Add monday.com MCP server setup page

docs.json

@@ -133,6 +133,7 @@
                   "product/admin/mcp-server/lucid",
                   "product/admin/mcp-server/metabase",
                   "product/admin/mcp-server/metronome",
+                  "product/admin/mcp-server/monday",
                   "product/admin/mcp-server/n8n",
                   "product/admin/mcp-server/notion",
                   "product/admin/mcp-server/okta",

product/admin/mcp-server/monday.mdx

@@ -0,0 +1,164 @@
+---
+title: Set up the monday.com MCP server
+description: Connect monday.com to C1 through monday.com's own hosted MCP server or the monday.com API, then register the server and govern its tools.
+og:title: Set up the monday.com MCP server
+og:description: Connect monday.com to C1 through monday.com's own hosted MCP server or the monday.com API, then register the server and govern its tools.
+sidebarTitle: monday.com
+---
+
+{/* Editor Refresh: 2026-07-24 */}
+
+<Note>
+**Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough.
+</Note>
+
+C1 can govern monday.com access two ways. Both let your AI clients read from and act on monday.com through governed MCP tools, but they come from different places and appear as two separate entries in your MCP server catalog — and the two catalog names are easy to mix up:
+
+- **Monday** — the native MCP option. C1 registers monday.com's own hosted MCP server (`mcp.monday.com`) as a downstream server C1 governs. Authentication is always per-user OAuth using dynamic client registration (DCR) — monday.com's hosted MCP server doesn't support a bearer token or API key, so there's no integration to create in monday.com first. Tool calls run with the connected user's full monday.com permissions.
+- **monday.com** — the API option. C1 hosts its own MCP server that translates monday.com's REST/GraphQL API into tools. Authentication is a single personal API token sent as a bearer token, so all tool calls reach monday.com as one shared identity.
+
+In your catalog, the bare name **Monday** always means the native hosted-MCP option, and **monday.com** always means the API option below — the two entries are distinct servers with different authentication models, not two names for the same thing.
+
+| | Monday | monday.com |
+| :--- | :--- | :--- |
+| **Who hosts the MCP server** | monday.com | C1 |
+| **Authentication** | Per-user OAuth with dynamic client registration (DCR) only — no bearer token or API key option | A single personal API token, sent as a bearer token |
+| **Access scoping** | The connected user's full monday.com permissions — not independently scoped, though an account admin can still limit hosted MCP to specific workspaces | Whatever workspace, board, column, and item access the token's creator has — not independently scoped |
+| **Tool surface** | monday.com's own tool set: search, boards, items and subitems, updates, docs, dashboards, workflows, and automations | Boards, items, columns, groups, workspaces, and users, mapped to monday.com API endpoints |
+| **Setup effort** | An account admin must first turn on hosted MCP access in monday.com, then register in C1 and authorize | Create a personal API token in monday.com, then register it in C1 |
+
+Use the native **Monday** option if you want monday.com's own broader, agentic tool set and per-user OAuth is acceptable for your tenant. Use **monday.com** if you need a shared service-account credential instead of per-user login.
+
+<Tabs>
+
+<Tab title="Monday MCP">
+
+C1 registers as a client of monday.com's own hosted MCP server ([monday MCP: Connect AI assistants to your account](https://monday.com/w/mcp)) rather than translating monday.com's REST API itself. Your users' AI clients still only ever see C1-governed MCP tools, but C1 proxies each tool call straight through to `mcp.monday.com` under the connected user's authorized session, then returns the result.
+
+## Before you begin
+
+- AI access management must be enabled for your tenant. See [Enable AI access management](/product/admin/enable-ai-access-management).
+- An account admin must turn on hosted MCP access for your monday.com account before anyone can connect. Under **Admin** > **Permissions** > **AI Connectors**, the **"Allow external AI agents to access your monday.com account data"** toggle and the **"Public Hosted MCP"** sub-permission must both be on. If access is scoped to specific workspaces instead of the whole account, the workspaces this integration needs must be included. See monday.com's [Managing AI Connectors and MCP Access](https://support.monday.com/hc/en-us/articles/35696101067154-Managing-AI-Connectors-and-MCP-Access) documentation.
+- Nothing to create in monday.com ahead of time. This option only supports per-user OAuth with dynamic client registration — there's no client ID, secret, bearer token, or API key mode, so there's no integration to register in monday.com first. Each user just needs a monday.com account with access to the workspace you want to govern.
+
+<Note>
+In your MCP server catalog, this option is listed as **Monday** — distinct from the **monday.com** entry, which connects through C1's own MCP server. If you don't see either, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant.
+</Note>
+
+## Set up per-user OAuth with dynamic client registration
+
+Per-user OAuth with dynamic client registration (DCR) is the only authentication method this option supports — there's no bearer token or API key fallback. Each user authorizes individually, and C1 registers itself with monday.com's authorization server automatically, so there's no app to create in monday.com first ([Platform MCP security](https://developer.monday.com/api-reference/docs/monday-mcp-security-overview)).
+
+<Steps>
+<Step>
+Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **Monday** from the catalog.
+</Step>
+<Step>
+When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose **OAuth2 — per-user passthrough** and enable **Use dynamic client registration**. There's no client ID or secret to enter.
+</Step>
+<Step>
+Save your changes. The first time a user calls a Monday tool from their AI client, they're redirected to monday.com to sign in (if they aren't already) and approve the connection, then returned to C1.
+</Step>
+</Steps>
+
+## What access is granted
+
+Unlike the monday.com API option, there are no separate capability toggles to configure. Every MCP tool call runs as the authorizing user and is bound to that user's own monday.com permissions — board and item visibility, private boards, and workspace access all apply exactly as they would if that person were using monday.com directly. There is no elevated or shared service account that bypasses these controls ([Platform MCP security](https://developer.monday.com/api-reference/docs/monday-mcp-security-overview)). Within those limits, this option's tools can search, read, and manage boards, items, and subitems (including column values, groups, and descriptions), post and reply to updates, and work with docs, dashboards, workflows, and automations across a user's monday.com workspace ([monday MCP available tools](https://support.monday.com/hc/en-us/articles/32364501317906-monday-MCP-available-tools)).
+
+## How Monday credentials are shared
+
+This option only supports per-user OAuth — there's no shared, service-account, or bearer-token mode. Every tool call runs under the calling user's own monday.com identity. C1 still attributes each call to the individual user in the [AI tool usage audit log](/product/admin/audit-ai-tool-usage).
+
+## Discover and govern tools
+
+After you register the server, C1 runs tool discovery against monday.com's MCP server. Discovered tools appear on the server's **Tools** tab.
+
+Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCP** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification).
+
+Before anyone can call a Monday tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up.
+
+<Note>
+Tool discovery runs even if authentication isn't complete yet, so seeing discovered tools doesn't confirm a user has authorized. You confirm access when an approved user successfully calls a Monday tool from their AI client.
+</Note>
+
+## Manage access to Monday
+
+Because this option uses per-user OAuth, there's no shared secret in C1 to rotate. An account admin manages access from monday.com itself: under **Admin** > **Permissions** > **AI Connectors**, uncheck **Public Hosted MCP** to cut off this integration along with every other AI tool using monday.com's hosted MCP server, or turn off the whole **"Allow external AI agents to access your monday.com account data"** toggle to block all external AI access outright. Admins can also narrow access to specific workspaces from the same panel instead of revoking entirely ([Managing AI Connectors and MCP Access](https://support.monday.com/hc/en-us/articles/35696101067154-Managing-AI-Connectors-and-MCP-Access)).
+
+</Tab>
+
+<Tab title="monday.com API">
+
+C1 hosts the monday.com MCP server, so your users' AI clients only ever see MCP tools — they never call monday.com directly. When an AI client calls one of these tools, C1 makes the matching request to monday.com's API using the credentials you configure here, then returns the result to the AI client.
+
+monday.com authenticates with a personal API token that C1 sends as a bearer token. A single token authenticates everyone, so all tool calls reach monday.com as one shared identity.
+
+## Before you begin
+
+- AI access management must be enabled for your tenant. See [Enable AI access management](/product/admin/enable-ai-access-management).
+- A monday.com account that can generate a personal API token, with access to the boards and workspaces you want this integration to have.
+
+<Note>
+In your MCP server catalog, this option is listed as **monday.com** — distinct from the **Monday** entry, which connects to monday.com's own hosted MCP server. If you don't see either, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant.
+</Note>
+
+## Create a monday.com personal API token
+
+Create a personal API token in monday.com for C1 to authenticate with. See monday.com's [Authentication](https://developer.monday.com/api-reference/docs/authentication) documentation.
+
+<Steps>
+<Step>
+Sign in to monday.com and select your avatar in the bottom-left corner.
+</Step>
+<Step>
+Select **Developers** to open the Developer Center, then select **My access tokens** in the left menu. Account admins can instead go to their avatar, then **Administration** > **Connections** > **Personal API token**.
+</Step>
+<Step>
+Select **Show** and copy the token.
+</Step>
+</Steps>
+
+A personal token inherits whatever workspace, board, column, and item permissions the creating user already has in monday.com — there's no separate scope to configure. For a shared production setup, create the token under a dedicated service-account user so activity is attributable to C1 rather than a person.
+
+## How monday.com credentials are shared
+
+Every user's tool calls use the one API token you provided, so monday.com sees a single shared identity. C1 still attributes each call to the individual user in the [AI tool usage audit log](/product/admin/audit-ai-tool-usage).
+
+For how shared and per-user credentials work across MCP servers, see [Configure authentication](/product/admin/mcp-servers#configure-authentication).
+
+## Register the monday.com MCP server in C1
+
+With your API token ready, register the server and provide it to C1.
+
+<Steps>
+<Step>
+Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **monday.com** from the catalog.
+</Step>
+<Step>
+When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose **Bearer token** and paste your personal API token.
+</Step>
+<Step>
+Save your changes. C1 starts a sync that discovers the tools the monday.com server exposes.
+</Step>
+</Steps>
+
+## Discover and govern tools
+
+After you register the server, C1 runs tool discovery against monday.com. Discovered tools appear on the server's **Tools** tab.
+
+Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCP** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification).
+
+Before anyone can call a monday.com tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up.
+
+<Note>
+Tool discovery runs even if your credentials are incorrect, so seeing discovered tools doesn't confirm that authentication is working. You confirm your monday.com credentials when an approved user successfully calls a monday.com tool from their AI client.
+</Note>
+
+## Manage your monday.com credentials
+
+- **Rotate the personal API token** by regenerating it from the same **My access tokens** (or **Administration** > **Connections**) page in monday.com, then updating it in C1. Regenerating immediately invalidates the previous token, so confirm the new one works in C1 before considering the old one retired.
+- **Adjust access** by changing the permissions of the user the token belongs to in monday.com, since the token mirrors whatever access that user already has.
+
+</Tab>
+
+</Tabs>