Access levels of skills and MCP servers

The access level of every catalog entry and the reasons behind it. The level shows what a tool adds to what the agent can already do. It does not rate code quality.

Broad access

  • IDA Pro MCPMCP server
    • Runs arbitrary IDAPython and modifies the IDA Pro database
    • Opens and analyzes potentially malicious binaries
    • The IDA plugin can run arbitrary code through py_eval and the key is a bearer token: whoever has it controls the instance
    • The server listens on 0.0.0.0 by default, accepts file uploads with POST /upload and writes them to disk
    • The --unsafe flag enables destructive tools and the debugger; run malware samples only in an isolated environment
  • IFClite MCPMCP server
    • The edit tools change properties, attributes and geometry, create and delete elements and save the result to files on disk
    • The agent reads the whole model: georeferencing, cost data, materials and the properties of every element
    • In HTTP mode the server accepts requests over the network, and its token is set through a separate flag
    • Installs into the live 1C infobase and exposes its data to external agents over HTTP
    • Sends infobase data and error texts to cloud LLM providers
    • Stores API keys and a Telegram bot token
    • execute_code runs arbitrary BSL code in privileged mode
    • post_document, unpost_document and delete_object change document posting and delete objects
    • import_data and run_scheduled_job can mass-change data or trigger scheduled jobs
  • IWEMCP server
    • The MCP server creates, updates, deletes and renames documents in the workspace, and edits go straight to files
    • The `iwe_query` tool runs bulk `update` and `delete`, and `iwe_normalize` rewrites the formatting of every document in the graph
    • The config created by `iwe init` holds a command that launches an external agent, `claude -p`
    • May download the engine binary into ~/.impeccable/bin on first run
    • Installs hooks that run on agent edits
    • Runs a server via npx with the InSales store admin key and password
    • Gives the agent store orders and customers, which means shopper personal data
    • All eight tools are read-only
    • Sends paid messages to real recipients
    • Buys numbers and changes customer and account data
  • InkOSSkill
    • API keys for model providers are stored on disk in `.inkos/secrets.json` and `~/.inkos/.env`
    • `inkos up` writes chapters on a schedule with no person involved and sends notifications to Telegram, Feishu, WeCom and a webhook
    • The system writes and rewrites project files, and the manuscript text goes to the model provider over the network
  • Instagram MCPMCP server
    • Publishes posts and reels on behalf of your account
    • Posts and deletes comments and sends direct messages
    • The token opens the business account and the linked Facebook page
    • Takes provider keys in environment variables and spends tokens against them
    • The review, fix and test tools send code to external model APIs
    • CodingAgent edits repository files and runs a test command
    • Commands run in your accounts and apps with saved cookies and logins, and the extension's permissions are broader than a single task
    • Reads network traffic, cookies, storage and screens, can deliver a secret from the macOS vault and run code on the page and on the phone
    • On macOS it installs a daemon and a native bridge that are granted Accessibility, screen recording and microphone permissions
    • Initiates payments between agents and works with wallets and crypto assets
    • Sets up escrow and delegated spending permissions
    • Relies on third-party blockchain protocols and their keys
    • Runs SQL against the database, including potentially modifying queries
    • Keeps the database password in config
    • Includes offensive techniques: network probes, ONVIF credential brute-forcing and hardware access over JTAG, UART and telnet
    • Runs system tools and commands with network and physical access to devices, some under sudo
  • IxCLI
    • The installer adds Node.js, Git, ripgrep and Docker and runs a backend in containers on your machine
    • `ix mcp install` changes the configuration of Claude Code, Codex, Cursor and other clients
    • A graph of the repository's source code is stored in a local ArangoDB database
  • JADX-AI-MCPMCP server
    • Reverse engineering and security analysis are only allowed for permitted apps
    • Gives the agent access to the analyzed APK's decompiled code
  • Jarvis RegistryMCP server
    • Controls agent access to internal corporate systems and data
    • Requires configuring an identity provider and stores its credentials
  • Jira MCPMCP server
    • The token acts on your behalf: the agent creates and edits issues, moves them between statuses, writes comments and logs time
    • The server keeps Jira credentials in environment variables and uses them against your company's API
    • The agent downloads Jira attachments into the temporary files folder on your computer
    • Runs arbitrary code in the Jupyter kernel
    • Edits and deletes notebook cells
    • Kady writes and runs code in the project and works with files, including a shell and Python
    • Connected keys and subscriptions are spent on your behalf, and request material goes to the model provider
  • KARIMOPlugin
    • Agents write code, create branches and worktrees in your repository and open pull requests through GitHub CLI
    • Running several agents in parallel burns through your plan's limits and tokens quickly
    • The plugin installs lifecycle hooks that can connect to Slack and Jira
    • App keys and brokerage account numbers sit in the client environment variables
    • The agent sees account balance and history and, with the full set, can place, modify and cancel orders with real money
    • The server downloads method code from GitHub and executes it in a temporary environment at run time
    • Runs commands in your KOMPAS-3D project
    • The copilot panel launches claude -p inside the program
    • The project is early, the repository has 5 stars and no license
    • Runs commands in your KOMPAS-3D project through COM
    • The execute_python_script tool runs arbitrary Python when turned on
    • The project is early, the repository has 0 stars and no license
    • When KAITEN_ENABLE_WRITE_TOOLS is on, it can change cards and comments
    • The token gives user-level rights in your Kaiten
  • Kaiten MCPMCP server
    • Creates and changes cards, boards and spaces
    • Can delete columns and subcolumns
    • Stores the Kaiten API token in a file on disk
    • Can permanently delete a card
    • Changes columns, members and tags on a real board
    • Creates, updates and deletes cards and comments in the live tracker
    • The API token grants access to all of the owner's spaces
    • Creates and changes cards on a real board
    • The token gives full user-level access to your Kaiten organization
    • Uploads and deletes files on cards
    • Can delete cards, comments and checklists
    • Can delete cards, documents and attachments
    • Reads the company audit log and data for all workspace users
    • Creates and updates cards on a real board
    • In team mode the server is hosted separately, tokens are passed to its side
    • Can delete spaces, boards, columns and cards
    • The token gives user-level rights to change data in Kaiten
    • Creates and updates cards and comments on a real board
    • The remote mode, if misconfigured, can expose Kaiten access from outside
  • KeyID agent-kitMCP server
    • Sends and receives real email on the agent's behalf
    • Can set auto-reply and scheduled delivery through an external service
    • The agent runs commands and modifies files
    • The --auto mode removes all confirmations
    • Spawns Kimi Code CLI as a second agent that runs its own tools
    • Per the README Kimi runs without a sandbox and can write files in its working directory
    • Runs shell commands and edits project files
    • Installs plugins, MCP servers and data sources from the marketplace
    • Sends code and prompts to Moonshot AI servers when using Kimi models
  • Kite MCP ServerMCP server
    • The server can place, modify and cancel real exchange orders
    • The Kite token and sign-in expose the portfolio, margin and trade history
    • The agent writes and deletes files and runs shell commands, asking permission by default
    • Every message and code fragment passes through the external Klaatu service
    • Login tokens are stored in ~/.klaatai/credentials.json and remote MCP tokens in mcp-oauth.json
    • Connectors grant access to CRM, email, documents and data warehouses
    • Can draft and push content into external systems
    • The console agent edits project files, runs commands and works with git at your request
    • OpenAI-compatible service keys and the Hugging Face token live in the environment or `.env`, and requests go to an external model
    • Token spend is hard to predict in advance
    • Tools create, update and delete leads, contacts and companies in the CRM, including bulk updates
    • Auto-refreshing OAuth tokens grant full access to the Kommo account
    • Tools create and update leads, contacts, companies and catalogs in the CRM
    • A long-lived access token in the config grants full access to the Kommo account
    • Tools create, update and delete Kommo leads and other entities
    • The bat installer runs with administrator rights on Windows
    • Tools create, update and delete leads, contacts, companies and custom fields in the CRM
    • Auto-refreshing OAuth tokens are stored locally and grant full access to the Kommo account
    • Tools create and change deals, contacts, tasks and can start a Salesbot
    • Without MCP_CONFIRM_WRITES, write operations run without extra confirmation
    • Tools change leads and add notes and tasks in a real Kommo account
    • The composite Bearer token carries access data for several client accounts at once

How we set the access level

Methodology

The editors set the level and the reasons from the README, the way the tool runs and the permissions it needs. Reading project files the agent can already see does not raise the level. There is no automatic code audit yet.