Monoproject MCP Server
monoproject-mcp
npm
v1.1.1
Source verified
Published by mono-digital-studio — publish provenance cryptographically ties this package to that repository. That is proof of origin, not an official vendor package.
MCP server for MONOProject — full API coverage for project management from Claude Code
The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.
1. Threat score — 100 − 0 = 100. What the published surface and source actually contain:
The deterministic scan raised no scored threat in the surface it inspected — the threat score stayed at 100. Capability observations and advisory notes are recorded but never lower it.
2. Client adoption risk — 100 − 3 = 97. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:
| Points | Adoption-risk factor |
|---|---|
| −3 | capability blast radius (moderate) — client exposure if the model is manipulated |
Capability observations and info notes are shown under Findings but never scored.
Open any row's finding below for the file, line and evidence behind a deduction.
Findings 2
medium Tool "mono_unlink_dependency" can modify the filesystemMTC-CAP-002
Tool "mono_unlink_dependency" can write, overwrite or delete files (keyword "unlink" in tool name). Verify it is scoped to a safe directory.
Fix: Constrain file operations to an explicit, non-sensitive root; reject path traversal.
Location: tool mono_unlink_dependency
low Mutating tool "mono_unlink_dependency" declares no destructiveHintMTC-CAP-005
Tool "mono_unlink_dependency" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.
Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.
Location: tool mono_unlink_dependency
Tools 103
Each tool and what it can reach — statically extracted from the published source.
mono_unlink_dependencywrites filesmono_add_commentno sensitive capabilitymono_add_cycle_memberno sensitive capabilitymono_add_project_to_cycleno sensitive capabilitymono_add_task_to_cycleno sensitive capabilitymono_add_task_to_sprintno sensitive capabilitymono_advanceno sensitive capabilitymono_apply_task_templateno sensitive capabilitymono_bulk_close_sprint_reviewsno sensitive capabilitymono_bulk_create_labelsno sensitive capability
Show 93 more tools ↓
mono_bulk_create_tasksno sensitive capabilitymono_bulk_delete_tasksno sensitive capabilitymono_bulk_update_tasksno sensitive capabilitymono_complete_cycleno sensitive capabilitymono_complete_sprintno sensitive capabilitymono_create_custom_fieldno sensitive capabilitymono_create_cycleno sensitive capabilitymono_create_docno sensitive capabilitymono_create_feedbackno sensitive capabilitymono_create_incidentno sensitive capabilitymono_create_key_resultno sensitive capabilitymono_create_labelno sensitive capabilitymono_create_opportunityno sensitive capabilitymono_create_productno sensitive capabilitymono_create_specificationno sensitive capabilitymono_create_sprintno sensitive capabilitymono_create_taskno sensitive capabilitymono_create_task_from_incidentno sensitive capabilitymono_create_task_templateno sensitive capabilitymono_decompose_specno sensitive capabilitymono_delete_commentno sensitive capabilitymono_delete_custom_fieldno sensitive capabilitymono_delete_cycleno sensitive capabilitymono_delete_docno sensitive capabilitymono_delete_feedbackno sensitive capabilitymono_delete_incidentno sensitive capabilitymono_delete_productno sensitive capabilitymono_delete_sprintno sensitive capabilitymono_delete_taskno sensitive capabilitymono_delete_task_templateno sensitive capabilitymono_find_userno sensitive capabilitymono_generate_specno sensitive capabilitymono_get_bug_hub_statsno sensitive capabilitymono_get_cycleno sensitive capabilitymono_get_docno sensitive capabilitymono_get_incidentno sensitive capabilitymono_get_pm_hub_statsno sensitive capabilitymono_get_projectno sensitive capabilitymono_get_project_summaryno sensitive capabilitymono_get_sprintno sensitive capabilitymono_get_taskno sensitive capabilitymono_get_task_activitiesno sensitive capabilitymono_get_task_custom_fieldsno sensitive capabilitymono_link_commitno sensitive capabilitymono_link_dependencyno sensitive capabilitymono_link_pull_requestno sensitive capabilitymono_list_activitiesno sensitive capabilitymono_list_commentsno sensitive capabilitymono_list_commitsno sensitive capabilitymono_list_custom_fieldsno sensitive capabilitymono_list_cyclesno sensitive capabilitymono_list_docsno sensitive capabilitymono_list_feedbackno sensitive capabilitymono_list_incidentsno sensitive capabilitymono_list_labelsno sensitive capabilitymono_list_notificationsno sensitive capabilitymono_list_opportunitiesno sensitive capabilitymono_list_productsno sensitive capabilitymono_list_projectsno sensitive capabilitymono_list_specificationsno sensitive capabilitymono_list_sprintsno sensitive capabilitymono_list_task_dependenciesno sensitive capabilitymono_list_task_deploysno sensitive capabilitymono_list_task_pull_requestsno sensitive capabilitymono_list_task_templatesno sensitive capabilitymono_list_tasksno sensitive capabilitymono_list_usersno sensitive capabilitymono_log_deployno sensitive capabilitymono_mark_all_notifications_readno sensitive capabilitymono_mark_notification_readno sensitive capabilitymono_remove_project_from_cycleno sensitive capabilitymono_remove_task_from_cycleno sensitive capabilitymono_remove_task_from_sprintno sensitive capabilitymono_resolve_userno sensitive capabilitymono_searchno sensitive capabilitymono_search_docsno sensitive capabilitymono_session_startno sensitive capabilitymono_set_task_custom_fieldsno sensitive capabilitymono_start_cycleno sensitive capabilitymono_start_sprintno sensitive capabilitymono_sync_sentryno sensitive capabilitymono_sync_usersno sensitive capabilitymono_update_commentno sensitive capabilitymono_update_cycleno sensitive capabilitymono_update_docno sensitive capabilitymono_update_feedbackno sensitive capabilitymono_update_incidentno sensitive capabilitymono_update_key_resultno sensitive capabilitymono_update_opportunityno sensitive capabilitymono_update_productno sensitive capabilitymono_update_projectno sensitive capabilitymono_update_sprintno sensitive capabilitymono_update_taskno sensitive capability
What this scan could not see
- Tools were statically extracted from the published source (103 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
Versions 1
Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.
| Version | Score | Findings | Engine | Scanned |
|---|---|---|---|---|
v1.1.1 latest |
A 97/100 | 2 | 1.13.0 | 2026-09-09 |
Embed this score
Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.
Verify this score yourself
The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.
npx mcptrustchecker scan monoproject-mcp --onlineMore in Developer Tools
Hotel booking MCP server — 300K+ properties, real confirmation numbers, loyalty programs. Builders monetize every booking via Stripe Connect. The first MCP server that completes real hotel reservations inside AI conversations.
Generates production-ready UI components from natural language, inspired by v0.
Manage AdGuard Home through AI assistants
Read-only Azure DevOps for MCP clients using only your existing browser session — no PAT, no Azure CLI. Browse work items, pull requests, comments, attachments and Artifacts feeds across every project, repo and feed you can access.
MCP server for Adobe Experience Manager Assets integration development
Servidor MCP para el tiempo oficial de España (API pública OpenData de AEMET). Predicción, observación y avisos como herramientas MCP tipadas.