Coda MCP Server (thierryvm/coda-mcp-server) is an MCP server listed on the M8ven Trust Index. It scores 56 out of 100, grade D. It declares 35 tools. No publisher has claimed this listing.
Integrates Coda.io with Claude, enabling direct access to docs, pages, tables, and data via natural language commands.
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
thierryvm
Source: Glama
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
coda_list_docsList and search Coda documents accessible by the API token. Returns doc titles, IDs, owner, creation dates and URLs. Args: - query (string, optional): Filter by title keywords - limit (number): Max docs to return, 1–500 (default 25) - page_token (string, optional): Pagination token from prev…
coda_get_docGet metadata for a specific Coda document by its ID. Args: - doc_id (string): The doc ID (e.g. "AbCdEfGh") - response_format: 'markdown' or 'json' Returns: Doc metadata including name, owner, pages count, browserLink.
coda_create_docCreate a new Coda document. Args: - title (string): Title for the new document - source_doc (string, optional): ID of a doc to duplicate as template Returns: New doc ID, name, and browserLink.
coda_update_docUpdate a document's title or icon. Args: - doc_id (string): The document ID - title (string, optional): New title for the document - icon_name (string, optional): Emoji icon name (e.g. "gear") Returns: Confirmation with updated doc info.
coda_delete_docDelete a Coda document permanently. THIS ACTION IS IRREVERSIBLE. Args: - doc_id (string): The document ID to delete Returns: Confirmation of deletion.
coda_list_pagesList all pages in a Coda document. Args: - doc_id (string): The document ID - limit (number): Max pages to return (default 25) - page_token (string, optional): Pagination token - response_format: 'markdown' or 'json' Returns: List of pages with id, name, type, browserLink.
coda_update_pageUpdate a page's name or content in a Coda document. Args: - doc_id (string): The document ID - page_id (string): The page ID or name - name (string, optional): New name for the page - subtitle (string, optional): New subtitle - icon_name (string, optional): Emoji icon name (e.g. "gear") …
coda_rename_pageRenomme une page existante. Raccourci explicite pour changer uniquement le nom.
coda_delete_pageDelete a page from a Coda document permanently. THIS ACTION IS IRREVERSIBLE. Args: - doc_id (string): The document ID - page_id (string): The page ID or name to delete Returns: Confirmation of deletion.
coda_list_tablesList all tables and views in a Coda document. Args: - doc_id (string): The document ID - table_type (string, optional): Filter by type — 'table' or 'view' - limit (number): Max tables (default 25) - page_token (string, optional): Pagination token - response_format: 'markdown' or 'json' R…
coda_get_tableGet metadata for a specific table or view. Args: - doc_id (string): The document ID - table_id (string): The table ID or name - response_format: 'markdown' or 'json' Returns: Table metadata including id, name, type, rowCount, browserLink.
coda_list_columnsList all columns in a Coda table, including their IDs and types. Useful to get column IDs before reading/writing rows, since Coda rows use column IDs as keys. Args: - doc_id (string): The document ID - table_id (string): The table ID or name - response_format: 'markdown' or 'json' Returns: …
coda_get_columnGet detailed information about a specific column, including its formula and format. Especially useful to inspect calculated column formulas and currency/number format settings. Args: - doc_id (string): The document ID - table_id (string): The table ID or name - column_id (string): The column…
coda_list_rowsList rows from a Coda table with optional filtering and sorting. Args: - doc_id (string): The document ID - table_id (string): The table ID or name - query (string, optional): Filter rows — format: "columnId:value" - sort_by (string, optional): Sort column ID - limit (number): Max rows (d…
coda_get_rowGet a specific row from a Coda table by its ID or name. Args: - doc_id (string): The document ID - table_id (string): The table ID or name - row_id (string): The row ID or name - value_format: 'simple' or 'rich' - response_format: 'markdown' or 'json' Returns: Row with all column values.
coda_upsert_rowsInsert or update rows in a Coda table (base table only, not views). Provide row data as an array of objects, each with column IDs as keys. Use coda_list_columns to get the column IDs first. Args: - doc_id (string): The document ID - table_id (string): The BASE table ID (not a view) - rows (a…
coda_update_rowUpdate specific cells in an existing row. Args: - doc_id (string): The document ID - table_id (string): The table ID - row_id (string): The row ID - cells (array): Array of {column, value} pairs to update Returns: Request ID confirmation.
coda_delete_rowDelete a specific row from a Coda table. This action is irreversible. Args: - doc_id (string): The document ID - table_id (string): The table ID - row_id (string): The row ID to delete Returns: Confirmation with request ID.
coda_list_formulasList all named formulas in a Coda document. Args: - doc_id (string): The document ID - response_format: 'markdown' or 'json' Returns: List of formulas with id, name, and value.
coda_get_formulaGet details of a specific named formula in a Coda document. Args: - doc_id (string): The document ID - formula_id (string): The formula ID or name - response_format: 'markdown' or 'json' Returns: Formula name, id, and computed value.
coda_search_docsSearch across all accessible Coda documents by title keyword. Args: - query (string): Search term - limit (number): Max results (default 25) - response_format: 'markdown' or 'json' Returns: Matching docs with id, name, browserLink.
coda_get_page_contentRécupère le contenu complet d'une page Coda au format markdown.
coda_peek_pageAperçu des premières lignes d'une page Coda (évite de charger tout le contenu).
coda_create_pageCrée une nouvelle page dans un document Coda, avec contenu markdown optionnel.
coda_replace_page_contentRemplace entièrement le contenu d'une page par du markdown. ATTENTION : action irréversible.
coda_append_page_contentAjoute du contenu markdown à la fin d'une page Coda.
coda_duplicate_pageDuplique une page existante sous un nouveau nom.
coda_resolve_linkRésout une URL Coda (browserLink) en métadonnées : type d'objet, ID doc, ID page, etc.
coda_delete_rowsSupprime plusieurs lignes d'une table en une seule opération. Action irréversible.
coda_push_buttonDéclenche un bouton Coda sur une ligne spécifique d'une table.
coda_list_controlsList all controls (formula cells, buttons, date pickers, etc.) in a Coda document. Args: - doc_id (string): The document ID - limit (number): Max controls (default 25) - page_token (string, optional): Pagination token - response_format: 'markdown' or 'json' Returns: List of controls with i…
coda_get_controlGet details of a specific control (formula cell, button, date picker...) in a Coda document. Args: - doc_id (string): The document ID - control_id (string): The control ID or name - response_format: 'markdown' or 'json' Returns: Control details including id, name, type, formula, browserLink.
coda_get_doc_schemaGet the full schema of a Coda document: all tables with their columns, types, and formulas in a single call. Equivalent to running coda_list_tables + coda_list_columns for every table at once. Especially useful to understand table structure before writing data or debugging formulas. Args: - doc_…
coda_resolve_uriParse a coda:// URI (returned by the official Coda MCP) and extract the raw IDs usable with this server. Supports URIs like: - coda://docs/{docId} - coda://docs/{docId}/pages/{pageId} - coda://docs/{docId}/tables/{tableId} - coda://docs/{docId}/tables/{tableId}/columns/{columnId} - coda:/…
coda_whoamiRetrieve information about the currently authenticated Coda user. Useful to verify which account is active and confirm the API token is valid. Args: - response_format: 'markdown' or 'json' Returns: User name, email (loginId), and account type.
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
Anthropic's MCP TypeScript SDK has a ReDoS vulnerability
Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default
axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig
CODA_API_TOKENenv =VOTRE_TOKEN_ICI \HOSTMCP_ACCESS_TOKENMODEPORTTool test coverage
Only 0/35 tools referenced in tests (0%)
Write tests that reference each tool by name so every tool has at least one test.
Production dependencies are patched
0 critical, 12 high severity in production deps — @modelcontextprotocol/sdk@1.6.1 (high), @modelcontextprotocol/sdk@1.6.1 (high)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/thierryvm/coda-mcp-server)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check