
Research
/Security News
PolinRider Spreads Through Compromised GitHub Accounts and Packagist
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.
@mindstone/mcp-server-workday
Advanced tools
Workday HCM MCP server for Model Context Protocol hosts — workers, profiles, organizations
Workday HCM MCP server for Model Context Protocol hosts. Query workers, profiles, and organizations in Workday through a standardised MCP interface using OAuth 2.0 authentication.
cd <path-to-repo>/connectors/workday
npm install
npm run build
npx -y @mindstone/mcp-server-workday
node dist/index.js
WORKDAY_HOST — Workday API host (e.g. wd5-impl-services1.workday.com)WORKDAY_TENANT — Workday tenant IDWORKDAY_CLIENT_ID — OAuth 2.0 client IDWORKDAY_CLIENT_SECRET — OAuth 2.0 client secretWORKDAY_REFRESH_TOKEN — OAuth 2.0 refresh tokenMCP_HOST_BRIDGE_STATE — optional path to a host bridge state file used for credential managementMINDSTONE_REBEL_BRIDGE_STATE — backwards-compatible alias for MCP_HOST_BRIDGE_STATE{
"mcpServers": {
"Workday": {
"command": "npx",
"args": ["-y", "@mindstone/mcp-server-workday"],
"env": {
"WORKDAY_HOST": "wd5-impl-services1.workday.com",
"WORKDAY_TENANT": "your-tenant",
"WORKDAY_CLIENT_ID": "your-client-id",
"WORKDAY_CLIENT_SECRET": "your-client-secret",
"WORKDAY_REFRESH_TOKEN": "your-refresh-token"
}
}
}
}
{
"mcpServers": {
"Workday": {
"command": "node",
"args": ["<path-to-repo>/connectors/workday/dist/index.js"],
"env": {
"WORKDAY_HOST": "wd5-impl-services1.workday.com",
"WORKDAY_TENANT": "your-tenant",
"WORKDAY_CLIENT_ID": "your-client-id",
"WORKDAY_CLIENT_SECRET": "your-client-secret",
"WORKDAY_REFRESH_TOKEN": "your-refresh-token"
}
}
}
}
configure_workday_credentials — Configure Workday OAuth API credentialslist_workday_workers — List or search workers (employees and contingent workers)get_workday_worker — Get a worker's full profile by IDlist_workday_organizations — List organizations (departments, supervisory orgs, cost centers)FSL-1.1-MIT — Functional Source License, Version 1.1, with MIT future licence. The software converts to MIT licence on 2030-04-08.
FAQs
Workday HCM MCP server for Model Context Protocol hosts — workers, profiles, organizations
The npm package @mindstone/mcp-server-workday receives a total of 20 weekly downloads. As such, @mindstone/mcp-server-workday popularity was classified as not popular.
We found that @mindstone/mcp-server-workday demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.

Company News
Allow myself to introduce... myself.