Secure monday.com access for AI agents
Boards, items, docs, dashboards, workflows, and platform agents via monday.com's official MCP server.
Connect monday.com to the gateway to give agents governed access to your monday.com account: boards, items, docs, dashboards, views, workflows, automations, forms, and platform agents – every call runs through your policies and is logged for audit.
Server URL: https://mcp.monday.com/mcp
Credential modes
monday.com supports per-org dynamic registration only, so there is no app to create on monday.com's side and no client ID or secret to enter. See Credential modes for how it compares with Use SecureAuth's app and Bring your own app.
Before you begin
- A monday.com account that can reach the boards and docs your agents need.
- Administrator access to your Agent Authority workspace, to add the resource.
Setup
- In the Agent Authority console, go to Resources and click Add Resource.
- Select Monday from the catalog.
- On Choose how to install Monday, click Per-org dynamic registration. Selecting it adds the resource right away with its tools pre-configured.
Dynamic client registration
When you add the resource, the gateway registers its own OAuth client with monday.com – the credential that lets it sign users in. monday.com's own board, doc, and workspace permissions still apply, so an agent can only reach what the person who signed in could already reach.
Verify the connection
The gateway syncs the monday.com tools automatically. To check the connection end to end, ask your agent to run a request:
Get my monday.com user contextIf your user and account details come back, the connection is working.
How users connect
Access is per user. Each additional user connects their own monday.com account the first time their agent calls a monday.com tool: the gateway returns a sign-in link, the user authorizes once, and the tools work from then on. Go to Connections to manage linked accounts.
Each person only reaches the boards, docs, and workspaces their monday.com role allows.
Available tools
monday.com exposes a broad tool surface. Highlights by area:
| Tool | Access | Description |
|---|---|---|
search | read | Search boards, docs, folders, workspaces, and updates |
get_board_info | read | Get board metadata, structure, owners, and configuration |
get_board_items_page | read | Page through a board's items, with optional column values |
board_insights | read | Filter, group, and aggregate a board's data for insights |
get_user_context | read | Fetch the current user, account, and their relevant items |
list_workspaces | read | List workspaces available to the user |
read_docs | read | Read monday.com documents (content or metadata) |
all_api_read | read | Run read-only GraphQL queries against the monday.com API |
create_item / create_items | write | Create one or many items on a board |
change_item_column_values | write | Change an item's column values |
create_board | write | Create a board |
create_doc / update_doc | write | Create or update a monday.com doc |
create_update | write | Add an update (comment/post) to an item |
create_dashboard | write | Create a dashboard aggregating one or more boards |
create_workflow / publish_workflow | write | Build and publish a workflow |
move_object | write | Move a folder, board, or overview |
manage_agent / manage_automations | write | Create, update, delete, or run agents and automations |
vibe_create / vibe_update | write | Create or update a Vibe app |
all_api_write | write | Run GraphQL mutations against the monday.com API |
all_monday_api | write | Run any monday.com API operation as generated GraphQL |
The connector registers the full monday.com MCP tool set (boards, items, columns, groups, docs, dashboards, views, widgets, forms, automations, workflows, notifications, assets, platform agents, and Vibe apps). Use gateway policies to allow only the tools each agent needs.
Required scopes
monday.com does not require you to configure OAuth scopes for its MCP server. The connection's reach is established during the OAuth flow and bounded by the authorizing user's monday.com permissions.
Policy examples
Every org is created with a seeded Allow all rule at the bottom of the list,
so any call your own rules don't match stays allowed. monday.com's write surface
is too wide to enumerate safely – all_monday_api alone runs arbitrary GraphQL
mutations, and move_object, manage_*, publish_workflow, and vibe_* sit
outside the obvious create_* / update_* prefixes. Restrict this resource with
a catch-all Deny * rule scoped to the Monday MCP, then allow back only the
tools an agent needs.
New rules are added at the top of the list, so create the catch-all deny first and the allows after it – that leaves the allows above the deny, which is the order evaluation needs. See Rule order.
- Read-only access: deny
*on the Monday MCP, then allowsearch,get_*,list_*,read_docs,board_insights,workspace_info, andall_api_readabove it. Anything you don't allow back – including every raw-GraphQL and management tool – is denied. - Boards and items only: deny
*on the Monday MCP, then allowget_board_info,get_board_items_page,create_item,create_items, andchange_item_column_valuesabove it. - Typed tools only (on top of a broader allow): deny
all_monday_api,all_api_read, andall_api_writeso agents cannot hand-write GraphQL.
Next steps
- Create a policy – start from the read-only pattern in Policy examples above.
- Policies – how first-match-wins rule order and the seeded Allow all rule interact.