Back to Browse

Mm MCP Server

Developer ToolsLow Risk10.0MCP RegistryLocal
Free

Server data from the Official MCP Registry

Read, search and post in Mattermost as yourself or a bot.

About

Read, search and post in Mattermost as yourself or a bot.

Security Report

10.0
Low Risk10.0Low Risk

Valid MCP server (5 strong, 1 medium validity signals). No known CVEs in dependencies. Imported from the Official MCP Registry.

12 files analyzed · No issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

HTTP Network Access

Connects to external APIs or services over the internet.

env_vars

Check that this permission is expected for this type of plugin.

What You'll Need

Set these up before or after installing:

Offer the tools that post and change things. Your client's own approval of each call decides, and mm-mcp checks what each change others see states before it acts.Optional

Environment variable: MM_MCP_ALLOW_WRITES

A PEM file of certificate authorities to trust beside your system's, for a Mattermost whose certificate your organisation signed itself. Leave it empty otherwise.Optional

Environment variable: MM_MCP_CA_FILE

Where save_file writes attachments. Leave it empty for your Downloads directory.Optional

Environment variable: MM_MCP_DOWNLOAD_DIR

Your client's own approval of each call decides whether a post or another change others see goes ahead, and mm-mcp checks what each states. Turn this on to have mm-mcp ask you too, through a question your client shows: a convenience where it shows it, not a safeguard, since some clients answer it themselves.Optional

Environment variable: MM_MCP_ELICITATION_OPT_IN

Not with mm-mcp asks as well: marks each tool that changes what others see so that Claude Code asks a person on every call, whatever its permission mode or rules allow. An agent cannot post on its own while it is on.Optional

Environment variable: MM_MCP_FORCE_HUMAN_IN_THE_LOOP_IN_CLAUDE_CODE

Mark every post and edit the model writes with Mattermost's own marker for text written with AI.Optional

Environment variable: MM_MCP_MARK_AI_GENERATED

Where your app shows mm-mcp's views, a post the model proposes as your draft can be posted from the view with Post. Off, the draft waits in Mattermost for you to send.Optional

Environment variable: MM_MCP_POST_FROM_VIEWS

The most one message carrying an attached file as an MCP resource holds, a binary file counted as its base64. MCP sends a resource whole, and a client drops a message past its own limit, 10 MB for clients built on the TypeScript SDK. A larger one is refused, and read_file or save_file reads it instead. 0 is no limit.Optional

Environment variable: MM_MCP_RESOURCE_MAX_MB

A personal access token or a bot token. Where those are switched off, leave it empty after logging in once with mm-mcp login --url <address> in a terminal, which keeps your session in the system's credential store.Required

Environment variable: MM_TOKEN

The address you open Mattermost at, such as https://chat.example.com.Optional

Environment variable: MM_URL

Documentation

View on GitHub

From the project's GitHub README.

mm-mcp

CI codecov

An MCP server for Mattermost. It lets an AI agent read and search your Mattermost and, when you allow it, post and reply, as you or as a bot.

mm-mcp is an independent project. It is not affiliated with, endorsed by or supported by Mattermost, Inc.; Mattermost is a trademark of Mattermost, Inc.

The tools read channels, threads, unread posts, mentions and files, search posts, files, people and channels, and, once you allow writes, post, reply, edit, react, pin, propose posts, join, leave and create channels, and set your status. A link pasted from Mattermost works wherever a tool that reads wants an id, every answer links each post, channel and team it names and gives the address a write others see takes, and attached files, their previews, profile pictures and custom emoji are MCP resources your client can read too. The tools page lists every tool. In a client that renders MCP Apps views, a thread, what is unread for you, or a post your agent made or proposes can be shown in the chat as Mattermost lays it out; more views are planned, and the issues are the plan.

A reply your agent drafted, waiting for you to post, change or discard, and a thread you asked to see, as an AI app that shows views shows them (try them live):

Why it works the way it does

  • Read-only unless you say otherwise. The tools that post or change anything are not offered until MM_MCP_ALLOW_WRITES is true. Then your MCP client's own approval of each call decides, and mm-mcp checks what each change others see states before it acts: how many people a post or an edit reaches and a post notifies, the text an edit replaces, what a deletion takes away, and where it goes, by address. By default, every post and edit is marked as written with AI. MM_MCP_ELICITATION_OPT_IN=true has mm-mcp ask you as well, in a client that shows its question.
  • Your token, a bot's, or your own login. A personal access token, a bot token, or your own login through mm-mcp login, single sign-on included, kept in your system's credential store, for servers where personal access tokens are switched off.
  • Mattermost's own client. Requests and answers use the server's own Go client and types, not a hand-written description of the API.
  • Every supported release, tested. Every tool runs against a real Mattermost Team Edition, on the Extended Support Release and the newest release on every change, and on every release between them each week.
  • stdio and Streamable HTTP. A client starts it as a local process, or it serves Streamable HTTP on a loopback address.

Quick start

Install mm-mcp with brew install vriesdemichael/tap/mm-mcp, winget install vriesdemichael.mm-mcp or scoop install vriesdemichael/mm-mcp (after scoop bucket add vriesdemichael https://github.com/vriesdemichael/scoop), or download the binary for your machine from the latest release. Then get a personal access token in Mattermost under Profile → Security → Personal Access Tokens, and keep it in your system's credential store, out of your client's configuration, with mm-mcp login --with paste --url https://chat.example.com. Where those tokens are switched off, log in once with mm-mcp login --url https://chat.example.com instead.

{
  "mcpServers": {
    "mattermost": {
      "command": "mm-mcp",
      "args": ["serve"],
      "env": {
        "MM_URL": "https://chat.example.com"
      }
    }
  }
}

Or, for Claude Code, the plugin, which asks for the address and a token you can leave empty after mm-mcp login:

/plugin marketplace add vriesdemichael/mm-mcp
/plugin install mm-mcp@mm-mcp

or the server alone:

claude mcp add mattermost --scope user --env MM_URL=https://chat.example.com -- mm-mcp serve

Claude Desktop users can open the .mcpb bundle for their machine from the latest release instead.

When it does not work, mm-mcp doctor --url https://chat.example.com checks the configuration, the stored login, the way to the server and the credential, and says what to fix; from inside your MCP client, the diagnose tool does the same with the client's own configuration.

The documentation has every setting, the tools, and the supported Mattermost releases.

Contributing

See CONTRIBUTING.md. The decisions behind how this project is built are in docs/site/adr.

License

Apache-2.0

Reviews

No reviews yet

Be the first to review this server!