Skip to main content
Glama
arose26

xlsx-audit-mcp

by arose26

xlsx-audit-mcp

An MCP server that audits Excel workbooks. Other Excel MCP servers read and write your data — this one reviews your model:

  • "What feeds the Total cell on the Summary sheet?" — precedent tracing

  • "If I change this assumption, what breaks?" — dependent tracing, including cells that consume it through ranges like SUM(A1:A40)

  • "Audit this workbook" — circular references with example chains, volatile functions (INDIRECT, OFFSET, NOW, RAND...), hardcoded constants buried inside formulas, external workbook links, merged cells, extra-long formulas

Spreadsheet mistakes are famously expensive. This is the "trace precedents" discipline auditors apply by hand, exposed to an LLM for a whole workbook at once. Local files only; nothing leaves your machine.

Quick start

Claude Code

claude mcp add xlsx-audit -- npx -y xlsx-audit-mcp

Claude Desktop — add to claude_desktop_config.json:

{
  "mcpServers": {
    "xlsx-audit": {
      "command": "npx",
      "args": ["-y", "xlsx-audit-mcp"]
    }
  }
}

Then: "Audit C:\models\budget-2026.xlsx and tell me what looks fragile."

Related MCP server: Excel MCP Server

Tools

Tool

What it does

workbook_overview

Sheets, dimensions, formula counts, defined names, external links

list_formulas

Formulas with addresses and cached values, filterable (INDIRECT, VLOOKUP, ...)

trace_cell

One cell's formula, value, precedents, and dependents (direct + via ranges)

audit_workbook

Ranked risk report across the whole model

How it works

  • Reference tokenizer that understands real formulas: string literals are stripped first (the "A1" in INDIRECT("A1") is not a reference), function names can't collide (the G10 in LOG10(...) is not a cell), $ absolutes, quoted sheet names ('My Data'!A1), and ranges are handled.

  • Shared formulas are materialized. Excel stores filled formulas once with an offset scheme; the loader translates them per-cell (relative refs shifted, absolutes preserved), so dependency queries see what each cell actually computes.

  • Ranges are never expanded for storage — dependents queries use range-containment tests, and cycle detection caps range fan-out (a SUM(A:A) can't explode the graph; capped ranges are reported, not silently dropped).

  • No formula evaluation. Cached values from the file are shown instead — no spreadsheet engine dependency.

Known limitations: R1C1 notation and structured table references ([@Column]) are counted but not resolved into the graph.

Development

npm install
npm test                 # offline tests — synthetic workbooks built in-suite
npm run build            # tsc → dist/
node scripts/smoke.mjs   # end-to-end: generates a workbook, drives the server over stdio

Architecture: src/xlsx.ts (zip + XML → workbook model) and src/formulas.ts (tokenizer, graph, smells) are pure logic; src/index.ts is the MCP wiring.

License

MIT

Available Tools

4 tools
audit_workbookAudit the workbookA

Risk report across the whole model: circular references (with example chains), volatile functions (INDIRECT/OFFSET/NOW/RAND...), hardcoded constants inside formulas, external workbook links, merged cells, very long formulas.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYesPath to an .xlsx workbook

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full transparency burden. It lists concrete behavioral aspects (e.g., circular references with example chains, volatile functions, hardcoded constants) which go beyond the tool name. However, it does not state output format or explicitly confirm read-only behavior, though 'audit' implies non-destructive. Overall, it adds substantial transparency beyond mere existence.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, information-dense sentence with a colon and a clear list. It front-loads the core purpose ('Risk report across the whole model') and then enumerates specifics without any fluff or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the main scope comprehensively: it lists six distinct audit categories, which is substantial for a reporting tool. There is no output schema, so the return value is not fully specified, but 'Risk report' implies a textual summary. For moderate complexity with a single parameter, this is sufficiently complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% for the single 'path' parameter, which already documents 'Path to an .xlsx workbook'. The tool description does not add further meaning to the parameter itself, so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool produces a risk report across the whole model, listing specific checks (circular references, volatile functions, etc.). This verb+resource+scope distinguishes it from siblings like workbook_overview or list_formulas by focusing on audit risks rather than general overview or formula listing.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage: use this tool to get a comprehensive model-wide risk report. It does not explicitly exclude alternatives or mention when not to use it, but the specific scope ('across the whole model') and distinct checks provide clear context that differentiates it from sibling tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_formulasList formulasA

Formulas with addresses and cached values. Filter with contains (e.g. 'INDIRECT', 'VLOOKUP') and/or sheet.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYesPath to an .xlsx workbook
limitNoMax results
sheetNoOnly this sheet
containsNoCase-insensitive substring of the formula text

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must carry the burden of behavioral disclosure. It adds useful context like 'cached values' (indicating it reads cached results rather than recalculating) and the filtering behavior, but it does not explicitly state whether the operation is read-only, mention potential side effects, or discuss rate limits or performance considerations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two concise sentences that front-load the core purpose ('Formulas with addresses and cached values') and then immediately explain the filtering options with concrete examples. Every word adds value, with no redundancy or fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given that there is no output schema, the description provides a reasonable overview of what is returned (formulas with addresses and cached values) and mentions the key filtering capabilities. It lacks details about the exact return structure or pagination, but for a moderately simple list tool with thorough schema coverage, it is sufficiently complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already describes all parameters with 100% coverage. The description's mention of filtering with `contains` and/or `sheet` adds a small amount of practical context, but it largely repeats what the schema already dictates, so the baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states what the tool does: it lists formulas with their addresses and cached values. This is a specific verb+resource combination that distinguishes it from sibling tools like workbook_overview or trace_cell by focusing on formula listing and filtering.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context on how to use the tool by mentioning filtering options (`contains` and `sheet`). However, it does not explicitly state when to use this tool over the sibling tools or when not to use it, so it falls short of a perfect score.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

trace_cellTrace a cellA

Audit one cell: its formula and cached value, precedents (cells and ranges it reads), and dependents (formulas that read it, directly or via a range). Address like 'Summary!B14'; unqualified addresses use the first sheet.

ParametersJSON Schema
NameRequiredDescriptionDefault
cellYesCell address, e.g. B14 or 'Summary!B14'
pathYesPath to an .xlsx workbook
max_dependentsNo

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full transparency burden. It discloses what the tool computes (formula, cached value, precedents, dependents), how dependents are traced (directly or via ranges), and how unqualified addresses resolve. This goes beyond a basic statement, though it omits details about return format and max_dependents behavior, so it does not earn a 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description consists of two tightly written sentences that are front-loaded with the core verb and scope. Every clause contributes important information, with no redundant words or filler, making it an exemplary concise tool description.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a per-cell audit tool with no output schema or annotations, the description provides the essential context: what it does, how to address cells, and what outputs to expect. It lacks a detailed return schema but enumerates the output categories adequately. The missing detail on max_dependents is a minor gap, but overall the description is sufficient for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 67%, so the description must add meaning for undocumented aspects. It explains the cell address format in detail, including unqualified address resolution, which is not fully covered by the schema. It does not explain max_dependents, but that parameter has constraints and a default in the schema, and the missing info is not critical for usage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool audits a single cell, listing specific outputs (formula, cached value, precedents, dependents) and distinguishing it from sibling tools that operate at the workbook level. The wording 'Audit one cell' is a specific verb+resource that unambiguously defines the scope.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for single-cell auditing and provides address format guidance, but it does not explicitly contrast with sibling tools like audit_workbook or list_formulas. There is no statement of when-not-to-use or alternative tools, so the guidance is only implicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

workbook_overviewWorkbook overviewA

Structure of an .xlsx workbook: sheets with dimensions and formula counts, defined names, external workbook links, merged cells. The map you need before tracing or auditing.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYesPath to an .xlsx workbook

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. It specifies what the tool returns (structural details), and the phrasing 'overview' and 'map' implies a read-only inspection. However, it does not explicitly state safety (no modification) or mention error cases, which would have made it fully transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is only two sentences, the first giving a concise list of what the tool returns and the second using a helpful metaphor. It is front-loaded with the essential information and contains no unnecessary words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with a single parameter, no output schema, and clear structural return content, the description is complete. It tells the user exactly what to expect and when to use it, without needing to describe return formats or additional options.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% for the single parameter 'path', which already has a descriptive comment. The description does not add any further meaning or nuance to the parameter beyond what the schema provides, so a baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states what the tool does: it provides the structure of an .xlsx workbook, including sheets with dimensions and formula counts, defined names, external workbook links, and merged cells. It distinguishes itself from sibling tools by positioning as 'the map you need before tracing or auditing.'

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly tells the user when to use this tool: as a preliminary step before tracing or auditing, which are clearly related to sibling tools (trace_cell, audit_workbook). It implies this tool should be used first to get an overview, providing context for alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. 4 tool updatesv0.1.0
    • First observedaudit_workbook
    • First observedlist_formulas
    • First observedtrace_cell
    • First observedworkbook_overview

TDQS

A4.3/5.0
Disambiguation5/5

Each tool targets a distinct audit aspect: structure, formula listing, single-cell tracing, and overall risk. No overlap or ambiguity, as even the two workbook-level tools (overview vs. audit) have clearly different outputs.

Naming Consistency4/5

Most tools follow verb_noun pattern (list_formulas, trace_cell, audit_workbook), but workbook_overview is noun_noun, breaking the pattern slightly. The style is otherwise consistent and readable.

Tool Count5/5

Four tools is ideal for an Excel audit server, covering the essential workflow without redundancy or bloat. Each tool has a clear, non-overlapping purpose.

Completeness5/5

The tool set covers the full audit lifecycle: structure overview, formula discovery, cell-level tracing with precedents/dependents, and a comprehensive risk report. There are no obvious missing operations for the stated domain.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

  • A
    license
    C
    quality
    B
    maintenance
    Enables conversational data analysis of Excel/CSV files through natural language queries, powered by 395 Excel functions via HyperFormula and multi-provider AI. Supports advanced analytics, bulk operations, financial modeling, and large file processing with intelligent chunking.
    35
    37
    36
    MIT
  • A
    license
    Not graded
    quality
    C
    maintenance
    Enables users to ask questions about their spreadsheets in plain English and receive instant answers using DuckDB-powered analytics, supporting multiple file formats like Excel, CSV, and Parquet.
    2
    MIT
  • A
    license
    A
    quality
    A
    maintenance
    50 tools and 400 functions for working with Excel/.xlsx spreadsheets — read/write, recalculate formulas, diff, repair broken references, and audit. Built for AI agents.
    50
    273
    6
    MIT

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/arose26/xlsx-audit-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server