ModelsAtlas
Explore
Atlas / MCP servers / sbroenne / Excel

ExcelCAUTION

mcp/sbroenne/excel-9
MCP server by sbroenne · ai automation · claude ai · com automation · Audited 2026-10-01
⚑ Report / re-scanSource ↗

Automate real Microsoft Excel with AI via MCP Server or CLI — Power Query, DAX, VBA, PivotTables, charts, and 326 operations.

Verdict
CAUTION
Grade
C
Trust score
79 /100
Exposed tools
—
Transport
stdio
License
MIT
Stars
794
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://marketplace.visualstudio.com/items?itemName=sbroenne.excel-mcp) [](https://github.com/sbroenne/mcp-server-excel/releases)

[](https://github.com/sbroenne/mcp-server-excel/actions/workflows/ci.yml) [](https://github.com/sbroenne/mcp-server-excel/releases/latest)

[](https://opensource.org/licenses/MIT) [](https://dotnet.microsoft.com/download/dotnet/10.0) [](https://github.com/sbroenne/mcp-server-excel) [](https://copilot.github.com/)

**Website** · **Installation** · **Features** · **Troubleshooting** · **2-minute demo**

Automate real Microsoft Excel with AI. Excel MCP Server lets GitHub Copilot, Claude, ChatGPT, and other agents control Excel through natural-language requests—using either MCP or a token-efficient CLI.

Unlike file-parser tools, ExcelMcp drives the actual Excel application through its official COM API. It can refresh Power Query, recalculate formulas, evaluate DAX, run VBA and Python =PY(), and preserve PivotTables, charts, macros, the Data Model, and workbook formatting.

31 tools with 326 operations cover en

Read from source at commit 183f71d534feOBSERVED · 2026-10-01
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code (npm)
claude mcp add mcp-server-excel -- npx -y @sbroenne/[email protected]
03

Trust audit

CAUTIONgrade C · trust 79/100 Install with care. The audit found things worth knowing before you trust its output.

LayerWhat it checksResult
L0Provenance & inventoryWARN
L1Static analysis of the codePASS
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (1 observation(s))
Network
none-observed
Shell
declared (2 observation(s))
Dependencies
not all pinned
Secrets in source
none-found

Findings (25)

MEDIUMInventory / provenance · inv.binary · CWE-1104
videos/excel-mcp-intro/assets/voice/02a.wav
02a.wav
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
videos/excel-mcp-intro/assets/voice/02b.wav
02b.wav
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
videos/excel-mcp-intro/assets/voice/02c.wav
02c.wav
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
videos/excel-mcp-intro/assets/voice/03a.wav
03a.wav
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
LOWInventory / provenance · inv.binary · CWE-1104
tests/ExcelMcp.ComInterop.Tests/Integration/Session/TestFiles/batch-test-static.xlsx
batch-test-static.xlsx
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
LOWInventory / provenance · inv.hidden_file · CWE-1104
vscode-extension/.vscodeignore
.vscodeignore
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
.github/workflows/publish-mcp-registry.yml:86
../../../../mcp-publisher.exe publish --verbose
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
gh-pages/mkdocs.yml:41
# Many pulled-in source READMEs contain repo-relative links (e.g. ../../FEATURES.md)
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
npm-packages/shared/test/packaging.test.js:9
const repoRoot = fileURLToPath(new URL('../../../', import.meta.url));
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
npm-packages/excelcli/package.json
foreground-child
Why it matters. 1 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
npm-packages/mcp-server-excel/package.json
foreground-child
Why it matters. 1 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
npm-packages/shared/package.json
foreground-child
Why it matters. 1 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
package.json
@changesets/changelog-github, @changesets/cli
Why it matters. 2 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
vscode-extension/package.json
@types/node, @types/vscode, @vscode/vsce, oxlint, typescript
Why it matters. 5 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWPrompt injection · prompt.authority_framing · CWE-94, CWE-1427
PRIVACY.md:139
- No elevated privileges are required or requested
LOWPrompt injection · prompt.authority_framing · CWE-94, CWE-1427
docs/COM-API-BEHAVIOR-FINDINGS.md:329
- `Workbook.Model` - full access to Data Model object
LOWPrompt injection · prompt.authority_framing · CWE-94, CWE-1427
specs/DATA-MODEL-DAX-FEATURE-SPEC.md:103
**TOM Capabilities (Full Access):**
LOWPrompt injection · prompt.credential_read · CWE-94, CWE-1427
docs/features/CELLS-WORKBOOKS.md:15
- **Open:** Open workbook and create session (returns session ID for all subsequent operations). IRM/AIP-protected files are automatically detected and opened read-only with Excel visible for credenti
Why it matters. asks the agent to read credentials
LOWPrompt injection · prompt.credential_read · CWE-94, CWE-1427
skills/shared/workbook.md:18
- `get-info` returns the active workbook name, path, Excel file format, saved/read-only state, and password/write-reservation flags.
Why it matters. asks the agent to read credentials
LOWPrompt injection · prompt.persistence · CWE-94, CWE-1427
docs/INSTALLATION-MCP-SERVER.md:125
# Add to user PATH (persistent)
Why it matters. instructs the agent to persist itself in the user's environment
LOWPrompt injection · prompt.persistence · CWE-94, CWE-1427
docs/INSTALLATION-MCP-SERVER.md:471
# Edit PATH and remove the ExcelMcp directory
Why it matters. instructs the agent to persist itself in the user's environment
LOWPrompt injection · prompt.persistence · CWE-94, CWE-1427
examples/mcp-configs/README.md:12
Extract mcp-excel.exe to a permanent location and add to PATH
Why it matters. instructs the agent to persist itself in the user's environment
LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427
CHANGELOG.md:526
- [#727](https://github.com/sbroenne/mcp-server-excel/pull/727) [`163d9b2`](https://github.com/sbroenne/mcp-server-excel/commit/163d9b247eb8b4371bd572d80e27d38bb70c07e4) Thanks [@sbroenne](https://git
Why it matters. an instruction to move sensitive data to an outside destination
Fix. remove; a skill never needs the user's secrets off the machine
LOWInventory / provenance · mcp.no_tools_extracted · CWE-1104
src/ExcelMcp.McpServer/.mcp/server.json
Why it matters. the tool list is enumerated at runtime by tools/list, not declared in source
Fix. the page says so rather than showing an empty table
INFOInventory / provenance · inv.oversize · CWE-1104
llm-tests/Fixtures/amazon.csv
llm-tests/Fixtures/amazon.csv
Why it matters. 4745947 bytes not read

Gates applied: no_behavioural_pass.

Audited 2026-10-01 · audit v0.4.1 · source sha 183f71d534fefull audit observations/trust-audit/mcp-server/sbroenne__excel-9.json · Report an issue / request a re-scan
04

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-01183f71d534feCAUTIONC79first audit
05

Questions

What is the Excel MCP server?

Automate real Microsoft Excel with AI via MCP Server or CLI — Power Query, DAX, VBA, PivotTables, charts, and 326 operations.

Is Excel safe to connect to an agent?

With care. The audit graded it C (79/100) and found 25 things worth knowing before you trust this server, listed below with the exact line each was found on.

What credentials does Excel need?

It reads GITHUB_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does Excel run?

It speaks stdio, so it runs as a local process your client starts. It is published on npm as excel-mcp at 2.1.1.

How current is this page?

The grade is for one exact copy of the source (183f71d534fe), read on 2026-10-01. The repository is watched and re-audited when it changes.

Advertisement