OpenAI Codex security directory

monday.com

Published by monday.com

High risk

Connects your assistant to monday.com work management and CRM. Search boards, create or update items, assign owners, set timelines and post updates. Use project context to manage work, plan automations and configure agent workflows.

Security assessment

Plutonium assessed this plugin for permissions, capabilities, and security-relevant behavior.

Agent lifecycle can activate and run automation agents: Can deploy code, applications, containers, workflows, or infrastructure to a persistent environment.
Hosted inventory includes destructive form and agent actions: Can delete records, files, projects, messages, or resources that may be difficult to recover.
Can change persistent data or access: Can create or change persistent records, files, projects, permissions, settings, or credentials.
Connector searches authenticated workspace and CRM content: Can read private account, workspace, repository, message, analytics, or file data.
Hosted endpoint keeps an OAuth authorization: Uses credentials, OAuth grants, API keys, or tokens that may remain valid after the current session.
Raw GraphQL tool can execute arbitrary queries and mutations: Can execute code, commands, scripts, unrestricted queries, or dynamic gateway actions.
Platform MCP posts comments and sends notifications: Can send messages, comments, invitations, posts, or published content attributed to the connected user.

The interactive security report will load automatically.