Model Context Protocol moderate risk

Coda

The Coda MCP server bridges AI assistants to Coda, enabling document and page manipulation via API key authentication.

Connections & Capabilities

Connects To

Docker

Capabilities

readwrite

Quickstart

Config

{
  "mcpServers": {
    "coda": {
      "command": "npx",
      "args": ["-y", "coda-mcp@latest"],
      "env": {
        "API_KEY": "..."
      }
    }
  }
}

Exposed MCP Tools (10)

safe

coda_list_documents

Lists all Coda documents accessible to the API key.

Read-only operation, no data modification.

safe

coda_list_pages

Lists all pages within a specified Coda document.

Read-only operation, no data modification.

moderate

coda_create_page

Creates a new page in a Coda document.

Creates new content; potential for unintended document structure changes.

safe

coda_get_page_content

Retrieves the content of a specified Coda page.

Read-only operation, no data modification.

high

coda_replace_page_content

Replaces the content of a specified Coda page.

Overwrites existing content; potential for data loss.

moderate

coda_append_page_content

Appends content to the end of a specified Coda page.

Adds content; potential for unintended document changes.

moderate

coda_duplicate_page

Creates a copy of an existing Coda page.

Duplicates existing content; potential for unintended document bloat.

moderate

coda_rename_page

Renames an existing Coda page.

Renames existing content; potential for breaking internal links.

safe

coda_peek_page

Retrieves the first few lines of a Coda page.

Read-only operation, no data modification.

safe

coda_resolve_link

Resolves metadata from a Coda object browser link.

Read-only operation, no data modification.

Safety Assessment

This server allows for both read and write operations on Coda documents, making it moderately risky. It's safe when used responsibly with a securely stored API key and clear understanding of the tool functionalities. Risky scenarios include accidental data overwrites or exposure of the API key.

API key authentication
No direct shell access
Limited scope of operations to Coda documents
Clear tool descriptions provided

Write operations possible (create, update, duplicate)
API key stored in environment variables
Potential for unintended data modification if misused
No built-in rate limiting