Access levels of skills and MCP servers
The access level of every catalog entry and the reasons behind it. The level shows what a tool adds to what the agent can already do. It does not rate code quality.
Broad access
- MCP Server for OdooMCP server
- Creates, updates and deletes records in an ERP database
- Requires an API key or username and password for the Odoo instance
- YOLO mode and model method calls bypass security checks
- MCP Server for Paddle BillingMCP server
- Creates transactions and changes subscriptions in a payment system
- Has access to customer data and a secret API key
- MCP Toolbox for DatabasesMCP server
- Can run arbitrary SQL against the connected database
- Handles database credentials
- MCP UnityMCP server
- Changes objects and components in a real Unity project
- Can install packages into the project
- Can irreversibly delete a Yandex Metrica counter
- Can create and delete goals, affecting conversion data
- No separation of read-only and write modes at the server configuration level
- It has confirmed changing digital-item stock in a real seller cabinet via an API write
- The documentation states intent to carry write access through the full order-shipment-code cycle
- The token grants full Retensy account access, including publishing and deleting scenarios
- Scenarios can pass leads to connected CRMs and publish live changes to real bots
- The token grants full zaytsv account access, including publishing and deleting scenarios
- Publishes live changes to real Telegram, MAX and Instagram bots
- Publishes to a VK wall, a VK group and Telegram on behalf of the token owner
- Stores the TenChat browser session locally
- Any client that reaches the server gets control of the running Premiere and its projects
- A separate setting enables tools that run arbitrary code inside Premiere
- Installing the connector writes into Premiere's per-user extensions folder and switches on debug mode
- It can create, update and delete infoblock elements and highload-block records
- It runs as a Bitrix service user; access is limited only by the whitelist and a Bearer token
- MCP for UnityMCP server
- Modifies project scenes, assets and C# scripts
- Runs builds and tests in the editor
- MCP for Yandex DeliveryMCP server
- Can place real orders with actual costs
- Order cancellation may incur fees
- Token is stored in plain text in the client configuration
- MCP for classic Timeweb hosting domainsMCP server
- Requires two-factor authentication disabled on the account, weakening login and password security
- Account password is passed directly as an environment variable along with the app key
- Publishes content on eight platforms on behalf of the account owner
- Stores credentials and browser sessions for several platforms locally
- Publishes content on behalf of the owner of connected VK, YouTube and Instagram accounts
- Stores OAuth tokens in self-hosted Nango on the user's machine
- The yadirect server creates and pauses ad campaigns with a real budget
- The vk and edaru-telegram servers publish posts on behalf of the community and channel with no platform-side preview
- MCP server for 1C over COMMCP server
- execute_script, once protection is disabled, runs arbitrary 1C code via the Выполнить and Вычислить operators
- COM access reads and can write infobase data under the configured user's rights
- MCP server for KaitenMCP server
- Tools create, update and delete boards and cards in a live Kaiten workspace
- Board deletion supports a forced mode without extra confirmation
- MCP server for Ozon Seller APIMCP server
- Can create and update products, and change prices and stock
- Can cancel FBS shipments and run other write actions from the catalog of 111
- Tools create and update leads, contacts and templates across several Kommo accounts at once
- Long-lived tokens for every client account are stored in a single file or environment variable
- MCP server inside 1CMCP server
- Gives the agent access to live 1C infobase data
- Direct mode requires publishing the base without authentication
- Custom tools can modify data
- MCP server inside Bitrix24MCP server
- Can irreversibly delete CRM entities, tasks, groups and user fields
- Runs from inside the portal with the rights of the configured admin_user_id, not a webhook's limited scope
- The agent posts and deletes messages, creates and deletes channels and roles and assigns permissions as the bot
- The bot token opens control of the server, and the recommended Administrator permission extends access to the maximum
- Picks and runs the connected MCP servers' tools based on the request text itself, with no separate confirmation before the call
- The example setup connects a Gmail and Google Drive server with access to the account's mail and files after a one-time authorization
- The filesystem MCP server can read and write files in the allowed directory at the local model's own choice
- MCP-ShieldMCP server
- It runs the commands of every MCP server in your settings, passing them the current process environment
- It reads the Cursor, Claude Desktop, Windsurf and VS Code configuration files, which often hold API keys
- With --claude-api-key tool descriptions are sent to the Anthropic API
- MCP:1C-DevToolsMCP server
- The apply-and-build-cf batch automation applies configuration changes to a real infobase through the designer
- Changing operations require confirmed=true, but once passed they run without further questions
- The channel installs the MCP:RSV Server plugin into 1C:EDT, through which the agent writes code and creates metadata objects
- In higher profiles the plugin runs the debugger and tests, updates the infobase and merges configurations
- MCPControlMCP server
- The agent drives the mouse and keyboard of a real desktop and can click or type anything
- Screenshots and the clipboard expose personal data
- A server address over SSE without HTTPS exposes computer control to everyone on the network
- METRMCP server
- Updates the 1C infobase configuration via the connection string
- Launches Designer, ibcmd and 1C clients on the machine
- Infobase login and password sit in the settings file
- MKPMCP server
- In write mode it changes cluster resources and runs commands in pods
- Runs with the permissions of the supplied kubeconfig
- MOEX and T-Bank Invest market data MCPMCP server
- The T-Invest token gives access to a real brokerage account, and a leak exposes the owner's data
- With ENABLE_PORTFOLIO on, the server reads real portfolio and account operations, even though there are no write methods in the code
- MTPLXCLI
- Sets up its own Python environment in `~/.mtplx` and downloads models up to 170 GB from Hugging Face
- Brings up a local server on `127.0.0.1:8000` that takes agent requests to the model and keeps a session cache on disk
- Fan control (`mtplx max --install`) asks for `sudo`, and Forge publishes models to the Hub with your Hugging Face token
- Mac Messages MCPMCP server
- Reads your private conversations and contacts from macOS databases
- The send and scheduled-send tools write to real people in your name
- Work requires macOS system permissions for the launching app
- Specialists run in parallel and change code in the project, and execution follows the plan without you in every step
- The MCP server and scripts run locally, and sessions accumulate files in docs/maestro
- Magic CLICLI
- The unsafe-execution mode runs the model-proposed command in the current shell, and ask may request running other commands
- With a cloud model the task description and shell history fragments go to its provider
- The OpenAI key is stored in a regular settings file, not in the system's secure storage
- MagpieCLI
- Reads the Claude Code and Codex sign-in files and the keychain to offer subscriptions to other agents, and stores provider keys in `providers.json`
- All agent traffic goes through a local gateway, and JavaScript plugins and middleware see and can rewrite prompts and replies
- Edits installed agents' configs, and the Claude subscription bridge launches the local `claude` with the `--dangerously-skip-permissions` flag
- Mail.ru MCP serverMCP server
- Can send mail and delete cloud files on the user's behalf
- Uses an app password with access to mail and WebDAV
- Mail.ru MCP server and Telegram notifierMCP server
- The send_reply tool sends emails via SMTP on behalf of the mailbox owner
- The Mail.ru app password sits in Railway environment variables in plain text with no secrets manager
- Mail.ru read-only mail MCP serverMCP server
- Runs a Python server that reads Mail.ru email over IMAP with an app password
- The mail_mark_all_read tool changes the mailbox state
- There is no sending or deleting of email
- MailCheapMCP server
- A full access API key opens the whole account to the agent, including reader contacts and sending
- Sent emails cannot be recalled, so an agent mistake reaches real subscribers and affects domain reputation
- The app stores subscribers personal data and sending provider keys
- Mango Office MCP serverMCP server
- Can start real calls and send SMS on the company's behalf
- The API key and salt grant access to call recordings and statistics
- Mano skillSkill
- Controls the mouse and keyboard and opens and closes apps
- In cloud mode sends screenshots to an external server
- MantisSkill
- The skills write and run generated reproduction code, which is why the author requires an isolated environment with no access to production systems
- A run sends the contents of reviewed files to the chosen model and spends tokens, with the limit set by parameters
- Fixes are applied to code through shadow copies, and the GitHub Action writes annotations into a pull request
- Changes real product prices and stock on three marketplaces
- API tokens grant access to the seller's orders and financial operations
- Through marketplaces-mcp-ru it can write listings, prices and promotion into platform cabinets
- Every write needs human confirmation, but the write capability itself exists
- The agent gets a token or API key with your permissions in the catalog and can edit descriptions, tags and owners, and the `marmot assets delete` command removes assets
- The query_data tool runs SQL against data sources under your account, and the rows end up in the conversation with the model
- Signing in with marmot login registers the token in the Docker credential store for the instance host
- Megaplan MCP serverMCP server
- Creates deals and tasks visible to the whole team in Megaplan
- Logging in with login and password passes account credentials to the server
- The skills perform actions in mail, chats and CRMs on your behalf
- They require login to third-party services and a Membrane account
- MemmyCLI
- The hook writes the course of every conversation with the agent to the memory database, and conversations can hold secrets and personal data
- Installation puts skills, hooks and plugins into agents' settings and registers a background service
- With a remote provider, texts from memory go to it for summarization and filtering
How we set the access level
MethodologyThe editors set the level and the reasons from the README, the way the tool runs and the permissions it needs. Reading project files the agent can already see does not raise the level. There is no automatic code audit yet.