Access levels of skills and MCP servers

Broad access

• Obsidian + Claude Code PKMSkill
  • A PostToolUse hook makes a git commit after every file write in the vault
  • The permissions in settings.json let the agent write and edit vault folders and run git, cp and mv
• Obsidian MCPMCP server
  • Reads and changes the Obsidian vault files
  • Clients can call destructive tools
  • Deletion goes to the bin by default
• OctogentCLI
  • Launches many agents that change code in parallel
  • Runs a local API and installs Claude Code hooks
• OdevioCLI
  • Works with your Apple Developer account: the App Store Connect key, certificates and signing profiles
  • Publishes builds to TestFlight and the App Store and can update the app's store listing
  • Project code is built on the service's remote machines, and after the skill install the odevio commands are pre-approved in Claude Code
• Odoo MCPMCP server
  • Connects to an Odoo database with credentials
  • Can write changes to ERP data
  • Works with production systems
• Official Timeweb Cloud skillsPlugin
  • Can create paid resources and charge the account balance
  • A full API token opens access to every service on the Timeweb Cloud account
• Official Wildberries Seller API skillSkill
  • It covers write operations like card uploads, prices and promotions with no separate read/write gate
  • The helper only guards against a wrong host and rate limits, not against the act of writing data itself
• Official YDB MCP serverMCP server
  • By default the server only reads, but with the --ydb-allow-write flag it executes arbitrary SQL, including data changes and deletions
  • Token or service account authentication grants broad database access unless the key's rights are restricted
• Official n8n SkillsSkill
  • Through MCP the agent creates, edits, publishes and runs workflows in your n8n instance, and workflows reach your services
  • The plugin installs SessionStart, PreToolUse and PostToolUse hooks, which are shell scripts that run on agent calls
  • The agent deals with n8n credentials and keys, so tokens must stay out of node text fields
• Oil MotionSkill
  • Uses a paid ZenMux key kept in the system store and sends your images and prompts to an outside generation service
  • Runs Python and TypeScript scripts, ffmpeg and a local key-entry page, and writes asset files and code into the project
  • Every generation request costs money, so a batch without your approval of the pilot clip is ruled out by the skill's instructions
• OmniClawCLI
  • The wallet private key and Circle keys open real accounts, and an agent with the `pay` command moves money on its own
  • A mistake in the policy file or an oversized budget lets the agent spend more than you planned
  • The agent and owner tokens live in the `.env` file and the policy file: a leak of either opens payment control
• OmnigraphMCP server
  • The server listens on the network (`0.0.0.0:8080` in the example) and works with your storage, including S3 through `AWS_*` keys
  • After the `--mcp-allow-writes` flag the agent changes the graph and creates, deletes and merges branches
  • The install script runs through `curl | bash` from the main branch and puts binaries in `~/.local/bin`
• OneBridgeMCP server
  • execute_code runs arbitrary 1C server code as the current user
  • execute_query gives direct access to database data, including catalogs and documents
• OneWave AI Claude SkillsSkill
  • The skills handle sensitive money and data: statements, invoices, contracts, CRM records, and with connected mail they read emails and create drafts
  • The `agent-army` skill launches dozens of parallel agents that edit files in bulk and use up model limits
  • Some skills run Python scripts on the user's files and reach the network, for example for SEC EDGAR filings
• Open Agent EmailMCP server
  • An agent with a full-access key sends mail from your address and domain on its own, and human confirmation works only while `hitl_enabled` is on
  • The agent reads mail from strangers, and the scanner checks text and HTML but gives no protection against attachments until ClamAV is on
  • The server keeps relay passwords, webhook secrets and DKIM keys in its database, encrypted with a single key
• Open Computer UseMCP server
  • Drives the real desktop session: clicks, types and can change data in apps
  • Requires Accessibility and Screen Recording permissions
• Open Ralph WiggumCLI
  • Runs the agent CLI with no iteration limit and, by default, no confirmations, so the agent can change and delete project files and run commands
  • Commits to git after every iteration and writes state to `.ralph/`, while repeated requests spend the agent's paid plan
• Open source MCP servers for AWSMCP server
  • Servers operate on real AWS resources and can modify them
  • Cloud account credentials are required
• Open-AutoGLMCLI
  • The agent controls the phone and can act inside apps
  • Screenshots are sent to the model, possibly a third-party service
• Open-ReverseLabMCP server
  • It runs reverse-engineering tools and arbitrary binary analysis
  • It handles malware and exploit samples
• OpenAPI-driven Wildberries MCP serverMCP server
  • The catalog covers write operations on orders, prices and content, reachable through an explicit allow_write flag
  • wb_raw_request allows calling arbitrary endpoints outside the catalog
• OpenBrowserPlugin
  • The agent executes arbitrary Python code and controls a browser: it can press buttons, submit forms and download files
  • Saved logins give access to your accounts: cookies and localStorage are stored in a profile on disk
  • The allowed-domain list is empty by default, so sites are not restricted
• OpenCLICLI
  • Acts through the user's real logged-in browser and can take actions under their accounts
  • Writes and runs adapters that decide themselves how to interact with a site
• OpenChatXMCP server
  • ChatGPT gets tools that run commands, edit files and control applications with your user's permissions
  • An OpenAI platform API key is stored on your machine and runs the tunnel
  • Other MCP servers are attached through this one, so their permissions become available to ChatGPT too
• OpenClaudiaSkill
  • Integration skills send emails and publish posts on your behalf
  • They need keys to ad, analytics and CRM services
• OpenClawCLI
  • The assistant sends messages in messengers on your behalf
  • Runs tools and commands on the gateway host
  • Stores provider keys and channel tokens
• OpenCodeCLI
  • In build mode it edits files and runs shell commands
  • Sends project code to the chosen model provider
• OpenCode Power PackPlugin
  • The code-review skill posts comments on a GitHub pull request when asked
  • The SageMaker and Hugging Face Jobs skills create cloud resources and can spend money
  • The skills run Semgrep, CodeQL and commands in the repository working copy
• OpenCode SwarmPlugin
  • The installer changes OpenCode settings and disables the built-in explore and general agents in opencode.json
  • Agents write files and run commands
  • Optional features work with git worktrees, the GitHub CLI and GitHub Actions
• OpenCode Telegram BotCLI
  • Prompts sent through the Telegram chat reach an agent that edits files and runs commands on your computer
  • The bot token and user ID sit in a .env file, and local JSON commands run in a shell with the bot's permissions
  • Project files can be downloaded from the chat with /ls, and attachments go to the agent and the speech-to-text service
• OpenCoveCLI
  • Launches terminals and agent sessions with access to your projects and git worktrees
  • A Worker web UI open to the local network gives terminal control to anyone with the password
  • The opencove command controls the canvas from scripts, and the installer downloads and unpacks a runtime bundle
• OpenDesignMCP server
  • Install via curl piped to a shell script
  • The app launches local agent CLIs with filesystem access
  • Handles model API keys
• OpenDiaMCP server
  • Acts in your browser and in all open sessions
  • Can read pages and submit forms in your name
  • The tunnel mode makes the server address reachable from the network
• OpenGUISkill
  • The agent taps, types and opens apps on a real phone that holds personal messages, banking and other accounts
  • Screen screenshots go to the chosen model, and the client gets the AccessibilityService and USB debugging
  • The plugin installer runs through curl piped into bash and prepares an environment on your machine
• OpenHands Agent CanvasCLI
  • Agents run arbitrary commands, with full filesystem access when not sandboxed
  • Automations receive tokens for Slack, GitHub and other services
  • Sends code to the chosen LLM provider
• OpenIntegrationsCLI
  • Sends messages and changes data in external services on your behalf
  • Handles tokens and runs SQL against connected databases
• OpenPost MCPMCP server
  • With the mcp:full scope the agent publishes and schedules posts in connected social networks on your behalf, replies to comments and hides them
  • It uploads media and reads the workspace's accounts, comments and analytics
  • A developer token stays valid until you revoke it and opens workspaces without signing in again
• OpenProseSkill
  • Executes contracts with the host's tools: the agent starts helper agents, reads and writes files and runs commands from the sources
  • The delivery library can send email, Slack messages and webhooks, and `prose serve` brings up local schedules and HTTP triggers
  • State, receipts and dependencies are written to the OpenProse root, where `.env` may hold keys
• OpenQodexCLI
  • init writes global agent instructions, MCP settings, a git pre-push hook and Cursor and Cline rules
  • Project changes go to the model of your Claude Code or Codex login, and scanners download executables on first run
  • A scanner you connect runs its own command with your permissions after trust
• OpenRigCLI
  • Several agents edit project files and run commands in parallel
  • rig setup changes ~/.tmux.conf and the npm install runs a post-install script
  • The agent asks permission to run rig without repeated confirmations
• OpenTabsMCP server
  • Actions go in your name through a signed-in session
  • Service terms may forbid automation
  • Telemetry is on by default
• OpenWolfCLI
  • Installs hooks into agents and adds instructions to their context
  • Writes to the project's working folder
  • The AGPL-3.0 license has copyleft conditions
• OracleCLI
  • The contents of the chosen files go to external providers, and files can hold secrets
  • Browser mode drives Chrome and uses your signed-in ChatGPT or Gemini session
  • API mode spends paid tokens on provider keys
• OrcaCLI
  • The agent runs shell commands and edits project files
  • On macOS, computer use lets the agent operate other applications with your permission
  • Requests to DeepSeek go out with your paid key, and every task spends money from the account
• OrcaCLI
  • Runs several agents that execute commands and change code in parallel
  • Enables remote control of agents from a phone
• Overleaf MCP ServerMCP server
  • The Git token grants full read and write access to the whole Overleaf project
  • The write_file and write_section tools change project files and create commits
• Oxylabs Agent SkillsSkill
  • The skills reach the network through the vendor's paid services and pass requests and target URLs to them
  • They operate with credentials in environment variables
  • Some capabilities rely on anti-bot bypass and CAPTCHA solving, which carries legal responsibility
• Oya BrowserMCP server
  • The agent acts in a browser with your imported logins and can perform actions as you on websites
  • Pages the agent reads may contain instructions aimed at it, so keep sign-in, payment and email-sending steps for a person
  • The API key opens access to your Oya account and its cloud browsers
• Ozon API MCP serverMCP server
  • Changes product prices and stock and can cancel a posting
  • Can send messages to buyers and reply to reviews on behalf of the shop
  • Start with a read-only key if Ozon offers one
• Ozon MCPMCP server
  • Can change prices, products and stocks in the seller cabinet
  • Requires secret Seller API keys
  • Performance API ad methods involve spending budget