grade F

10 days ago

official

kesslerio/attio-mcp-server

Connect AI to your Attio CRM. Manage contacts, companies, deals, and sales pipelines. Create tasks…

→ kesslerio/attio-mcp-server · listed on official

Install from

Official mcp.so

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

🚨

Secret credentials may flow to a network call

3 flows detected: ATTIO_API_KEY. We can’t prove the destination matches the brand the credential belongs to.

🚨

Known vulnerabilities in dependencies: 3 critical, 5 high

Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.

🔐

You'll be asked for 3 credentials: ATTIO_ACCESS_TOKEN, ATTIO_API_KEY, ATTIO_REFRESH_TOKEN

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// required environment variables

This server reads these from process.env. You'll be asked to provide them before it can run.

🔐 secretATTIO_ACCESS_TOKEN— OAuth Access Token OAuth integrations, third-party apps

🔐 secretATTIO_API_KEY— "": "your_api_key_here"

configATTIO_AUTO_MIGRATE

configATTIO_BASE_URL

configATTIO_DEFAULT_CURRENCY— export ="USD" # Default currency for deal values

configATTIO_DEFAULT_DEAL_OWNER— export ="user@company.com" # Default owner email address (see below)

configATTIO_DEFAULT_DEAL_STAGE— export ="Interested" # Default stage for new deals

configATTIO_MCP_TOOL_MODE— Full Tool Access (Default): All 35 tools are exposed by default (21 universal + 11 list + 3 workspace member). Do NOT set in Smithery configuration for full access.

configATTIO_PHONE_METADATA

🔐 secretATTIO_REFRESH_TOKEN

configATTIO_WORKSPACE_SLUG

configBASE_REF

configBATCH_DELAY_MS

configCLAUDE_ALLOWED_ASSOCIATIONS

configCLAUDE_ALLOWED_USERS

configCLAUDE_TRIGGER_PHRASE

configCLEANUP_TEST_DATA

configE2E_MODE

configENABLE_SEARCH_SCORING

configENFORCE_GATES

configGITHUB_BASE_REF

configGITHUB_EVENT_PATH

configGITHUB_EVENT_PULL_REQUEST_BASE_REF

configGITHUB_RUN_ID

configGITHUB_SHA

configHEAD_REF

configINPUT_BASE

configINPUT_HEAD

configLINT_SRC_BASELINE

configLINT_SRC_SLACK

configMAX_BATCH_PAYLOAD

configMAX_BATCH_RPM

configMAX_BATCH_SIZE

configMAX_BATCH_SIZE_COMPANIES

configMAX_BATCH_SIZE_DELETE

configMAX_BATCH_SIZE_LISTS

configMAX_BATCH_SIZE_NOTES

configMAX_BATCH_SIZE_PEOPLE

configMAX_BATCH_SIZE_RECORDS

configMAX_BATCH_SIZE_SEARCH

configMAX_BATCH_SIZE_TASKS

configMAX_CONCURRENT_BATCH_REQUESTS

configMAX_FILTER_SIZE

configMAX_RECORD_SIZE

configMAX_SEARCH_QUERY_SIZE

configMCP_SERVER_MODE

configMCP_TOOL_LINT_MODE

configOFFLINE_MODE

configOUTPUT_DIR

configPARENT_OBJECT

configRING1_MAX

configSEARCH_CACHE_MAX

configSEARCH_CACHE_TTL_MS

configSEARCH_DEFAULT_LIMIT

configSEARCH_FAST_PATH_LIMIT

configSEARCH_FETCH_MIN

configSEARCH_FETCH_MULTIPLIER

configSKIP_INCOMPLETE_TESTS

configSTRICT_DEAL_STAGE_VALIDATION

configTEST_COMPANY_ID

configTEST_DATA_PREFIX

configTEST_DEAL_ID

configTEST_LIST_ID

configTEST_PERSON_ID

configTOKEN_FOOTPRINT_THRESHOLD

configTOKEN_FOOTPRINT_TOP_N

configUSE_MOCK_DATA

configWORKSPACE_ACCESS

configWORKSPACE_API_UUID

configWORKSPACE_MEMBER_ID

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// improvement guidance — verified publishers only

We have 4 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/official-https-github-com-kesslerio-attio-mcp-server)](https://m8ven.ai/mcp/official-https-github-com-kesslerio-attio-mcp-server)

commit: 01d695d61e0c45fb153e232198adb1c5e1088a02

code hash: cd44dea1f5d3bf74f06ae3d6ade7de3174ce7c993a996523ac6ebca82cb92e96

verified: 4/11/2026, 1:36:51 PM

view raw JSON →