Announcing Todoist's web-based MCP server

[gnapse]

We're starting to transition from this CLI MCP server into a web-based one. It is currently hosted at https://ai.todoist.net/mcp and uses the newer Streamable HTTP transport, instead of the legacy SSE transport. The tools it offers are the ones we're developing out in the open in Doist/todoist-ai, instead of the ones found in this todoist-mcp repository.

Here's how you can start using it:

• If you make requests with your Todoist API token included in the Authentication header as Bearer <token>, it should work right away. Copy your token from the Todoist integration settings.
• It also supports OAuth so that client apps can dynamically authenticate you and obtain a token.
  • But this may have some quirks depending on the client app (Claude Desktop vs. Claude Code vs. Cursor/VSCode, etc.), because in our experience, not everybody implements the spec correctly, possibly not even ourselves.

If you have any feedback or issues, please let us know in the comments below.

[hoegertn]

Claude Desktop is throwing this when using the native MCP settings using OAuth

{
  type: "error",
  error: {
    type: "invalid_request_error",
    message: "code: Field required"
  }
}

[gnapse]

Yes, that's one of the quirks I was referring to. The crazy thing is, during our first tests with Claude Desktop it worked. We'll look into it.

[hoegertn]

The request sent to Todoist includes this scope
task:add+data:read+data:read_write+data:delete+project:delete+dev:app_console+backups:read

The Todoist API returns a 302 with invalid scope.

Let me know if I can be of any help.

[mvdoc]

I can +1 for the same error with Claude Desktop. Interestingly Claude Code works great instead.

[AkosHosszu]

I encountered the same invalid_scope error when trying to connect Todoist with Claude Desktop via OAuth.

The Problem

The OAuth URL generated by Claude Desktop uses + instead of , to separate scope values, which doesn't match Todoist's API specification. There might also be an issue with the base URL format.

Example of Problematic URL

scope=task%3Aadd%2Bdata%3Aread%2Bdata%3Aread_write%2Bdata%3Adelete%2Bproject%3Adelete%2Bdev%3Aapp_console%2Bbackups%3Aread

The Fix

Manually construct the correct OAuth URL according to Todoist's API documentation:

https://todoist.com/oauth/authorize?client_id=[CLIENT_ID]&scope=task:add,data:read,data:read_write,data:delete,project:delete,dev:app_console,backups:read&state=[STATE]&redirect_uri=https://claude.ai/api/mcp/auth_callback

Key change: Use , instead of + as scope delimiter.

Steps to Apply

1. Copy the OAuth URL generated by Claude Desktop
2. Replace all + with , in the scope parameter
3. Navigate to the corrected URL and complete OAuth flow

After this fix, authentication completed successfully and Todoist integration worked perfectly.

[chadly]

I had to use the chrome dev tools network log to pull the URL that claude web was trying to navigate to and I replaced the + with , in scope and it worked. thank you!

[mahmoudfazeli]

I opened an issue proposing Cloudflare Workers deployment docs + a minimal example, so users can run the Streamable HTTP server on Cloudflare:

Doist/todoist-ai#66

(If helpful, there’s also a small MIT template showing the same pattern:
https://github.com/mahmoudfazeli/cloudflare-mcp-template)