Access levels of skills and MCP servers
The access level of every catalog entry and the reasons behind it. The level shows what a tool adds to what the agent can already do. It does not rate code quality.
Broad access
- Workopia MCP ServerMCP server
- Your resume with personal data goes to the Workopia server for tailoring and letters
- Saves jobs and results to an account on the service side
- X API MCP (xmcp)MCP server
- The agent publishes and deletes posts, likes, follows and sends messages as the account: write tools are on until an allowlist is set
- The app key, secret and token sit in `.env`, and debug flags can print user tokens
- The server listens on local port 8000 and any MCP client connected to it gets every enabled tool
- YCLIENTS MCP serverMCP server
- Tools create, change and delete records, staff and clients in the company's live database
- The partner token grants broad access to the company's YCLIENTS data
- YCLIENTS MCP serverMCP server
- Can create, edit and delete clients, staff and appointments
- The partner and user tokens grant broad access to the company's YCLIENTS data
- YClients tools create and change bookings, clients, cash transactions, fiscal receipts and inventory
- The Ozon server bypasses anti-bot protection by emulating a browser to read the storefront
- Start with a read-only token if YClients offers one
- The agent can run arbitrary JavaScript and fill and submit forms in real tabs with the user's active login sessions
- Access extends to every open tab, including email, banking and other sensitive services if they are open
- YaAllMCP server
- The Direct server changes bids, campaigns and ads, affecting budget spend
- Needs several tokens with access to ads, analytics, mail and disk
- Search API requests are paid
- YadMCP server
- Sends and deletes email on the mailbox owner's behalf
- Deletes Disk files and publishes them via public links
- Stores app passwords for a personal Yandex account
- The tools delete files on Disk, delete messages, and change Messenger chat membership
- Yandex Ads MCP ServerMCP server
- Creates campaigns and changes bids and budgets in the live account, spending money
- Uploads customer CRM data such as emails and phones to Audiences
- Safety modes are off by default
- Yandex Audience MCPMCP server
- Can irreversibly delete a segment or change someone else's access to it
- Uploads personal data from a CRM: emails, phone numbers and hashed identifiers
- Yandex Calendar MCP server over CalDAVMCP server
- Adding or removing an attendee sends a real invitation or cancellation email that cannot be recalled
- Deleting events is irreversible on Yandex's side, though a local trash copy remains
- Yandex Calendar MCP with a setup CLIMCP server
- The update and delete event tools are explicitly called destructive by the author's own code and require an explicit scope
- It creates, edits and deletes events and whole calendars, though deletion requires explicit confirmation
- Deleting a calendar by a wrong or stale URL could hit the wrong data, so the URL is re-checked against a fresh list
- The server can send mail on the user's behalf and change calendar events and contacts
- Yandex Cloud MCP ServersMCP server
- Creates and changes billable cloud resources
- Operates with permissions to modify infrastructure
- Yandex Direct For AllPlugin
- Can change ad campaigns with budget after approval
- Stores OAuth tokens for Direct, Metrika and amoCRM
- Paid Search API requests cost money
- After approval it can start and stop A/B experiments and package strategies
- Can grant access to Library objects and delete segments with no way to restore them
- Yandex Direct MCPPlugin
- Changes bids, budgets and campaign states in an ad account
- Includes finance operations: top-ups, invoices and transfers between accounts
- Stores a Yandex OAuth token and a live session
- Leaking MCP_SECRET grants full account access, including irreversible campaign deletion
- Creates, suspends and archives campaigns, groups, ads and keywords
- Once DIRECT_ALLOW_WRITES is set, it opens 80 changing and 16 deleting Direct methods
- Deletion and archiving in Direct are irreversible, and real money sits on the other end
- Yandex Direct MCP server (npm)MCP server
- Creates and changes campaigns, ads and bids in the live ad account
- Can spend real budget when sandbox mode is not enabled
- Yandex Direct MCP server in RubyMCP server
- Creates, edits and archives real ad campaigns and ads
- Manages campaign bids and budget, so an agent mistake causes real spending
- With confirm=True it actually creates, pauses and archives campaigns
- Bulk-changes keyword bids with real money
- Yandex Direct MCP with launch policiesMCP server
- Creates new ad campaigns with a real client budget
- The agency OAuth token grants access to real Yandex Direct data and actions
- Yandex Direct MCP with two access modesMCP server
- The local mode changes ad settings in a live account and can affect spend
- The OAuth token auto-refreshes and grants long-lived account access
- The 79 actions cover creating, changing and archiving campaigns, ads and keywords
- Runs against the live account; no built-in dry-run is described in the README
- Yandex Direct MCP: 59 toolsMCP server
- The resume, moderate_ads and update_campaign tools start real serving and spend budget
- 12 tools are marked DESTRUCTIVE and delete objects with no way to restore them
- Yandex Direct MCP: hardened forkMCP server
- With writes enabled it changes campaigns, ad groups, ads and bids in a live account
- Finance tools top up balances and transfer money between accounts
- Stores the user's OAuth token locally
- Yandex Direct SkillSkill
- Can create and change campaigns, bids and ads in a real ad account
- Spends ad budget through the API, so an agent mistake causes real charges
- Scripts suspend and resume delivery of campaigns, ads and keywords
- Sends ads to moderation, after which real serving begins
- After approval it can change representative access and account financial settings
- Covers API applications and account transfers, i.e. credential and rights operations
- Can propose, and after approval carry out, budget and campaign changes
- Works with an advertising account's spend and conversion reports
- The script can perform real writes to Direct with the --execute flag, including creating ads and campaigns
- It requires a Direct token with access to the live account
- Review the payload in preview mode first and confirm campaigns are created stopped
- Creates and changes real campaigns, bids and budgets in the live account
- The autopilot can bulk-change bids without manual review of every step
- Creates, edits and deletes campaigns, ad groups, ads and bids, spending ad budget
- Uploads offline conversions and costs to Metrica
- Read-only and confirm safety modes are off by default
- The Direct skill supports add, update, delete, suspend, resume and moderate methods, so it can change ad campaigns directly
- Yandex Disk MCP (Antiloop)MCP server
- Can delete files permanently and empty the trash
- Can make files publicly accessible
- The token grants access to the whole disk
- Yandex Disk MCP server for ClaudeMCP server
- Allows permanently deleting files from the Disk
- Uploads arbitrary files from external URLs to the user's Disk
- The server's only protection is a URL secret with no expiry
- Can change prices, stock, orders, promo codes and publish the storefront of a real store
- The store token is passed in chat when the session has no secrets support
- Yandex MCPMCP server
- Direct supports controlled campaign changes when enabled
- Tests cover Metrika write scenarios, indicating write operations exist
- Wordstat and the Search API spend a metered Yandex Cloud quota
- Yandex MCPPlugin
- Direct tools change live ad campaigns and bids, affecting ad spend
- Uses OAuth tokens with write access to Metrika, Webmaster and Direct
- Yandex MCP ServerMCP server
- Changes bids, budgets and strategies, which spends ad money
- Can permanently delete campaigns, ads and counters
- Holds OAuth tokens with write access
- Yandex Mail MCPMCP server
- The agent can send mail on your behalf
- The agent reads private mail and can move and delete messages
- The app password is stored in plain text in .env
- Yandex Mail MCP serverMCP server
- Connects to Yandex Mail over IMAP with an app password and reads messages
- Creates drafts and moves messages to trash, there is no sending
- The plugin can send emails and replies on the user's behalf, though only after explicit draft confirmation
- IMAP and SMTP access gives visibility into the account's whole correspondence
- Yandex Metrika + Direct MCP ServerMCP server
- Can create, change and delete shared negative keyword sets applied across several campaigns at once
- Can add or fully replace negative keywords at the campaign level
- Stores tokens for multiple ad accounts in one .env file
- Yandex Metrika MCP with DuckDBMCP server
- Downloads raw visit logs with visitor identifiers via the Logs API and stores them locally
- The agent runs DuckDB SQL queries over those logs
- Writes nothing to Metrica, needs an OAuth token
- 62 management tools create, edit and delete counters, goals, filters and access grants
- A token with metrika:write can change settings on live counters
- Yandex Search MCP via browser automationMCP server
- Works around Yandex's automated-request protection using cookies and browser stealth mode
- Using a shared or borrowed account risks that account being blocked by Yandex
How we set the access level
MethodologyThe editors set the level and the reasons from the README, the way the tool runs and the permissions it needs. Reading project files the agent can already see does not raise the level. There is no automatic code audit yet.