Is it safe to connect Claude Code to your task list?
By Jake Marsh, who builds Taskhold. Updated 2026-10-31. 3 min read.
Short answer: Yes, with sensible limits. Taskhold's MCP tools let an agent read tasks, file and plan them, report progress and complete them, but none of them deletes a task. Each agent gets its own key, stored only as a hash, that you can revoke in Settings. Your tasks aren't sold or used to train AI models.
Handing a coding agent access to anything deserves a minute of thought. A task list holds your plans, sometimes notes about customers or bugs, and the agent will be writing to it unattended.
Here is exactly what Claude Code, Cursor, Codex or any MCP client can do once it's connected to Taskhold, and what stays in your hands. Everything an agent does also shows up on the live board as it happens, so nothing it writes is hidden from you. Setup itself is on the Claude Code page.
What the agent can do
The MCP server gives agents a fixed set of tools. Eight only read: list, get and search tasks, get current work, read your updates, list projects and labels, and get a summary. The rest file tasks, plan their steps, report progress, block with a question, add notes and complete work.
None of them deletes a task. The most an agent can undo is its own plan: replanning a task drops steps that haven't started yet.
What it can't do
- Delete tasks or projects.
- See other people's lists, your billing, or anything outside your own task list.
- Read back an API key: keys are stored as SHA-256 hashes with a short prefix for display.
- Touch your code or machine. Code changes happen in your editor, under the permissions you gave the agent there.
One key per agent, revocable
Each setup URL makes a new key, so Claude Code, Cursor and Codex each get their own. Agents that connect with OAuth (claude.ai, ChatGPT, Claude Code's sign-in) get a key the same way. Revoke any key in Settings and that agent loses access at once, without affecting the others.
What's stored and for how long
Tasks, their steps, notes, block questions and replies are kept with the task until you delete it. The individual progress reports in the activity history are deleted after 14 days. Taskhold doesn't sell your data, share it with advertisers, or use it to train AI models, and the site has no advertising or third-party analytics trackers.
When an agent reads a task, that text goes to the AI tool you connected, under that tool's own terms. Keep secrets like passwords and API keys out of task text, the same as you would in a ticket.
Watching what it does
Everything an agent does shows up on the live board as it happens: which agent is on which task, its progress messages, and any question it's blocked on (monitoring coding agent progress walks through it). When it finishes, review what your agent did from its summary and notes. If something looks wrong, reply on the task or revoke the key.
See how far along your coding agents are.
$12/month or $120/year after the trial. Card up front. Cancel before day 7 and you pay nothing. Every agent you run is included.
Questions
- Can a coding agent delete my tasks through Taskhold?
- No. Taskhold's MCP tools read, create, plan, update and complete tasks, but none deletes one. Replanning only drops steps that haven't started.
- How do I stop an agent from using my list?
- Revoke its key in Settings. Each agent has its own key, so the others keep working.
- Is my task data used to train AI models?
- No. Taskhold doesn't sell your data or use it to train AI models. Text an agent reads goes to the AI tool you connected, under that tool's terms.
- What happens to progress updates?
- Tasks and their notes stay until you delete them. Individual progress reports in the activity history are deleted after 14 days.
Related
Updated 2026-10-31. Something wrong or out of date? Email hello@greatwork.company.