mcp
Enable AI agents to work reliably - giving them secure access to structured data, tools to take action, and the context needed to make smart decisions.
No outside reports on file
Use this connector only with a dedicated, low-privilege Monday.com account and monitor all AI-driven changes closely, since the AI has direct control over your project data.
Based on public adoption and transparency signals as of Oct 19, 2026. Our opinion, not a code audit or security guarantee.
What it can access
- Local filesNo local folder access notedLOW
- Command executionNo shell command runner notedLOW
- Network reachConnects to outside service APINOTED
- CredentialsRequires API key or tokenREVIEW
- Package sourcenpm (@mondaydotcomorg/monday-api-mcp)PUBLIC
Inferred from this listing’s public package details and description. Check the project’s source before installing.
Install
npx -y @mondaydotcomorg/monday-api-mcpEverything known
We found nothing about this project in the sources we read (last checked 2026-10-30). That does not mean it has no problems.
0 incidents · 0 advisories · 0 news articles · 0 community threads · checked 2026-10-30
Popularity grade: C (from public signals such as stars and downloads, not a code review). Graded 2026-10-19.
Sources we read: OSV, GitHub Advisory Database, CISA Known Exploited Vulnerabilities, 44 security news feeds and our incident library. Last checked 2026-10-30.
About MCP
This is an MCP connector that links AI agents to Monday.com, a work management platform. It gives AI agents access to structured data from Monday.com projects and tasks, plus tools to take actions like creating or updating items.
Who it’s for
Teams using Monday.com who want to let AI assistants read and modify their project data. It's designed for businesses that need AI to help manage tasks, workflows, or reporting within Monday.com.
Alternatives
- Zapier MCP or native integrations: Use Zapier's automation tools for Monday.com without direct AI control.
- Monday.com API client libraries: Build custom integrations with strict guardrails instead of using a general MCP connector.
- Other work management MCPs: Look for connectors to Asana, Jira, or Notion if switching platforms is an option.
Setup
Check these steps against the project’s own instructions before running anything.
Follow the project's README. The package is published as @mondaydotcomorg/monday-api-mcp on npm. Check the GitHub repository for Claude Desktop configuration examples and authentication setup instructions.
Why this grade
Signal-based grade (3/7 points): listed in several sources, public source code. This reflects adoption and transparency, not a code review.
Popularity and upkeep
- GitHub stars
- 436
- Listing last refreshed
- 2026-10-29
These are public popularity signals, not a maintenance check. Look at the repository’s commit history and open issues.
Risks to watch for
- Monday.com account access: The AI gets whatever permissions the connected Monday.com account has, which could include sensitive projects, client data, or financial information.
- Unintended task changes: The AI could modify, delete, or create tasks if misconfigured or tricked by a misleading prompt, disrupting workflows.
- Data leakage in responses: Project names, descriptions, and task details could be leaked in AI responses or logs if not carefully managed.
- Weak or stolen credentials: If the Monday.com API key or authentication tokens are exposed, anyone can impersonate that account and access all linked data.
- Prompt injection risks: A malicious task description or comment in Monday.com could contain hidden instructions that trick the AI into performing unintended actions.
How to lower the risk
Least-privilege permissions
- Create a separate Monday.com user account with only the boards and permissions the AI actually needs.
- Restrict the API key to read-only if possible, or limit write access to specific boards.
Network isolation
- Run the MCP server on a secure, isolated network if possible.
- Use VPNs or private networks to limit exposure of Monday.com API calls.
Monitoring
- Log all AI actions and changes made through the connector.
- Set up alerts in Monday.com to catch unusual bulk edits or deletions.
Red flags to watch for
- AI suddenly creating many tasks or bulk-updating unrelated items.
- Unexpected API errors or authentication failures in logs.
- Changes to sensitive boards or fields the AI shouldn't touch.
Questions
How do I install MCP?
Run npx -y @mondaydotcomorg/monday-api-mcp in your terminal, or add the server entry to your claude_desktop_config.json or .cursor/mcp.json as shown in the Setup section on this page. Full setup docs and environment variables are in github.com/mondaycom/mcp.
Are there security reports about MCP?
No reports found for this package in our research (last checked 2026-10-30). MCP currently holds Grade C (Moderate risk signals) based on public adoption and transparency signals. Key risk areas to watch include monday.com account access, unintended task changes, data leakage in responses.
Is MCP actively maintained?
MCP has 436 GitHub stars. Our directory data was last refreshed on 2026-10-29. Check recent commit activity, release tags, and open issues at github.com/mondaycom/mcp before pinning it in production.
What are alternatives to MCP?
Notable alternatives to MCP include Zapier MCP or native integrations (Use Zapier's automation tools for Monday.com without direct AI control), Monday.com API client libraries (Build custom integrations with strict guardrails instead of using a general MCP connector), Other work management MCPs (Look for connectors to Asana, Jira, or Notion if switching platforms is an option). You can also compare MCP side by side with other MCP servers in the Related tools section on this page.
README badge and team notes
Maintain or use MCP? Show its live grade in your GitHub README, docs site, or run a check from the terminal before you install.
GitHub README Markdown:
[](https://agentarmorhq.com/skills/mondaycom-mcp)HTML embed:
<a href="https://agentarmorhq.com/skills/mondaycom-mcp"><img src="https://agentarmorhq.com/api/badge/mondaycom-mcp" alt="AgentArmorHQ Risk Grade for MCP" height="20" /></a>Terminal check:
curl -fsSL https://agentarmorhq.com/api/cli | node --input-type=module - check "mondaycom-mcp"Share with your security lead
Need sign-off to use mcp? Copy this note for Slack, a ticket or a pull request.
### AgentArmorHQ Security Review Memo: mcp
- **Listing URL:** https://agentarmorhq.com/skills/mondaycom-mcp
- **Type:** App connector
- **Risk Grade:** Grade C (Moderate risk signals)
- **Outside Security Advisories on File:** 0
- **Public Adoption:** 436 GitHub stars
#### Permission & Blast-Radius Signals
- **Local files:** No local folder access noted
- **Command execution:** No shell command runner noted
- **Network reach:** Connects to outside service API
- **Credentials:** Requires API key or token
- **Package source:** npm (@mondaydotcomorg/monday-api-mcp)
#### Recommended Hardened Setup
- **Command:** `npx -y --ignore-scripts @mondaydotcomorg/monday-api-mcp`
- **Controls:** Pin an exact version in `.mcp.json`, scope access to a single workspace folder, and use a least-privilege read-only token where supported.
_Based on public adoption and transparency signals as of Oct 19, 2026. Our opinion, not a code audit or security guarantee._Key facts
- Type
- App connector
- Publisher
- mondaycom
- Source code
- github.com/mondaycom/mcp
- Install command
- npm install @mondaydotcomorg/monday-api-mcp
- Est. context load
- ~1.1k tokens / turn (~6 tool schemas, 0.53% of 200k context)
- Popularity
- 436 GitHub stars
- Last updated
- 2026-10-29
- Last graded
- 2026-10-19
Community
Discussions for MCP
Ask questions or share configuration tips. Governed by our Community Rules & Terms.
No posts match this filter yet.
Be the first to ask a question or share a working tip.
Check before you install, in Claude
Your assistant answers Block, Review or No known issues for any package before it installs it.
Get this check inside Claude