diff --git a/__tests__/mcpAuth.spec.ts b/__tests__/mcpAuth.spec.ts
index 7238075f6..b66c2d45e 100644
--- a/__tests__/mcpAuth.spec.ts
+++ b/__tests__/mcpAuth.spec.ts
@@ -113,6 +113,25 @@ describe("resolveMcpToken", () => {
     });
   });
 
+  it("does not add task scopes to an existing token", async () => {
+    (prisma.mcpAccessToken.findUnique as any).mockResolvedValue({
+      id: "legacy-token",
+      userId: "user-1",
+      scopes: JSON.stringify(["jobs:write"]),
+      name: "legacy",
+      expiresAt: new Date(Date.now() + 1000 * 60 * 60),
+    });
+
+    const result = await resolveMcpToken(makeRequest("Bearer jsync_legacy"));
+
+    expect(result).toEqual({
+      ok: true,
+      userId: "user-1",
+      scopes: ["jobs:write"],
+      tokenName: "legacy",
+    });
+  });
+
   it("updates lastUsedAt fire-and-forget on a valid token", async () => {
     (prisma.mcpAccessToken.findUnique as any).mockResolvedValue({
       id: "t-1",
diff --git a/__tests__/mcpScope.spec.ts b/__tests__/mcpScope.spec.ts
new file mode 100644
index 000000000..1e45f93bf
--- /dev/null
+++ b/__tests__/mcpScope.spec.ts
@@ -0,0 +1,15 @@
+import { getMcpScopeError } from "@/lib/mcp/scope";
+
+describe("getMcpScopeError", () => {
+  it("allows a granted scope", () => {
+    expect(getMcpScopeError(["tasks:read"], "tasks:read")).toBeNull();
+  });
+
+  it("returns the required scope when access is missing", () => {
+    expect(getMcpScopeError(["jobs:write"], "tasks:read")).toEqual({
+      content: [
+        { type: "text", text: "Insufficient scope. Required: tasks:read" },
+      ],
+    });
+  });
+});
diff --git a/__tests__/mcpTaskQueries.spec.ts b/__tests__/mcpTaskQueries.spec.ts
new file mode 100644
index 000000000..fb2941b91
--- /dev/null
+++ b/__tests__/mcpTaskQueries.spec.ts
@@ -0,0 +1,160 @@
+import { PrismaClient } from "@prisma/client";
+import { checkMcpRateLimit } from "@/lib/mcp/rate-limit";
+import { handleGetTask } from "@/lib/mcp/tools/getTask";
+import { handleListTasks } from "@/lib/mcp/tools/listTasks";
+import {
+  McpGetTaskSchema,
+  McpListTasksSchema,
+} from "@/models/mcp.schema";
+
+const prisma = new PrismaClient();
+
+vi.mock("@prisma/client", () => {
+  const mPrismaClient = {
+    task: {
+      findMany: vi.fn(),
+      findFirst: vi.fn(),
+      count: vi.fn(),
+    },
+  };
+  return { PrismaClient: vi.fn(function () { return mPrismaClient; }) };
+});
+
+vi.mock("@/lib/mcp/rate-limit", () => ({
+  checkMcpRateLimit: vi.fn(() => ({ allowed: true, resetIn: 0 })),
+}));
+
+const task = {
+  id: "task-1",
+  userId: "user-1",
+  title: "Prepare follow-up",
+  description: "<p>Email &amp; schedule a call</p>",
+  status: "in-progress",
+  priority: 7,
+  percentComplete: 25,
+  dueDate: new Date("2026-10-01T15:00:00.000Z"),
+  activityTypeId: "type-1",
+  activityType: { id: "type-1", label: "Networking" },
+  activities: [],
+  createdAt: new Date("2026-09-18T10:00:00.000Z"),
+  updatedAt: new Date("2026-09-18T11:00:00.000Z"),
+};
+
+function parseResult(result: { content: Array<{ text: string }> }) {
+  return JSON.parse(result.content[0].text);
+}
+
+describe("task MCP schemas", () => {
+  it("applies active-task pagination defaults", () => {
+    expect(McpListTasksSchema.parse({})).toEqual({
+      statuses: ["in-progress", "needs-attention"],
+      page: 1,
+      limit: 25,
+    });
+  });
+
+  it("accepts every task status and rejects an excessive page size", () => {
+    expect(
+      McpListTasksSchema.parse({
+        statuses: ["in-progress", "complete", "needs-attention", "cancelled"],
+      }).statuses,
+    ).toHaveLength(4);
+    expect(() => McpListTasksSchema.parse({ limit: 51 })).toThrow();
+  });
+
+  it("requires a task id", () => {
+    expect(() => McpGetTaskSchema.parse({ taskId: "" })).toThrow();
+  });
+});
+
+describe("task MCP query handlers", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    (checkMcpRateLimit as any).mockReturnValue({ allowed: true, resetIn: 0 });
+    (prisma.task.findMany as any).mockResolvedValue([task]);
+    (prisma.task.count as any).mockResolvedValue(26);
+    (prisma.task.findFirst as any).mockResolvedValue(task);
+  });
+
+  it("lists only the caller's filtered tasks with pagination", async () => {
+    const result = await handleListTasks(
+      McpListTasksSchema.parse({
+        activityType: "NETWORKING",
+        search: "follow-up",
+        page: 2,
+        limit: 10,
+      }),
+      "user-1",
+    );
+
+    expect(prisma.task.findMany).toHaveBeenCalledWith(
+      expect.objectContaining({
+        where: expect.objectContaining({
+          userId: "user-1",
+          status: { in: ["in-progress", "needs-attention"] },
+          activityType: { value: "networking", createdBy: "user-1" },
+          OR: expect.any(Array),
+        }),
+        skip: 10,
+        take: 10,
+      }),
+    );
+    expect(prisma.task.count).toHaveBeenCalledWith({
+      where: expect.objectContaining({ userId: "user-1" }),
+    });
+
+    expect(parseResult(result)).toEqual({
+      tasks: [
+        expect.objectContaining({
+          id: "task-1",
+          description: "Email & schedule a call",
+          dueDate: "2026-10-01T15:00:00.000Z",
+        }),
+      ],
+      pagination: {
+        page: 2,
+        limit: 10,
+        total: 26,
+        totalPages: 3,
+        hasMore: true,
+      },
+    });
+  });
+
+  it("retrieves a task only for the caller", async () => {
+    const result = await handleGetTask({ taskId: "task-1" }, "user-1");
+
+    expect(prisma.task.findFirst).toHaveBeenCalledWith(
+      expect.objectContaining({ where: { id: "task-1", userId: "user-1" } }),
+    );
+    expect(parseResult(result).task).toEqual(
+      expect.objectContaining({ id: "task-1", title: "Prepare follow-up" }),
+    );
+  });
+
+  it("does not reveal another user's task", async () => {
+    (prisma.task.findFirst as any).mockResolvedValue(null);
+
+    const result = await handleGetTask({ taskId: "task-1" }, "user-2");
+
+    expect(parseResult(result)).toEqual({
+      error: "task_not_found",
+      taskId: "task-1",
+    });
+  });
+
+  it("consumes the shared rate limit before querying", async () => {
+    (checkMcpRateLimit as any).mockReturnValue({ allowed: false, resetIn: 2500 });
+
+    const result = await handleListTasks(
+      McpListTasksSchema.parse({}),
+      "user-1",
+    );
+
+    expect(parseResult(result)).toEqual({
+      error: "rate_limit_exceeded",
+      retryAfterSeconds: 3,
+    });
+    expect(prisma.task.findMany).not.toHaveBeenCalled();
+  });
+});
diff --git a/__tests__/mcpTokens.spec.ts b/__tests__/mcpTokens.spec.ts
index 808d3abe4..a2f5f8d1a 100644
--- a/__tests__/mcpTokens.spec.ts
+++ b/__tests__/mcpTokens.spec.ts
@@ -1,5 +1,17 @@
 import { createHash } from "crypto";
-import { generateToken, hashToken } from "@/lib/mcp/tokens";
+import { generateToken, hashToken, MCP_DEFAULT_SCOPES } from "@/lib/mcp/tokens";
+
+describe("MCP_DEFAULT_SCOPES", () => {
+  it("grants task read and write access to newly created tokens", () => {
+    expect(MCP_DEFAULT_SCOPES).toEqual([
+      "jobs:write",
+      "questions:write",
+      "resume:write",
+      "tasks:read",
+      "tasks:write",
+    ]);
+  });
+});
 
 describe("hashToken", () => {
   it("returns the sha256 hex digest of the input", () => {
diff --git a/evals/mcp-tools/assertions.ts b/evals/mcp-tools/assertions.ts
index 856f6092c..595abbde6 100644
--- a/evals/mcp-tools/assertions.ts
+++ b/evals/mcp-tools/assertions.ts
@@ -178,3 +178,8 @@ export function assertRoutesToReviewResume(output: unknown): AssertionResult {
   const { pass, score, reason } = expectSingle(output, 'review_resume');
   return { pass, score, reason };
 }
+
+export function assertRoutesToListTasks(output: unknown): AssertionResult {
+  const { pass, score, reason } = expectSingle(output, 'list_tasks');
+  return { pass, score, reason };
+}
diff --git a/evals/mcp-tools/promptfooconfig.yaml b/evals/mcp-tools/promptfooconfig.yaml
index 1641f0401..32cdab8a2 100644
--- a/evals/mcp-tools/promptfooconfig.yaml
+++ b/evals/mcp-tools/promptfooconfig.yaml
@@ -135,3 +135,10 @@ tests:
     assert:
       - type: javascript
         value: file://./assertions.ts:assertRoutesToReviewResume
+
+  - description: Active-task request - routes to list_tasks
+    vars:
+      userMessage: Show me my active tasks.
+    assert:
+      - type: javascript
+        value: file://./assertions.ts:assertRoutesToListTasks
diff --git a/evals/mcp-tools/tools.ts b/evals/mcp-tools/tools.ts
index 7113a9ab4..bc5feae5d 100644
--- a/evals/mcp-tools/tools.ts
+++ b/evals/mcp-tools/tools.ts
@@ -10,6 +10,8 @@ import {
   McpSaveMatchResultsBatchInputShape,
   McpReviewResumeInputShape,
   McpSaveResumeReviewInputShape,
+  McpListTasksInputShape,
+  McpGetTaskInputShape,
 } from '../../src/models/mcp.schema';
 
 // Same raw shapes route.ts hands the MCP SDK, so the model sees the parameter
@@ -25,6 +27,8 @@ const SHAPES: Record<string, z.ZodRawShape> = {
   save_match_results_batch: McpSaveMatchResultsBatchInputShape,
   review_resume: McpReviewResumeInputShape,
   save_resume_review: McpSaveResumeReviewInputShape,
+  list_tasks: McpListTasksInputShape,
+  get_task: McpGetTaskInputShape,
 };
 
 export function getTools() {
diff --git a/src/actions/mcpToken.actions.ts b/src/actions/mcpToken.actions.ts
index 578cfe2fd..90a0388c6 100644
--- a/src/actions/mcpToken.actions.ts
+++ b/src/actions/mcpToken.actions.ts
@@ -3,7 +3,7 @@
 import prisma from "@/lib/db";
 import { requireUser } from "./shared";
 import { handleError } from "@/lib/utils";
-import { generateToken } from "@/lib/mcp/tokens";
+import { generateToken, MCP_DEFAULT_SCOPES } from "@/lib/mcp/tokens";
 import { APP_CONSTANTS } from "@/lib/constants";
 
 export interface PublicTokenMeta {
@@ -43,7 +43,7 @@ export async function createMcpToken(input: {
         name: input.name.trim(),
         tokenHash: hash,
         tokenPrefix: prefix,
-        scopes: JSON.stringify(["jobs:write", "questions:write", "resume:write"]),
+        scopes: JSON.stringify(MCP_DEFAULT_SCOPES),
         expiresAt,
       },
     });
diff --git a/src/actions/task/queries.ts b/src/actions/task/queries.ts
index 778e32eba..da2d9706b 100644
--- a/src/actions/task/queries.ts
+++ b/src/actions/task/queries.ts
@@ -3,46 +3,9 @@ import prisma from "@/lib/db";
 import { handleError } from "@/lib/utils";
 import { TaskGroupBy, TaskStatus } from "@/models/task.model";
 import { APP_CONSTANTS } from "@/lib/constants";
+import { getTaskForUser, listTasksForUser } from "@/lib/tasks/queries";
 import { requireUser } from "../shared";
 
-const TASK_WITH_ACTIVITIES_INCLUDE = {
-  activityType: true,
-  activities: {
-    select: { id: true },
-  },
-};
-
-function getTasksOrderBy(groupBy?: TaskGroupBy) {
-  switch (groupBy) {
-    case "dueDate":
-      return [
-        { dueDate: "asc" as const },
-        { priority: "desc" as const },
-        { createdAt: "desc" as const },
-      ];
-    case "createdDate":
-      return [{ createdAt: "desc" as const }, { priority: "desc" as const }];
-    case "updatedDate":
-      return [
-        { updatedAt: "desc" as const },
-        { priority: "desc" as const },
-        { createdAt: "desc" as const },
-      ];
-    case "activityType":
-      return [
-        { activityType: { label: "asc" as const } },
-        { priority: "desc" as const },
-        { createdAt: "desc" as const },
-      ];
-    default:
-      return [
-        { priority: "desc" as const },
-        { createdAt: "desc" as const },
-        { updatedAt: "desc" as const },
-      ];
-  }
-}
-
 export const getTasksList = async (
   page: number = 1,
   limit: number = APP_CONSTANTS.RECORDS_PER_PAGE,
@@ -54,40 +17,14 @@ export const getTasksList = async (
   try {
     const user = await requireUser();
 
-    const offset = (page - 1) * limit;
-
-    const whereClause: any = {
-      userId: user.id,
-    };
-
-    if (filter) {
-      whereClause.activityTypeId = filter;
-    }
-
-    if (statusFilter && statusFilter.length > 0) {
-      whereClause.status = { in: statusFilter };
-    }
-
-    if (search) {
-      whereClause.OR = [
-        { title: { contains: search } },
-        { description: { contains: search } },
-        { activityType: { label: { contains: search } } },
-      ];
-    }
-
-    const [data, total] = await Promise.all([
-      prisma.task.findMany({
-        where: whereClause,
-        include: TASK_WITH_ACTIVITIES_INCLUDE,
-        orderBy: getTasksOrderBy(groupBy),
-        skip: offset,
-        take: limit,
-      }),
-      prisma.task.count({
-        where: whereClause,
-      }),
-    ]);
+    const { data, total } = await listTasksForUser(user.id, {
+      page,
+      limit,
+      activityTypeId: filter,
+      statuses: statusFilter,
+      search,
+      groupBy,
+    });
 
     return {
       success: true,
@@ -106,13 +43,7 @@ export const getTaskById = async (
   try {
     const user = await requireUser();
 
-    const task = await prisma.task.findFirst({
-      where: {
-        id: taskId,
-        userId: user.id,
-      },
-      include: TASK_WITH_ACTIVITIES_INCLUDE,
-    });
+    const task = await getTaskForUser(user.id, taskId);
 
     if (!task) {
       return { success: false, message: "Task not found" };
diff --git a/src/app/api/mcp/route.ts b/src/app/api/mcp/route.ts
index 9050e3064..43341a8ad 100644
--- a/src/app/api/mcp/route.ts
+++ b/src/app/api/mcp/route.ts
@@ -21,6 +21,10 @@ import {
   McpAddJobsBatchSchema,
   McpSaveMatchResultsBatchInputShape,
   McpSaveMatchResultsBatchSchema,
+  McpListTasksInputShape,
+  McpListTasksSchema,
+  McpGetTaskInputShape,
+  McpGetTaskSchema,
 } from "@/models/mcp.schema";
 import { handleAddJob } from "@/lib/mcp/tools/addJob";
 import { handleAddQuestion } from "@/lib/mcp/tools/addQuestion";
@@ -31,6 +35,9 @@ import { handleFindJob } from "@/lib/mcp/tools/findJob";
 import { handleUpdateJob } from "@/lib/mcp/tools/updateJob";
 import { handleAddJobsBatch } from "@/lib/mcp/tools/addJobsBatch";
 import { handleSaveMatchResultsBatch } from "@/lib/mcp/tools/saveMatchResultsBatch";
+import { handleListTasks } from "@/lib/mcp/tools/listTasks";
+import { handleGetTask } from "@/lib/mcp/tools/getTask";
+import { getMcpScopeError } from "@/lib/mcp/scope";
 
 function isMcpEnabled(): boolean {
   const env = process.env.MCP_ENABLED;
@@ -131,6 +138,42 @@ async function handler(req: Request): Promise<Response> {
     },
   );
 
+  server.tool(
+    "list_tasks",
+    MCP_TOOL_DESCRIPTIONS.list_tasks,
+    McpListTasksInputShape,
+    async (rawInput) => {
+      const scopeError = getMcpScopeError(auth.scopes, "tasks:read");
+      if (scopeError) return scopeError;
+      const parsed = McpListTasksSchema.safeParse(rawInput);
+      if (!parsed.success) {
+        const issues = parsed.error.issues.map((i) => i.message).join("; ");
+        return {
+          content: [{ type: "text" as const, text: `Validation error: ${issues}` }],
+        };
+      }
+      return handleListTasks(parsed.data, userId);
+    },
+  );
+
+  server.tool(
+    "get_task",
+    MCP_TOOL_DESCRIPTIONS.get_task,
+    McpGetTaskInputShape,
+    async (rawInput) => {
+      const scopeError = getMcpScopeError(auth.scopes, "tasks:read");
+      if (scopeError) return scopeError;
+      const parsed = McpGetTaskSchema.safeParse(rawInput);
+      if (!parsed.success) {
+        const issues = parsed.error.issues.map((i) => i.message).join("; ");
+        return {
+          content: [{ type: "text" as const, text: `Validation error: ${issues}` }],
+        };
+      }
+      return handleGetTask(parsed.data, userId);
+    },
+  );
+
   server.tool(
     "add_question",
     MCP_TOOL_DESCRIPTIONS.add_question,
diff --git a/src/components/settings/McpAccessSettings.tsx b/src/components/settings/McpAccessSettings.tsx
index 65166e538..db3104da7 100644
--- a/src/components/settings/McpAccessSettings.tsx
+++ b/src/components/settings/McpAccessSettings.tsx
@@ -229,7 +229,10 @@ export default function McpAccessSettings() {
         <CardHeader className="flex-row flex-wrap items-start justify-between gap-2">
           <div className="min-w-0">
             <CardTitle className="text-lg font-medium">Personal Access Tokens</CardTitle>
-            <CardDescription>Tokens authenticate external agents to call MCP tools.</CardDescription>
+            <CardDescription>
+              Tokens authenticate external agents to call MCP tools. Older tokens
+              without task scopes must be regenerated to access task tools.
+            </CardDescription>
           </div>
           <Button size="sm" className="shrink-0" onClick={() => setShowGenerateDialog(true)} disabled={isLoading}>
             <Plus className="h-4 w-4 mr-1" />
diff --git a/src/lib/mcp/scope.ts b/src/lib/mcp/scope.ts
new file mode 100644
index 000000000..a018b6243
--- /dev/null
+++ b/src/lib/mcp/scope.ts
@@ -0,0 +1,9 @@
+export function getMcpScopeError(scopes: string[], required: string) {
+  if (scopes.includes(required)) return null;
+
+  return {
+    content: [
+      { type: "text" as const, text: `Insufficient scope. Required: ${required}` },
+    ],
+  };
+}
diff --git a/src/lib/mcp/tokens.ts b/src/lib/mcp/tokens.ts
index 9ff209c6a..28c979aa9 100644
--- a/src/lib/mcp/tokens.ts
+++ b/src/lib/mcp/tokens.ts
@@ -2,6 +2,14 @@ import { createHash, randomBytes } from "crypto";
 
 const TOKEN_PREFIX = "jsync_";
 
+export const MCP_DEFAULT_SCOPES = [
+  "jobs:write",
+  "questions:write",
+  "resume:write",
+  "tasks:read",
+  "tasks:write",
+] as const;
+
 export function generateToken(): { plaintext: string; hash: string; prefix: string } {
   const plaintext = TOKEN_PREFIX + randomBytes(32).toString("base64url");
   const hash = hashToken(plaintext);
diff --git a/src/lib/mcp/toolDescriptions.ts b/src/lib/mcp/toolDescriptions.ts
index 5c27abe27..7b6d807f2 100644
--- a/src/lib/mcp/toolDescriptions.ts
+++ b/src/lib/mcp/toolDescriptions.ts
@@ -9,6 +9,10 @@ export const MCP_TOOL_DESCRIPTIONS = {
     "Look up whether a job posting is already saved in JobSync, by URL. Call this before add_job when re-running a search. With no URL to look up, use add_job's upsert instead of skipping dedupe.",
   update_job:
     "Correct or enrich a job previously added through MCP. Only the fields you supply change. Supplying a fuller jobDescription re-classifies the posting and requests a fresh match analysis — use this instead of re-adding with allowDuplicate.",
+  list_tasks:
+    "List the user's tasks with pagination and optional status, search-text, and activity-type filters. Defaults to active tasks that are in progress or need attention. Use this to discover task ids before another task operation.",
+  get_task:
+    "Retrieve one task by id, including its plain-text description, status, priority, completion, due date, activity type, and timestamps.",
   add_question:
     "Add an entry to the Question Bank. Resolves or creates tags by name. Returns a transparency report of what was matched vs. created.",
   save_match_result:
diff --git a/src/lib/mcp/tools/getTask.ts b/src/lib/mcp/tools/getTask.ts
new file mode 100644
index 000000000..24a06b75b
--- /dev/null
+++ b/src/lib/mcp/tools/getTask.ts
@@ -0,0 +1,23 @@
+import { checkMcpRateLimit } from "@/lib/mcp/rate-limit";
+import { serializeTask, taskJson } from "@/lib/mcp/tools/taskResult";
+import { getTaskForUser } from "@/lib/tasks/queries";
+import type { McpGetTaskInput } from "@/models/mcp.schema";
+
+export async function handleGetTask(input: McpGetTaskInput, userId: string) {
+  const rateCheck = checkMcpRateLimit(userId);
+  if (!rateCheck.allowed) {
+    return taskJson({
+      error: "rate_limit_exceeded",
+      retryAfterSeconds: Math.ceil(rateCheck.resetIn / 1000),
+    });
+  }
+
+  try {
+    const task = await getTaskForUser(userId, input.taskId);
+    if (!task) return taskJson({ error: "task_not_found", taskId: input.taskId });
+
+    return taskJson({ task: serializeTask(task) });
+  } catch (error: any) {
+    return taskJson({ error: error?.message ?? "Failed to get task" });
+  }
+}
diff --git a/src/lib/mcp/tools/listTasks.ts b/src/lib/mcp/tools/listTasks.ts
new file mode 100644
index 000000000..b4b05cdfb
--- /dev/null
+++ b/src/lib/mcp/tools/listTasks.ts
@@ -0,0 +1,37 @@
+import { checkMcpRateLimit } from "@/lib/mcp/rate-limit";
+import { serializeTask, taskJson } from "@/lib/mcp/tools/taskResult";
+import { listTasksForUser } from "@/lib/tasks/queries";
+import type { McpListTasksInput } from "@/models/mcp.schema";
+
+export async function handleListTasks(input: McpListTasksInput, userId: string) {
+  const rateCheck = checkMcpRateLimit(userId);
+  if (!rateCheck.allowed) {
+    return taskJson({
+      error: "rate_limit_exceeded",
+      retryAfterSeconds: Math.ceil(rateCheck.resetIn / 1000),
+    });
+  }
+
+  try {
+    const { data, total } = await listTasksForUser(userId, {
+      page: input.page,
+      limit: input.limit,
+      statuses: input.statuses,
+      search: input.search,
+      activityTypeLabel: input.activityType,
+    });
+
+    return taskJson({
+      tasks: data.map(serializeTask),
+      pagination: {
+        page: input.page,
+        limit: input.limit,
+        total,
+        totalPages: Math.ceil(total / input.limit),
+        hasMore: input.page * input.limit < total,
+      },
+    });
+  } catch (error: any) {
+    return taskJson({ error: error?.message ?? "Failed to list tasks" });
+  }
+}
diff --git a/src/lib/mcp/tools/taskResult.ts b/src/lib/mcp/tools/taskResult.ts
new file mode 100644
index 000000000..eae4b3781
--- /dev/null
+++ b/src/lib/mcp/tools/taskResult.ts
@@ -0,0 +1,37 @@
+import { toPlainText } from "@/lib/tasks/description";
+
+interface TaskResultInput {
+  id: string;
+  title: string;
+  description: string | null;
+  status: string;
+  priority: number;
+  percentComplete: number;
+  dueDate: Date | null;
+  activityType: { id: string; label: string } | null;
+  createdAt: Date;
+  updatedAt: Date;
+}
+
+export function serializeTask(task: TaskResultInput) {
+  return {
+    id: task.id,
+    title: task.title,
+    description: toPlainText(task.description),
+    status: task.status,
+    priority: task.priority,
+    percentComplete: task.percentComplete,
+    dueDate: task.dueDate?.toISOString() ?? null,
+    activityType: task.activityType
+      ? { id: task.activityType.id, label: task.activityType.label }
+      : null,
+    createdAt: task.createdAt.toISOString(),
+    updatedAt: task.updatedAt.toISOString(),
+  };
+}
+
+export function taskJson(value: unknown): {
+  content: Array<{ type: "text"; text: string }>;
+} {
+  return { content: [{ type: "text", text: JSON.stringify(value) }] };
+}
diff --git a/src/lib/tasks/queries.ts b/src/lib/tasks/queries.ts
new file mode 100644
index 000000000..09cbf51ba
--- /dev/null
+++ b/src/lib/tasks/queries.ts
@@ -0,0 +1,81 @@
+import prisma from "@/lib/db";
+import type { Prisma } from "@prisma/client";
+import type { TaskGroupBy, TaskStatus } from "@/models/task.model";
+
+export const TASK_WITH_ACTIVITIES_INCLUDE = {
+  activityType: true,
+  activities: {
+    select: { id: true },
+  },
+} satisfies Prisma.TaskInclude;
+
+export interface TaskListOptions {
+  page?: number;
+  limit?: number;
+  activityTypeId?: string;
+  activityTypeLabel?: string;
+  statuses?: TaskStatus[];
+  search?: string;
+  groupBy?: TaskGroupBy;
+}
+
+function getTasksOrderBy(groupBy?: TaskGroupBy): Prisma.TaskOrderByWithRelationInput[] {
+  switch (groupBy) {
+    case "dueDate":
+      return [{ dueDate: "asc" }, { priority: "desc" }, { createdAt: "desc" }];
+    case "createdDate":
+      return [{ createdAt: "desc" }, { priority: "desc" }];
+    case "updatedDate":
+      return [{ updatedAt: "desc" }, { priority: "desc" }, { createdAt: "desc" }];
+    case "activityType":
+      return [
+        { activityType: { label: "asc" } },
+        { priority: "desc" },
+        { createdAt: "desc" },
+      ];
+    default:
+      return [{ priority: "desc" }, { createdAt: "desc" }, { updatedAt: "desc" }];
+  }
+}
+
+export async function listTasksForUser(userId: string, options: TaskListOptions = {}) {
+  const page = options.page ?? 1;
+  const limit = options.limit ?? 25;
+  const where: Prisma.TaskWhereInput = { userId };
+
+  if (options.activityTypeId) where.activityTypeId = options.activityTypeId;
+  if (options.activityTypeLabel) {
+    where.activityType = {
+      value: options.activityTypeLabel.trim().toLowerCase(),
+      createdBy: userId,
+    };
+  }
+  if (options.statuses?.length) where.status = { in: options.statuses };
+  if (options.search) {
+    where.OR = [
+      { title: { contains: options.search } },
+      { description: { contains: options.search } },
+      { activityType: { label: { contains: options.search } } },
+    ];
+  }
+
+  const [data, total] = await Promise.all([
+    prisma.task.findMany({
+      where,
+      include: TASK_WITH_ACTIVITIES_INCLUDE,
+      orderBy: getTasksOrderBy(options.groupBy),
+      skip: (page - 1) * limit,
+      take: limit,
+    }),
+    prisma.task.count({ where }),
+  ]);
+
+  return { data, total };
+}
+
+export function getTaskForUser(userId: string, taskId: string) {
+  return prisma.task.findFirst({
+    where: { id: taskId, userId },
+    include: TASK_WITH_ACTIVITIES_INCLUDE,
+  });
+}
diff --git a/src/models/mcp.schema.ts b/src/models/mcp.schema.ts
index fd6ca6bd0..2db33cb1c 100644
--- a/src/models/mcp.schema.ts
+++ b/src/models/mcp.schema.ts
@@ -2,6 +2,39 @@ import { z } from "zod";
 import { APP_CONSTANTS, JOB_STATUS_VALUES } from "@/lib/constants";
 import { WORKPLACE_TYPES, matchEnumEntry } from "@/models/job.model";
 
+const MCP_TASK_STATUS_VALUES = [
+  "in-progress",
+  "complete",
+  "needs-attention",
+  "cancelled",
+] as const;
+
+export const McpListTasksInputShape = {
+  statuses: z
+    .array(z.enum(MCP_TASK_STATUS_VALUES))
+    .optional()
+    .describe("Task statuses to include. Defaults to in-progress and needs-attention."),
+  search: z.string().trim().min(1).max(200).optional().describe("Text to match in the task title, description, or activity type."),
+  activityType: z.string().trim().min(1).max(100).optional().describe("Activity-type label to match case-insensitively."),
+  page: z.number().int().min(1).optional().describe("One-based page number. Defaults to 1."),
+  limit: z.number().int().min(1).max(50).optional().describe("Tasks per page. Defaults to 25; maximum 50."),
+};
+
+export const McpListTasksSchema = z.object(McpListTasksInputShape).transform((input) => ({
+  ...input,
+  statuses: input.statuses ?? ["in-progress", "needs-attention"],
+  page: input.page ?? 1,
+  limit: input.limit ?? 25,
+}));
+export type McpListTasksInput = z.infer<typeof McpListTasksSchema>;
+
+export const McpGetTaskInputShape = {
+  taskId: z.string().min(1).describe("The task id returned by list_tasks or another task tool."),
+};
+
+export const McpGetTaskSchema = z.object(McpGetTaskInputShape);
+export type McpGetTaskInput = z.infer<typeof McpGetTaskSchema>;
+
 // An enum rather than a described string, for the same reason status is one:
 // a small local model fills an enum-constrained slot and ignores prose hints.
 // It sent "On-site" — the posting's own spelling — and when that was rejected
diff --git a/wiki/mcp.md b/wiki/mcp.md
index d4cd6ab3e..9235185fa 100644
--- a/wiki/mcp.md
+++ b/wiki/mcp.md
@@ -13,7 +13,7 @@ stale_after: 2027-09-02
 
 ## What can an AI agent do with JobSync over MCP?
 
-It can add and correct jobs, add Question Bank entries, and save a job-match or resume review that it produced itself. JobSync runs a built-in MCP (Model Context Protocol) server, so a chat client such as Claude Desktop can write to your tracker without you switching to the app — paste a posting into your agent and ask it to add the job, and the company, title, location, source and tags resolve against your existing lists.
+It can list and inspect tasks, add and correct jobs, add Question Bank entries, and save a job-match or resume review that it produced itself. JobSync runs a built-in MCP (Model Context Protocol) server, so a chat client such as Claude Desktop can work with your tracker without you switching to the app.
 
 Two things stay in your control. Every connection needs a personal access token you generate yourself, and each token is named — jobs it creates carry that name as their source, and an agent can only edit jobs that were created through MCP in the first place. Nothing an agent does can overwrite a job you curated in the app.
 
@@ -71,17 +71,19 @@ Both snippets are shown in the token dialog with your real URL and token already
 
 ## Which tools does a connected agent get?
 
-Nine, all of them writes to your own data:
+Eleven. Read tools can inspect your own tasks, and write tools change only your own data:
 
 - **add_job** — adds a job, resolving or creating company, title, location, source and tags by name, and reporting back what it matched versus created.
 - **add_jobs_batch** — the same thing for up to 10 jobs in one call, for a scheduled run.
 - **find_job** — checks by URL whether a posting is already saved, before adding it again.
 - **update_job** — corrects or enriches a job that was added through MCP. Only the fields supplied change.
+- **list_tasks** — lists tasks with pagination and optional status, text, and activity-type filters. With no filters it returns active tasks that are in progress or need attention.
+- **get_task** — returns one task by id with its description, status, priority, completion, due date, activity type and timestamps.
 - **add_question** — adds an entry to your Question Bank, with tags resolved the same way.
 - **review_resume** / **save_resume_review** — hands the agent your default resume and reviewing instructions, then stores the review it writes.
 - **save_match_result** / **save_match_results_batch** — stores a job-fit analysis the agent produced after adding a job.
 
-Tokens are issued with the scopes needed for all of these, so there is nothing to configure per tool.
+New tokens are issued with the scopes needed for all of these, including `tasks:read` and `tasks:write`. Tokens generated before task tools were added keep their original authority and do not receive task access automatically; revoke and regenerate an older token if it needs the task tools.
 
 ## How do I get a job match or resume review from my agent?