@planoda/sdk
Type-safe, isomorphic TypeScript client for the REST API (Node, Bun, Deno, edge, browser) — zero runtime dependencies, typed errors, retries, and webhook-signature verification.
npm i @planoda/sdkDevelopers
A typed SDK, scoped API keys, signed webhooks, an OAuth 2.1 Model Context Protocol server, a sandboxed plugin runtime, and rotateable signing keys. The same primitives we use to ship the product, exposed for you.
Developers hub in short
Open source
Published on npm, dependency-light, and kept in lockstep with the hosted product. The platform stays closed-source; these are the public building blocks around it.
$ npx @planoda/cli triage "Fix the flaky login test" "Add dark mode" "Typo in footer"
urgent Bug 3pt Fix the flaky login test
medium Feature 5pt Add dark mode
low Chore 1pt Typo in footerNo account, no API key — that's the real public AI backlog-triage endpoint. Full reference in the CLI docs, or try the same demo in a browser at /tools/triage.
Type-safe, isomorphic TypeScript client for the REST API (Node, Bun, Deno, edge, browser) — zero runtime dependencies, typed errors, retries, and webhook-signature verification.
npm i @planoda/sdkAI-triage a backlog with no account at all, or create and list issues from your terminal and CI once you add an API key.
npx @planoda/cli triage "Fix the flaky login test"A dependency-free stdio bridge connecting Claude, Cursor, or any Model Context Protocol client to a Planoda workspace, with propose/approve guardrails on every destructive call.
npx -y @planoda/mcp-server --version10 ready-to-use work-template packs — sprint boards, bug triage, OKRs, incident response, and more — as plain JSON. One-click import, or copy the fields into any tracker.
npm i @planoda/templatesFAQ
First-class `@planoda/sdk` ships with full request/response types, runtime Zod validators, automatic retries with exponential backoff, idempotency-key support, and edge/node/bun adapters. `npm i @planoda/sdk` and your IDE knows every endpoint, every field, every enum.
const issue = await planoda.issues.create({
teamId: '<team-uuid>',
title: 'Auth fails on Safari 17',
priority: 2,
});Authenticate the REST API with a scoped key minted (and revocable) in Settings → API keys, on the same Clerk-backed identity layer that protects the product UI. Keys carry per-namespace scopes (`issues:read`, `issues:write`, …) and are workspace-bound. Agent clients connecting over MCP can use OAuth 2.1 with dynamic client registration instead.
curl https://planoda.com/api/v1/issues \
-H "Authorization: Bearer ttm_<prefix>_<secret>"30+ event types across issues, comments, automations, releases, and inbox. Every payload is HMAC-SHA-256 signed, idempotency-keyed, and delivered with exponential backoff up to 24 hours. Replay any delivery from the dashboard, inspect the raw body, and rotate signing secrets without dropping a packet.
X-Webhook-Signature: v1=4f…,t=1716700000
// Verify with `verifyWebhook(req, secret)`Native Model Context Protocol endpoint so Claude, Cursor, Zed, and Continue can read your workspace through a single OAuth-scoped tool surface. Resources for issues / boards / projects, tools like `issues_create`, `issues_search`, and `issues_update`, and prompts pinned to your team's conventions.
{
"mcpServers": {
"planoda": { "url": "https://planoda.com/api/mcp/streamable-http" }
}
}Ship UI extensions that mount inside the issue panel, the board sidebar, or the command palette — sandboxed in a Web Worker, capability-scoped to the workspace, and reviewed before listing. Plugins use the same tRPC API the product uses; there is no second-class surface.
export default definePlugin({
slot: 'issue.panel',
render: ({ issue }) => <FigmaPreview url={issue.figma} />,
});Every integration owns a key pair. Rotate on demand with overlapping windows — old + new keys both validate for 24 hours so you never break a downstream consumer. Audit log records who rotated, when, and the previous key's last successful verify timestamp.
await trpc.webhooks.rotateSecret.mutate({ id: "<endpoint-id>" });
// or: Settings → Webhooks → Rotate secretEvery integration surface is rate-limited per workspace and per token, observable in Sentry + OpenTelemetry, and documented with OpenAPI 3.1. We ship the same SDK we use internally — when the product gets faster, your scripts get faster too.