This guide walks you through connecting your own MCP client — an AI assistant, agent platform, or product feature — to the monday.com hosted MCP server. Pick an authentication path below, then follow the linked guide for setup details.

Overview

The hosted MCP server is the recommended way to connect to monday.com. It requires no local setup, updates automatically, and handles all the infrastructure for you.

Server URL: https://mcp.monday.com/mcp
Transport: Streamable HTTP
Auth: OAuth 2.0 or Bearer token with a personal API token

📘
The monday MCP server is a wrapper around the monday.com platform API. Every tool call executes in the context of the authenticated user and respects that user's monday.com permissions. See the MCP security overview for the full security architecture.

Choosing an authentication path

How you authenticate depends on what you're building:

Use case	Guide	Registration required
Personal use and testing	Authenticate with an API token	No
Private / org-controlled access (who connects, which client, and which scopes limit MCP actions)	Control MCP access with your own OAuth app	No
Publicly available integration	Make your integration publicly available (DCR)	Yes — register your integration

Advanced configuration

Specifying an API version

The MCP server executes tool calls against the monday.com GraphQL API. You can pin a specific API version using the Api-Version header:

{
  "mcpServers": {
    "monday-mcp": {
      "url": "https://mcp.monday.com/mcp",
      "headers": {
        "Api-Version": "2026-07"
      }
    }
  }
}

Available tools

The monday MCP server exposes more than 60 tools for reading and writing monday.com data. To view all available tools and their current parameters, use the tools/list MCP command, or browse the Platform MCP tools reference.

The tool set may evolve over time — tools may be added, updated, or deprecated. Use tools/list to ensure your client always has the most up-to-date schemas.

Rate limits

MCP tool calls consume from your account's daily API call limit, just like direct API requests. Keep this in mind for agent-driven workflows that may issue many calls.

Security and permissions

User-scoped access: All actions taken over MCP appear as the user who authorized them. Access is determined by the authenticated user's monday.com permissions — users can only reach workspaces, boards, and items they already have access to.
Token security: Store client secrets and all tokens securely (never commit them to version control), use HTTPS for all requests, implement proper token refresh logic, and revoke tokens when they're no longer needed.
No token storage: The MCP server does not store or log customer OAuth tokens. Token lifecycle management (storage, rotation, revocation) is your responsibility.

For the full security architecture — tenant isolation, AI-layer risks, and OWASP MCP Top 10 alignment — see the MCP security overview.

Common issues

Authentication failures

Verify your redirect URL matches exactly in both your app settings and authorization request
Ensure your client ID and client secret are correct
Check that the requested scopes are enabled on your app's OAuth & Permissions page

Connection issues

Verify the MCP server URL is https://mcp.monday.com/mcp
Check that you're including a valid access token or API token in the Authorization header
Verify the access token hasn't expired

Related resources: