All work

Product

Working On It

The team, the client and the work in one conversation.

Work management for teams delivering to a client. Development tasks, support tickets, deliverables and discussions share a project, so the people doing the work and the people following it have the same context.

Account required · demo available

Open app

From a task to a delivery

A project gives tasks, deliverables and discussion threads a shared home. Support tickets stay alongside development work without becoming the same kind of task; the client can follow the conversation in the app.

AI agents can read and update work through MCP. Each key has its own permissions and acts within its owner's access, keeping agent updates tied to an identifiable actor.

Built and maintained

Team
Solo, design to deploy
Period
2026-05 – 2026-09
Status
Live at woi.mattediworks.com
Stack
TypeScript, React, Express, TypeORM, PostgreSQL

Permissions and account ownership

  • MCP access is scoped to a user

    MCP access uses user-scoped API keys, shown once and stored as a SHA-256 hash. Requests are checked against the key permissions and its owner's access; revoking a key blocks further requests with it. The cost: managing separate keys for agents and tools instead of a shared integration token.

  • Accounts are linked by issuer and subject, never by e-mail

    The permanent identity key is the pair (issuer, sub) from MW Identity. Existing users are migrated by an administrator after checking ownership, rather than linked automatically by a matching e-mail address. This adds a manual step and avoids treating control of an e-mail address as proof of ownership of an existing account.

  • Deleting an account is one transaction

    When someone leaves through MW Identity, a signed event arrives, is verified against the JWKS and recorded before answering 202. Then, in one database transaction, the account is disabled, its audit and thread references are anonymized and its data is deleted. Existing sessions fail because the user no longer exists.

Behind the project workspace

Browsers and AI agents reach an nginx router, which sends pages to a server-rendered React app and /api to the Express API. The API stores data in PostgreSQL, signs people in through MW Identity and sends e-mail through MW Mail.Compose project on StackportHTTPS · WS/api/mcppages/apisendOIDCBrowserAI agentMCP clientrouternginxssrReact · SSRapiExpress · TypeORMPostgreSQLMW Maile-mail gatewayMW IdentityOIDC
  • React + Vite front end and an Express API in TypeScript, with TypeORM over PostgreSQL.
  • WebSockets push updates to whoever has the project open.
  • MCP server on the same API (/api/mcp), JSON or SSE responses.
  • Sign-in through MW Identity (OIDC); e-mail through the MW Mail gateway.
  • Deployed on Stackport behind its proxy: no host ports, /health checked every 30 s.

Current scope

  • One instance, one database: no horizontal scaling yet.
  • The old password login still exists behind a flag, for migration only.
  • Private repository.