{ "schema": "varexis-public-evidence-record/0.3", "generated_at_utc": "2026-10-14T01:00:52.414Z", "record_id": "VXI-EXT-TOOL-TRUST-MONDAY-PLATFORM-01-v1", "record_kind": "external_reference", "title": "monday.com MCP: Board access and GraphQL actions", "system": "monday.com Platform MCP", "evidence_family": "agent_tool_trust_review", "index_status": "PUBLIC_SAFE_SOURCE_REVIEW", "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY", "canonical_question": "Can a monday.com agent connection do more than read task boards?", "near_questions": [ "Can a task-board agent execute GraphQL mutations?", "Does a monday.com lookup task permit sending notifications?", "How do personal and app tokens differ for an assistant?", "Which workspace should a board agent use?", "Is the Platform MCP the same as Apps MCP?", "Can a generic API tool exceed the named board tools?", "What evidence supports limited monday.com access?", "Could API limits interrupt a multi-step board change?", "Does a successful connection authorise new items?", "What data could board results reveal to an assistant?", "Can I save a review of platform permissions?", "When should I recheck a monday.com tool list?" ], "supported_claims": [ { "claim": "The Platform MCP exposes board operations and broader GraphQL queries and mutations, with calls tied to the authenticated user. Tool availability is therefore wider than task lookup. Confirm token permissions, permitted actions and the target board; distinguish this connection from the separate app-development MCP.", "reliance": "DOCUMENTED_CAPABILITY_ONLY" } ], "not_demonstrated_claims": [ "Verified buyer configuration or effective access rights", "Independent execution, completeness or security testing", "Vendor certification, legal compliance or guaranteed suitability" ], "public_summary": "The Platform MCP exposes board operations and broader GraphQL queries and mutations, with calls tied to the authenticated user. Tool availability is therefore wider than task lookup. Confirm token permissions, permitted actions and the target board; distinguish this connection from the separate app-development MCP.", "related_record_ids": [ "VXI-EXT-TOOL-TRUST-AIRTABLE-01-v1", "VXI-EXT-TOOL-TRUST-BOX-REMOTE-01-v1", "VXI-EXT-TOOL-TRUST-MIRO-01-v1", "VXI-EXT-TOOL-TRUST-INTERCOM-01-v1" ], "source_review": { "source_type": "official_external_documentation", "source_title": "monday Platform MCP identity, authentication and API scope", "source_url": "https://developer.monday.com/api-reference/docs/build-on-monday-with-ai", "checked_on": "2026-10-14", "candidate_record_id": "VXI-EXT-TOOL-TRUST-MONDAY-PLATFORM-01-v1", "candidate_record_sha256": "8fa10caf97d394376fdddc6d65f04f4f0488bd00695fc60ccfd9a03986eef573", "method": "Primary documentation reviewed for the published bounded statement.", "deployment_tested_by_varexis": false, "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research." }, "answer_policy": { "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY", "bounded_answer": "The Platform MCP exposes board operations and broader GraphQL queries and mutations, with calls tied to the authenticated user. Tool availability is therefore wider than task lookup. Confirm token permissions, permitted actions and the target board; distinguish this connection from the separate app-development MCP.", "required_buyer_context": "Identify the Platform MCP connection, user or app token, board/workspace, approved actions and API version.", "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state." }, "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.", "trust_profile": { "schema": "varexis-agent-tool-trust/1", "identity": { "tool": "monday.com Platform MCP", "variant": "Hosted Platform MCP; Apps MCP excluded" }, "review_status": "documentation_review_only", "checked_on": "2026-10-14", "version_scope": "Dated rolling documentation snapshot; no installed or hosted runtime version independently verified.", "plan_scope": "Buyer plan, entitlement and effective configuration are not verified.", "findings": [ { "field": "operator", "label": "Publisher and operator", "status": "documented", "statement": "monday.com maintains the hosted Platform MCP.", "source_ids": [ "monday", "monday-tools" ] }, { "field": "purpose", "label": "Purpose", "status": "documented", "statement": "Work with platform data through structured tools and GraphQL.", "source_ids": [ "monday", "monday-tools" ] }, { "field": "reads", "label": "Read capability", "status": "documented", "statement": "Reads boards, items, documents and user context.", "source_ids": [ "monday", "monday-tools" ] }, { "field": "writes", "label": "Write capability", "status": "documented", "statement": "Can create or update platform data and send notifications; GraphQL mutations are exposed.", "source_ids": [ "monday", "monday-tools" ] }, { "field": "auth", "label": "Authentication", "status": "documented", "statement": "OAuth or a bearer personal API token is documented.", "source_ids": [ "monday", "monday-tools" ] }, { "field": "permissions", "label": "Permission surface", "status": "documented", "statement": "Calls use the authenticated user context; app scopes and personal-token permissions differ.", "source_ids": [ "monday", "monday-tools" ] }, { "field": "egress", "label": "Data leaving the environment", "status": "review_inference", "statement": "Tool results can disclose board data to the assistant; writes can notify other people.", "source_ids": [ "monday", "monday-tools" ] }, { "field": "failures", "label": "Failure modes to consider", "status": "review_inference", "statement": "Broad GraphQL access, wrong board selection and API limits can exceed a narrow task.", "source_ids": [ "monday", "monday-tools" ] }, { "field": "unknown", "label": "Unknowns and applicability", "status": "unknown", "statement": "The buyer grants, account settings and effective available tools are unverified.", "source_ids": [] }, { "field": "gate", "label": "Suggested refusal or clarification condition", "status": "varexis_review_policy", "statement": "Require approval for mutations and notifications; do not infer read-only access from a board-search use case.", "source_ids": [] } ], "evidence_sources": [ { "source_id": "monday", "url": "https://developer.monday.com/api-reference/docs/build-on-monday-with-ai", "final_url": "https://developer.monday.com/api-reference/docs/build-on-monday-with-ai", "title": "monday Platform MCP identity, authentication and API scope", "checked_on": "2026-10-14", "sha256": "1b59444b813a7e23396f8c57e60680146de82e4b8573f11d62ef34801c8da2d2", "bytes": 1232688 }, { "source_id": "monday-tools", "url": "https://developer.monday.com/api-reference/docs/platform-mcp-tools", "final_url": "https://developer.monday.com/api-reference/docs/platform-mcp-tools", "title": "monday Platform MCP data, notification and GraphQL tools", "checked_on": "2026-10-14", "sha256": "5f4f5f523e67635ab3f7c725f06fd852fa7fe586a2e2a903fd28106827606323", "bytes": 1244660 } ], "observed_tool_execution": false, "policy_basis": "Suggested VAREXIS review gates; apply the buyer's authorized task and policy. These conditions do not execute or enforce controls.", "commercial_reliance_boundary": "A source-linked review aid, not a vendor certification, security clearance or deployment assessment. Unknown does not mean false or unsafe.", "paid_value": { "decision_context": "Preserve a decision about permitted board operations and the wider GraphQL surface.", "free": "Complete review, practical questions, sources and limitations; may be saved locally.", "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.", "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.", "excluded": [ "Fresh vendor research", "Continuous monitoring or change alerts", "Testing the buyer configuration", "Private evidence or vendor certification" ], "integrity": "Hashes identify content versions; they do not prove truth or provide a signature." }, "revalidation": { "trigger": "Recheck when permissions, deployment, authentication, source guidance or intended use changes; a purchase does not trigger revalidation.", "specific_watch": "Recheck token type, exposed tools, API version and board permissions." }, "change_history": [ { "version": 1, "date": "2026-10-14", "change": "Initial documentation review; no earlier vendor assessment claimed." } ] }, "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.", "service_route": { "request_guide": "/varexis-index/request.html", "request_workflow": "/varexis-index/request-workflow.json", "service_id": "single_request", "service_routes_url": "/varexis-index/service-routes.json", "payment_required": true, "availability_endpoint": "/api/index/capabilities", "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED", "checkout_url": "/index-access" }, "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.", "human_page": "/varexis-index/catalog.html#monday-mcp-graphql-action-trust", "machine_readable_record": "/varexis-index/records/monday-mcp-graphql-action-trust.json" }