Planning Center Online MCP Server (tracsoftllc/PCO-MCP) is an MCP server listed on the M8ven Trust Index. It scores 56 out of 100, grade D. It declares 29 tools. No publisher has claimed this listing.

D
Caution
56/100

Planning Center Online MCP Server

Enables AI assistants to interact with Planning Center Online accounts across modules like People, Services, Giving, and Calendar. It provides tools for searching people, managing service plans, tracking donations, and monitoring events through the PCO API.

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

tracsoftllc

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

Install from

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
⚠️
Known vulnerabilities in dependencies: 16 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
29 tools verified — handlers match their declared behaviour
27 read-only tools verified — handlers contain no write/delete/exec
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
🔐
You'll be asked for 1 credential: PCO_SECRET
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// tools this server exposes29 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

pco_list_calendar_events

List events in Planning Center Calendar. Args: - filter (string, optional): Filter events — 'approved', 'pending', 'rejected', 'future', 'past' - limit (number): Max results (1-100, default 25) - offset (number): Pagination offset (default 0) - response_format ('markdown' | 'json'): Output

pco_get_calendar_event

Get detailed information about a specific calendar event. Args: - id (string): The event ID - response_format ('markdown' | 'json'): Output format (default: 'markdown') Returns: Full event record with name, approval status, description, visibility, and registration info. Error: Returns "Error:

pco_list_event_instances

List specific instances (occurrences) of a calendar event. Args: - event_id (string): The calendar event ID (get this from pco_list_calendar_events) - limit (number): Max results (1-100, default 25) - offset (number): Pagination offset (default 0) - response_format ('markdown' | 'json'): Ou

pco_list_calendar_resources

List facility resources (rooms, equipment) in Planning Center Calendar. Args: - limit (number): Max results (1-100, default 25) - offset (number): Pagination offset (default 0) - response_format ('markdown' | 'json'): Output format (default: 'markdown') Returns: List of resources with name,

pco_list_checkins

List check-in records in Planning Center Check-Ins. Args: - where_created_after (string, optional): Filter check-ins created after this date (YYYY-MM-DD) - where_created_before (string, optional): Filter check-ins created before this date (YYYY-MM-DD) - limit (number): Max results (1-100, def

pco_list_checkin_events

List events (attendance tracking sessions) in Planning Center Check-Ins. Args: - limit (number): Max results (1-100, default 25) - offset (number): Pagination offset (default 0) - response_format ('markdown' | 'json'): Output format (default: 'markdown') Returns: List of check-in events with

pco_list_checkin_locations

List locations (rooms) for a check-in event in Planning Center Check-Ins. Args: - event_id (string): The check-in event ID (get this from pco_list_checkin_events) - limit (number): Max results (1-100, default 25) - offset (number): Pagination offset (default 0) - response_format ('markdown'

pco_list_donations

List donations in Planning Center Giving. Args: - where_received_after (string, optional): Filter donations received after this date (YYYY-MM-DD) - where_received_before (string, optional): Filter donations received before this date (YYYY-MM-DD) - where_payment_method (string, optional): Filt

pco_get_donation

Get detailed information about a specific donation by ID. Args: - id (string): The donation ID - response_format ('markdown' | 'json'): Output format (default: 'markdown') Returns: Full donation record including amount, payment details, fund designations, and dates. Error: Returns "Error: Reso

pco_list_funds

List giving funds in Planning Center Giving. Args: - limit (number): Max results (1-100, default 25) - offset (number): Pagination offset (default 0) - response_format ('markdown' | 'json'): Output format (default: 'markdown') Returns: List of funds with name, ledger code, description, visib

pco_list_donation_batches

List donation batches in Planning Center Giving. Args: - limit (number): Max results (1-100, default 25) - offset (number): Pagination offset (default 0) - response_format ('markdown' | 'json'): Output format (default: 'markdown') Returns: List of batches with description, status, total, and

pco_list_groups

List groups in Planning Center Groups. Args: - query (string, optional): Search groups by name - where_group_type_id (string, optional): Filter by group type ID - limit (number): Max results (1-100, default 25) - offset (number): Pagination offset (default 0) - response_format ('markdown'

pco_get_group

Get detailed information about a specific group by its ID. Args: - id (string): The group ID - response_format ('markdown' | 'json'): Output format (default: 'markdown') Returns: Full group record including name, description, location, schedule, member count, and Church Center URL. Error: Retu

pco_list_group_members

List members of a specific group in Planning Center Groups. Args: - group_id (string): The group ID (get this from pco_list_groups) - filter (string, optional): Filter members — 'leader' for leaders only, 'member' for regular members - limit (number): Max results (1-100, default 25) - offse

pco_list_group_types

List group types in Planning Center Groups. Group types categorize groups (e.g., "Small Groups", "Bible Studies", "Recovery"). Args: - limit (number): Max results (1-100, default 25) - offset (number): Pagination offset (default 0) - response_format ('markdown' | 'json'): Output format (defa

pco_list_people

Search for and list people in Planning Center People (PCO). Supports filtering by name, status, and more. Returns person records with attributes. Args: - query (string, optional): Search by name (partial match on first or last name) - where_first_name (string, optional): Filter by exact first

pco_get_person

Get detailed information about a single person by their PCO ID. Args: - id (string): The PCO person ID - response_format ('markdown' | 'json'): Output format (default: 'markdown') Returns: Full person record including all attributes (name, gender, status, birthdate, etc.). Error: Returns "Erro

pco_create_person

Create a new person record in Planning Center People. Args: - first_name (string, required): First name - last_name (string, required): Last name - middle_name (string, optional): Middle name - birthdate (string, optional): Birthdate in YYYY-MM-DD format - gender (string, optional): Gende

pco_update_person

Update an existing person record in Planning Center People. Only the fields you provide will be updated (sparse update / PATCH semantics). Args: - id (string): PCO person ID to update - first_name (string, optional): Updated first name - last_name (string, optional): Updated last name - mi

pco_list_person_emails

Get all email addresses for a specific person in PCO. Args: - person_id (string): The PCO person ID - response_format ('markdown' | 'json'): Output format (default: 'markdown') Returns: List of email addresses with location and primary status. Error: Returns "Error: Resource not found" if the

pco_list_person_phone_numbers

Get all phone numbers for a specific person in PCO. Args: - person_id (string): The PCO person ID - response_format ('markdown' | 'json'): Output format (default: 'markdown') Returns: List of phone numbers with carrier, location, and primary status. Error: Returns "Error: Resource not found" i

pco_list_households

List households in Planning Center People. Args: - limit (number): Max results (1-100, default 25) - offset (number): Pagination offset (default 0) - response_format ('markdown' | 'json'): Output format (default: 'markdown') Returns: List of households with name, member count, and primary co

pco_list_people_lists

List smart lists (saved filters) in Planning Center People. Args: - limit (number): Max results (1-100, default 25) - offset (number): Pagination offset (default 0) - response_format ('markdown' | 'json'): Output format (default: 'markdown') Returns: List of PCO Lists with name, description,

pco_list_service_types

List all service types in Planning Center Services. Service types represent different worship services (e.g., "Sunday Morning", "Wednesday Night"). Args: - limit (number): Max results (1-100, default 25) - offset (number): Pagination offset (default 0) - response_format ('markdown' | 'json')

pco_list_plans

List plans for a specific service type in Planning Center Services. Args: - service_type_id (string): The service type ID (get this from pco_list_service_types) - filter (string, optional): Filter plans — 'future' (upcoming), 'past', 'no_dates', or 'undated' - limit (number): Max results (1-1

pco_get_plan

Get detailed information about a specific plan in Planning Center Services. Args: - service_type_id (string): The service type ID - plan_id (string): The plan ID - response_format ('markdown' | 'json'): Output format (default: 'markdown') Returns: Full plan details including title, dates, te

pco_list_songs

List songs in the Planning Center Services song library. Args: - query (string, optional): Search songs by title - hidden (boolean, optional): Filter by hidden status (true = hidden, false = visible only) - limit (number): Max results (1-100, default 25) - offset (number): Pagination offset

pco_list_teams

List teams for a specific service type in Planning Center Services. Args: - service_type_id (string): The service type ID (get this from pco_list_service_types) - limit (number): Max results (1-100, default 25) - offset (number): Pagination offset (default 0) - response_format ('markdown' |

pco_list_series

List sermon/service series in Planning Center Services. Args: - service_type_id (string): The service type ID (get this from pco_list_service_types) - limit (number): Max results (1-100, default 25) - offset (number): Pagination offset (default 0) - response_format ('markdown' | 'json'): Ou

// known CVEs in dependencies16 high12 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.6.1GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.6.1GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

highaxios@1.7.9GHSA-35jp-ww65-95wh

axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

highaxios@1.7.9GHSA-3g43-6gmg-66jw

axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

highaxios@1.7.9GHSA-43fc-jf86-j433

Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
configPCO_APP_ID"": "your_application_id",
🔐 secretPCO_SECRET"": "your_secret"
configTRANSPORTPCO_APP_ID=your_app_id PCO_SECRET=your_secret =http PORT=3000 npm start
Deployment configuration, supplied by whoever hosts the server. Users are not asked for these.
deployPORT
// quality suggestions

License file

No license file

Add a LICENSE file (MIT, Apache-2.0, etc.).

Tests exist

No test files found

Add tests that exercise each declared tool.

Production dependencies are patched

0 critical, 16 high severity in production deps — @modelcontextprotocol/sdk@1.6.1 (high), @modelcontextprotocol/sdk@1.6.1 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 3 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/tracsoftllc/pco-mcp?variant=verified)](https://m8ven.ai/mcp/tracsoftllc/pco-mcp)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: 5772b75ecf77a3a5a7c1ed45a771a190fe526b6d
code hash: c8e75160f0aba0f9e1793533cb1dd430092ee298cdf2c475088b944dbf07c851
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client