MCP100 IndexMCP Server

WatchlistRepository

haris-musa-excel-mcp-server

by github:haris-musa

Reviewed October 5, 2026

MCP Server

Watchlist tracking

Reviewed for relevance and future tracking value.

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

The recent security and tool rewrite warrants checking adoption of explicit path confinement and any follow-up to the resolved formula reports.

Reviewed Oct 5, 2026 · Documentation review; complete setup workflow not independently tested

Best fit

Local Excel workbook editing and analysis with bounded filesystem access.

What we know

Open-source Python MCP server for local Excel manipulation, including workbook, sheet, range, formatting, charts and PivotTables. Its current server supports stdio and self-hosted Streamable HTTP, optional read-only mode, explicit file allowlist directories, and opt-in VBA code writing.

Maintenance / activity evidence

PyPI 1.1.1 published 2026-09-28; v1.0 security rewrite documented.

Tracking evidence observed Oct 5, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: high.

Verification gaps / watch-outs

Installation and comprehensive security have not been independently audited.
Read/write accessible Excel files; optional VBA writing when explicitly enabled. Writes: Create/modify workbooks, worksheets, cells and file objects; Delete sheets/chart objects; Write VBA source (explicit opt-in, not execution).
Local process permissions; optional HTTP bearer token.
Sensitive access: Local Excel workbooks, Business spreadsheets and formulas, Potential VBA source

Workbook mutation and possible unintended access to local Excel files; confine folders and prefer read-only.
Opt-in VBA writing does not itself run macros.
Stored historical advisory CVE-2026-40576: disposition patched, observed 2026-08-11.

Security source · repository notice (attribution not established) ↗

Full authority, access and evidence limits are available in Review context and Access & risk.

Popularity

4,108 repository stars · 225.9k package downloads / 30 days

Stars observed Aug 14, 2026. Downloads observed Sep 8, 2026.

Exact implementation repository metric.

Exact package is documented; download evidence is unavailable.

Do not overwrite existing reviewed adoption metrics.

All limitations / Review context

Has 1.x retained case-normalized formula checks and clearly documented path confinement across transports?

Owner closed issue 149 after the 1.0 rewrite; current code normalizes formula names and supports resolved-path allowlists. The older 0.x issue is not treated as proof that current 1.1.1 remains blocked.

Workbook mutation and possible unintended access to local Excel files; confine folders and prefer read-only.
Opt-in VBA writing does not itself run macros.
Stored historical advisory CVE-2026-40576: disposition patched, observed 2026-08-11.
Read/write accessible Excel files; optional VBA writing when explicitly enabled.
Local process permissions; optional HTTP bearer token.
Workbook contents are processed locally; HTTP deployments expose contents to the host process and configured clients.
Reviewed write actions: Create/modify workbooks, worksheets, cells and file objects; Delete sheets/chart objects; Write VBA source (explicit opt-in, not execution)
Sensitive access: Local Excel workbooks, Business spreadsheets and formulas, Potential VBA source
Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
Without --allow-dir, current stdio still accepts absolute Excel paths; confinement is opt-in.
No third-party software executed; the rewrite and all write paths are not comprehensively certified.
Historic 0.x installations remain distinct from the reviewed current 1.1.1 evidence.
Default stdio can access any absolute Excel-file path if no --allow-dir is set.
Mutating tools alter workbook contents; read-only mode requires opt-in.
VBA code writing is disabled by default; code can execute later if a user enables macros.
Current major release differs from older 0.x tool naming and removes legacy SSE transport.
Historical profile warning (observed 2026-08-14T18:46:26.000Z): Current stdio behavior accepts arbitrary absolute file paths without workspace confinement, and the formula safety denylist remains case-sensitive, allowing lower/mixed-case unsafe functions to bypass validation. The corresponding security issue remains open.
Latest signed Radar review (2026-10-05T21:46:52.000Z): Owner closed issue 149 after the 1.0 rewrite; current code normalizes formula names and supports resolved-path allowlists. The older 0.x issue is not treated as proof that current 1.1.1 remains blocked.

Original activity observations

PyPI 1.1.1 published 2026-09-28; v1.0 security rewrite documented.

Technical identity

github:haris-musa/excel-mcp-server

Exact implementation source: https://github.com/haris-musa/excel-mcp-server ↗
Reviewed resource type: MCP Server
Repository identity: haris-musa/excel-mcp-server
Package identity: excel-mcp-server
Observed package version: 0.1.8

Evidence & Sources

Evidence basis: Recorded source evidence
Setup runtime verification: Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed Oct 5, 2026 · Latest source observation Oct 8, 2026

GitHub repository ↗
haris-musa/excel-mcp-server
Recorded repository material and project history.
Includes references whose attribution is not established.
Evidence source ↗
pypi.org/pypi/excel-mcp-server/json
Source material retained for this review.

Setup · Watchlist

Install & Agents

Publisher instructions.

Source evidence observed Oct 14, 2026.

Additional setup details required — see the specific gaps below.

Install / connect
MCP100 setup guide
Publisher-documented install or connect path; prerequisites and any extra host configuration remain required.
publisher install or stdio launch · Publisher instructions
uvx excel-mcp-server stdio --allow-dir /path/to/workbooks
reviewed install or registration · Claude Code only · MCP100 composed guide
claude mcp add excel --scope user -- uvx excel-mcp-server stdio --allow-dir /path/to/workbooks
Configure / authenticate
MCP100 setup guide
Use `uvx excel-mcp-server stdio --allow-dir /path/to/workbooks`; choose folder confinement for approved workbooks; the alternative HTTP mode is a separately hosted endpoint.
Previously reviewed HTTP endpoint authentication; separate from stdio: Streamable HTTP can bind beyond localhost only with explicit bearer authentication.
Check connection
Suggested check
List Excel tools and inspect a test workbook within the explicitly allowed directory.
Remove / uninstall / revoke
MCP100 setup guide
For Claude Code setup named excel use `claude mcp remove excel`; for Cursor/Desktop delete matching MCP configuration; stop any separately hosted HTTP mode. Do not delete user workbooks.
Client removal, software uninstall, persistent-data deletion and credential revocation are separate actions.
Remove client registration · Claude Code only · MCP100 composed guide
claude mcp remove excel

Official Documentation & Sources

FAQ

Based on reviewed evidence as of 2026-10-08. Watchlist tracking is not a recommendation or a security certification.

Which tasks are documented for this implementation?

The reviewed tasks include: Read and inspect workbooks and cell ranges; Create/edit workbooks, sheets, formulas, charts and PivotTables; Apply formatting and data validation; Import/export Excel workbooks in HTTP mode.

What setup and authentication are documented?

Recorded installation/entrypoint step: uvx excel-mcp-server stdio --allow-dir /path/to/workbooks. Recorded transport: stdio, streamable_http. Recorded environment-variable notes: EXCEL_FILES_PATH (optional); EXCEL_MCP_READ_ONLY (optional); EXCEL_MCP_ALLOW_VBA_WRITE (optional); EXCEL_MCP_AUTH_TOKEN (HTTP non-local host). No configuration values are supplied here. Prerequisites: Python 3.11+; uv/uvx; Excel files under chosen allow-dir. Client notes: Prefer --allow-dir and --read-only for review tasks. These are the documented setup details, not a claim that installation or client compatibility was independently tested. Authentication: Local stdio uses OS file permissions; remote HTTP can require bearer token via EXCEL_MCP_AUTH_TOKEN.

Can it modify data or perform write operations?

Documented write actions include: Create/modify workbooks, worksheets, cells and file objects; Delete sheets/chart objects; Write VBA source (explicit opt-in, not execution). Recorded permission boundary: Read/write accessible Excel files; optional VBA writing when explicitly enabled.

What data-handling boundary should I consider?

Workbook contents are processed locally; HTTP deployments expose contents to the host process and configured clients. Recorded sensitive-access context: Local Excel workbooks; Business spreadsheets and formulas; Potential VBA source.

What limitations and risks should I check before use?

Workbook mutation and possible unintended access to local Excel files; confine folders and prefer read-only. Default stdio can access any absolute Excel-file path if no --allow-dir is set. Mutating tools alter workbook contents; read-only mode requires opt-in. VBA code writing is disabled by default; code can execute later if a user enables macros. Current major release differs from older 0.x tool naming and removes legacy SSE transport. Opt-in VBA writing does not itself run macros. Stored historical advisory CVE-2026-40576: disposition patched, observed 2026-08-11. Without --allow-dir, current stdio still accepts absolute Excel paths; confinement is opt-in. No third-party software executed; the rewrite and all write paths are not comprehensively certified. Historic 0.x installations remain distinct from the reviewed current 1.1.1 evidence.

Do the older formula warnings establish that the current version is still affected?

A review dated October 5, 2026, covering the reviewed 1.1.1 code, records that issue 149 was closed after the 1.0 rewrite. It reports formula-name normalization and resolved-path allowlist support, so the older 0.x warning alone does not establish that this reviewed version has the same issue. This is a dated, version-specific assessment, not a safety finding for newer releases or every installation. Folder confinement still requires opting in with `--allow-dir`, and the rewrite and its write paths have not been comprehensively audited.

haris-musa-excel-mcp-server

Why we’re tracking it

Best fit

What we know

Maintenance / activity evidence

Verification gaps / watch-outs

Popularity

Original activity observations

Evidence & Sources

Install & Agents

Install / connect

Configure / authenticate

Check connection

Remove / uninstall / revoke

Official Documentation & Sources

What it does

Representative uses

Limitations

Access & risk

Access scope and cautions

FAQ