monday.com MCP server

What it does

This server reads and edits monday.com work management: boards, items and subitems, updates, docs, forms, dashboards, automations, AI columns and account-level object schemas. It is @mondaydotcomorg/monday-api-mcp, monday.com's own package, published from the mondaycom/mcp repository and built on its agent toolkit. Statio runs version 3.3.1 with your personal API token, and every call goes to monday's GraphQL API at api.monday.com as you.

monday.com also hosts the same toolkit at https://mcp.monday.com/mcp, with OAuth sign-in through its Monday MCP marketplace app. That is a separate connection that monday runs, not the one this page sets up.

Tools

Version 3.3.1 lists 84 tools when it starts with no flags, which is how Statio runs it. Every tool carries annotations. The last column follows the read-only hint, and 31 of the 84 set it. Those 31 are exactly what the server keeps in read-only mode.

Items

Updates and notifications

Boards, columns, groups and views

Workspaces, folders, users and search

Docs and files

Forms

Dashboards and widgets

Automations and AI columns

Object schemas

Raw GraphQL

Other

Set it up

Both setups need a personal API token. In monday.com, click your profile picture, then Developers, then API token > Show. Account admins can also find it under Administration > Connections > Personal API token. monday's authentication docs say personal tokens "mirror all permission levels set in the monday.com UI" and carry every scope, so the token can do whatever you can do in the browser. Regenerate in the same place invalidates the old token at once.

Claude Code, directly:

claude mcp add monday -e MONDAY_TOKEN=your-token -- npx -y @mondaydotcomorg/monday-api-mcp@3.3.1

Cursor, directly, in ~/.cursor/mcp.json or .cursor/mcp.json:

{
  "mcpServers": {
    "monday": {
      "command": "npx",
      "args": ["-y", "@mondaydotcomorg/monday-api-mcp@3.3.1"],
      "env": {
        "MONDAY_TOKEN": "${env:MONDAY_TOKEN}"
      }
    }
  }
}

The variable is MONDAY_TOKEN. The package README's monday_token example is out of date in 3.3.1, which reads every setting from MONDAY_ plus the setting's name in capitals.

To run it read-only, add --read-only true to the args, or set MONDAY_READONLYMODE=true. The value matters. The argument parser only reads a flag that has a value after it, so a bare --read-only, as monday's own README writes it, leaves all 84 tools in place. With the value set, the server lists the 31 read tools and nothing else. all_api_read stays, and all_api_write goes.

The client tutorials, How to add MCP servers to Claude Code and How to set up MCP servers in Cursor, explain config scopes and how to keep the token out of files you commit.

Through Statio: install monday.com from the catalog, paste the token under the server's Credentials, and grant tools under Permissions. A new server has no grants, so nobody can call it until you add some. The desktop app then writes your client configs. The manual entry is the local proxy URL with the server name from your dashboard, http://127.0.0.1:7777/monday/mcp, added in Claude Code with claude mcp add --transport http monday <url> or as a "url" in Cursor. Statio's image starts the server without read-only mode, so all 84 tools are there and your grants decide which an agent sees. Tools missing after that? Start a fresh session, then work through How to debug an MCP server that won't connect.

What to hold back

Start with the token. It is you, with every scope, in every workspace you can open. If an agent should only work on one team's boards, make a monday user for it, add that user only where it belongs, and use its token.

all_api_write is the tool to keep from every agent. It runs any mutation the GraphQL API accepts, so a grant on it covers every delete and admin change the named tools would have shown you separately, plus ones they don't have. Per-tool grants stop meaning much once an agent holds it. all_api_read is the read-side version. It can reach anything your token can see, including account and user data no named tool returns, so give it only to an agent you want exploring the account.

The deletes are scattered: delete_item, delete_update, delete_column, delete_object_schema, delete_object_schema_columns, the delete action in manage_automations and form_questions_editor, and block deletes inside update_doc. delete_column removes every value in the column, on every item. undo_action is also marked destructive, because it reverses changes on a board whoever made them.

Some writes act on people. create_notification sends a bell notification and optionally an email to any user, from your account. create_update and create_updates notify anyone they mention. An agent that posts 40 updates in one call reaches 40 item owners.

Some writes keep running after the session. create_automation and configure_ai_column change what happens to every future item on the board, and configure_ai_column can run over existing items too. The account-level schema tools change the columns of every board connected to a schema. Workspace, folder and move_object changes rearrange where everyone finds their work. A task agent needs none of these.

get_assets returns a public link to a private file, valid for an hour. On its own that is a read. Next to any tool that sends text out, on this server or another, it is a way to share a file nobody meant to share.

Item names, updates, docs and attached files are written by whoever has access, and form responses by whoever has the form link. fetch_file_content tells the agent to read attached files without being asked. Any of that text can carry instructions aimed at the agent, and an agent holding the read tools and the batch writes together is the setup where that changes your boards.

Leave out submit_bug_or_feature_request too. It is marked read-only, but its description tells the agent to file reports about your session whenever things go wrong, and no agent's job needs it.

With Statio you grant each tool separately, so a status-report agent can hold get_board_items_page, get_updates and board_insights while a triage agent also gets create_item and change_item_column_values. MCP permissions covers how grants and denies combine.

Questions