Atlas / MCP servers / mondaycom / Agent Tool Protocol

Agent Tool ProtocolBLOCK

Name: Agent Tool Protocol
Author: mondaycom

mcp/mondaycom/agent-tool-protocol

MCP server by mondaycom · ai · atp · llm · Audited 2026-10-12

⚑ Report / re-scan Source ↗

Agent Tool Protocol

Verdict

BLOCK

Grade

Trust score

55 /100

Exposed tools

132 110r · 18w · 4d

Transport

—

License

MIT

Stars

101

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

A production-ready, code-first protocol for AI agents to interact with external systems through secure sandboxed code execution.

What is Agent Tool Protocol?

Agent Tool Protocol (ATP) is a next-generation protocol that enables AI agents to interact with external systems by generating and executing TypeScript/JavaScript code in a secure, sandboxed environment. Unlike traditional function-calling protocols, ATP allows LLMs to write code that can execute multiple operations in parallel, filter and transform data, chain operations together, and use familiar programming patterns.

ATP provides a complete ecosystem for building production-ready AI agents with:

Secure code execution in isolated V8 VMs with memory limits and timeouts
Runtime SDK (atp.*) for LLM calls, embeddings, approvals, caching, and logging
Stateless architecture with optional caching for scalability
Client tools for seamless integration with LangChain, LangGraph, and other frameworks
Provenance tracking to defend against prompt injection attacks
OpenAPI and MCP compatibility for connecting to any API or MCP server

Why ATP vs MCP?

Traditional function-calling protocols like Model Context Protocol (MCP) have fundamental limitations:

MCP Limitations

Context Bloat: Large schemas consume significant tokens in every request
Sequential Execution: Only one tool can be called at a time
No Data Processing: Can't filter, transform, or combine results within the protocol
Limited Model Support: Not all LLMs support function calling well
Schema Overhead: Complex nested schemas are verbose and token-expensive

ATP Advantages

✅ OpenAPI Integration: Built in open api integration allowing to connect a single server to multiple mcps & openapis
✅ Parallel Execution: Execute multiple operations simultaneously
✅ Data Processing: Filter, map, reduce, and transform data inline
✅ **Code Flexibili

Read from source at commit 5c0dae9fbfc1OBSERVED · 2026-10-12

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add atp-vercel-sdk --env API_KEYS=${API_KEYS} --env ATP_API_KEY=${ATP_API_KEY} --env ATP_API_KEYS=${ATP_API_KEYS} --env ATP_AUTH_TOKEN=${ATP_AUTH_TOKEN} -- npx -y @mondaydotcomorg/[email protected]

claude-desktop

{
  "mcpServers": {
    "atp-vercel-sdk": {
      "command": "npx",
      "args": [
        "-y",
        "@mondaydotcomorg/[email protected]"
      ],
      "env": {
        "API_KEYS": "${API_KEYS}",
        "ATP_API_KEY": "${ATP_API_KEY}",
        "ATP_API_KEYS": "${ATP_API_KEYS}",
        "ATP_AUTH_TOKEN": "${ATP_AUTH_TOKEN}"
      }
    }
  }
}

Exposed tools (132)

110 read · 18 write · 4 destructive. Blast radius: 4 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`add`	write
`allOptional`	read	All fields optional
`allRequired`	read	All fields required
`alwaysFails`	read	Endpoint that always fails
`analyze`	read
`analyze_data`	read
`apiCall1`	read
`atp_execute_code`	write	Execute TypeScript code in ATP sandbox with access to streaming tools. Available APIs: ${typeDefinitions}
`audit-sensitive-access`	read	Logs access to sensitive data (does not block)
`block-llm-recipients`	read	Blocks sending data to LLM-extracted email addresses
`block-llm-recipients-approval`	read	Requires approval for sending to LLM-extracted email addresses
`calculate`	read	Perform calculation
`compute`	read	Perform computation
`conversations_list`	read	List conversations (channels)
`conversations_members`	read
`createIssue`	write	Create a new issue
`createRepo`	write	Create repository
`createTable`	write	Create a new table (requires db:admin scope)
`deepFunction`	read	Deep nested test
`delete`	destructive	Delete a record (requires db:write scope)
`deleteFile`	destructive	Delete a file
`deletePlan`	destructive	delete a plan
`destructiveOperation`	read
`doSomething`	read	Do something
`documented`	read	Function with documentation
`dummy`	read	Dummy function
`echo`	read	Echo input
`emptyRequired`	read	Empty required array
`enrichData`	read	Enrich data with additional info
`events_delete`	destructive	delete event
`events_get`	read	get event
`events_insert`	write	create event
`events_list`	read	list events
`example`	read
`exfiltrate`	read
`explorerTest`	read
`failingOperation`	read
`fetchAnalytics`	read
`fetchData`	read	Fetch data (pauses execution)
`fetchPublicInfo`	read
`fetchSensitiveData`	read
`fetchSensitiveUser`	read
`fetchUser`	read
`fetchUserData`	read
`fetchUsers`	read
`formatDate`	read	Format a date string
`func1`	read	Function 1
`func2`	read	Function 2
`getChannel`	read	Get channel information
`getCurrentWeather`	read	Get the current weather for a location
`getData`	read	Get data
`getForecast`	read	Get weather forecast for the next 5 days
`getItems`	read	Get items
`getPublicData`	read	Get public data
`getSensitive`	read
`getStatus`	read	Get API status
`getSystemInfo`	read	Get system information
`getTimestamp`	read	Get current timestamp
`getTransaction`	read	Get transaction by ID
`getUser`	read	Get user information
`getValue`	read	Get a value
`greet`	read
`hello`	read	Say hello
`insert`	write	Insert a record into a table (requires db:write scope)
`list`	read	List users
`listChannels`	read	List Slack channels
`listDirectory`	read	List files in a directory
`listEvents`	read	List calendar events
`listPlans`	read	list plans
`listRepos`	read	List repositories for a user
`listUsers`	read	List users
`localCompute`	read	Perform local computation
`lowercase`	read	Convert text to lowercase
`mcpTool`	read	Tool from MCP server
`messages_list`	read	list messages
`messages_send`	write	send message
`mixedTypes`	read	Function with mixed types
`multiply`	read
`mutation_create_item`	write	Create an item on a board
`no_schema_tool`	read	Tool without schema
`postMessage`	write	Post a message to Slack
`prevent-data-exfiltration`	read	Prevents sending data to recipients who cannot read it
`prevent-data-exfiltration-approval`	read	Requires approval for sending data to recipients who cannot read it
`processData`	read	Process data (pauses execution)
`processInternal`	read
`processLocal`	read	Process data locally
`query`	read	Query records from a table (requires db:read scope)
`queryUsers`	read	Query users from the database
`query_boards`	read	Query boards from Monday.com
`readFile`	read	Read a file from the filesystem
`readLocal`	read	Read local data
`read_file`	read	Read a file from disk
`require-user-origin`	read	Requires critical parameters to come directly from user input
`require-user-origin-approval`	read	Requires approval for critical operations with non-user data
`research`	read
`safeOperation`	read
`sayHello`	read	Say hello
`search_api`	read	Search API
`searchableFunction`	read
`send`	write	Send an email
`sendEmail`	read
`sendExternal`	read
`sensitiveOperation`	read
`setStatus`	write	Set status
`setValue`	write	Set cached value
`simple_calc`	read
`slowOperation`	read	Slow operation that pauses
`sometimesFails`	read	Endpoint that sometimes fails
`storeValue`	read	Store a value
`stream_story`	read
`success`	read	Endpoint that always succeeds
`systemInfo`	read	Get system information
`test`	read
`testAdd`	read
`testApi`	read
`testFunction`	read	Test function with mixed fields
`testOperation`	read
`testTool`	read
`test_tool`	read	A test tool
`throwError`	read	Tool that throws
`toolA`	read	Tool A
`toolB`	read	Tool B
`track`	read	Track event to external analytics
`transfer`	write	Transfer money
`transform`	read	Transform data
`update`	write	Update a record (requires db:write scope)
`updateUser`	write	Update user
`uppercase`	read	Convert text to uppercase
`users_info`	read
`validSyntax`	read	Function with valid syntax
`writeFile`	write	Write content to a file
`write_file`	write	Write a file to disk

Trust audit

BLOCKgrade F · trust 55/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (1 observation(s))
Network: none-observed
Shell: declared (2 observation(s))
Dependencies: not all pinned
Secrets in source: found

Findings (25)

HIGHCode injection · code.deserialize · CWE-78, CWE-94, CWE-95

packages/server/src/openapi-loader.ts:353

return yaml.load(content) as OpenAPISpec;

Why it matters. deserialises untrusted bytes into live objects

Fix. use json or yaml.safe_load

HIGHCode injection · code.deserialize · CWE-78, CWE-94, CWE-95

packages/server/src/openapi-loader.ts:358

return yaml.load(content) as OpenAPISpec;

Why it matters. deserialises untrusted bytes into live objects

Fix. use json or yaml.safe_load

MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321

__tests__/e2e/core-flows/core-functionality/multiple-openapi-auth.test.ts:68

token: 'test-protected-token',

MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321

packages/providers/__tests__/token-expiration.test.ts:126

token: 'gho_expires_now_token',

MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59

delete, deleteFile, deletePlan, events_delete

Why it matters. 4 tool(s) can delete or overwrite

Fix. prefer a read-only mode or scoped tokens; the page states the blast radius

LOWInventory / provenance · inv.hidden_file · CWE-1104

.prettierignore

.prettierignore

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInventory / provenance · inv.hidden_file · CWE-1104

.prettierrc.json

.prettierrc.json

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInventory / provenance · inv.hidden_file · CWE-1104

.yarnrc.yml

.yarnrc.yml

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose