critical

@mondaydotcomorg/monday-api-mcp

v1.16.1

MCP server for using the monday.com API

npmmonday-npm-publisherFirst seen Feb 22, 2026Source

Total

Critical

High

Medium

Findings

unknown

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    25:         if (argValue === undefined) {
    26:             const envVarName = `MONDAY_${config.name.toUpperCase()}`;
>>> 27:             if (process.env[envVarName]) {
    28:                 argValue = process.env[envVarName];
    29:             }

Report false positive

criticalDE-002Data ExfiltrationHigh ConfidenceLine 0

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    26:             const envVarName = `MONDAY_${config.name.toUpperCase()}`;
    27:             if (process.env[envVarName]) {
>>> 28:                 argValue = process.env[envVarName];
    29:             }
    30:         }

Report false positive

Scan History

Date	Risk	Findings	Files	Duration
Feb 25, 2026	critical	2	13	0.00s
Feb 23, 2026	critical	2	13	0.00s
Feb 22, 2026	critical	2	13	0.00s