Kanban your agent can work.
A small, fast kanban board for small teams - with an MCP server, so Claude can read the board, write cards and move them. Free in beta, no credit card.
- Free in beta
- No credit card
- No feature gates
- MCP server included
What it is
What Noeto is
Noeto is a kanban board: boards, columns and cards, shared by a team, with nothing bolted on that a small team doesn’t need - and an MCP server, so an AI assistant can work that board alongside you rather than you keeping it current by hand.
It’s built for the teams a heavier tool talks over - a handful of developers shipping a product, a department tracking its own work inside a larger company. Set up a board in minutes, put your work on it, and it stays legible because there’s nowhere for complexity to hide: no nested workspaces, no nested epics, no view you have to configure before the board looks right.
Noeto is not a project-management suite, not a spreadsheet with a kanban skin, and not a platform you extend until it becomes one. It’s a board that does the board well and stops there - see what you get for exactly where that line is drawn, and what’s deliberately on the other side of it.
What you get
What you get
Boards & cards
5- Boards, columns and cards, visible at all times - no nested views to get lost in
- Drag and drop cards between columns, and reorder within a column, on a trackpad or a touchscreen
- The board refreshes itself every few seconds, so a teammate’s change shows up without a manual reload
- A move that fails rolls back and tells you why, rather than quietly discarding it
- Colour-coded labels to slice a board by more than its columns
People
5- Any number of teams per person - an account isn’t locked to one workspace
- Three roles - owner, admin, member - each with a clear ceiling on what it can do
- Two guardrails that keep a team from getting stuck: the last owner can’t be demoted or removed, and nobody can change their own role
- Invite by email, or by a shareable link that always joins as a member however it was configured, so a leaked link can’t hand out admin
- Invitations expire after seven days; revoking one takes effect immediately
Cards in detail
5- A title, and a Markdown description in a small editor - headings, bold, italic, lists; enough for a task, not a wiki page
- One assignee, a priority, and a due date rendered relative - Today, Tomorrow, “2 days overdue” - each independently clearable
- Who created the card, and how long ago, on the tile and in the card itself - a board says where its work came from
- Comments, plain text, editable by their author and removable by an owner or admin
- File attachments uploaded straight to storage rather than through the app server; images preview inline, anything else the browser can display opens in a tab, and the rest downloads
The app itself
5- Email when a card is assigned to you, and when someone comments on a card you’re on - both switchable off on their own, in settings
- Push notifications on the installed app, so an assignment reaches a phone that isn’t sitting open on a board
- Installable as a PWA, with an offline app shell - the interface loads without a connection, though a board’s own data still needs one; nothing here pretends to work offline when the data can’t
- No email-verification loop standing between you and a working team
- No per-seat pricing to work out before you can try it - see what it costs
What Noeto deliberately does not have
6- Sprints or velocity charts
- Time tracking
- Automation rules
- Custom fields
- A plugin marketplace
- Per-seat pricing today
Every one of those is a decision, not a backlog item.
AI agent
A board an agent can work
Noeto ships an MCP server. MCP - the Model Context Protocol - is the standard an AI assistant uses to reach a tool outside itself, so pointing Claude Code, Claude Desktop or any other MCP client at your board takes one block of JSON and an access token.
What that buys you is the half of a board nobody enjoys keeping current. Ask what is assigned to you and get the answer without opening a tab. Finish a piece of work and say so, and the card moves to Done. Hit a bug mid-task and have it written up as a card, in the right column, with a label and a description longer than the one you would have typed yourself.
It reads boards, searches across all of them - by assignee, label, priority, due date, or what is overdue - creates and edits cards, moves and reorders them, and comments as you. It deliberately cannot delete anything, cannot create boards or columns, and cannot leave the team its token belongs to: a card in the wrong column is recoverable, and setting a board up is a decision that shouldn’t be taken from a sentence. The token is an ordinary access token, scoped to one team and revocable from settings, so the agent reaches exactly as far as you do and no further.
The full tool list and the setup block are in the AI agent documentation; access tokens covers what one can reach. None of this is a plan or an add-on - it is in the same free beta as everything else on this page.
Security
How teams are kept apart
Every row a team owns - boards, cards, comments, attachments - carries a
tenant_id, and every read filters on it. That’s the mechanism; here’s what
enforces it.
The tenant your requests operate on is a claim inside your signed access token, never a value you send. No ordinary request carries a team id at all. The two endpoints that do - switching your active team, editing a team’s name or invite policy - re-check your membership and role in that team on the way in, and answer “not found” to a non-member exactly as they would to a team that doesn’t exist, so ids can’t be probed for. Membership is re-checked against the database on every request, not cached and not trusted from the token alone - removing someone from a team takes effect on their next request, not whenever their session happens to expire.
That predicate isn’t just a convention: a build-time analyzer,
tenantscopelint, catches the common mistake of a query touching a
tenant-scoped table with no tenant predicate anywhere in its text. It’s a
heuristic, not a proof - it can’t tell whether that predicate is actually
compared against the caller’s own scope - but it runs on every domain
package and fails make lint the moment it finds nothing. Opting out has to
be written into the code as tenantscope.CrossTenantCtx - visible in a
diff, not implied by its absence. Queries assembled dynamically, which the
static analyzer can’t see, are checked the same way at run time by a pgx
query tracer during integration tests.
Attachments are private objects, reached only through signed URLs that expire within the hour - there’s no public link to a file, ever. The ones that open in a browser tab rather than downloading are the same signed URL with a different disposition, and only for types on a short allow-list: an uploaded SVG or HTML file is never served inline, because a browser would run it as a page instead of showing it as a file. None of this adds up to a compliance program: there’s no SOC 2 report, no penetration test, no DPA yet - Noeto is a beta, and if you need those, it is too early for you. See the privacy page for what this site itself collects.
Pricing
What it costs
Noeto is in beta and free to use. No credit card, no trial timer, no feature gates.
That won’t be true forever - a product with running costs and no revenue isn’t one you can rely on, so paid plans will exist eventually. If and when they do, teams already using Noeto will get notice before anything changes for them, and there will be a free tier that stays genuinely useful at the size of team Noeto is built for. There’s no price list today, because there’s no price.
Questions
Questions
How much does Noeto cost?
Noeto is free during its beta, with no credit card, no trial timer and no feature gates. Paid plans will exist eventually, because a product with running costs and no revenue isn’t one to build on - but existing teams will get notice before that happens, and a free tier is planned to stay useful at this team size. There’s no price list today because there’s no price.
Will Noeto notify me when something happens?
Yes, in two ways, and both only for things that concern you: a card assigned to you, and a comment on a card you’re the assignee of or have already commented on. There is no digest, no activity feed and no notification for every change on a board.
Email is the default channel, and the two card notifications can each be switched off on their own in settings. Two kinds of mail aren’t switchable: an invitation, which is addressed to someone who may not have an account yet, and a notice that your role in a team changed - an app that lets you mute that leaves you unable to explain why a button disappeared.
Push notifications need the installable app at pwa.noeto.online and the browser’s own permission, which it asks for once, on that device. They carry the same two card events. The browser you signed into at app.noeto.online has no service worker and receives no push - see is there a mobile app.
Who is Noeto for?
Noeto is for small teams that want a board and nothing else: a handful of developers shipping a product, or a department inside a larger company tracking its own work. If your team already needs sprints, time tracking or custom workflow automation, a heavier tool will serve you better - see what Noeto deliberately does not have.
Can an AI agent use my board?
Yes - Noeto ships an MCP server, so Claude Code, Claude Desktop or any other MCP client can read your boards, search them, create and edit cards, move them between columns and comment as you. It cannot delete anything, cannot create boards or columns, and is confined by its access token to one team. Setup is a token from settings and one block of JSON: see the AI agent documentation. It’s included in the free beta, not a paid add-on.
How are teams kept apart from each other?
Every shared row carries a tenant_id, and every read filters on it, with
the team determined by your signed access token rather than by anything the
client sends. The couple of endpoints that do take a team id - switching
your active team, editing one - re-check your membership and role in that
team and answer “not found” to anyone who isn’t a member, so ids can’t be
probed for. Membership is re-checked on every request, not cached, and a
build-time analyzer flags the common mistake of a query touching team data
with no tenant filter in sight. See how teams are kept apart
for the full mechanism.
Can I export my data?
Not yet - there’s no export feature today, and this page won’t claim one that doesn’t exist. Every board, card, comment and attachment stays exactly where you put it, readable through the app for as long as your team uses it, but there is no button to download it all as a file yet.
What happens to my data?
Your data stays in a database that’s backed up daily to a separate, write-only store the application itself can’t read from or delete. Noeto is a beta without a formal retention or deletion policy yet, so if you need contractual guarantees around data handling, ask before you rely on it - see how teams are kept apart.
Is there a mobile app? Does it work offline?
There’s no native mobile app, but Noeto installs as a PWA on a phone’s home screen, with an offline app shell so the interface loads without a connection. Open pwa.noeto.online on the phone - that address is the installable build, and it is the one to add to a home screen. On Android it offers to install itself; on an iPhone no browser can, so it tells you where Safari’s own Add to Home Screen lives instead of pretending there’s a button.
Once installed it can also deliver push notifications, if you allow them. Your boards themselves still need a network to load and update, on purpose - nothing here pretends to work offline when the data can’t.
Can I self-host Noeto?
No - Noeto is only available as the hosted service at app.noeto.online, and there’s no packaged self-hosting option today. Everything runs from a single managed deployment, which is part of how the team keeps it free during the beta.
How do I invite people to my team?
Send an email invitation or share an open invite link, both from your team’s settings once you’ve signed in. An email invite can carry the member or admin role, but a shareable link always joins as a member no matter how it’s configured, so a leaked link can never hand out admin. Invitations expire after seven days, and revoking one takes effect immediately.
What does Noeto not do?
Noeto has no sprints or velocity charts, no time tracking, no automation rules, no custom fields, no plugin marketplace, and no per-seat pricing today. Every one of those is a decision, not a backlog item - see what you get for the full list of what’s in instead.
Get started
Start a board
Create a team, make a board, and put your first card on it - it takes less time than reading the rest of this page. Free in beta, no credit card required.