Access levels of skills and MCP servers

Broad access

• Publish MCP content factory for Telegram, VK and MAXMCP server
  • Publishes posts across several messengers on behalf of the token owner
  • Sends content to an external AI provider for text and image generation
• Python MCP for Yandex Direct and WordstatMCP server
  • Full CRUD over campaigns, groups and ads in production mode
  • Bulk-adds and updates keywords and bids
• QuickBooks Online MCP ServerMCP server
  • The server sees company financial data: invoices, payments, journal entries, employee and vendor details and tax codes
  • Create, update and delete tools change the real books, and a deleted invoice or payment is hard to bring back
  • The app secret and refresh token sit in .env in plain text, and the token is rewritten on every renewal
• Qwen CodeCLI
  • The agent runs shell commands and modifies project files
  • Project code is sent to the chosen model provider
• RAPTORWorkflow
  • Executes model-generated code and exploits
  • Processes untrusted repositories and binaries
• RAT: Remote API for TestingPlugin
  • The REST API grants rights to create, change and delete data in the connected base
  • Allows remotely triggering scheduled jobs and running arbitrary queries
• REAMCP server
  • Runtime capture runs the chosen program and drives a browser and Android devices through adb with your user permissions
  • Setup edits agent settings files and can install Hopper, though it shows a plan and makes backups before writing
  • Decompiled code and the contents of analyzed programs enter the agent's context and reach its model provider
• ROS MCP ServerMCP server
  • Controls a real robot: publishes to topics, calls services and actions, sets parameters
  • A wrong command can cause unwanted movement of mechanisms
• RadarMCP server
  • Gives the agent access to the Kubernetes cluster
  • Write operations affect the real cluster
  • Optional route probing creates temporary pods
• Railway CLICLI
  • Deploys services and changes production environment variables
  • Handles account and project tokens
  • Installs from a remote script and updates in the background
• Railway SkillsPlugin
  • Through the CLI and MCP the agent creates services and databases, changes environment variables and domains and starts deploys in your Railway account
  • The analysis scripts connect to Postgres, MySQL, Redis and MongoDB databases and read their data
  • The plugin package includes the auto-approve-api.sh hook, so check which requests it approves without asking you
• RalphWorkflow
  • Runs Claude Code with --dangerously-skip-permissions and Amp with --dangerously-allow-all, so the agent executes any command without confirmation
  • Creates branches and commits in the project repository on its own
  • Runs unattended for up to 10 iterations by default, and each one spends model requests
• Ralph Loop by PageAIWorkflow
  • The agent works without permission prompts: it edits code, installs packages, runs the app and tests and commits, and only the sandbox limits it
  • The loop runs for hours and days and spends subscription limits or API key money on every iteration
  • The agent sees the project's sources and environment variables: in the description's example Supabase and Stripe keys are available to it
• RalphyCLI
  • Runs the coding agent with flags that skip action confirmation
  • Can automatically create commits, merge branches and open PRs without manual review
• Raygun MCP ServerMCP server
  • Changes error statuses, deployments and team invitations
  • Can return or rotate ingestion API keys
• ReVaMCP server
  • Exposes the PyGhidra environment, meaning arbitrary code execution
  • A reverse engineering tool; use it on your own or authorized binaries
  • A public interface without an API key grants access to analysis and scripting
• RedAmonMCP server
  • The autonomous agent runs Metasploit, Hydra, scanners and other attack tools in a Kali container; dangerous steps need manual approval, but the tool exists to exploit vulnerabilities
  • It stores discovered data about target infrastructure, third-party service keys and model provider tokens
  • An MCP token acts as you, and command execution in Kali, when all three switches are on, runs with no target check
• RedNote to ObsidianPlugin
  • The plugin keeps live cookies of your RedNote account on disk, and whoever gets the file gets the session
  • The script requests pages with those cookies, sets a browser User-Agent and turns off TLS certificate verification
  • The agent runs Python and shell commands and writes files into the Obsidian vault, and for video transcription it downloads and processes media files; automation with account cookies may break Xiaohongshu rules and get the account banned
• Reddit MCP ServerMCP server
  • The write tools publish posts and replies as your account, and they cannot be recalled once sent
  • For publishing, the Reddit account password sits in the client configuration
  • The server collects and analyzes the public history of specific users
• Redis MCP ServerMCP server
  • Can modify and delete data in Redis
  • Receives the database password
• Remote macOS Use: control of a remote MacMCP server
  • The agent gets the full screen, mouse and keyboard of a remote Mac and can do anything a user can there
  • The Mac account password is passed in an environment variable and stored in the client configuration
• Render MCP ServerMCP server
  • Creates paid resources and triggers deploys
  • Changes environment variables of production services
• Rentgen: a 1C development environment with MCPMCP server
  • The live writer applies supported metadata and BSL changes directly to the source, albeit with an atomic journal and CAS rollback
  • The confirmed native business roundtrip scenario includes writing, renaming and deleting data in a database
• ReplicaSkill
  • Writes the whole app's code, migrations and environment files into the project and runs builds, Playwright tests and its own scripts
  • The backend and deploy skills set up auth, Stripe payments and shipping to a domain: keys and purchases stay with you, but Claude writes code and commands for production
  • Reads public pages, reviews and your account in the studied app through a browser you connected
• Repository HarnessSkill
  • Executes a binary downloaded from a GitHub release; a checksum and the release identity are verified before it runs
  • Writes and updates files in the repository: `AGENTS.md`, `docs`, `.agents/skills`, `.harness-core`, and `--override` replaces existing ones
  • On your command the `$encode-invariant` skill adds checks to the project and `$improve-harness` changes agent instructions
• Researcher SkillSkill
  • The agent runs your command in a loop and edits files in the agreed scope until you stop it
  • The skill makes commits and rolls them back with `git reset --hard HEAD~1` on the `research/` branch
  • Rubric scoring launches three subagents per experiment, and token use grows with the loop length
• Resend MCP ServerMCP server
  • Sends email to real recipients
  • Can create and delete API keys, domains and contacts
• Resend skillsSkill
  • The agent can send real emails and broadcasts
  • Handles an API key and webhooks
• RetailCRM MCPMCP server
  • Creates and changes orders, customers and payments in a live CRM
  • Customer merges and payment deletion are irreversible
  • Handles shoppers' personal data
• RetailCRM MCP on the official PHP clientMCP server
  • Tools create, change and delete orders, payments, customers, tasks and notes, including the destructive merge_customers and order_payment_delete
  • Start with RETAILCRM_READONLY=1 and a key with minimal necessary rights
• RetailCRM MCP serverMCP server
  • The create_order, create_customer and update_customer tools change real orders and customers in the CRM
  • There is no read-only mode; grant the key minimal necessary rights and test it on a non-production account
• RetailCRM plugin for Codex and Claude CodePlugin
  • Mutations can change orders, customers, deliveries, payments and conversations in the live RetailCRM account
  • The skill requires confirmation before a mutation, but reads are available to the agent without limits
• Reverse API EngineerCLI
  • Drives a browser, and with the `chrome-mcp` provider works in your real Chrome with saved sessions and cookies
  • Has a model write a client and runs it on your machine, and may install `agent-browser` globally through npm
  • Sends the captured traffic, which can hold tokens and personal data, to the provider of the chosen model
• Reverse Engineering SkillsSkill
  • Removes protection and extracts code from third-party Android and iOS apps
  • Generates and runs Frida and IDAPython scripts, emulates and debugs binary code
• Revit MCPMCP server
  • Runs arbitrary C# code inside your Revit model
  • Creates, changes and deletes project elements
  • Works with a live licensed program on your computer
• RigorPilot SkillsSkill
  • The skill runs commands from someone else's README on your machine with no OS sandbox
  • Approved commands have network access and can download data and weights
  • Writing evidence creates files in the target repository
• RiserFlowMCP server
  • Creates real orders in the store and exports them to Bitrix
  • Stores and encrypts customer personal data, including profile and preferences
• Roblox Studio MCP (community, debugging and playtests)MCP server
  • The agent runs arbitrary Luau in Studio and edits scripts and instance properties in your place
  • The monetization tool creates and changes products and game passes through an Open Cloud key, and window screenshots may capture other screen content
• Robokassa MCP: full API coverageMCP server
  • Tools create invoices, initiate refunds, hold and charge customer cards
  • Keep Password#3 separate and enable Refund API access only when it is actually needed
• Robokassa MCP: payment link and statusMCP server
  • The create_invoice tool builds a real payment link on the shop's behalf
  • Test with ROBOKASSA_TEST before using it in production
• RuSender MCPMCP server
  • OAuth access to the email account
  • The agent can send emails to a real subscriber list, which cannot be undone
  • Tools change sender DNS settings, webhooks and keys
• RufloPlugin
  • Installs hooks and a background daemon that run agents without user input
  • Agents change code and run commands across several worktrees
• Run Gemini CLIWorkflow
  • Edits the repository and leaves comments in the name of a bot
  • The model key secret is stored in the repository settings
  • Model calls are paid
• Russian Post MCP serverMCP server
  • Needs the Russian Post sender account login and password plus a token
  • Tracking and address normalization handle recipient data
  • Does not create or change shipments
• SBER-MCPMCP server
  • Logs into a personal bank account through an unofficial API
  • With the write flag it executes real money transfers
  • The bank may block the account
• SBIS (Saby) API MCP serverMCP server
  • Signs documents with an electronic signature on the employee's behalf
  • Five catalog methods are irreversible, including power-of-attorney operations
• SEC EDGAR MCPMCP server
  • The data feeds financial decisions, misreading it is costly, and it is not investment advice
  • It reaches the external SEC service and needs correctly identified requests
  • The HTTP transport has no authentication and must not be exposed on a shared network
• SEO Skills for AI AgentsSkill
  • The autopilot changes the site repository's files and can merge changes itself after a green build if that mode is chosen
  • The `linkdr` skill leads to paying for link placements through Stripe, with the confirmation left to you
  • The agent requests every page of the site and connects to Search Console, Ahrefs and analytics when they are available
• SSH MCPMCP server
  • Runs commands on remote servers
  • The README names the danger as a combination of private data, untrusted input and outbound network
  • A separate account with minimal rights is needed
• SSH MCP ServerMCP server
  • The agent runs arbitrary shell commands on remote servers
  • Stores SSH passwords and private keys
  • The admin token is printed to logs on first start