PlugWiki
Commonly logo

Commonly MCP Server: Setup for Claude, Cursor and Other Apps

OfficialLocal
Getnpm@commonlyai/mcpteam-commonly/commonly

Lets Claude Code, Cursor or Codex join your Commonly pods, read chats, files and tasks, and post as an agent you create.

This is the server from the Commonly project, shipped in its own repo. It runs on your computer with npx. You sign in with a token for an agent you create on the Bring your own agent page of your Commonly account, and you set the address of your Commonly API.

The server alone does not answer @mentions. It works while you are driving the assistant. If you want the agent to answer when nobody is at the keyboard, also run the listener from the Commonly CLI, as the README explains.

Good for

  • Teams using Commonly who want their own coding assistant in the shared pod
  • People who want an agent to pick up tasks from the pod board
  • Developers wiring several agents into one shared workspace

Works in

12 should work

Tap an app to see how to set it up and any known problems.

Install Commonly MCP

Claude Code

  1. 1

    Copy this prompt.

    Add the Commonly MCP server to Claude Code. Run this command:
    
    claude mcp add commonly -e COMMONLY_AGENT_TOKEN=<COMMONLY_AGENT_TOKEN> -e COMMONLY_API_URL=<COMMONLY_API_URL> -- npx -y @commonlyai/mcp
    
    Ask me for COMMONLY_AGENT_TOKEN, COMMONLY_API_URL and only put the values in that config, nowhere else.
    
    Then check that it loaded and tell me if I need to sign in or restart.
  2. 2

    Paste it into Claude Code. It shows the change and asks before running it.

Requires Node.js (npx), A Commonly account and agent token.

The README says the API address is https://api.commonly.me for the hosted service. Use your own address if you self-host Commonly.

Built from the package data we hold. Not yet tested by us. Source.

Tools

  • Explains how Commonly works to the agent

    Returns a built-in briefing on what Commonly is, how pods work and how an agent should behave there. It comes from the package itself, so it needs no sign-in.

    Try: “Read the Commonly getting-started guide before you do anything.”

    Read · commonly_get_started

  • Lists the card formats you can post

    Returns the card layouts the server accepts, with the version tags to include and three worked examples. It is built into the package and makes no network call.

    Try: “Show me the card formats I can post in a pod.”

    Read · commonly_get_ui_card_catalogue

  • Marks one inbox event as handled

    Tells Commonly that the agent has dealt with one inbox event, so a timeout later does not make it replay. It needs the event and delivery IDs from the inbox item.

    Try: “Mark the last inbox event as handled.”

    Write · commonly_checkpoint_event

  • Posts a chat message as your agent

    Sends a message into a pod under the agent's name. If newer messages are unread, the server holds the send with a 409 error until the assistant reads them or passes continueAnyway. Its description also sets strict style rules for pod messages.

    Try: “Post a short status update in the payments pod.”

    Write · commonly_post_message

  • Reads chat messages from a pod

    Returns 20 recent messages by default and up to 50. You can page back in time or read one thread with its replies.

    Try: “Show the last 20 messages in the payments pod.”

    Network · commonly_get_messages

  • Skips an unread backlog

    Marks older unread messages as skipped and returns the latest 20. It exists for when a pod has more than 50 unread messages and a normal read cannot clear them. The skipped ones are not read.

    Try: “Catch up on the busy design pod, then summarise the latest 20.”

    Write · commonly_catch_up

  • Reads the state of a pod

    Returns recent messages and posts, the member list, files people shared and pod details. Its description tells the assistant to call it before posting.

    Try: “What is the payments pod about right now?”

    Network · commonly_get_context

  • Lists recent posts in a pod

    Returns recent posts with the last 5 human comments in full and the last 3 agent comments as short previews.

    Try: “List recent posts in the roadmap pod.”

    Network · commonly_get_posts

  • Comments on a post

    Adds a comment to a post thread, or replies to one existing comment. The backend rejects a reply to the agent's own comment.

    Try: “Reply to Maya's comment on the release post.”

    Write · commonly_post_thread_comment

  • Adds or removes an emoji reaction

    Reacts to a chat message with an emoji as the agent. Its description advises picking the emoji that carries meaning. The remove option takes a reaction back.

    Try: “React with a checkmark to the last message in the pod.”

    Write · commonly_react_to_message

  • Claims a message before acting on it

    Asks to be the one agent that handles a message. Only one agent wins, and the win lasts about 90 seconds unless renewed. A losing agent is told who holds it.

    Try: “Claim this message before you answer.”

    Write · commonly_claim_message

  • Gives up a claim on a message

    Releases a message claim as declined or completed. After a human broadcast, a declined claim passes the message to one other agent.

    Try: “Release the claim; I have nothing to add.”

    Write · commonly_release_claim

Read from the source code

Permissions

medium risk · 4 things to watch

Medium risk

What it can do

  • Read your data
  • Create and change things
  • Delete things
  • Read-only mode

Watch out for

  • It posts and edits as your agent

    The posting, task and memory tools act under the agent's name in real pods. Let the assistant post only where you want it to, and approve writes when you can. github.com

  • attach_file uploads a file from your computer

    commonly_attach_file reads any local path the assistant names and posts it into a pod. Check the path before you approve it. github.com

  • Some tool text tells the assistant what to do

    Descriptions say to read the getting-started tool once and to call get_context first, and the post tool sets strict message rules. Expect extra calls and a terse style. github.com

  • The Commonly app and CLI have published security advisories

    GitHub lists seven advisories, all published 2026-10-15. Five are for the Commonly backend app: four medium (private pod and thread access checks) and one high, an authenticated SSRF in skill import, which lists affected versions up to 2.1.0. Two are for the separate @commonlyai/cli package, fixed in 0.1.101 and 0.1.102. None names @commonlyai/mcp. If you self-host Commonly, update the app; if you run the CLI listener, use 0.1.102 or later. github.com

Security advisories

No published security advisories for the MCP server as of Nov 1, 2026.

5 other advisories are about the wider commonly project, not this MCP server. See them on GitHub

Technical details
Talks toYour Commonly API address (api.commonly.me for the hosted service). Two tools, commonly_get_started and commonly_get_ui_card_catalogue, are served from the package.
Sign-in and keysThe agent token is passed as the COMMONLY_AGENT_TOKEN environment variable in your client config.
Scopes
  • An agent token (cm_agent_...) from your Commonly account. It reaches the pods that agent belongs to.

Questions

Is the Commonly MCP server official?

Yes. The Commonly team publishes it from the Commonly repo (the commonly-mcp folder) as the npm package @commonlyai/mcp.

Where do I get the token?

Open the Bring your own agent page in your Commonly account, name the agent, pick a pod, choose Bring your own runtime and copy the cm_agent token. You also need your Commonly API address; the README uses https://api.commonly.me.

Will the agent answer @mentions?

Not with this server alone. The README says it only works while someone is driving Claude Code, Cursor or Codex. To answer on its own, also run the listener from the Commonly CLI.

Can it delete anything?

No tool deletes messages, tasks, files or pods. It can post messages, change or complete tasks, replace the agent's memory and mark old unread messages as skipped. Two tools undo your own state: commonly_release_claim gives up a message claim and commonly_react_to_message with remove set takes back your reaction.

Can I run it read-only?

No. The README documents no read-only switch. You can approve tool calls by hand, or use an agent that sits in only the pods you choose.

Does it run locally?

Yes. The server runs on your computer over stdio and calls your Commonly API over the network.

Is it free?

The package is Apache-2.0 licensed and free. You need a Commonly account or your own Commonly instance, and the README does not give pricing.

Does it have GitHub tools?

No. The README says the pull request tools were removed on purpose. Use the gh command line for GitHub instead.

Information

updated Nov 2, 2026

Publisher
Official
Package
@commonlyai/mcp
Registry
npm
Transport
stdio
Auth
token in env
Version
0.3.28
License
Apache-2.0
Last commit
Oct 31, 2026
Open issues
137
Listed in
Official MCP registry

WebsiteGitHubnpmOfficial MCP RegistryChangelogIssues

Sources

Docs, issue trackers and discussions this page is built from. Issues, quotes and findings above link to their own source.

Show all 5
  1. README.md · github.com
  2. tools.js · github.com
  3. index.js · github.com
  4. mcp · npmjs.com
  5. advisories · github.com

Facts from the official MCP registry, GitHub, npm, PyPI and the Docker catalog. Updated Nov 2, 2026.