Monday.com
5 reviewed Dtwo policies for Monday.com MCP servers — egress + ingress controls for governing what AI agents can do with Monday.com.
On this page
Reusable DTwo policies for monday.com MCP servers — the official hosted monday MCP (https://mcp.monday.com/mcp, the server the Claude connector uses) and its local stdio build (@mondaydotcomorg/monday-api-mcp), plus the community sakce/mcp-server-monday. The MCP surface is broad: board and item reads (get_board_items_page, get_full_board_data, board_insights, read_docs, search), item and board writes (create_item, create_items, change_item_column_values, create_update), directory and notification tools, persistence tools that install standing automations and AI agents, destructive delete_* tools, and — where enabled — a GraphQL escape hatch (all_monday_api / all_api_read / all_api_write) and a self-expanding manage_tools. Its risk profile is dominated by concentration and bypass: monday boards are schemaless business databases where HR/recruiting PII, CRM financials, and security trackers sit behind one flat API token, sensitivity is a property of the board/workspace ID rather than the tool, and a single opaque GraphQL query or a newly enabled tool can reduce every per-tool policy to nothing — which is why the default-deny gate is the outer boundary for this app.
Available policies
| Policy | Direction | Purpose | Framework bundles |
|---|---|---|---|
| default-deny-unknown-tools | ingress | Deny every monday tool whose name does not end with an audited allowlist suffix; blocks the GraphQL escape hatch, manage_tools, dynamic-API and apps-mode tools by default and surfaces new/renamed tools as drift. |
soc2, gdpr-ccpa |
| fence-sensitive-boards | ingress | Fence sensitive board and workspace IDs behind IdP groups, turning monday's flat single-token scope into per-team least privilege on reads, writes, and account-wide search. |
soc2, hipaa, pci-dss, gdpr-ccpa |
| freeze-destructive-ops | ingress | Block irreversible whole-board deletes (delete_column, delete_object_schema*) for everyone and admin-gate recycle-bin-recoverable deletes (delete_item, delete_update, undo_action, archive_item) behind an IdP group. |
soc2, sox, hipaa, gdpr-ccpa |
| freeze-standing-automation | ingress | Deny the tools that install side effects outliving the session — standing automations and workflows (create_automation, publish_workflow, ...) and autonomous AI agents (manage_agent*). |
soc2 |
| redact-board-pii-egress | egress | Redact SSN, email, phone, and national-ID patterns from board, doc, and update read responses (transform), and deny the account-directory tool for non-admins. | soc2, hipaa, gdpr-ccpa |
Tool naming on the DTwo gateway
monday's official tool names are bare snake_case with no vendor prefix (create_item, search, get_board_items_page). Behind the DTwo gateway they surface as <configured-server-name>-<tool-name>, and that prefix is not standardized across deployments; the community sakce server additionally prefixes its own names with monday_ (monday_create_item). The policies here match case-insensitively on the tool-name suffix so a single entry covers all three spellings, but you should confirm the exact string your gateway sends with the dump-input debug technique before pinning an allowlist or fence.
Identity claims
Three of these policies are identity-gated and read input.subject.claims.groups with placeholder group names. Replace both the group names (and, where present, the board/workspace IDs) with your own at import time. Missing or malformed claims fail closed — no group never grants access.
fence-sensitive-boardsmaps placeholder groups (e.g.hr,sales,infosec) to placeholder board/workspace IDs; only a caller in the mapped group reaches a fenced target.freeze-destructive-opsadmin-gates the recycle-bin-recoverable delete tier behind the placeholdermonday-adminsgroup; the irreversible tier is denied for everyone regardless of group.redact-board-pii-egressdenies the account-directory tool (list_users_and_teams) for callers outside the placeholder admin group; the PII redaction transform applies to all callers and needs no claims.
default-deny-unknown-tools and freeze-standing-automation require no claims; add a break-glass allow if branch gated on input.subject.claims groups if you need a platform-admin exemption.
Contributing
To add a monday policy:
- Create
apps/monday/<policy-slug>/withpolicy.mdand atests.yamltest file. - Add a row to the table above.
- Declare
apps: ["monday"]in the policy frontmatter, plus any bundle slugs that apply. - If the policy fits a bundle (e.g.
soc2,hipaa,pci-dss,gdpr-ccpa), link to it from the matching landing page. - Run
pnpm manifestfrom the repo root.
See CONTRIBUTING.md for the full process.