Developer builds a task manager where Claude Code picks up scheduled tasks on its own

A familiar story: an agent is excellent at drafting an email or comparing libraries, but every time you still have to explain exactly what it should do. You open a chat, formulate the task, wait, and copy the result. The creator of this project decided he already had a place where all assignments lived: his to-do list. All that remained was to teach agents to pick up tasks from it on their own.

How it works

In the shar8.app task manager, every task has a “For agent” label. Only a human can apply it in the app, so an agent cannot assign work to itself. Then, provided the computer is on, the agent picks up a task due today or overdue within a minute, completes it, and writes the result in the notes. The task receives one of three statuses: “Under review,” “Clarification needed,” or “Agent failed.” A human closes it after reading the report.

The integration runs over MCP via HTTP. There is one endpoint, and any client supporting remote MCP servers can connect without a client-specific plugin. Claude Code, Codex CLI, and OpenCode all work with the same list. The server exposes 15 tools for reading, creating, and editing, plus three service tools for delegation: agent_queue, agent_claim, and agent_finish. Only the scheduled agent calls the last three.

In conversation, this feels natural. While working on code, you can say, “Add a task: update dependencies on Friday,” and the task will appear on your phone.

A Claude Code plugin handles unattended execution. It adds a job to the system scheduler: launchd on Mac, a systemd timer on Linux, or Task Scheduler on Windows. Once a minute, the plugin checks the queue. If it is empty, the model is not invoked at all. Each run takes no more than three tasks, with 15 minutes allotted to each. If the server is unavailable, the plugin backs off instead of hammering it every minute. The model runs locally under your subscription or ANTHROPIC_API_KEY, and the server never sees your keys.

Two details are worth borrowing. Exactly one run holds a task, so a second one cannot claim it. A stalled task also returns automatically with the “Agent failed” status instead of remaining in progress forever.

Security: what is and is not included

Task text is treated as untrusted input. If someone pastes an external email into a task, it may contain instructions for the model. The agent is therefore told that the text is data, not commands. In addition, it has no tools by default: it sees text and responds with text. Web search is enabled through a separate configuration file. External sending is disabled and can be enabled only with an explicit allowlist of recipients.

The author is candid about what is missing. An agent connected in a conversation can see every task and delete them; its permissions cannot yet be restricted. He does not consider a prompt to be a security boundary: safety comes from the absence of tools and human review. For unattended operation, he recommends restricting tools on the client side.

There are two authorization methods. Only Claude Code and Codex can connect through a browser using OAuth; other clients encounter an error on the consent screen. For cron, claude -p, and OpenCode, the service issues a personal token that is shown once. Revocation takes effect immediately, without waiting for the token to expire.

Here is what has and has not been tested on real systems: a Mac running the real claude client under a subscription works, and a task was claimed within a minute. Linux is covered by tests but has not been run on a real machine. Windows is in beta. Calling tasks_list from Codex has not been tested; only authentication has been verified.

What to take away from it

The service itself is niche, but the pattern is universal. An agent queue rests on three things: exclusive task claiming, automatic recovery of stalled tasks, and immediate access revocation. An agent’s result should arrive with an “under review” status, not “done.” And the fewer permissions an overnight agent has, the better: adding access is easier than investigating where a task disappeared.