Official server for Teamwork.com project management platform
Do not connect
A critical issue was found. Do not connect this server as-is.
Scanned 6 days ago
A server can change after it's graded. Re-run the automated scan to refresh this report.
This grade is deterministic and reproducible: the same server surface always yields the same grade under a given algorithm version. It is a real automated assessment computed by the MCPGrade engine from what the probe actually observed — not a fabricated or opinion score. It is not a manual human pentest, so it can miss context-specific risks.
Every signal below was measured directly by the automated probe. The grade is derived only from evidence like this — nothing is assumed.
The Teamwork.com MCP server exposes 207 tools, focused primarily on communication, filesystem, and web capabilities. Its published description reads: "Official server for Teamwork.com project management platform". It communicates over Streamable HTTP using the 2025-06-18 protocol revision, and does not require authorization to connect. MCPGrade currently rates Teamwork.com F — a critical issue was found and the server should not be connected as-is. Its most notable findings include "Cross-tool shadowing" and "Cross-tool shadowing". This report is a deterministic, reproducible automated assessment: the same observed surface always yields the same grade under a given algorithm version, and it is refreshed as new scans arrive and free to read — but it is not a substitute for a manual human security review. Always re-check Teamwork.com's advertised tools, transport security, and authorization posture before connecting an autonomous agent or sharing sensitive context with it.
Add Teamwork.com to an MCP client using the endpoint below. Review the grade and findings above before granting an autonomous agent access.
MCP endpoint
https://mcp.ai.teamwork.com/mcpStreamable HTTP transport. This is the MCP endpoint, not a website — paste it into your MCP client server list rather than a browser.
Captured passively during the read-only scan. Click any value to find servers that match it.
The tools this server advertises via tools/list — names, purposes, and the parameters each accepts, exactly as enumerated read-only.
Get task.
List tasks with structured filters (tasklist_id, project_id, or site-wide). For keyword search use search. Completed tasks and tasks in completed tasklists are excluded unless show_completed is true,
Sorted worst-first. Each finding shows its severity, what it means, its OWASP MCP Top-10 mapping, and a recommended fix — the check id links to the exact methodology row that produced it.
tool: twprojects-list_comments
A tool description tries to alter the model’s use of another tool.
ey are cut; use twprojects-get_comment for the full text.RecommendationDescriptions must describe only their own tool.
tool: twprojects-list_projects
A tool description tries to alter the model’s use of another tool.
ith the ID from twprojects-get_user_me, or only_starred. For projects that have slippeRecommendationDescriptions must describe only their own tool.
tool: twchat-list_conversations
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
twchat-list_conversations List Teamwork Chat conversations the current uRecommendationRemove side-channel parameters; constrain tool inputs.
tool: twchat-send_dm
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
eating) the 1:1 conversation automatically. Requires user_id and body. Use lRecommendationRemove side-channel parameters; constrain tool inputs.
tool: twchat-send_message
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
a Teamwork Chat conversation. Requires conversation_id and body. {"type":"obRecommendationRemove side-channel parameters; constrain tool inputs.
tool: twdesk-create_customer
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "notes"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: twdesk-list_users
A tool description tries to alter the model’s use of another tool.
customers, use twdesk-list_customers.RecommendationDescriptions must describe only their own tool.
tool: twdesk-update_customer
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "notes"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: twprojects-count_milestones
A tool description tries to alter the model’s use of another tool.
aging twprojects-list_milestones to count rows. Use twprojects-list_milestRecommendationDescriptions must describe only their own tool.
tool: twprojects-count_projects
A tool description tries to alter the model’s use of another tool.
paging twprojects-list_projects to count rows. Use twprojects-list_projecRecommendationDescriptions must describe only their own tool.
tool: twprojects-count_tasks
A tool description tries to alter the model’s use of another tool.
of paging twprojects-list_tasks to count rows. Note due_before excludes tRecommendationDescriptions must describe only their own tool.
tool: twprojects-count_timelogs
A tool description tries to alter the model’s use of another tool.
paging twprojects-list_timelogs to count rows.RecommendationDescriptions must describe only their own tool.
tool: twprojects-create_custom_item
A tool description tries to alter the model’s use of another tool.
m item and call twprojects-list_custom_items on the relevant project to confirm.RecommendationDescriptions must describe only their own tool.
tool: twprojects-create_custom_item_field
A tool description tries to alter the model’s use of another tool.
m item and call twprojects-list_custom_items on the relevant project to confirm.RecommendationDescriptions must describe only their own tool.
tool: twprojects-create_custom_item_record
A tool description tries to alter the model’s use of another tool.
m item and call twprojects-list_custom_items on the relevant project to confirm.RecommendationDescriptions must describe only their own tool.
tool: twprojects-create_file
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
scription":"The file content, base64-encoded with the standard alphabet. ItRecommendationRemove side-channel parameters; constrain tool inputs.
tool: twprojects-create_file
A tool description tries to alter the model’s use of another tool.
achment_refs on twprojects-create_task, twprojects-update_task, twprojects-create_commRecommendationDescriptions must describe only their own tool.
tool: twprojects-get_custom_item
A tool description tries to alter the model’s use of another tool.
m item and call twprojects-list_custom_items on the relevant project to confirm.RecommendationDescriptions must describe only their own tool.
tool: twprojects-get_custom_item_field
A tool description tries to alter the model’s use of another tool.
m item and call twprojects-list_custom_items on the relevant project to confirm.RecommendationDescriptions must describe only their own tool.
tool: twprojects-get_custom_item_record
A tool description tries to alter the model’s use of another tool.
m item and call twprojects-list_custom_items on the relevant project to confirm.RecommendationDescriptions must describe only their own tool.
tool: twprojects-link_task_to_allocation
A tool description tries to alter the model’s use of another tool.
ked_task_ids on twprojects-update_allocation, which replaces the whole set.RecommendationDescriptions must describe only their own tool.
tool: twprojects-list_allocations
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: twprojects-list_calendar_events
A tool description tries to alter the model’s use of another tool.
or timelog. Use twprojects-list_calendars to find the calendar ID; the calendar of type 'RecommendationDescriptions must describe only their own tool.
tool: twprojects-list_custom_item_fields
A tool description tries to alter the model’s use of another tool.
m item and call twprojects-list_custom_items on the relevant project to confirm.RecommendationDescriptions must describe only their own tool.
tool: twprojects-list_custom_item_records
A tool description tries to alter the model’s use of another tool.
m item and call twprojects-list_custom_items on the relevant project to confirm.RecommendationDescriptions must describe only their own tool.
tool: twprojects-list_messages
A tool description tries to alter the model’s use of another tool.
vel posts). Use twprojects-list_message_replies for thread replies.RecommendationDescriptions must describe only their own tool.
tool: twprojects-list_project_budgets
A tool description tries to alter the model’s use of another tool.
ects (diff with twprojects-list_projects for budgetless).Filter server-side via project_RecommendationDescriptions must describe only their own tool.
tool: twprojects-restore_allocation
A tool description tries to alter the model’s use of another tool.
e ID first with twprojects-list_allocations and show_deleted set, since a deleted allocatioRecommendationDescriptions must describe only their own tool.
tool: twprojects-summarize_timelogs
A tool description tries to alter the model’s use of another tool.
rojects-list_timelogs whenever the question is about totals, sums, or breaRecommendationDescriptions must describe only their own tool.
tool: twprojects-update_custom_item
A tool description tries to alter the model’s use of another tool.
m item and call twprojects-list_custom_items on the relevant project to confirm.RecommendationDescriptions must describe only their own tool.
tool: twprojects-update_custom_item_field
A tool description tries to alter the model’s use of another tool.
m item and call twprojects-list_custom_items on the relevant project to confirm.RecommendationDescriptions must describe only their own tool.
tool: twprojects-update_custom_item_record
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
The server accepts tool enumeration (and likely invocation) with no authentication.
RecommendationRequire OAuth 2.1 authorization for any server exposing non-public tools.
tool: twdesk-create_helpdoc_article
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: twdesk-create_ticket
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: twdesk-reply_ticket
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: twdesk-unlink_task_from_ticket
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: twdesk-update_helpdoc_article
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
The server exposes one or more ui:// (MCP Apps) resources whose HTML/JS renders inside the host client — a client-side injection / data-exposure surface most scanners ignore. Flagged for review, not damning on its own.
1 ui:// resource(s); e.g. ui://teamwork/timelog-createRecommendationReview each ui:// resource’s markup and scripts; treat host-rendered UI as untrusted, sandbox it, and never expose secrets or conversation context to it.
Vantaj uptime monitoring via MCP — manage monitors, heartbeats, incidents, and status pages.
Unified gateway to Algeria's TKAWEN ecosystem: commerce, certification, and AI tools.
Provides access to the Cohereon Doctrine AI safety framework with governance components, tiered access, and agent onboarding.
Agentic rails for complex workflows with receipts, fees, and MCP tool access.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Create task in a tasklist.
List comments. Scope by one of task_id, milestone_id, notebook_id, link_id, or file_version_id; omit all for site-wide. Comment bodies are truncated at 500 characters and marked where they are cut; us
Update task.
List projects with structured filters (membership, progress state, health, category, tag, company, owner). For "my projects" pass user_ids with the ID from twprojects-get_user_me, or only_starred. For
Create timelog entry against a project or task.
List timelogs. Scope by project_id or task_id, or omit for site-wide.
Cross-entity keyword search across projects, tasks, files, messages, and more. Long content fields in the sideloaded records are truncated at 500 characters and marked where they are cut; the marker n
List tasklists. Scope by project_id or omit for site-wide.
Create comment on a task, milestone, notebook, file, or link.
Get tasklist.
Get project.
Get ticket.
Update timelog.
List recent activity events. Scope by project_id or omit for site-wide.
Move one or more tasks to a workflow stage.
Mark task complete.
Search tickets. Filter by inbox, customer, company, tag, status, priority, user, or creation date range.
List users. Scope by project_id or filter by type (account/collaborator/contact).
Get a single Teamwork Chat conversation by ID.
Get the current authenticated Teamwork Chat user, including identity, counts (unread conversations/messages, mentions), and settings.
Get the 1:1 direct-message conversation with a person, creating it if it does not exist yet. Returns the conversation (use its id with send_message). Use list_people to find user_id.
List Teamwork Chat conversations the current user is a member of.
List messages within a Teamwork Chat conversation. Requires conversation_id.
List people in the Teamwork Chat installation. Useful for resolving names to user IDs.
Send a direct message to a person, resolving (or creating) the 1:1 conversation automatically. Requires user_id and body. Use list_people to find user_id.
Send a message to a Teamwork Chat conversation. Requires conversation_id and body.
Create Desk company.
Create customer.
Upload file. Attach the returned ID to tickets or messages.
Create a new help doc article.
Create ticket priority.
Create ticket status.
Create Desk tag.
Create ticket.
Create ticket type.
Get Desk company (customer organization).
Get customer.
Get a help doc article by ID.
Get a help doc site (knowledge base) by ID, including its subdomain, branding and article counts.
Get inbox.
Get ticket priority.
Get ticket status.
Get Desk tag.
Get ticket type.
Get support agent.
Link a Teamwork Projects task to a Desk ticket, so the ticket shows the work tracked by that task.
List Desk companies. Filter by name, domains, or kind.
List customers. Filter by company or email.
List help doc sites (knowledge bases). Filter by name or subdomain. Use this to discover the site ID required by the help doc article tools.
List inboxes. Filter by name or email.
List ticket priorities. Filter by name or color.
List ticket statuses. Filter by name, color, or code.
List Desk tags. Filter by name, color, or inbox.
List ticket types. Filter by name or inbox.
List support agents. For customers, use twdesk-list_customers.
Reply to a ticket. Use threadType=note for internal agent notes.
Search help doc articles. Filter by search term, status, site, or category.
Unlink a Teamwork Projects task from a Desk ticket. The task and the ticket themselves are kept.
Update Desk company.
Update customer.
Update an existing help doc article.
Update ticket priority.
Update ticket status.
Update Desk tag.
Update ticket.
Update ticket type.
Add a user to a project.
Clone/copy an existing project or instantiate one from a template.
Stop a timer permanently and convert it to a timelog. Use pause_timer to pause without converting.
Exact milestone count for any filter set: one call, one number, no rows. Use for "how many milestones" questions (per project, per tag, matching a term) instead of paging twprojects-list_milestones to
Exact project count for any filter set: one call, one number, no rows. Use for "how many projects" questions (mine, late, per category, per tag, per company, per owner, matching a term) instead of pag
Exact task count for any filter set: one call, one number, no rows. Use for "how many" questions (totals, late, per person, per project, per tag, completed in a window) instead of paging twprojects-li
Exact count of time entries for any filter set: one call, one number, no rows. This counts entries, not hours — for logged, billable or billed time totals use twprojects-summarize_timelogs. Use for "h
Commit a user's time to a project over a date range (a scheduler allocation). This is planned time, a separate plane from task estimates and logged time.
Create company (aka client).
Create custom field.
Set a custom field value on a task, project or company. The custom field must already exist and be applicable to the target entity.
Create a new custom item type (e.g. Contracts, Leads, Deals) on a project. Custom items are user-defined entity types — Contracts, Leads, Deals, or anything else a customer has set up on a project. Us
Add a field (column) to a custom item type. Field types include text, number, dropdown, multiselect, checkbox, url, user, date, time and datetime. Custom items are user-defined entity types — Contract
Create a record (row) on a custom item type. For example, add a Contract on the Contracts type. Pass field values by name; the tool resolves names to the API's internal IDs. Custom items are user-defi
Upload a file so it can be attached to a task, comment or message. Returns a single-use reference like "tf_1a2b"; pass it in attachment_refs on twprojects-create_task, twprojects-update_task, twprojec
Create job role.
Create link.
Create message in a project.
Create message reply.
Create milestone in a project.
Create notebook in a project.
Create project.
Create project category.
Create project template.
Create skill.
Create tag.
Create tasklist in a project.
Create team.
Create and start a timer.
Create user.
Create workflow.
Create workflow stage.
Get an allocation. linkedTaskEstimatedTime counts each linked task whole, and a task can sit behind more than one allocation, so it must not be summed across allocations.
Get comment.
Get company (aka client).
Get custom field.
Get a single custom field value from a task, project or company.
Get a custom item type with its fields and sections inline, so you can see its schema before creating or updating records. Custom items are user-defined entity types — Contracts, Leads, Deals, or anyt
Get a single field on a custom item type. Custom items are user-defined entity types — Contracts, Leads, Deals, or anything else a customer has set up on a project. Use these tools when the user refer
Get a single record. Field values come back keyed by display name with dropdown values translated to their human-readable labels. Custom items are user-defined entity types — Contracts, Leads, Deals,
Get job role.
Get link.
Get message.
Get message reply.
Get milestone.
Get notebook.
Get project category.
Get skill.
Get tag.
Get team.
Get timelog.
Get timer.
Get user.
Get the currently authenticated user.
Get workflow.
Get workflow stage.
Link a project to a workflow so its tasks track through workflow stages.
Link one task to an allocation, showing what task work sits behind the committed time. The task and the allocation must be in the same project. This adds a single link and leaves the allocation's othe
List scheduler allocations — who is committed to which project, and when. ALWAYS pass start_date and end_date: with neither set the endpoint returns only today through 30 days from today, and says not
List events from a calendar, including time-blocking events that link a calendar slot to a Teamwork project, task or timelog. Use twprojects-list_calendars to find the calendar ID; the calendar of typ
List calendars. Calendars hold events such as meetings, out-of-office periods and time-blocking entries; the calendar of type 'blocked_time' holds the account's time-blocking events.
List companies (aka clients).
List the custom field values of a task, project or company.
List custom fields.
List fields on a custom item type. Each entry includes the twId you need when writing record values. Custom items are user-defined entity types — Contracts, Leads, Deals, or anything else a customer h
List records on a custom item type. Returns each record with field values keyed by display name. Use the section_ids filter to scope to a specific section. Custom items are user-defined entity types —
List the custom item types defined on a project. Returns each type's id, display name and labels — call get_custom_item to see a type's fields and sections. Custom items are user-defined entity types
List supported company (aka client) industries.
List job roles.
List links.
List replies under a message thread. Filter by message_ids or project_ids.
List project messages (top-level posts). Use twprojects-list_message_replies for thread replies.
List milestones. Scope by project_id or omit for site-wide.
List notebooks.
Lists top-level project budgets. Filters: project_ids, status.Returns only budgeted projects (diff with twprojects-list_projects for budgetless).Filter server-side via project_ids when known. 1-based
List project categories.
List project templates.
List skills.
List tags.
List tasklist budgets nested under a project budget. Requires project_budget_id.
List teams. Scope by company_id or project_id, or omit for site-wide.
List timers.
List workflow stages.
List workflows.
Move tasks and all their subtasks to another tasklist, preserving the parent/child structure. Subtasks move with their parent automatically, so only the topmost task of each subtree needs to be listed
Pause a running timer; can be resumed later. Use complete_timer to stop permanently.
Restore a deleted allocation. Find the ID first with twprojects-list_allocations and show_deleted set, since a deleted allocation is otherwise not returned.
Resume a paused timer back to running.
Deterministic, complete time-tracking totals for a date window, grouped by user or project. Returns every group in one call with exact minute sums and 2-decimal hours — no pagination for the caller, a
Remove the link between one task and an allocation. Only the association is removed: both the task and the allocation are left in place. This removes a single link and leaves the allocation's other li
Update an allocation. Changing end_date ADDS or REMOVES committed time rather than redistributing it, because the per-day rate is what is held constant.
Update comment.
Update company (aka client).
Update custom field.
Update a custom field value on a task, project or company.
Update a custom item type's display name, description, or labels. Custom items are user-defined entity types — Contracts, Leads, Deals, or anything else a customer has set up on a project. Use these t
Update a field on a custom item type. Custom items are user-defined entity types — Contracts, Leads, Deals, or anything else a customer has set up on a project. Use these tools when the user refers to
Update a record on a custom item type. Only the fields you supply are changed; others are left as-is. Set section_id to null to remove the record from any section. Custom items are user-defined entity
Update job role.
Update link.
Update message.
Update message reply.
Update milestone.
Update notebook.
Update project.
Update project category.
Update skill.
Update tag.
Update tasklist.
Update team.
Update timer.
Update user.
Update workflow.
Update workflow stage.
Get task allocation across users for a date range. (workload of users)
Create space category.
Create comment on a page. Use parentId for replies.
Create page in a space.
Create space.
Create one or more Spaces tags in a single request.
Duplicate page with a new title.
Get space category.
Get page comment.
Get a space's homepage.
Get page. Returns content, metadata, tags, and revision info.
Get space.
Get Spaces tag.
List space categories.
List comments on a page. Returns top-level comments with replies.
List pages in a space as a hierarchical tree.
List space collaborators (users and teams).
List spaces.
List Spaces tags.
Full-text search across pages. Filter by space.
Update space category.
Update page comment.
Update page. Note: content and publish changes update the published page only, not the live collaborative editor draft; if the page has an active editor draft, re-publishing from the Spaces web editor
Update space.
Update Spaces tag.