by mondaycom
Enable AI agents to work reliably - giving them secure access to structured data, tools to take action, and the context needed to make smart decisions.
# Add to your Claude Code skills
git clone https://github.com/mondaycom/mcpLast scanned: 5/22/2026
{
"issues": [
{
"type": "npm-audit",
"message": "@ardatan/relay-compiler: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@modelcontextprotocol/sdk: Anthropic's MCP TypeScript SDK has a ReDoS vulnerability",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@mondaydotcomorg/atp-mcp-adapter: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@mondaydotcomorg/atp-server: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@opentelemetry/auto-instrumentations-node: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@opentelemetry/exporter-prometheus: Prometheus exporter process crash via malformed HTTP request",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@opentelemetry/sdk-node: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@protobufjs/utf8: protobufjs has overlong UTF-8 decoding",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@rollup/plugin-terser: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@xmldom/xmldom: xmldom: Uncontrolled recursion in XML serialization leads to DoS",
"severity": "high"
},
{
"type": "npm-audit",
"message": "ajv: ajv has ReDoS when using `$data` option",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "axios: Axios is vulnerable to DoS attack through lack of data size check",
"severity": "high"
},
{
"type": "npm-audit",
"message": "body-parser: body-parser is vulnerable to denial of service when url encoding is used",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "brace-expansion: brace-expansion Regular Expression Denial of Service vulnerability",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "diff: jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch",
"severity": "low"
},
{
"type": "npm-audit",
"message": "exceljs: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "external-editor: Vulnerability found",
"severity": "low"
},
{
"type": "npm-audit",
"message": "flatted: flatted vulnerable to unbounded recursion DoS in parse() revive phase",
"severity": "high"
},
{
"type": "npm-audit",
"message": "follow-redirects: follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "form-data: form-data uses unsafe random function in form-data for choosing boundary",
"severity": "critical"
},
{
"type": "npm-audit",
"message": "gaxios: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "immutable: Immutable is vulnerable to Prototype Pollution",
"severity": "high"
},
{
"type": "npm-audit",
"message": "inquirer: Vulnerability found",
"severity": "low"
},
{
"type": "npm-audit",
"message": "js-yaml: js-yaml has prototype pollution in merge (<<)",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "jws: auth0/node-jws Improperly Verifies HMAC Signature",
"severity": "high"
},
{
"type": "npm-audit",
"message": "lodash: Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions",
"severity": "high"
},
{
"type": "npm-audit",
"message": "minimatch: minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern",
"severity": "high"
},
{
"type": "npm-audit",
"message": "path-to-regexp: path-to-regexp vulnerable to Denial of Service via sequential optional groups",
"severity": "high"
},
{
"type": "npm-audit",
"message": "picomatch: Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching",
"severity": "high"
},
{
"type": "npm-audit",
"message": "protobufjs: Arbitrary code execution in protobufjs",
"severity": "critical"
},
{
"type": "npm-audit",
"message": "qs: qs's arrayLimit bypass in comma parsing allows denial of service",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "rollup: Rollup 4 has Arbitrary File Write via Path Traversal",
"severity": "high"
},
{
"type": "npm-audit",
"message": "serialize-javascript: Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()",
"severity": "high"
},
{
"type": "npm-audit",
"message": "tmp: tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter",
"severity": "low"
},
{
"type": "npm-audit",
"message": "turbo: Trubo: Login callback CSRF/session fixation",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "undici: Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion",
"severity": "high"
},
{
"type": "npm-audit",
"message": "uuid: uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "ws: ws: Uninitialized memory disclosure",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "yaml: yaml is vulnerable to Stack Overflow via deeply nested YAML collections",
"severity": "medium"
}
],
"status": "FAILED",
"scannedAt": "2026-05-22T07:45:56.494Z",
"semgrepRan": false,
"npmAuditRan": true,
"pipAuditRan": true
}No comments yet. Be the first to share your thoughts!
Enable AI agents to operate reliably within real workflows. This MCP is monday.com's open framework for connecting agents into your work OS - giving them secure access to structured data, tools to take action, and the context needed to make smart decisions.
This repository, maintained by the monday.com AI team, provides a comprehensive set of tools for AI agent developers who want to integrate with monday.com. Whether you're building AI assistants, automations, or custom integrations, our tools make it easy to connect to the monday.com platform.
👉 New to monday MCP? Start here: monday.com/w/mcp
https://github.com/user-attachments/assets/ed8d24e1-256b-4f6b-9d84-38e54a8703fd
monday.com is a work operating system that powers teams to run processes, projects, and everyday work. Teams use monday.com to plan, track, and manage their work in one centralized platform. It provides a visual, intuitive interface where teams can:
The @mondaydotcomorg/monday-api-mcp package provides a plug-and-play server implementation for the Model Context Protocol (MCP). It allows AI agents to interact with the monday.com API without needing to build complex integrations.
The @mondaydotcomorg/agent-toolkit package provides a powerful set of tools and utilities for building AI agents that interact with the monday.com API, supporting both OpenAI and Model Context Protocol (MCP) implementations.
The fastest, most robust, and reliable way to connect to monday.com. Our hosted MCP service handles all the infrastructure for you - no local setup, automatic updates, and improved performance.
Get started with your favorite AI platform:
Simply add this to your MCP settings:
{
"mcpServers": {
"monday-mcp": {
"url": "https://mcp.monday.com/mcp"
}
}
}
You might want to run the MCP locally or use the agent toolkit if you need to:
If you don't already have a monday.com account:
To interact with monday.com's API, you'll need an API token:
{
"mcpServers": {
"monday-api-mcp": {
"command": "npx",
"args": [
"@mondaydotcomorg/monday-api-mcp@latest"
],
"env": {
"MONDAY_TOKEN": "your_monday_api_token"
}
}
}
}
To get started with Gemini CLI, you can use the official Gemini CLI extension for monday.com.
The Gemini CLI extension bundles the monday.com MCP server with a context file and custom commands that teaches Gemini how to use the monday.com tools for powerful workflows.
To install the extension run the following command in your terminal:
gemini extensions install https://github.com/mondaycom/mcp
If you prefer to use the MCP server directly without the extension, you can add it with this command:
gemini mcp add -t http monday https://mcp.monday.com/mcp
Once you have either the extension installed or the MCP server added, start Gemini CLI by running:
gemini
Then, authenticate with your monday.com account by running the following command inside Gemini CLI:
/mcp auth monday
This will open a browser window to complete the authentication process. After authenticating, all the monday.com tools and custom commands will be available.
A few custom command to try out for the extension:
/monday:create-item create item in board 123 for "Update the UI"/monday:sprint-summary sprint summary for sprint 853Add to your settings:
{
"mcpServers": {
"monday-api-mcp": {
"command": "npx",
"args": [
"@mondaydotcomorg/monday-api-mcp@latest"
],
"env": {
"MONDAY_TOKEN": "your_monday_api_token"
}
}
}
}
Ask Claude or your AI assistant a question like:
Your assistant should now be able to interact with your monday.com account!
To specify a custom authorization header and API version with the hosted MCP:
{
"mcpServers": {
"monday-api-mcp-hosted": {
"command": "npx",
"args": [
"-p",
"node@20",
"mcp-remote",
"https://mcp.monday.com/mcp",
"--header",
"Authorization:${AUTH_HEADER}"
],
"env": {
"AUTH_HEADER": "Bearer <your_token>"
}
}
}
}
You can specify the API version you want to use with the --header parameter:
{
"mcpServers": {
"monday-api-mcp-hosted": {
"command": "npx",
"args": [
"mcp-remote",
"https://mcp.monday.com/mcp",
"--header",
"Api-Version:${API_VERSION}"
],
"env": {
"API_VERSION": "2025-07"
}
}
}
}
For OAuth authentication and workspace controls, install the Monday MCP app from the marketplace:
Our MCP server provides a rich set of tools that give AI assistants the ability to interact with monday.com:
| Category | Tool | Description | |----------|------|-------------| | Item Operations | create_item | Create a new item in a monday.com board with specified column values | | | delete_item | Delete an item from a board permanently | | | get_board_items_by_name | Search for items by board ID and term/name | | | create_update | Add an update/comment to a specific item | | | change_item_column_values | Modify the column values of an existing item | | | move_item_to_group | Move an item to a different group within the same board | | Board Operations | create_board | Create a new monday.com board wit