mcp

The server, particularly in 'ATP mode (Alpha)', exposes an `execute_code` tool that allows dynamic JavaScript code execution to call monday.com APIs. This is a critical security risk as it permits arbitrary code execution which, if not rigorously sandboxed and contained, could lead to system compromise or unauthorized data access. The server requires a monday.com API token, which grants significant access to a user's data and should be treated with extreme care. API tokens are passed via command line or environment variables, which is a standard practice, but the tokens themselves are sensitive. Developers are cautioned about the alpha status of ATP mode and the potential for changes in behavior.