Mcp MCP Server
https://mcp.ai.teamwork.com/
Remote
v1.25.3
Published by mcp.ai.teamwork.com — no publish provenance and no public repository, so the publisher could not be verified and the source cannot be independently located.
The Teamwork.com official MCP server helps teams efficiently manage client projects with AI.
The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.
1. Threat score — 100 − 0 = 100. What the published surface and source actually contain:
The deterministic scan raised no scored threat in the surface it inspected — the threat score stayed at 100. Capability observations and advisory notes are recorded but never lower it.
2. Client adoption risk — 100 − 3 = 97. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:
| Points | Adoption-risk factor |
|---|---|
| −3 | capability blast radius (moderate) — client exposure if the model is manipulated |
Capability observations and info notes are shown under Findings but never scored.
Open any row's finding below for the file, line and evidence behind a deduction.
Findings 3
medium Untrusted input can drive an external actionMTC-FLOW-005
Untrusted-input tools ([twspaces-get_comment, twspaces-get_page]) co-exist with external-action tools ([twprojects-create_comment, twchat-get_or_create_dm, twchat-send_message, twdesk-create_file, twspaces-create_comment]). A prompt injection could cause unwanted external actions, though no direct sensitive-data leak path was found.
Evidence: untrusted [twspaces-get_comment, twspaces-get_page] → sinks [twprojects-create_comment, twchat-get_or_create_dm, twchat-send_message, twdesk-create_file, twspac
Fix: Require confirmation for state-changing/egress actions triggered after processing untrusted content.
Location: flow twspaces-get_comment → twprojects-create_comment
medium Tool "twdesk-create_file" can modify the filesystemMTC-CAP-002
Tool "twdesk-create_file" can write, overwrite or delete files (keyword "create_file" in tool name). Verify it is scoped to a safe directory.
Fix: Constrain file operations to an explicit, non-sensitive root; reject path traversal.
Location: tool twdesk-create_file
low Mutating tool "twdesk-create_file" declares no destructiveHintMTC-CAP-005
Tool "twdesk-create_file" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.
Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.
Location: tool twdesk-create_file
Tools 190
Each tool and what it can reach — enumerated from the running server.
twdesk-create_filenetwork egresswrites filestwchat-get_or_create_dmnetwork egresstwchat-send_messagenetwork egresstwprojects-create_commentnetwork egresstwspaces-create_commentnetwork egresstwspaces-get_commentingests untrusted inputtwspaces-get_pageingests untrusted inputtwchat-get_conversationno sensitive capabilitytwchat-get_current_userno sensitive capabilitytwchat-list_conversationsno sensitive capability
Show 180 more tools ↓
twchat-list_messagesno sensitive capabilitytwchat-list_peopleno sensitive capabilitytwchat-send_dmno sensitive capabilitytwdesk-create_companyno sensitive capabilitytwdesk-create_customerno sensitive capabilitytwdesk-create_helpdoc_articleno sensitive capabilitytwdesk-create_priorityno sensitive capabilitytwdesk-create_statusno sensitive capabilitytwdesk-create_tagno sensitive capabilitytwdesk-create_ticketno sensitive capabilitytwdesk-create_ticket_typeno sensitive capabilitytwdesk-get_companyno sensitive capabilitytwdesk-get_customerno sensitive capabilitytwdesk-get_helpdoc_articleno sensitive capabilitytwdesk-get_inboxno sensitive capabilitytwdesk-get_priorityno sensitive capabilitytwdesk-get_statusno sensitive capabilitytwdesk-get_tagno sensitive capabilitytwdesk-get_ticketno sensitive capabilitytwdesk-get_ticket_typeno sensitive capabilitytwdesk-get_userno sensitive capabilitytwdesk-list_companiesno sensitive capabilitytwdesk-list_customersno sensitive capabilitytwdesk-list_inboxesno sensitive capabilitytwdesk-list_prioritiesno sensitive capabilitytwdesk-list_statusesno sensitive capabilitytwdesk-list_tagsno sensitive capabilitytwdesk-list_ticket_typesno sensitive capabilitytwdesk-list_usersno sensitive capabilitytwdesk-reply_ticketno sensitive capabilitytwdesk-search_helpdoc_articlesno sensitive capabilitytwdesk-search_ticketsno sensitive capabilitytwdesk-update_companyno sensitive capabilitytwdesk-update_customerno sensitive capabilitytwdesk-update_helpdoc_articleno sensitive capabilitytwdesk-update_priorityno sensitive capabilitytwdesk-update_statusno sensitive capabilitytwdesk-update_tagno sensitive capabilitytwdesk-update_ticketno sensitive capabilitytwdesk-update_ticket_typeno sensitive capabilitytwprojects-add_project_memberno sensitive capabilitytwprojects-clone_projectno sensitive capabilitytwprojects-complete_taskno sensitive capabilitytwprojects-complete_timerno sensitive capabilitytwprojects-create_companyno sensitive capabilitytwprojects-create_custom_fieldno sensitive capabilitytwprojects-create_custom_field_valueno sensitive capabilitytwprojects-create_custom_itemno sensitive capabilitytwprojects-create_custom_item_fieldno sensitive capabilitytwprojects-create_custom_item_recordno sensitive capabilitytwprojects-create_jobroleno sensitive capabilitytwprojects-create_linkno sensitive capabilitytwprojects-create_messageno sensitive capabilitytwprojects-create_message_replyno sensitive capabilitytwprojects-create_milestoneno sensitive capabilitytwprojects-create_notebookno sensitive capabilitytwprojects-create_projectno sensitive capabilitytwprojects-create_project_categoryno sensitive capabilitytwprojects-create_project_templateno sensitive capabilitytwprojects-create_skillno sensitive capabilitytwprojects-create_tagno sensitive capabilitytwprojects-create_taskno sensitive capabilitytwprojects-create_tasklistno sensitive capabilitytwprojects-create_teamno sensitive capabilitytwprojects-create_timelogno sensitive capabilitytwprojects-create_timerno sensitive capabilitytwprojects-create_userno sensitive capabilitytwprojects-create_workflowno sensitive capabilitytwprojects-create_workflow_stageno sensitive capabilitytwprojects-get_commentno sensitive capabilitytwprojects-get_companyno sensitive capabilitytwprojects-get_custom_fieldno sensitive capabilitytwprojects-get_custom_field_valueno sensitive capabilitytwprojects-get_custom_itemno sensitive capabilitytwprojects-get_custom_item_fieldno sensitive capabilitytwprojects-get_custom_item_recordno sensitive capabilitytwprojects-get_jobroleno sensitive capabilitytwprojects-get_linkno sensitive capabilitytwprojects-get_messageno sensitive capabilitytwprojects-get_message_replyno sensitive capabilitytwprojects-get_milestoneno sensitive capabilitytwprojects-get_notebookno sensitive capabilitytwprojects-get_projectno sensitive capabilitytwprojects-get_project_categoryno sensitive capabilitytwprojects-get_skillno sensitive capabilitytwprojects-get_tagno sensitive capabilitytwprojects-get_taskno sensitive capabilitytwprojects-get_tasklistno sensitive capabilitytwprojects-get_teamno sensitive capabilitytwprojects-get_timelogno sensitive capabilitytwprojects-get_timerno sensitive capabilitytwprojects-get_userno sensitive capabilitytwprojects-get_user_meno sensitive capabilitytwprojects-get_workflowno sensitive capabilitytwprojects-get_workflow_stageno sensitive capabilitytwprojects-link_project_to_workflowno sensitive capabilitytwprojects-list_activitiesno sensitive capabilitytwprojects-list_calendar_eventsno sensitive capabilitytwprojects-list_calendarsno sensitive capabilitytwprojects-list_commentsno sensitive capabilitytwprojects-list_companiesno sensitive capabilitytwprojects-list_custom_field_valuesno sensitive capabilitytwprojects-list_custom_fieldsno sensitive capabilitytwprojects-list_custom_item_fieldsno sensitive capabilitytwprojects-list_custom_item_recordsno sensitive capabilitytwprojects-list_custom_itemsno sensitive capabilitytwprojects-list_industriesno sensitive capabilitytwprojects-list_jobrolesno sensitive capabilitytwprojects-list_linksno sensitive capabilitytwprojects-list_message_repliesno sensitive capabilitytwprojects-list_messagesno sensitive capabilitytwprojects-list_milestonesno sensitive capabilitytwprojects-list_notebooksno sensitive capabilitytwprojects-list_project_budgetsno sensitive capabilitytwprojects-list_project_categoriesno sensitive capabilitytwprojects-list_project_templatesno sensitive capabilitytwprojects-list_projectsno sensitive capabilitytwprojects-list_skillsno sensitive capabilitytwprojects-list_tagsno sensitive capabilitytwprojects-list_tasklist_budgetsno sensitive capabilitytwprojects-list_tasklistsno sensitive capabilitytwprojects-list_tasksno sensitive capabilitytwprojects-list_teamsno sensitive capabilitytwprojects-list_timelogsno sensitive capabilitytwprojects-list_timersno sensitive capabilitytwprojects-list_usersno sensitive capabilitytwprojects-list_workflow_stagesno sensitive capabilitytwprojects-list_workflowsno sensitive capabilitytwprojects-move_task_to_workflow_stageno sensitive capabilitytwprojects-pause_timerno sensitive capabilitytwprojects-resume_timerno sensitive capabilitytwprojects-searchno sensitive capabilitytwprojects-summarize_timelogsno sensitive capabilitytwprojects-update_commentno sensitive capabilitytwprojects-update_companyno sensitive capabilitytwprojects-update_custom_fieldno sensitive capabilitytwprojects-update_custom_field_valueno sensitive capabilitytwprojects-update_custom_itemno sensitive capabilitytwprojects-update_custom_item_fieldno sensitive capabilitytwprojects-update_custom_item_recordno sensitive capabilitytwprojects-update_jobroleno sensitive capabilitytwprojects-update_linkno sensitive capabilitytwprojects-update_messageno sensitive capabilitytwprojects-update_message_replyno sensitive capabilitytwprojects-update_milestoneno sensitive capabilitytwprojects-update_notebookno sensitive capabilitytwprojects-update_projectno sensitive capabilitytwprojects-update_project_categoryno sensitive capabilitytwprojects-update_skillno sensitive capabilitytwprojects-update_tagno sensitive capabilitytwprojects-update_taskno sensitive capabilitytwprojects-update_tasklistno sensitive capabilitytwprojects-update_teamno sensitive capabilitytwprojects-update_timelogno sensitive capabilitytwprojects-update_timerno sensitive capabilitytwprojects-update_userno sensitive capabilitytwprojects-update_workflowno sensitive capabilitytwprojects-update_workflow_stageno sensitive capabilitytwprojects-users_workloadno sensitive capabilitytwspaces-create_categoryno sensitive capabilitytwspaces-create_pageno sensitive capabilitytwspaces-create_spaceno sensitive capabilitytwspaces-create_tagsno sensitive capabilitytwspaces-duplicate_pageno sensitive capabilitytwspaces-get_categoryno sensitive capabilitytwspaces-get_homepageno sensitive capabilitytwspaces-get_spaceno sensitive capabilitytwspaces-get_tagno sensitive capabilitytwspaces-list_categoriesno sensitive capabilitytwspaces-list_commentsno sensitive capabilitytwspaces-list_pagesno sensitive capabilitytwspaces-list_space_collaboratorsno sensitive capabilitytwspaces-list_spacesno sensitive capabilitytwspaces-list_tagsno sensitive capabilitytwspaces-searchno sensitive capabilitytwspaces-update_categoryno sensitive capabilitytwspaces-update_commentno sensitive capabilitytwspaces-update_pageno sensitive capabilitytwspaces-update_spaceno sensitive capabilitytwspaces-update_tagno sensitive capability
Toxic flows 1
Cross-tool combinations that form a data-exfiltration primitive (untrusted input → sensitive source → external sink).
Versions 1
Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.
| Version | Score | Findings | Engine | Scanned |
|---|---|---|---|---|
v1.25.3 latest |
A 97/100 | 3 | 1.10.0 | 2026-07-25 |
Embed this score
Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.
Verify this score yourself
The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.
npx mcptrustchecker scan https://mcp.ai.teamwork.com/ --onlineMore in Communication & Collaboration
One key, 100+ models — chat with any LLM and generate video, images, speech. Free trial at 370.ai.
Security scan results for the Adeu MCP server.
Security scan results for the Agentcanary MCP server.
Signal-first Bitcoin intelligence: sovereign, hiring & hashrate signals over MCP.
WhatsApp® reminders and rescheduling for Calendly. Public read-only MCP endpoint.
Security scan results for the Chat MCP server.