `Webhooks:Endpoint` | *(unset)* | **Deprecated — migration seed only.** The single delivery URL from earlier versions. On the first startup after upgrading it is migrated into a managed subscription and is no longer read for delivery; manage delivery targets through the API instead (see [Webhooks](#webhooks) below). Unset it once the upgrade is done so it can't seed again. | | `Webhooks:Secret` | *(unset)* | **Deprecated — migration seed only.** The shared signing secret from earlier versions, carried into the migrated subscription on first startup. No longer read for delivery — each subscription now carries its own secret. | | `Webhooks:Enabled` | `true` | Global master switch for **all** webhook delivery. Set to `false` to pause every subscription at once, regardless of each one's own enabled state. | | `Webhooks:DeliveryTimeout` | `00:00:05` | Per-POST timeout. A slow endpoint is treated as a failed attempt, not waited on. | | `Webhooks:MaxAttempts` | `3` | Delivery attempts per event (initial try plus retries) before the event is dropped. | | `Webhooks:RetryBackoffBase` | `00:00:02` | Wait before the first retry. Later retries grow it (roughly 4× per step) with a little jitter. | | `Webhooks:AllowPrivateNetworkTargets` | `false` | Security control for outbound delivery. When `false`, deliveries to private, internal, loopback, and link-local addresses are blocked, and such URLs are rejected when a subscription is created. Setting `true` re-permits the **private LAN ranges only** (RFC1918 and IPv6 unique-local); loopback, link-local, and the cloud-metadata endpoint (`169.254.169.254`) stay blocked regardless. It's a single global all-or-nothing switch, takes effect on restart, and Tailscale `100.x` targets work without it. **This is a breaking change when upgrading — see [Webhooks](#webhooks) below.** | | `Webhooks:DeliveryLogRetentionDays` | `30` | Delivery-attempt log rows older than this many days are deleted on a daily sweep. Set to `0` to keep the log forever. | ### Webhooks Collaboard can POST a structured event to a URL of your choice whenever something happens on a board — a card created, moved, or labeled; a comment posted; a lane reordered; and more, across a 22-event catalog — a poll-free way to drive automation (a workflow tool, a script, an agent) off board activity. Delivery targets are managed as **subscriptions**. You can register more than one, and each carries its own URL, an optional signing secret, an enabled/disabled state, and a selection of which events it wants to receive. Manage them from the built-in **Webhooks admin screen** (in the Admin panel), the REST API, or — for agents — the MCP tools. See the [Webhooks Integration Guide](docs/integrating-webhooks.md) for the walkthrough and the [API Reference](docs/api-reference.md#webhooks) for the exact endpoints and the full event catalog. The `Webhooks:Enabled` setting in the table above is the global master switch — set it to `false` to pause every subscription at once. The other `Webhooks:*` settings are global delivery policy (per-POST timeout, retries, and how long the delivery log is kept) and apply to all subscriptions. > **Upgrading from an earlier version?** If you previously configured a single endpoint > with `Webhooks:Endpoint` (and optionally `Webhooks:Secret`), it is migrated > automatically into a subscription the first time this version starts — you don't lose > your webhook. After the upgrade, unset `Webhooks:Endpoint` so it isn't seeded again if > you later delete that subscription. From then on, manage delivery targets through the > API rather than these settings. > **Breaking change on upgrade — private-network targets are blocked by default.** > This version adds a security control, `Webhooks:AllowPrivateNetworkTargets` (default > `false`), that blocks webhook deliveries to private and internal addresses. **If your > webhook endpoint resolves to one of the blocked ranges, its deliveries stop after the > upgrade until you set `Webhooks__AllowPrivateNetworkTargets=true` and restart.** The > migrated subscription still exists and is visible through the API; only its deliveries > are paused. > > The blocked ranges fall into two tiers. Setting `AllowPrivateNetworkTargets=true` > re-permits the **private LAN tier** — the RFC1918 ranges (`10.0.0.0/8`, > `172.16.0.0/12`, `192.168.0.0/16`) and IPv6 unique-local (`fc00::/7`) — so you can > reach a self-hosted tool on your LAN. An **always-blocked tier** stays blocked no > matter what the flag is set to: loopback (`127.0.0.0/8`, `::1`), link-local > (`169.254.0.0/16` — which carries the cloud-metadata endpoint `169.254.169.254` — > and `fe80::/10`), and the unspecified and multicast ranges. So turning the flag on to > reach a LAN host can never also expose your own loopback services or a cloud > provider's metadata service. The flag is a single global all-or-nothing switch — it > is not per-subscription. > > Ordinary public endpoints are unaffected — and so is the carrier-grade NAT range > `100.64.0.0/10`, which includes **Tailscale `100.x` addresses**: a webhook pointed at > a Tailscale `100.x` host keeps delivering without the flag. For the full event contract, the recursion guard you'll want before pointing this at anything that creates cards, and a step-by-step walkthrough, see the [Webhooks Integration Guide](docs/integrating-webhooks.md). ### Version ```bash ./Collaboard.Api --version ``` ## Board Configuration ### Fresh Install Defaults On first run, Collaboard creates: - An **Admin** user (auth key printed to the console — save this!) - A **Default** board with three lanes: Backlog, In Progress, Done - Four card sizes: S, M, L, XL ### Admin Customization Admins can configure boards via the **Board Settings** panel: - **Lanes** — add, rename, reorder (drag-and-drop), or delete lanes - **Sizes** — define card size options with custom ordinals - **Labels** — create color-coded labels with a visual color picker - **Prune** — bulk-archive old cards by age, lane, or label filters ### Managing Users Create users via the **Admin** panel or the API: ```bash # Create a human user curl -X POST http://localhost:8080/api/v1/users \ -H "X-User-Key: " \ -H "Content-Type: application/json" \ -d '{"name": "Alice", "role": 1}' ``` The response includes the new user's `authKey`. Share it — they enter it on the login screen. | Role | Value | Permissions | |------|-------|-------------| | Administrator | 0 | Full access — boards, lanes, users, labels, all cards | | HumanUser | 1 | Create/edit/delete own cards, comments, attachments | | AgentUser | 2 | Same as Human, but cannot delete cards. Can delete own comments/attachments | | AgentAdministrator | 3 | Agent role with administrator-level board management (lanes, sizes, labels, prune, bulk operations) | ## For Agents Collaboard exposes an MCP (Model Context Protocol) server so agents can operate the board directly — no custom HTTP client, no REST adapter. If your agent speaks MCP, it speaks Collaboard. ### Endpoint | | | |---|---| | URL | `http://localhost:8080/mcp` | | Transport | Streamable HTTP (the client config `type` for this is `http` — see below) | | Auth | Per-call `authKey` argument carrying a user's ULID key. The `/mcp` connectio … ## Source & license This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code. - **Author:** [MrBildo](https://github.com/MrBildo) - **Source:** [MrBildo/collaboard](https://github.com/MrBildo/collaboard) - **License:** MIT - **Homepage:** https://github.com/MrBildo/collaboard/releases/latest Install and usage instructions live in the source repository linked above. ## Pricing - **Free** — Free ## Security capabilities Automated source analysis of v0.1.0 — what this tool can access: - **Network access:** yes - **Filesystem access:** no - **Shell / process execution:** no - **Environment & secrets:** no - **Dynamic code execution:** no *"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.* ## Versions - **0.1.0** — security scan: flagged — Imported from the upstream source. ## Links - Listing page: https://agentstack.voostack.com/l/mcp-mrbildo-collaboard - Seller: https://agentstack.voostack.com/s/mrbildo - Browse the marketplace: https://agentstack.voostack.com/browse --- Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.