Access levels of skills and MCP servers

Broad access

• daymade Skills MarketplacePlugin
  • Skills run external tools and scripts and read session history
  • GitHub and git skills modify repositories
  • Auto-install runs a script downloaded from the network
• dbskillSkill
  • The skills write files into `~/.dbs/` and `~/.config/dbs/` and keep paid keys for the video services
  • They run scripts (update check, key setup, video extraction) and reach the network: GitHub, TikHub, 轻抖
  • Instructions for three-digit codes are pulled from a public GitHub catalog at use time
• decocms-studioPlugin
  • The agent acts in Studio in your name: it reads the organization's chats and files and calls tools that can delete and overwrite data
  • Sharing a file by link opens it to anyone with the link, and when the CLI is not on PATH the latest package version runs through bunx
• delegate-skillsSkill
  • Launches third-party CLI agents that edit the working tree and run commands
  • Some CLIs do not enforce a read-only mode
• dev-browserCLI
  • Runs arbitrary JavaScript in the browser
  • Can attach to the user's browser with logged-in sessions
• didox-skillSkill
  • Performs legally binding actions: signing, accepting, rejecting and cancelling documents
  • Stores the Didox partner token and account password
  • Works with the local signing key via E-IMZO
• docx-mcpMCP server
  • The server creates, edits, merges and saves docx files on disk, including over the original
  • Documents hold personal and commercial data, and the personal-data removal feature is marked experimental
• dotaiSkill
  • `cleanup` removes git worktrees and cache folders with git worktree remove --force, and `test-audit` deletes and rewrites tests
  • `passwords` works with passwords and one-time codes through 1Password and a Keychain token
  • `video-transcripts` uploads video to Gemini and, for private attachments, uses GitHub tokens and Linear cookies
• easyeda-agentSkill
  • Changes the EasyEDA Pro project: creates and edits schematics, boards and libraries and saves files, with no programmatic undo in the editor API
  • Installs the easyeda binary and a background daemon that starts by itself, and installation runs a script from the internet through curl and bash
  • Through the connector extension the agent's commands reach the editor and change the open project
• eda-agentMCP server
  • The agent edits open schematics, boards and libraries and can save documents to disk
  • The `app_` tools simulate real keys and mouse, take focus and act inside the Altium window
  • The autonomous mode drives a project through stages on its own, so the changes can be many
• ego liteSkill
  • The agent acts in the browser under your logins and cookies
  • It can perform actions on sites on your behalf
• email-mcp: an MCP server for IMAP and SMTP mailMCP server
  • The agent reads your correspondence and attachments and sends and deletes email in your name
  • Access needs an app password or an OAuth token, which opens the whole mailbox
• emisarMCP server
  • The agent runs commands on production servers, though only declared actions
  • Policy decides actions and packs: a mistake in it or overly broad host permissions widens the damage
  • The runner install needs sudo and an outbound connection to an external control plane
• fast-agentCLI
  • In shell mode the agent runs arbitrary commands
  • Sends data to the chosen model provider
• fauxnixMCP server
  • Runs translated commands directly in PowerShell on your system, including deleting and moving files
  • The experimental mode replaces Claude Code's built-in Bash tool with a built binary based on node.exe
  • The MCP session holds environment variables and the working directory across calls, including values the agent set itself
• figma-useCLI
  • An unofficial route, breakages on Figma updates are possible
  • Edits your design files
• flow-mcpMCP server
  • The program signs in as your Google account and clicks buttons on the Flow site; the documentation does not discuss the service's rules for such automation
  • Shooting video spends your account credits
  • The local panel and API listen on 127.0.0.1 and are protected by a token in ~/.flow-mcp/token
• freee-mcpMCP server
  • The server can create, change and delete deals, invoices, requests and documents in your accounting system
  • The token opens payroll, employee and tax return data
  • Start with the app's minimum permissions and check the current company before writing
• full MCP for VK APIMCP server
  • In all mode, it enables financially sensitive VK API methods
  • Can publish, send messages, and manage communities if granted permissions
• gcloud MCP ServerMCP server
  • Runs gcloud commands with your account's rights
  • Can delete buckets, objects and backups
• geo-sleuthSkill
  • Runs about twenty Python scripts through uv and drives Chrome or Chromium, and ML packages and model weights are downloaded on first run
  • Reverse image search hands the photo to Baidu and Yandex, and the other scripts call OpenStreetMap and panorama services
  • A dual-use tool: it locates a place from a photo, including someone else's, so personal photos and frames with people require permission
• gf-data-1cMCP server
  • Installs the GTData extension into the 1C base, which needs the base login and password
  • Runs queries on balances, turnovers, catalogs and accounting totals
  • Rejects data-changing queries before they reach the base
• gflow-cliCLI
  • The utility drives a browser holding your Google session, and automation falls under Google's terms
  • Video generation spends account credits, and Flow interface errors can interrupt a batch midway
• gh-axiCLI
  • The tool creates, edits and deletes issues, gists, Actions secrets and variables, triggers workflows and cuts releases under your `gh` token
  • Through `gh-axi api` the agent gets direct GitHub API access with the rights of your login
• gh-imageCLI
  • Reads the encrypted browser cookie store and takes `user_session`, which gives full access to your GitHub account
  • Publishes the chosen files on GitHub under your name, and an upload cannot be removed
  • Calls undocumented GitHub endpoints, and `gh image -- ...` also writes to issues and PRs
• ghealthCLI
  • Access tokens to your health data are stored in plaintext on disk in ~/.config/ghealth
  • Reads sensitive data: heart rate, ECG, glucose, sleep and nutrition
  • Can create and delete exercise, sleep, weight, height and body fat records
• goofish-cli: CLI and MCP for Xianyu (Goofish)CLI
  • Xianyu cookies open the account: the agent can publish and take down items and message buyers in your name
  • Too frequent actions break the marketplace rules and may get the account blocked
• gooseCLI
  • The installer downloads and runs a script
  • The agent runs commands and works with files
  • MCP extensions can access external services
• gplayCLI
  • Ships releases to Google Play production tracks and changes store listings, subscriptions and prices
  • Manages Play Console users and permissions and reads financial reports, purchases and refunds
  • The service account key grants access to every app it is allowed to touch
• gpt2gigaCLI
  • Stores GigaChat credentials and sends the agent's code and session context to GigaChat
  • Client key authorization is off by default, and DEV mode exposes /docs and the /logs endpoints
• gstackSkill
  • Setup runs scripts and builds its own browser
  • Adds hooks to ~/.claude/settings.json and a session-start auto-update
  • Skills create commits and PRs and drive a browser with your sessions
• gwqCLI
  • Commands create and delete worktrees and branches, and remove with a flag forces deletion of an unmerged branch
  • `gwq exec` and `gwq tmux run` run arbitrary commands in the chosen folders
• gwsCLI
  • Gets OAuth access to mail, files and calendar
  • Can send email and modify documents
• h1-brainMCP server
  • The HackerOne API token opens your reports, program scopes and conversations with security teams
  • The briefing from hack puts the agent in offensive mode, and targets may be tested only within an authorized program
  • The personal h1_data.db holds details of vulnerabilities you found, including ones not yet fixed
• ha-mcpMCP server
  • Controls real smart-home devices
  • Uses a long-lived Home Assistant access token
  • Connected users share the server credentials
• hackingtool pluginPlugin
  • Runs pentest tools and network attacks on hosts, including scanners, exploits and secret handling
  • Many commands need elevated privileges and act on real targets; use only with written authorization
• hcomCLI
  • Writes hooks into agent configs
  • Agents launch and kill other agents; with the relay this extends to other devices
• hh-cv-mcp: full hh.ru job-seeker toolkitMCP server
  • apply, chat_send and cv_push write to the live account immediately, with no confirmation or dry-run
  • Access goes through a session cookie rather than an official API, which may violate hh.ru's rules
  • The hhtoken cookie is effectively an account access key and must be kept secret
• hh-mcp-pro: hh.ru via the Android app's OAuthMCP server
  • apply_to_vacancy, apply_two_step and send_message write directly to the live account and employer correspondence
  • Logging in via the official hh.ru mobile app's OAuth instead of your own app may violate the service's terms
  • The token grants broad access to the job seeker's resumes, applications and correspondence
• hh-mcp: hh.ru and hh.kz employer APIMCP server
  • Can invite a candidate and send a message on the employer's behalf (hh_employer_negotiations invite, message_send)
  • Viewing a resume spends a paid employer contact, so a mistaken call costs money
  • The employer OAuth tokens grant broad access to vacancies, applications and candidate resumes
• hh-ru-applySkill
  • Automates applications on your behalf, which may lead to hh.ru account restrictions under its rules
  • Stores the browser session and CV locally, and sends vacancy and CV text to an external LLM via OpenRouter
• hh-ru-apply: hh.ru application automationCLI
  • The hh-apply-chat flow can automatically send an application and a message to the employer unless --dry-run or --no-submit is passed
  • Bulk application automation, per the README's own warning, can lead to hh.ru account restrictions
• homeassistant-mcpMCP server
  • The Home Assistant token opens control of locks, cameras, climate and every other device in the house
  • The tools install and remove add-ons and HACS packages and change automations in the working configuration
  • The HTTP interface on port 3000 exposes home control to network clients until you restrict access to the port
• htmlweb.ru MCP: lookups, checks and paymentsMCP server
  • bind_payment_card and charge_saved_card can bind a card and charge money from it
  • create_topup_card and create_topup_crypto initiate top-ups and monetary operations
  • The key is issued automatically with no strict identity check, up to twice a day per IP
• http1c: MCP server framework for 1CMCP server
  • The demo execute tool runs arbitrary 1C code on the server or thin client
  • Authentication is off by default; anyone reaching the port gets access to every tool
• hyper-mcpMCP server
  • Plugin signatures can be turned off
  • Plugins by http links are not checked by signature
  • There are no stable releases
• iMCPMCP server
  • Opens messages, contacts, calendar and reminders to the agent
  • macOS only
• ida-mcp-rsMCP server
  • Runs IDAPython scripts and can modify the analysis database
  • A reverse engineering tool; use it on your own or authorized binaries
  • Working with untrusted binaries requires environment isolation
• ida-multi-mcpMCP server
  • The py_eval tool runs arbitrary IDAPython inside the IDA process, and patch, patch_asm and put_int change bytes and database data
  • The ida-multi-mcp --install command installs a plugin into the IDA directory and edits the settings of every MCP client it finds
  • The agent analyzes binaries that may include malware samples, so work in an isolated environment
• iikoServer MCP ServerMCP server
  • Can change recipe cards and record cash encashment in the live restaurant system
  • Keeps the iiko login and password in plain text, with SSL verification off by default
  • Raw calls reach any iikoServer endpoint beyond the tool list