MCP server

Underneath it is the same public REST API described in the API reference. Every tool is a thin call to one endpoint — no local state, no cache, so a refusal comes back to your agent verbatim.

Setup#

Create a key: Admin → API keys → New key. Then:

{
  "mcpServers": {
    "laver": {
      "command": "npx",
      "args": ["-y", "@laver/mcp"],
      "env": { "LAVER_API_KEY": "your key here" }
    }
  }
}

A client only reads this configuration when it starts a server — reconnect or start a new session after editing it.

LAVER_API_KEY_FILE keeps the key out of a committed config file — a path to a file with nothing but the key, or a .env-style line. It fails closed: if the file doesn't parse as a key, the server reports no key rather than sending arbitrary file contents as one.

What it can do#

Reading: list_workspaces, list_boards, get_board, list_tickets, get_ticket, get_ticket_comments, search.

Writing: create_ticket, update_ticket (needs version), move_ticket (needs version), comment_on_ticket (no version, cannot 409), archive_ticket, delete_ticket, create_board, link_tickets, unlink_tickets.

Attachments and wiki: file tools with a save_to path for large binary content so it never crosses the tool boundary as base64; wiki tools include append_wiki_page (markdown, no version, cannot conflict) but no edit/delete tool — a whole-document overwrite from a key would silently destroy a colleague's live collaborative edit.

What it does not cover#

Deliberately absent, not accidentally: notifications, writable subtasks, comment editing, board structure changes, labels, board templates, bulk ticket writes, Trash, the event stream, and anything workspace-administrative. Each gap is either "not yet" or "not ever from an API key" — see the full list in the source docs.

The one rule worth knowing#

Tickets carry a version. Every write must send the version you read, and a stale write is refused with 409 rather than silently overwriting whoever got there first. See Concurrency and polling.

Ticket text is untrusted input#

This matters more with MCP than the raw API, because tool results land directly in a model's context. Full guidance in Agent quickstart.

When something is refused#

401 — the key (missing, revoked, expired). 403 — accepted, then refused this action; never worth retrying. 402 — billing; reads still work, writes don't.

If the server doesn't start#

LAVER_API_KEY=your-key npx -y @laver/mcp

It should start and wait silently (stdin/stdout transport). If it exits immediately, upgrade with npx -y @laver/mcp@latest.