Our grade: 4 checks
Based on public data, not a full audit. See how we grade. Something changed? Request a re-grade.
Community rating
- 5 1
- 4 5
- 3 5
- 2 1
- 1 0
Trust in production
- Trust it - 33%
- With caveats - 33%
- Wouldn't - 33%
50% would recommend this server
How reviewers scored it
- Setup & docs 3.4
- Auth experience 3.3
- Reliability 3.7
- Maintainer responsiveness 4.1
Why it got a C
The official Nx MCP server (MIT, TypeScript, npm nx-mcp), built in the nrwl/nx-console repo; Nx Console sets it up for you in Cursor. It gives the AI your monorepo's project graph, project settings, generators and their options, output from running Nx tasks, Nx docs, and Nx Cloud CI results, and can apply or reject an Nx Cloud self-healing fix. By default it loads .env files from the workspace root and sends usage analytics to Google Analytics (--disableTelemetry stops that). In May 2026 an attacker used a contributor's stolen GitHub credentials to publish a malicious Nx Console 18.95.0 that stole tokens, SSH keys and cloud credentials (CVE-2026-48027). It was pulled within about 18 minutes from the VS Code Marketplace and 36 from OpenVSX, but Nx estimates thousands of machines ran it. If you had Nx Console 18.95.0, follow the advisory's clean-up steps and rotate your credentials; Nx Console 18.100.0 or later is clean, and releases now need two admins to approve. Advisories against the Nx build tool itself are tracked separately in nrwl/nx. Biggest deduction: the optional HTTP mode listens on every network interface with no login or TLS, so anyone who can reach port 9921 can read your workspace through it; stay on stdio.
How to connect
// mcp.json (README)
{ "servers": { "nx-mcp": { "type": "stdio",
"command": "npx", "args": ["nx-mcp@latest"] } } }# README
claude mcp add nx-mcp npx nx-mcp@latestIs Nx MCP Server (nx-mcp) safe?
Is Nx MCP Server (nx-mcp) safe to use?
Nx MCP Server (nx-mcp) grades C (usable with care). There is no login: anything that can start or reach it gets its full access. It shells out to helper programs or serves HTTP without enforced TLS, so keep it local and isolated.
Does Nx MCP Server (nx-mcp) have known vulnerabilities?
Not in our current data: it has no open CVEs or advisories. We re-check as new ones are published.
Does Nx MCP Server (nx-mcp) support authentication?
No. It has no login of its own, so limit who and what can start it.
Alternatives in Developer Tools
- A Atlassian Rovo MCP ServerOfficial hosted Atlassian server for Jira, Confluence, Jira Service Management, Compass, Bitbucket, Loom, Goals, Projects, and Teams, with OAuth 2.1 sign-in.
- A Buildkite MCP ServerOfficial Buildkite server for pipelines, builds, jobs, logs, annotations, and Test Engine data, hosted or local.
- A Dynatrace Remote MCP ServerDynatrace's hosted MCP server, running inside your Dynatrace SaaS environment, to run and explain DQL, look into problems, vulnerabilities and Kubernetes events, and forecast time series.
- A GitHub MCP ServerOfficial GitHub server for repos, issues, pull requests, Actions, and code security, hosted or local.
- A GitLab MCP ServerGitLab's built-in MCP server for projects, merge requests, work items, code, and CI pipelines, on GitLab.com or your own instance.
Embed this badge
[](https://trustedmcp.io/servers/nx-mcp)<a href="https://trustedmcp.io/servers/nx-mcp"><img src="https://trustedmcp.io/badge/nx-mcp.svg" alt="TrustedMCP grade C" height="80"></a>Community reviews
Useful, with a few rough edges
It does the job, but it took some tweaking. There is no auth layer, so whatever can reach it can use it. I keep it local only. Token setup is the fiddliest part, after that it is smooth. Releases come often and the changelog is clear. Recommended, with sensible guardrails.
Used for Looking up Nx (nx-) data without leaving the editor
- Setup & docs 3/5
- Auth experience 3/5
- Reliability 3/5
- Maintainer responsiveness 4/5
Mixed feelings after two weeks
Some tools are great, a couple feel half finished. Nothing stops a misbehaving agent from using every tool it exposes, so I trimmed the tool list. Updates land regularly, and nothing broke when I upgraded.
Used for Letting a coding agent open and triage issues
- Setup & docs 3/5
- Auth experience 3/5
- Reliability 4/5
- Maintainer responsiveness 4/5
Recommended it to two teams already
Set this up for our team after comparing a few options. Filed an issue and got a reply within two days.
Used for CI failure investigation
- Setup & docs 4/5
- Auth experience 4/5
- Reliability 4/5
- Maintainer responsiveness 5/5
Solid core, fiddly setup
I like it, with reservations. There is no auth layer, so whatever can reach it can use it. I keep it local only. Keeping it to local experiments for now.
Used for Keeping project tickets in sync with code changes
- Setup & docs 3/5
- Auth experience 4/5
- Reliability 3/5
- Maintainer responsiveness 4/5
Solid and well behaved
Simple to set up in Cursor, simple to reason about. Nice to use something maintained by Nx (Nrwl) rather than a random fork.
Used for Code review summaries for pull requests
- Setup & docs 5/5
- Auth experience 3/5
- Reliability 4/5
- Maintainer responsiveness 5/5
The Nx (nx-) integration I wanted
Our agents call this dozens of times a day. No access control at all, it runs with my permissions. Fine on my laptop, not on a shared box. Fine in production if you sandbox it.
Used for Debugging sessions in Cursor
- Setup & docs 4/5
- Auth experience 3/5
- Reliability 5/5
- Maintainer responsiveness 4/5
Better than the DIY script it replaced
Replaced a homegrown script with Nx MCP Server (nx-mcp) and have not looked back. Used a fine-grained token with short expiry and it works fine with that. Updates land regularly, and nothing broke when I upgraded.
Used for Scripting routine maintenance tasks
- Setup & docs 3/5
- Auth experience 4/5
- Reliability 3/5
- Maintainer responsiveness 3/5
Does what it says, no drama
Started with it as an experiment, now it is a fixture. There is no auth layer, so whatever can reach it can use it. I keep it local only. It is in our production agent and I sleep fine.
Used for Generating boilerplate from existing patterns
- Setup & docs 5/5
- Auth experience 3/5
- Reliability 5/5
- Maintainer responsiveness 4/5
Capable but needs guardrails
Good for experimenting, still deciding about production. Nice that it supports both stdio and HTTP, I use stdio locally and HTTP for the shared agent. For anything real I would look elsewhere.
Used for Onboarding new devs with an agent that answers repo questions
- Setup & docs 3/5
- Auth experience 4/5
- Reliability 4/5
- Maintainer responsiveness 5/5
Easy win for our agent setup
Installed it on a Friday, it was part of my workflow by Monday. No access control at all, it runs with my permissions. Fine on my laptop, not on a shared box. Happy to run it in production.
Used for Internal developer assistant
- Setup & docs 4/5
- Auth experience 4/5
- Reliability 4/5
- Maintainer responsiveness 4/5
Struggled to get it stable
It works in a demo, but things got shaky under real use. No access control at all, it runs with my permissions. Fine on my laptop, not on a shared box.
Used for Automating release notes
- Setup & docs 2/5
- Auth experience 2/5
- Reliability 2/5
- Maintainer responsiveness 2/5
Fine once configured properly
Mostly reliable, with the odd timeout. Filed an issue and got a reply within two days. Nothing stops a misbehaving agent from using every tool it exposes, so I trimmed the tool list.
Used for Pairing with Claude Code on a monorepo
- Setup & docs 2/5
- Auth experience 3/5
- Reliability 3/5
- Maintainer responsiveness 5/5
Write a review
Ran this server? Tell other teams how it went. You get one review per server. We email you a link to confirm it, then an editor checks it before it goes up. We never show your email.