Coda Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Coda Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
MCP (Model Context Protocol) server for Coda.io API. Enables AI assistants to read and write Coda documents, tables, and rows.
cargo install coda-mcpGet your token from coda.io/account → API settings.
Add to ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or ~/.config/claude/claude_desktop_config.json (Linux):
{
"mcpServers": {
"coda": {
"command": "/Users/YOUR_USERNAME/.cargo/bin/coda-mcp",
"env": {
"CODA_API_TOKEN": "your_token_here"
}
}
}
}The Coda tools will now be available.
cargo install coda-mcpgit clone https://github.com/nkpar/coda-mcp.git
cd coda-mcp
cargo build --releaseBinary will be at ./target/release/coda-mcp
Check the Releases page.
No Rust toolchain required. Multi-arch image (amd64 + arm64), ~3MB.
docker pull ghcr.io/nkpar/coda-mcp:latestClaude Code (CLI):
claude mcp add coda -e CODA_API_TOKEN=your_token_here -- docker run --rm -i -e CODA_API_TOKEN ghcr.io/nkpar/coda-mcp:latestClaude Desktop config:
{
"mcpServers": {
"coda": {
"command": "docker",
"args": ["run", "--rm", "-i", "-e", "CODA_API_TOKEN", "ghcr.io/nkpar/coda-mcp:latest"],
"env": {
"CODA_API_TOKEN": "your_token_here"
}
}
}
}For Claude Desktop with automatic configuration:
git clone https://github.com/nkpar/coda-mcp.git
cd coda-mcp
./scripts/install.shGet your Coda API token from coda.io/account → API settings.
Important: For write operations (create_doc, delete_doc, add_row, update_row, delete_row), ensure your token has write permissions enabled. Read-only tokens will return 403 Forbidden for these operations.
Claude Desktop (~/.config/claude/claude_desktop_config.json):
{
"mcpServers": {
"coda": {
"command": "/path/to/coda-mcp",
"env": {
"CODA_API_TOKEN": "your_token_here"
}
}
}
}Claude Code (CLI):
# Binary
claude mcp add coda -e CODA_API_TOKEN=your_token_here -- $HOME/.cargo/bin/coda-mcp
# Or via Docker (no Rust required)
claude mcp add coda -e CODA_API_TOKEN=your_token_here -- docker run --rm -i -e CODA_API_TOKEN ghcr.io/nkpar/coda-mcp:latestOr via .mcp.json in project root:
{
"mcpServers": {
"coda": {
"command": "/path/to/coda-mcp",
"env": {
"CODA_API_TOKEN": "your_token_here"
}
}
}
}| Variable | Required | Description |
|---|---|---|
CODA_API_TOKEN | Yes | Your Coda API token |
CODA_BASE_URL | No | API base URL (default: https://coda.io/apis/v1) |
RUST_LOG | No | Log level: error, warn, info, debug, trace |
| Tool | Description |
|---|---|
list_docs | List available documents |
get_doc | Get document details |
search_docs | Search documents by name |
create_doc | Create a new document (optional: folder, template, timezone) |
delete_doc | Delete a document (permanent) |
list_pages | List pages in a document |
get_page | Get page content (HTML) |
list_tables | List tables in a document |
get_table | Get table details |
list_columns | List columns in a table |
get_rows | Get rows with optional filtering |
get_row | Get a specific row |
add_row | Add a new row |
update_row | Update an existing row |
delete_row | Delete a row |
list_formulas | List named formulas |
get_formula | Get formula value |
list_controls | List controls (buttons, sliders) |
# List all documents
list_docs
# Create a new document
create_doc title="My New Doc"
# Create from template in specific folder
create_doc title="Project Plan" folder_id="fl-abc" source_doc="template-xyz"
# Delete a document (permanent!)
delete_doc doc_id="AbCdEfGh"
# Get rows from a table
get_rows doc_id="AbCdEfGh" table_id="grid-xyz" limit=50
# Filter rows
get_rows doc_id="AbCdEfGh" table_id="grid-xyz" query="Status:Active"
# Add a row
add_row doc_id="AbCdEfGh" table_id="grid-xyz" cells={"Name": "John", "Email": "[email protected]"}
# Get page content
get_page doc_id="AbCdEfGh" page_id="canvas-xyz"Coda API has rate limits:
Write operations return HTTP 202 (queued). Changes may take a few seconds to appear.
# Build
cargo build --release
# Run unit & integration tests
cargo test
# Run E2E tests (requires write-enabled API token)
export $(cat .env | xargs) && cargo test --test e2e_tests -- --ignored
# Run with debug logging
RUST_LOG=debug cargo run
# Format & lint
cargo fmt && cargo clippySee DEVELOPER.md for API details and CONTRIBUTING.md for contribution guidelines.
MIT License. See LICENSE for details.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.