ModelsAtlas
Explore
Atlas / MCP servers / sbroenne / mcp-server-excel

mcp-server-excelBLOCK

mcp/sbroenne/mcp-server-excel
MCP server by sbroenne · ai automation · claude ai · com automation · Audited 2026-10-05
⚑ Report / re-scanSource ↗

Automate real Microsoft Excel with AI via MCP Server or CLI — Power Query, DAX, VBA, PivotTables, charts, and 326 operations.

Verdict
BLOCK
Grade
D
Trust score
69 /100
Exposed tools
1 0r · 1w · 0d
Transport
stdio
License
MIT
Stars
803
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://marketplace.visualstudio.com/items?itemName=sbroenne.excel-mcp) [](https://github.com/sbroenne/mcp-server-excel/releases)

[](https://github.com/sbroenne/mcp-server-excel/actions/workflows/ci.yml) [](https://github.com/sbroenne/mcp-server-excel/releases/latest)

[](https://opensource.org/licenses/MIT) [](https://dotnet.microsoft.com/download/dotnet/10.0) [](https://github.com/sbroenne/mcp-server-excel) [](https://copilot.github.com/)

**Website** · **Installation** · **Features** · **Troubleshooting** · **2-minute demo**

Automate real Microsoft Excel with AI. Excel MCP Server lets GitHub Copilot, Claude, ChatGPT, and other agents control Excel through natural-language requests—using either MCP or a token-efficient CLI.

Unlike file-parser tools, ExcelMcp drives the actual Excel application through its official COM API. It can refresh Power Query, recalculate formulas, evaluate DAX, run VBA and Python =PY(), and preserve PivotTables, charts, macros, the Data Model, and workbook formatting.

31 tools with 387 operations cover en

Read from source at commit 18ad41dca727OBSERVED · 2026-10-05
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code (npm)
claude mcp add mcp-server-excel -- npx -y @sbroenne/[email protected]
03

Exposed tools (1)

0 read · 1 write · 0 destructive.

ToolRiskDescription
workspacewriteRead/list supplied task files and skill references, or write JSON, CSV, M, and text inputs in the task folder.
04

Trust audit

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryWARN
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (1 observation(s))
Network
declared (6 observation(s))
Shell
declared (2 observation(s))
Dependencies
not all pinned
Secrets in source
none-found

Findings (25)

HIGHNetwork egress · net.metadata_ip · CWE-200, CWE-319
infrastructure/azure/setup-excel-desktop.ps1:35
$tokenUri = 'http://169.254.169.254/metadata/identity/oauth2/token' +
Why it matters. cloud metadata endpoint: the classic SSRF credential grab
MEDIUMInventory / provenance · inv.binary · CWE-1104
videos/excel-mcp-intro/assets/voice/02a.wav
02a.wav
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
videos/excel-mcp-intro/assets/voice/02b.wav
02b.wav
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
videos/excel-mcp-intro/assets/voice/02c.wav
02c.wav
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
infrastructure/azure/setup-excel-desktop.ps1:35
$tokenUri = 'http://169.254.169.254/metadata/identity/oauth2/token' +
LOWInventory / provenance · inv.binary · CWE-1104
samples/world-bank-dashboard/world-in-motion.xlsx
world-in-motion.xlsx
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
LOWInventory / provenance · inv.binary · CWE-1104
tests/ExcelMcp.ComInterop.Tests/Integration/Session/TestFiles/batch-test-static.xlsx
batch-test-static.xlsx
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
LOWInventory / provenance · inv.hidden_file · CWE-1104
vscode-extension/.vscodeignore
.vscodeignore
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
.github/workflows/publish-mcp-registry.yml:80
../../../../mcp-publisher.exe publish --verbose
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
gh-pages/mkdocs.yml:43
# Many pulled-in source READMEs contain repo-relative links (e.g. ../../FEATURES.md)
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
gh-pages/tests/test_sitegen.py:36
self.rewrite("../../src/ExcelMcp.Core/Foo.cs"),
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
gh-pages/tests/test_sitegen.py:41
self.assertEqual(self.rewrite("../../scripts/"), f"[x]({REPO_URL}/tree/main/scripts)")
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
gh-pages/tests/test_sitegen.py:54
for link in ("https://example.com", "#here", "/faq/", "mailto:[email protected]", "../../../x.md"):
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
tests/ExcelMcp.Core.Tests/Helpers/LocalMSourceCancellationProbe.cs:20
Url = $"http://127.0.0.1:{((IPEndPoint)_listener.LocalEndpoint).Port}/evaluation.csv";
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
npm-packages/excelcli/package.json
foreground-child
Why it matters. 1 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
npm-packages/mcp-server-excel/package.json
foreground-child
Why it matters. 1 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
npm-packages/shared/package.json
foreground-child
Why it matters. 1 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
package.json
@changesets/changelog-github, @changesets/cli
Why it matters. 2 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
vscode-extension/package.json
@types/node, @types/vscode, @vscode/vsce, oxlint, typescript, vitest
Why it matters. 6 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWPrompt injection · prompt.authority_framing · CWE-94, CWE-1427
PRIVACY.md:134
- No elevated privileges are required or requested
LOWPrompt injection · prompt.authority_framing · CWE-94, CWE-1427
docs/COM-API-BEHAVIOR-FINDINGS.md:329
- `Workbook.Model` - full access to Data Model object
LOWPrompt injection · prompt.credential_read · CWE-94, CWE-1427
infrastructure/azure/README.md:119
assignments or access to the dedicated password vault. Only an identity created
Why it matters. asks the agent to read credentials
LOWPrompt injection · prompt.credential_read · CWE-94, CWE-1427
infrastructure/azure/README.md:389
read credential blobs, print account names or blindly delete returning caches.
Why it matters. asks the agent to read credentials
LOWPrompt injection · prompt.persistence · CWE-94, CWE-1427
docs/INSTALLATION-MCP-SERVER.md:185
# Add to user PATH (persistent)
Why it matters. instructs the agent to persist itself in the user's environment
LOWPrompt injection · prompt.persistence · CWE-94, CWE-1427
docs/INSTALLATION-MCP-SERVER.md:551
# Edit PATH and remove the ExcelMcp directory
Why it matters. instructs the agent to persist itself in the user's environment

Gates applied: no_behavioural_pass.

Audited 2026-10-05 · audit v0.4.1 · source sha 18ad41dca727full audit observations/trust-audit/mcp-server/sbroenne__mcp-server-excel.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-0518ad41dca727BLOCKD69first audit
06

Questions

What is the mcp-server-excel MCP server?

Automate real Microsoft Excel with AI via MCP Server or CLI — Power Query, DAX, VBA, PivotTables, charts, and 326 operations.

What tools does mcp-server-excel expose?

1 in total: 0 read-only, 1 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is mcp-server-excel safe to connect to an agent?

No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.

What credentials does mcp-server-excel need?

It reads GH_TOKEN and GITHUB_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does mcp-server-excel run?

It speaks stdio, so it runs as a local process your client starts. It is published on npm as excel-mcp at 2.2.1.

How current is this page?

The grade is for one exact copy of the source (18ad41dca727), read on 2026-10-05. The repository is watched and re-audited when it changes.

Advertisement