Back to Browse

Pushnote MCP Server

Developer ToolsModerate6.1MCP RegistryLocal
Free

Server data from the Official MCP Registry

Gotify push notifications: send, read messages, manage apps and clients, one router tool.

About

Gotify push notifications: send, read messages, manage apps and clients, one router tool.

Security Report

6.1
Moderate6.1Moderate Risk

pushnote is a straightforward Gotify REST client exposing one action-router tool over a CLI and stdio MCP server. Tokens come only from environment variables, are sent only in the X-Gotify-Key header to the configured GOTIFY_URL, and are never logged or returned by status; the remaining findings are low-severity hardening suggestions around destructive-action confirmation and the tool schema description. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 2 high severity). Package verification found 1 issue.

8 files analyzed · 8 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

HTTP Network Access

Connects to external APIs or services over the internet.

env_vars

Check that this permission is expected for this type of plugin.

What You'll Need

Set these up before or after installing:

GOTIFY_URLRequired
GOTIFY_CLIENT_TOKENRequired
GOTIFY_APP_TOKENRequired

How to Install

Add this to your MCP configuration file:

{
  "mcpServers": {
    "io-github-cloudcorprecords-pushnote": {
      "env": {
        "GOTIFY_URL": "your-gotify-url-here",
        "GOTIFY_APP_TOKEN": "your-gotify-app-token-here",
        "GOTIFY_CLIENT_TOKEN": "your-gotify-client-token-here"
      },
      "args": [
        "-y",
        "@reneturcios/pushnote"
      ],
      "command": "npx"
    }
  }
}

Documentation

View on GitHub

From the project's GitHub README.

pushnote

pushnote talks to a Gotify server: it sends push notifications, reads back messages, server health and version, and manages the Gotify applications and clients that notifications flow through. Everything is exposed as one action-router tool, gotify, over a command-line interface and a stdio MCP server, both served by the same binary.

Three environment variables configure it. GOTIFY_URL is the base URL of your Gotify server and is required — without it, every action except the local help fails before any request is made. GOTIFY_CLIENT_TOKEN is a Gotify client token used for reads and management (current user, messages, applications, clients). GOTIFY_APP_TOKEN is a Gotify application token used only by the send action. Tokens come from the environment only; they are never tool arguments.

Install

npx @reneturcios/pushnote health

Or run the container image:

docker run -i ghcr.io/cloudcorprecords/pushnote

The container defaults to the MCP server (see below). Pass CLI arguments to use it as a CLI instead.

CLI

Each command mirrors one router action. Multi-word commands accept both the hyphenated form shown here and the underscore action name (for example create-application or create_application).

export GOTIFY_URL=https://gotify.example.com
export GOTIFY_CLIENT_TOKEN=<client token>
export GOTIFY_APP_TOKEN=<app token>

pushnote health
pushnote version
pushnote me
pushnote messages --limit 25 --since 40
pushnote messages --app-id 7
pushnote applications
pushnote clients
pushnote status
pushnote send "deploy finished" --title CI --priority 5
pushnote create-application alerts --description "Alert channel" --default-priority 4
pushnote update-application 3 --name renamed
pushnote create-client phone
pushnote delete-message 9 --confirm
pushnote delete-all-messages --confirm
pushnote delete-application 4 --confirm
pushnote delete-client 5 --confirm
pushnote help

pushnote --version

Successful commands print the upstream JSON payload (status and help print local output instead). Exit codes: 0 on success, 1 when a call fails (including an upstream API error or a refused destructive action), 2 for usage errors.

Destructive commands — the four delete-* commands — do nothing unless --confirm is passed. Without it they fail before any request reaches the Gotify server.

MCP server

The mcp subcommand starts a stdio MCP server:

npx -y @reneturcios/pushnote mcp

MCP client configuration:

{
  "mcpServers": {
    "pushnote": {
      "command": "npx",
      "args": ["-y", "@reneturcios/pushnote", "mcp"],
      "env": {
        "GOTIFY_URL": "https://gotify.example.com",
        "GOTIFY_CLIENT_TOKEN": "<client token>",
        "GOTIFY_APP_TOKEN": "<app token>"
      }
    }
  }
}

Tool

One tool, gotify, takes a required action argument plus the parameters that action needs as optional top-level arguments:

ActionRequiredOptionalToken
health——none
version——none
me——client
messages—app_id, limit, sinceclient
applications——client
clients——client
status——none (local)
sendmessagetitle, priority, extrasapp
create_applicationnamedescription, default_priorityclient
update_applicationapp_idname, description, default_priorityclient
create_clientname—client
delete_messageid, confirm—client
delete_all_messagesconfirm—client
delete_applicationapp_id, confirm—client
delete_clientclient_id, confirm—client
help——none (local)

All four delete actions refuse to run unless confirm is true, and that check happens before any request. status returns a local snapshot (Gotify URL, which tokens are configured, action count) and never includes a token value. help returns the action documentation locally.

Development

npm install
npm run build   # tsc -> dist/
npm test        # node test runner over test/*.test.ts, no network (fake fetch fixtures)
npm run dev     # run the CLI from source via tsx

License

MIT — see LICENSE.

Reviews

No reviews yet

Be the first to review this server!