50
/ 100
1 day ago
official

kesslerio/attio-mcp-server

Streamline your Attio workflows using natural language to search, create, update, and organize com…

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
🚨
Secret credentials may flow to a network call
3 flows detected: ATTIO_API_KEY. We can’t prove the destination matches the brand the credential belongs to.
🚨
Known vulnerabilities in dependencies: 2 critical, 11 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
🔐
You'll be asked for 3 credentials: ATTIO_ACCESS_TOKEN, ATTIO_API_KEY, ATTIO_REFRESH_TOKEN
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// known CVEs in dependencies2 critical11 high5 medium13 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

criticalhandlebars@4.7.8GHSA-2w6w-674q-4c4q

Handlebars.js has JavaScript Injection via AST Type Confusion

criticalvitest@4.0.18GHSA-5xrq-8626-4rwp

When Vitest UI server is listening, arbitrary file can be read and executed

highaxios@1.12.0GHSA-35jp-ww65-95wh

axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

highaxios@1.12.0GHSA-3g43-6gmg-66jw

axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

highaxios@1.12.0GHSA-43fc-jf86-j433

Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
🔐 secretATTIO_ACCESS_TOKENOAuth Access Token OAuth integrations, third-party apps
🔐 secretATTIO_API_KEY"": "your_api_key_here"
configATTIO_AUTO_MIGRATE
configATTIO_BASE_URL
configATTIO_DEFAULT_CURRENCYexport ="USD" # Default currency for deal values
configATTIO_DEFAULT_DEAL_OWNERexport ="user@company.com" # Default owner email address (see below)
configATTIO_DEFAULT_DEAL_STAGEexport ="Interested" # Default stage for new deals
configATTIO_MCP_TOOL_MODEFull Tool Access (Default): All 41 tools are exposed by default (26 universal/OpenAI + 12 list + 3 workspace member). Do NOT set in Smithery configuration for full access.
configATTIO_PHONE_METADATA
🔐 secretATTIO_REFRESH_TOKEN
configATTIO_WORKSPACE_SLUG
configBASE_REF
configBATCH_DELAY_MS
configCLAUDE_ALLOWED_ASSOCIATIONS
configCLAUDE_ALLOWED_USERS
configCLAUDE_TRIGGER_PHRASE
configCLEANUP_TEST_DATA
configE2E_MODE
configENABLE_SEARCH_SCORING
configENFORCE_GATES
configGITHUB_BASE_REF
configGITHUB_EVENT_PATH
configGITHUB_EVENT_PULL_REQUEST_BASE_REF
configGITHUB_RUN_ID
configGITHUB_SHA
configHEAD_REF
configINPUT_BASE
configINPUT_HEAD
configLINT_SRC_BASELINE
configLINT_SRC_SLACK
configMAX_BATCH_PAYLOAD
configMAX_BATCH_RPM
configMAX_BATCH_SIZE
configMAX_BATCH_SIZE_COMPANIES
configMAX_BATCH_SIZE_DELETE
configMAX_BATCH_SIZE_LISTS
configMAX_BATCH_SIZE_NOTES
configMAX_BATCH_SIZE_PEOPLE
configMAX_BATCH_SIZE_RECORDS
configMAX_BATCH_SIZE_SEARCH
configMAX_BATCH_SIZE_TASKS
configMAX_CONCURRENT_BATCH_REQUESTS
configMAX_FILTER_SIZE
configMAX_RECORD_SIZE
configMAX_SEARCH_QUERY_SIZE
configMCP_SERVER_MODE
configMCP_TOOL_LINT_MODE
configOFFLINE_MODE
configOUTPUT_DIR
configPARENT_OBJECT
configRING1_MAX
configSEARCH_CACHE_MAX
configSEARCH_CACHE_TTL_MS
configSEARCH_DEFAULT_LIMIT
configSEARCH_FAST_PATH_LIMIT
configSEARCH_FETCH_MIN
configSEARCH_FETCH_MULTIPLIER
configSKIP_INCOMPLETE_TESTS
configSTRICT_DEAL_STAGE_VALIDATION
configTEST_COMPANY_ID
configTEST_DATA_PREFIX
configTEST_DEAL_ID
configTEST_LIST_ID
configTEST_PERSON_ID
configTOKEN_FOOTPRINT_THRESHOLD
configTOKEN_FOOTPRINT_TOP_N
configUSE_MOCK_DATA
configWORKSPACE_ACCESS
configWORKSPACE_API_UUID
configWORKSPACE_MEMBER_ID
configGIT_COMMIT_MSG_FILE
configALLOWED_PREFIXES
configCOMMIT_TITLE_MAXLEN
configALLOW_NO_ISSUE
configGITHUB_STEP_SUMMARY
configAC_STRICT_MODE
configREQUIRE_SECTIONS
configREQUIRE_VERIFICATION
configNO_COLOR
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 5 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/kesslerio-attio-mcp-server-1c0tk3)](https://m8ven.ai/mcp/kesslerio-attio-mcp-server-1c0tk3)
commit: 85496f82ba1e7f70db15689a4cf7ff585f8f17ec
code hash: 57951e7f76c61ecfe5ff42abae3b3e3a928f37a5a747ab169b19fdbdd40d2de7
verified: 7/30/2026, 8:14:08 PM
view raw JSON →