Claude security directory

Saga — Project Tracker for AI Agents

High risk

Saga gives your AI assistant a structured SQLite database to track projects, epics, tasks, subtasks, notes, and decisions across sessions. No more scattered markdown files — one `tracker_dashboard` call gives full project context to resume work. **Key features:** - Full hierarchy: Projects > Epics > Tasks > Subtasks - Task dependencies: Express sequencing with auto-block/unblock - Comments: Threaded discussions on tasks for decision trails - Templates: Reusable task sets with variable substitution - Dashboard: One tool call gives full overview with natural language summary - SQLite: Self-contained `.tracker.db` file per project — zero setup - Activity log: Every mutation is automatically tracked - Notes system: Decisions, context, meeting notes, blockers - Batch operations: Create multiple subtasks or update multiple tasks in one call - 31 focused tools with safety annotations - Import/export: Full project backup and migration as JSON

Security assessment

Plutonium assessed this web connector for permissions, capabilities, and security-relevant behavior.

  • Reads your private information: The connector can read full project context (tasks, notes, comments, activity logs, exports), which may include sensitive business plans, credentials pasted into notes, or personal data.
  • Can change or update your information: It can create and update projects, epics, tasks, subtasks, templates, comments, and notes, which could introduce incorrect planning data or alter historical decision context.
  • Can permanently delete data: Multiple delete operations (e.g., subtasks, templates, notes) can remove content, potentially causing irreversible loss of project history or context if not recoverable from backups.
  • Can run commands or queries on your behalf: Because the backend is a structured SQLite tracker, tools like import/export and search/batch operations imply the server executes database queries/operations that could be abused for broad data access or integrity-impacting actions if inputs are not strictly validated.

Available capabilities

This add-on exposes 31 tools or capabilities.

  • tracker_init
  • tracker_dashboard
  • project_create
  • project_list
  • project_update
  • epic_create
  • epic_list
  • epic_update
  • task_create
  • task_list
  • task_get
  • task_update
  • task_batch_update
  • subtask_create
  • subtask_update
  • subtask_delete
  • comment_add
  • comment_list
  • template_create
  • template_list
  • template_apply
  • template_delete
  • note_save
  • note_list

The interactive security report will load automatically.