Permissions
A client is offered only the tools its person’s role can use, and every call is checked like the same action in the app. Tokens, AI keys and workspace deletion stay out of reach.
MCP · STREAMABLE HTTP · OAUTH 2.1
Claude, Cursor, VS Code and other MCP clients can read and change your work in Backlog.pm. A client acts as the person who connected it, in every space they can see, with exactly their role’s permissions.
/mcp
Add the server, sign in, and ask away.
Use mcp.backlog.pm/mcp, the address for every workspace: signing in picks yours. Your workspace’s own {workspace}.backlog.pm/mcp works too and skips that choice. MCP has to be on for the workspace (the Owner turns it on in Account settings → Feature toggles).
The client opens your browser: sign in, pick the workspace and approve. No token to copy. A client that can’t sign in can use a token from Account settings → MCP server instead.
describe_workspace gives the valid types, statuses, labels and people; whats_new and my_work say what changed and what needs you.
A client is offered only the tools its person’s role can use, and every call is checked like the same action in the app. Tokens, AI keys and workspace deletion stay out of reach.
Every tool that changes something takes an idempotency_key: a retry with the same key answers with the first result instead of doing it twice. Keys last a day.
whats_new remembers where you left off; list_changes follows a cursor and can wait up to 30 seconds for the next change.
update_issues and revert_changes take dry_run, which runs every check and saves nothing. Every change lands in the item’s history “via MCP”.
What each tool does, what it takes, and what the connected person needs for it to be offered.
Addresses a client can attach as context, read with the same rights as the matching tool.
Ready-made flows a person can pick in their client. They ask before changing anything.