Field-by-field comparison

Compare the evidence before choosing an MCP.

Each signal stays separate, missing facts remain visible, and the column order follows your selection.

MCPs in this comparison

Excel MCP ServerCodebase Memory

Uncheck an MCP to remove it. Comparing two or three keeps each signal in its own row.

Comparable alternatives

Azure MCP ServerMCP100 SelectedChrome DevTools MCPMCP100 SelectedContext7 MCPMCP100 SelectedFirecrawl MCPMCP100 SelectedGrafana Cloud MCPMCP100 SelectedGoogle MCP Toolbox for DatabasesMCP100 Selected

Shown only when capability or industry context overlaps.

Side-by-side MCP evidence comparison
Evidence field	Excel MCP ServerMCP100 Selected	Codebase MemoryMCP100 Selected
Task fit
Best for	Reading, creating, formatting, charting, and updating XLSX workbooks and worksheets, including formulas and pivot tables	Repository indexing, symbol search, call-path tracing, impact analysis, and architecture queries across many languages
Not ideal for	Workbooks that depend on full desktop Excel behavior, macros, or manual visual review	Tiny repositories, one-off text searches, or semantic questions unsupported by the indexed parsers
Avoid when	You cannot restrict file access or are using a version affected by CVE-2026-40576	The source tree cannot be indexed locally or persistent cache files are prohibited
Provenance
Provenance details	Community implementation Haris Musa · Publisher source ↗	Community implementation io.github.DeusData · Publisher source ↗
Maintenance
Maintenance details	Repo: Apr 12, 2026 Package: Apr 12, 2026	Repo: Aug 14, 2026 Package: Aug 14, 2026
Popularity evidence
GitHub stars	4,108 GitHub stars · checked 2026-08-14T18:46:26.000Z	38,935 GitHub stars · checked 2026-08-14T18:46:26.000Z
30-day package downloads	No reliable download data	28,015 30-day package downloads · checked 2026-08-14T18:46:26.000Z
External adoption evidence	github: repository stars: 4,108Exact attributable signal.github: repository stars · Admission snapshot · checked 2026-08-14T18:46:26.000ZEvidence source ↗	github: repository stars: 38,935Exact attributable signal.github: repository stars · Admission snapshot · checked 2026-08-14T18:46:26.000ZEvidence source ↗
Client coverage
Client coverage details	Claude Code✓ Local stdio Claude Desktop✓ Local stdio Codex✓ Local stdio VS Code✓ Local stdio Cursor✓ Local stdio OpenCode✓ Local stdio	Claude Code✓ Local stdio Claude Desktop✓ Local stdio Codex✓ Local stdio VS Code✓ Local stdio Cursor✓ Local stdio OpenCode✓ Local stdio
Client coverage note	Local stdio runs on your computer. Streamable HTTP connects to a remotely hosted MCP server.
Access and data
Authentication	Local stdio has no separate service authentication. Remote MCP authentication is not documented, so remote listeners must remain network-restricted.	No authentication or API key is documented for local stdio. CBM_ALLOWED_ROOT is an optional filesystem containment control; no containment is imposed when it is unset.
Cost	The MIT-licensed local server lists no usage fee; normal hosting, client, model, and network costs may apply.	The MIT-licensed native software lists no service fee. Local storage and package-manager costs are separate.
Permissions	The server can read, create, modify, format, chart, and delete workbook content. Remote modes confine relative paths to EXCEL_FILES_PATH in the patched release.	Indexes repositories, queries code and graphs, performs architecture and impact analysis, manages ADRs and watchers, deletes projects, and writes agent configuration, instruction, Skill, and hook files.
Data handling	Workbook paths and spreadsheet content are processed by the server and returned to the connected client as required by tool calls; publisher telemetry and retention are not documented.	The publisher says processing is local and code does not leave the machine. Indexes, embeddings, memories, SQLite data, and logs persist under the local CBM cache directory.
Limitations
Tradeoffs	It provides deep spreadsheet manipulation without desktop Excel, but write tools can overwrite data and remote transports add network and filesystem exposure.	Persistent indexing can reduce repeated reads, but consumes local storage and graph results can become stale until the repository is re-indexed.
Risk context	Versions through 0.1.7 have a critical path-traversal vulnerability. Use 0.1.8 or later, prefer stdio, restrict workbook paths, avoid public remote listeners, and keep recoverable backups.	Indexing can capture sensitive files, while persistent graph data and installer/configuration writes expand local exposure. Set CBM_ALLOWED_ROOT, protect the cache, and use explicit project paths.
Evidence date
Editorial review	2026-08-13	2026-08-11
Candidate evidence	2026-08-14T18:46:26.000Z	2026-08-14T18:46:26.000Z

Popularity, maintenance, fit, permissions, and client support are independent evidence fields.

Read the evidence method →