Access levels of skills and MCP servers

Broad access

• amoCRM MCP with protection against destructive writesMCP server
  • With WRITE_ENABLED=true the agent can create and edit deals, contacts, tasks and files
  • With DANGEROUS_WRITE_ENABLED on, the agent can delete records, though only with explicit confirm on each call
• amoCRM MCP: run via npx with no cloneMCP server
  • The amocrm_request tool can call any API method, including deletes
  • Creates and updates leads, contacts and companies
• amuxCLI
  • Agents run autonomously, including overnight, with access to working directories and commands on your computer
  • Installing through `curl ... | bash` downloads code and, with your consent, installs Rust and tmux
  • Agent actions are approved from the dashboard and a phone, so access to the dashboard must be protected
• apktool-mcp-serverMCP server
  • Reads and modifies decoded Android app code and resources
  • A reverse engineering tool; use only on your own or authorized apps
  • Aimed at finding vulnerabilities and secrets, which requires authorization
• aprovodkaMCP server
  • Creates, edits and posts documents in a production 1C database
  • The write gate is off by default
  • The 1C user login and password sit in the config
• aurlune Yandex Music player MCP serverMCP server
  • Uses a Yandex Music token to like tracks and download them on your account
  • Runs an mpv-based player daemon and controls playback
• avito-mcpMCP server
  • Can send messages to buyers and change listing prices
  • Promotion tools spend money from the account balance
  • full_access mode is the default
• avito-mcp with multiple accountsMCP server
  • Can send messages on your behalf and change listing prices
  • The server access secret is embedded in the connector URL
• avito-mcp-pluginPlugin
  • Scraping public pages instead of the official API carries legal risk, as the README itself states
  • Uses proxy rotation and works around the site's anti-bot protections
• avito-mcp-ruMCP server
  • 22 methods write data, including messenger replies and stock changes
  • Two methods are irreversible, and OAuth2 keys for several accounts are stored locally
• awwwards-mcpMCP server
  • Launches a browser, opens arbitrary links, downloads page scripts and saves them to disk
  • The build_project tool writes project files to disk, and the optional auto-update installs new package versions in the background
• b24-hqSkill
  • The headless agent runs arbitrary code in your repo and commits changes without constant supervision
  • Federation mode lets one person spend another person's token budget up to a set limit
• baoyu-skillsSkill
  • Publishes posts to social networks on the user's behalf
  • Some skills use unofficial access to web services
• base (basemode)CLI
  • base hooks fire at every step of the agent's turn and add data to its context
  • The installer runs as curl piped to sh and executes downloaded code
• bb-browserCLI
  • Acts as your logged-in sessions and can operate on sites as you
  • Runs arbitrary JS in your browser and captures network traffic
  • Avoiding anti-bot detection may violate service terms
• bilibili-cliCLI
  • The tool takes Bilibili cookies from Chrome, Firefox, Edge or Brave and saves login data to a file
  • The like, coin, triple, unfollow, dynamic-post and dynamic-delete commands act on behalf of your account
  • Requests go to a third-party service, and frequent calls trip Bilibili's protection
• bitrix-mcpMCP server
  • Creates, changes and deletes deals, tasks, files and events in a live portal
  • The webhook is a bearer credential for the whole portal
  • Starts business processes and sends messages to employees
• bitrix24-mcpMCP server
  • Tools create and delete CRM items and tasks
  • bitrix_call allows calling any API method, not just read-safe ones
• bitrix24-mcp by RCS: a commercial server with audit loggingMCP server
  • Can modify and delete CRM records: destructive operations require client confirmation, but access is granted by a license key, not just webhook scopes
  • Reads call recordings and open-line conversations with clients, which are sensitive communications
• bldMCP server
  • The agent runs project build commands, which execute arbitrary Java code and tests on your machine
  • If the build defines a publishing task, the agent could push artifacts to Maven Central
• botmuxCLI
  • Every chat message starts a terminal agent with access to your working directory and shell commands
  • The web terminal gives write access to a live agent session from a phone or browser
  • The wizard creates a Lark app, grants it permissions and publishes a version, and the daemon can start with the system
• browser-searchSkill
  • CloakBrowser changes the browser fingerprint and passes bot-protection checks: use it only on sites and data you have a right to access
  • The agent runs JavaScript on third-party pages and launches Docker containers and a proprietary Chromium binary
  • Page texts from the web may carry harmful instructions aimed at the agent
• bsl-agent-mcpMCP server
  • The pay and deposit_btc tools move wallet funds, even if only on testnet
  • Below the SPEND_CAP_SATS limit, operations go through without extra user confirmation
• bsl-ai-toolkitSkill
  • Edits metadata and configuration code with apply into a test database
  • Reaches into database data and operations systems
  • Uses ssh, scp and credentials via environment variables
• catbusCLI
  • Sends requests as your account and can publish, like, follow and send direct messages
  • Keeps platform sessions and cookies in ~/.catbus/, and under risk control the account can be restricted or banned
  • Passes platform checks: reproduces a browser fingerprint and solves slider captchas itself, so use it on your own accounts and public data
• cc-fleetCLI
  • Installs and updates a binary from the network
  • Spawns agent processes on third-party providers
  • Handles provider keys and subscriptions
• cdek-mcpMCP server
  • In production it creates and cancels real orders and courier pickups billed under your contract
  • Holds CDEK API secrets
• chengfeng-videocutPlugin
  • Downloads and runs a separate Runtime and installs background user services
  • Processes and writes local media files, and bug reporting creates a GitHub issue after confirmation
• chrome-cdpSkill
  • The agent gets access to tabs where you are signed in to mail, GitHub and work services and sees their content
  • The eval, click and type commands run code and actions on real pages with your rights
  • Enabled Chrome remote debugging opens a port through which the browser can be controlled while it is on
• claude-bughunterPlugin
  • Includes offensive techniques and vulnerability exploitation chains
  • Runs recon tools and network commands against targets
  • Intended only for authorized testing, with responsibility on the user
• claude-code-cache-fixCLI
  • The proxy sits on the path of every Anthropic API request and can read and rewrite them and the responses, your prompts and code included
  • Forward-proxy mode terminates TLS for api.anthropic.com with a local CA the client must trust
  • The proxy listens on a port on your machine, and running it as a service keeps it up permanently
• claude-code-schedulerPlugin
  • Registers tasks with the system scheduler: they run `claude -p` as you even when no session is open
  • Autonomous mode adds `--dangerously-skip-permissions`, and the agent edits files and runs commands without confirmation
  • In worktree mode changes are committed and pushed to the remote; start with read-only tasks
• claude-dashboardPlugin
  • Reads credentials: the Claude Code token from the macOS Keychain (from .credentials.json on Linux and Windows), the sign-in files ~/.codex/auth.json and ~/.gemini/oauth_creds.json and the Antigravity token. The plugin uses them only to ask the providers' own APIs for remaining limits, and the tokens do not go to third parties
  • The SessionStart hook checks and corrects the statusLine entry in Claude Code settings at every session start
  • The setup-alias command appends a check-ai alias to the shell settings
• claude-faceless-shorts-creatorSkill
  • Uses paid ElevenLabs and fal.ai keys from the `.env` file and spends money on voice and video models
  • Runs Python tools, `npm` and `ffmpeg` that write files across the project
  • Downloads and installs `rembg` and Chromium for collage layers
• claude-grc-engineeringPlugin
  • Connectors reach AWS, GCP, Azure, Okta, Slack, Datadog and other systems with your credentials and collect evidence from them
  • Generation commands produce remediation code, policies and evidence packages that land in your project
• claude-opsPlugin
  • Access to mail, Slack, payments and analytics
  • The wizard installs a background daemon and programs
  • Keys of several services are needed
• claude-osintSkill
  • Runs active external recon against real targets: subdomain enumeration, port scanning, secret hunting
  • Executes network tools and scripts on the host
  • Usable only with written authorization for the scope
• claude-redSkill
  • Guides offensive actions against systems
  • Use without the target owner's authorization is illegal
  • Assumes a trained professional
• claude-supermemoryPlugin
  • Automatic capture sends the content of your agent conversations to the external Supermemory service
  • The pre-save secret filter does not catch every token and password and does not check explicit MCP calls at all
  • Hooks run at every session start, prompt and stop, launching Node scripts on your machine
• claude-weeekPlugin
  • Creates, edits and completes tasks in a live workspace
  • The token grants full access to the WEEEK workspace
• claude-youtube-editorSkill
  • Scripts upload videos to YouTube from your account through OAuth
  • The pipeline uses AssemblyAI, ElevenLabs and Gemini keys from the .env file and sends audio and frames to those services
  • The agent runs Python, Node and ffmpeg inside the project folder
• clihubCLI
  • Through `--stdio` it launches an arbitrary command to ask the server for its tool list, generates Go code and compiles it
  • Stores OAuth tokens and keys in `~/.clihub/credentials.json` and accepts them through command-line flags
  • Generated programs call the server's tools, including writing ones, on behalf of your account
• cmuxCLI
  • Its CLI and socket API send keystrokes to terminal panes where commands run
  • The agent drives the built-in browser by script: clicks, fills forms, evaluates JS
  • Imports cookies and sessions from Chrome, Firefox and Arc, so browser panes start signed in
• codex-authCLI
  • Reads and changes Codex auth files with access tokens
  • A wrong switch can leave the wrong account active
• codex-provider-syncCLI
  • Edits Codex session files and the SQLite database
  • The author does not guarantee that an old session can continue
  • The Windows desktop version is unsigned
• coding-tools-mcpMCP server
  • Runs shell commands in the workspace
  • Can expose remote network access to the workstation
• comandaCLI
  • Workflows launch coding agents and shell commands that write files in the repository
  • Parallel branches and unbounded loops spend provider tokens until a gate passes
• copperheadCLI
  • The agent edits project files and records changes in git
  • It runs kicad-cli and calls an external model with your key or a saved login
  • ERC and DRC do not replace an engineer's sign-off, so review the result before ordering boards
• cost-xrayCLI
  • Intercepts all of the agent's API traffic, including prompts and file contents
  • Runs as a background service with autostart
  • Installing by an internet script runs someone else's code
• dao-codeCLI
  • Runs commands and edits project files
  • Sends code to an external model with a key