Access levels of skills and MCP servers
The access level of every catalog entry and the reasons behind it. The level shows what a tool adds to what the agent can already do. It does not rate code quality.
Broad access
- The procedure queries the production database holding personal data and its system catalogs
- Runs a shell scan of the code, including a secrets search
- Calls the project API from outside to test access
- 1688 ShopkeeperSkill
- The publish command lists products in linked stores and, after a trial run, does so without asking again
- The AK key opens the 1688 account and is saved in openclaw.json in plain text
- The skill connects to ainext.1688.com and writes result files into the OpenClaw working directory
- The pipeline's final step uploads the product to a live Ozon store via the API
- Requires Ozon Seller API keys and correct pricing setup; a mistake gets published to the storefront
- Publishes a new product in a real Ozon seller account through the API
- Uses the paid third-party AlphaShop service for image translation, spending its balance
- Uploads a product listing to a live Ozon store via the seller API
- Ozon Seller API keys grant access to the store's catalog
- After explicit enablement it publishes new product listings to Ozon
- It calculates and writes prices based on its own logistics and exchange-rate estimates
- The db-* and cf-*/cfe-* skills change 1C configuration structure and database content
- The web-session skill drives a live 1C web session, including filling forms and taking state snapshots
- Skills load configurations into infobases, update them and publish to a web server
- They run PowerShell scripts on the developer machine
- 1C AI development environmentMCP server
- build_epf and code generators create and modify configuration and extension files on disk
- cfe_patch_method generates interceptor methods in extensions, changing configuration logic
- mcp-write-server changes 1C configuration metadata and BSL code
- Automatic rollback covers only 6 of 25 mutating tools, worth starting with the read server
- Assumes autonomous agent work on code and databases in a Docker sandbox
- Requires installing several third-party MCP servers
- The installer creates symlinks in project and IDE folders
- 1C Base MCPMCP server
- create_document and execute_code can write to the base and run arbitrary code once MCP_READONLY is turned off
- Access is protected by a single token; network isolation is the user's responsibility
- 1C Debug MCP ServerMCP server
- evaluate runs arbitrary BSL expressions in the context of a stopped session
- raw_request sends unchecked XML directly into the dbgs.exe debug protocol
- Can propose production, accounting and access-rights changes classified as R3
- Works with executable 1C artifacts (CF, CFE, EPF) via isolated extraction and optional static analysis
- 1C MCP ToolkitMCP server
- load_objects writes changes directly into a work infobase with storage
- 1c-com reads and writes infobase data over COM under the user's rights
- 1C MCP ToolkitMCP server
- The execute_code tool runs arbitrary code in the 1C base
- Reads live data, including personal data
- The built-in server has no authentication by default
- 1C OData MCP serverMCP server
- Runs a Python server that reads the published 1C OData with a login and password
- OData exposes the base catalogs and documents, including customer and employee data
- The password can end up in call arguments if not set as an environment variable
- 1C OData MCP with a JSON cacheMCP server
- The create_1c_entity, update_1c_entity and delete_1c_document tools directly create, change and delete documents and catalog items in 1C
- Basic Auth credentials are stored in plain text in .env, and exports are saved to disk locally
- The HTTP bridge writes objects and posts documents in the infobase
- Scripts load configurations and update infobases
- Runs PowerShell and Python scripts and the 1cv8 Designer in batch mode
- Can load configurations into and update infobases
- Starts an Apache web server to publish infobases
- 1C TestpilotMCP server
- Drives the real 1C interface and can post documents and change data like a regular user
- tc_execute_code runs arbitrary BSL code in the client or server context
- 1C Trusted GatewayMCP server
- Runs queries and arbitrary 1C code in the live infobase
- Masking of code output is heuristic and may miss sensitive data
- 1C binary unpack/repack MCPMCP server
- Decompiles closed modules from bytecode, which the platform license only permits for your own objects
- repack overwrites the configuration or processing binary based on the unpacked and edited directory
- 1C-Fresh CLI and MCP serverMCP server
- create_product, create_customer and update_product write data into a live 1C-Fresh base
- Writing to a live base is flagged by the author as not fully verified
- 1C:EDT companion MCP with 46 toolsMCP server
- edit_metadata and write_module_source change configuration objects, forms and code in one transaction
- sync_database performs a headless infobase update without a modal confirmation
- 1C:Enterprise MCP server over ODataMCP server
- The odata_create and odata_update tools write new records and change existing ones in the live 1C database
- Database admin credentials are passed via the MCP server's environment variables
- Executes arbitrary 1C built-in-language code in the infobase context
- execute_1c_code_complex needs rights to run 1cv8.exe on the server to build an external processing report
- 1c-agent-kitSkill
- Skills like db-server and epf-add-form perform operations against a real 1C database and its objects
- The link scripts change the consumer project's file structure, including the git index and .gitignore
- 1c-batchSkill
- Loads configurations and extensions into the infobase
- Keeps infobase credentials in a project file
- Runs 1cv8.exe DESIGNER, which can change the working infobase configuration
- Commits changes to the shared configuration repository on the user's behalf
- Infobase and repository passwords are stored in plain text in 1c-project.json
- 1c-fresh-mcpMCP server
- create_invoice and post_document create and post real documents in 1C-Fresh
- mark_for_deletion flags objects and documents for deletion
- 1c-mcpMCP server
- Reads the 1C database, which usually holds personal data of clients and employees
- Runs a Node.js server that reads objects and related records of a 1C infobase over OData
- Writing to 1C is not supported
- 1c-odata-mcpMCP server
- With writes enabled it creates and posts documents in a live accounting base
- Creates payment orders and cash documents
- Requires a 1C user login and password
- The installer and skills run PowerShell and Python scripts
- Tools change configuration metadata and operate on infobases
- Can connect MCP servers and external services, including 1C:Naparnik and the Gemini API for transcription
- 1c-templates-mcpMCP server
- MCP tools add, update and delete templates in the SQLite store
- The MCP endpoint and web UI are open without auth on the chosen port
- Embeddings can be computed through an external OpenAI-compatible API
- 1c-web-sessionSkill
- Creates and posts documents in the infobase through the UI
- Runs arbitrary JS scenario code in the browser
- 1creader: read a 1C file infobaseMCP server
- Runs a Python server that parses the 1Cv8.1CD file without the platform
- Gives the agent catalog and register data, which usually holds customers, employees and counterparties
- Writing to the database is not supported
- 2passwordCLI
- The tool gives an agent access to 1Password vaults and lets it create and update items
- `run` and `env run` hand a plaintext secret to a child process that can print it
- A service account works without approvals, so its vault should be separate and small
- 3X-UI on your VPSSkill
- Uses root SSH access to a remote server
- Installs packages and changes firewall rules and nginx configuration
- May ask for the root password in plain text
- 3dsmax-mcpMCP server
- The agent can run arbitrary MAXScript and change the scene, materials and the material library
- The installer places Python, native bridges and skills on the system and in client settings
- 7Deer SkillsSkill
- The set includes skills for deployment, backlink submission and paid APIs, which act externally only with your permission
- Scripts collect data from public pages and videos, whose content the agent must treat as untrusted data
- After an allowing rule or owner confirmation, tools transfer real money from a personal T-Bank account
- Login uses a phone number, SMS code and password over an unofficial protocol rather than an official API token
- A simple Yandex Calendar MCP serverMCP server
- delete_calendar_event deletes an event with no confirmation and no backup
- create_calendar_event writes to the user's first calendar with no way to choose another
- A.T.L.A.S.CLI
- The install script sets up a container runtime and driver layer, downloads about 20 GB and starts several services on the machine
- The agent writes files and runs commands, and sandbox commands have outbound network access by default
- In 3.1.x an unverified edit can be written with a "verified" mark
- A1 Yandex KIT SkillsPlugin
- Can bulk-change product prices and stock on command
- Creates, changes and disables promo codes and discounts in the live store
- Handles orders and customer personal data: names, phone numbers, addresses
- A1 Yandex Merchants MCPMCP server
- Changes product prices and discounts, directly affecting the seller's revenue
- Can hide and unhide products in bulk, up to 500 per request
- After a connection failure the operation is not auto-retried, and the actual state cannot be read back through the API
- ABS Studio ServerMCP server
- The 157-tool set includes code execution and a fullstack development mode
- It stores Stripe payment secrets and provider keys on your own server
- It contacts the vendor's server daily to check the license unless disabled
- The agent edits files and runs terminal commands
- Sends project code to the Anthropic API
- The agent gets the rights of your AFFiNE account: it can create, change and delete documents and databases
- A password or session cookie is stored in a settings file on your machine
- Stores database credentials and OAuth tokens
- The Gmail, Telegram and Jira skills can send messages and change data in external systems
How we set the access level
MethodologyThe editors set the level and the reasons from the README, the way the tool runs and the permissions it needs. Reading project files the agent can already see does not raise the level. There is no automatic code audit yet.