
Security News
Open VSX Unblocks Extension IDs Used in Malware Campaign
Open VSX has removed three extension IDs from its malicious-extension list as the legitimate publishers they impersonated move to claim the names for themselves.
@mindstone-engineering/mcp-server-workday
Advanced tools
Workday HCM MCP server for Model Context Protocol hosts — workers, profiles, organizations
Workday HCM MCP server for Model Context Protocol hosts. Query workers, profiles, and organizations in Workday through a standardised MCP interface using OAuth 2.0 authentication.
cd <path-to-repo>/connectors/workday
npm install
npm run build
npx -y @mindstone-engineering/mcp-server-workday
node dist/index.js
WORKDAY_HOST — Workday API host (e.g. wd5-impl-services1.workday.com)WORKDAY_TENANT — Workday tenant IDWORKDAY_CLIENT_ID — OAuth 2.0 client IDWORKDAY_CLIENT_SECRET — OAuth 2.0 client secretWORKDAY_REFRESH_TOKEN — OAuth 2.0 refresh tokenMCP_HOST_BRIDGE_STATE — optional path to a host bridge state file used for credential managementMINDSTONE_REBEL_BRIDGE_STATE — backwards-compatible alias for MCP_HOST_BRIDGE_STATE{
"mcpServers": {
"Workday": {
"command": "npx",
"args": ["-y", "@mindstone-engineering/mcp-server-workday"],
"env": {
"WORKDAY_HOST": "wd5-impl-services1.workday.com",
"WORKDAY_TENANT": "your-tenant",
"WORKDAY_CLIENT_ID": "your-client-id",
"WORKDAY_CLIENT_SECRET": "your-client-secret",
"WORKDAY_REFRESH_TOKEN": "your-refresh-token"
}
}
}
}
{
"mcpServers": {
"Workday": {
"command": "node",
"args": ["<path-to-repo>/connectors/workday/dist/index.js"],
"env": {
"WORKDAY_HOST": "wd5-impl-services1.workday.com",
"WORKDAY_TENANT": "your-tenant",
"WORKDAY_CLIENT_ID": "your-client-id",
"WORKDAY_CLIENT_SECRET": "your-client-secret",
"WORKDAY_REFRESH_TOKEN": "your-refresh-token"
}
}
}
}
configure_workday_credentials — Configure Workday OAuth API credentialslist_workday_workers — List or search workers (employees and contingent workers)get_workday_worker — Get a worker's full profile by IDlist_workday_organizations — List organizations (departments, supervisory orgs, cost centers)FSL-1.1-MIT — Functional Source License, Version 1.1, with MIT future licence. The software converts to MIT licence on 2030-04-08.
FAQs
Workday HCM MCP server for Model Context Protocol hosts — workers, profiles, organizations
We found that @mindstone-engineering/mcp-server-workday demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Open VSX has removed three extension IDs from its malicious-extension list as the legitimate publishers they impersonated move to claim the names for themselves.

Product
Socket’s PHP and Composer support is now in Beta for all customers, with PHP reachability analysis generally available.

Product
Socket is bringing experimental protection to Firefox, scanning 97,000+ extensions in Mozilla's official directory for malware and risky updates.