Task Automation: CLI, GraphQL, or MCP

TL;DR: Use the donebear CLI for shell scripts and cron, the GraphQL API at api.donebear.com/graphql for application integrations, or the hosted MCP server for AI assistants. CLI and GraphQL automation authenticate with an API key; MCP clients sign in with OAuth. Every change lands in the same synced workspace.

Most task managers bolt automation on afterwards: a webhook here, a read-only API there. Done Bear started from the other end. The terminal, the API, and AI agents are clients of the same server-sequenced sync engine the apps use, so a task filed by a cron job is on your phone before the shell prompt returns.

Pick the interface to suit the caller. The CLI and GraphQL API share an API key. MCP uses an interactive OAuth sign-in, so an assistant acts as the signed-in user.

Choose the interface before the credential

Create an API key once from the CLI:

donebear api-key create "Automation"
export DONEBEAR_TOKEN=<token>

That db_ key authenticates the first two surfaces. MCP clients use OAuth instead:

• The CLI for shell scripts, Git hooks, and cron. DONEBEAR_TOKEN replaces the browser login, and --json output pipes straight into your tooling.
• The GraphQL API for direct HTTP from any language. Reads and writes for tasks, projects, teams, labels, and workspaces.
• The hosted MCP server for AI agents like Claude and ChatGPT, which get structured tool calls over OAuth.

If the terminal itself is the destination, read the CLI task manager guide instead. This one is about the wider choice between a shell, direct HTTP, and an assistant.

Capture from CI and Git hooks

Capture is where automation pays off: a signal becomes a tracked task instead of a log line nobody reads. The CLI takes its token from the environment, so a CI step can file a task when a build breaks:

donebear task add "Dependency audit failed on main" \
  --when today \
  --description "npm audit flagged a high-severity advisory" \
  --json

Pin the workspace with --workspace <slug> so the job never leans on someone’s default. The task lands in your Inbox, synced everywhere.

Schedule reports with cron

--total prints just a count, which makes Done Bear a clean data source for scheduled jobs:

0 8 * * 1-5 DONEBEAR_TOKEN=$DB_KEY \
  donebear search "overdue" --total >> ~/standup.log

Send that number to a status bar, a Slack webhook, or a morning standup file. No output parsing.

Read over HTTP with GraphQL

When you want direct HTTP rather than a shell, POST to the GraphQL endpoint with the same key:

curl https://api.donebear.com/graphql \
  -H "Authorization: Bearer $DONEBEAR_TOKEN" \
  -H "Content-Type: application/json" \
  --data '{"query":"query { viewer { id email } }"}'

The endpoint supports Relay-style pagination and workspace-scoped filters. The GraphQL reference has the task, project, and workspace queries.

Hand it to an agent

If your assistant speaks MCP, the hosted server lets it triage your inbox and file follow-ups with your permission. If it runs shell commands instead, install the agent skill so it drives the CLI without guessing:

npx skills add donebear/skills -g --all -y

Either way it works against the same live workspace you do.

Why sync is the point

Turns out what makes automation trustworthy isn’t the shape of the API. It’s that every surface sees the same list. Done Bear is local-first: writes commit locally, then reconcile through real-time sync, a teammate’s edits in a shared workspace included. A task created by a script, an API call, or an agent is never a stale copy.

Get started

npm install -g donebear
donebear api-key create "Automation"

The CLI overview, the automation guide, and the API docs cover the full surface. Free for your first 250 tasks. See pricing.