Access levels of skills and MCP servers

Broad access

• iikoServer MCP: 39 iiko REST API toolsMCP server
  • create_encashment writes a cash movement entry with no separate confirmation
  • raw_request grants access to any iikoServer endpoint, including potentially data-changing ones
• immortal-skillSkill
  • Reads private correspondence and local messenger databases, handling sensitive data
  • Uses platform API tokens and runs Python collectors that access the network
• iphone-useMCP server
  • The agent taps and types in any phone app, including banking apps and messengers
  • Through the screen the agent reads personal data such as messages and Health records
  • The source is under PolyForm Shield: commercial use is limited by the author's terms
• iterm-mcpMCP server
  • Runs arbitrary commands in your terminal
  • No built-in command safety checks
  • Can start and interrupt any process
• itr-walaSkill
  • Handles personal tax documents
  • Runs extraction and decryption scripts
• k-skill: skills for life in KoreaSkill
  • Each skill's instructions are fetched from npm at run time, and the agent itself runs the commands
  • Some skills sign in to accounts (bookings, an employer portal, tax invoices) and take secrets from a password manager or a file
  • Requests go through the developer's shared proxy, and a usage counter goes to PostHog
• kaiten CLI (Swift)CLI
  • The CLI covers cards, automations and other write operations of the Kaiten API
  • Stores the API token in a config file on disk
• kaiten-cliCLI
  • Creates, edits and archives cards in the team's live tracker
  • Stores the Kaiten API token in a config file
  • Uploaded files get a public URL
• kaiten-cli (ViktorOgnev)CLI
  • The kaiten-cli-mutations skill performs write operations on Kaiten cards and data
  • The CLI runs under the user credentials set in its configuration
• kaiten-mcpMCP server
  • Tools create, move, archive and delete cards in a live Kaiten workspace
  • The remote mode encrypts and stores teammates' personal tokens on a third-party Vercel deployment
• kaiten-mcp (ViktorOgnev)MCP server
  • Tools cover write operations across nearly the whole Kaiten API, including roles, groups and automations
  • A shared HTTP server with OAuth grants access to multiple users of one instance, so the config needs careful review
• keenetic-mcp: Keenetic router controlMCP server
  • The agent receives the router admin password and can block devices, bring interfaces down and create networks
  • A careless interface shutdown or segment deletion can cut off your own access to the router
• kiwi-memMCP server
  • Stores the content of your conversations, personal details included, in a database on your server
  • There is no built-in authentication, and a backup can contain API keys
  • Passes all requests to the model provider through its own gateway
• kmcpCLI
  • The controller manages cluster resources
  • The install script runs through the shell
• kmsgCLI
  • Reads your personal and work chats and sends messages and images in your name
  • Requires macOS Accessibility access, meaning control of other apps' windows
  • Automation may lead to an account restriction under the service's rules, and the author places responsibility on the user
• kommo-mcpMCP server
  • The token grants Kommo account administrator rights
  • Tools create and bulk-update leads and can trigger a salesbot on a lead
• kubectl-aiCLI
  • Runs kubectl and bash commands against the cluster
  • Can modify resources, production included
• kubectl-mcp-serverMCP server
  • Runs real kubectl operations against the cluster, including mutating ones
  • Its scope equals the kubeconfig permissions
  • An agent mistake can affect a live cluster
• last30daysSkill
  • Can extract cookies from Chromium-family browsers to access accounts
  • Runs Python scripts and installs additional CLIs
  • Uses third-party API keys
• last30days-cnSkill
  • Keeps login cookies for Weibo, Zhihu, Bilibili and Douyin and API keys on disk and then uses them in requests
  • Reaches eight platforms and the paid services TikHub, jisuapi and Baidu Qianfan
  • Runs Python scripts and opens a Chromium browser during login
• ljg-skillsSkill
  • `ljg-blind` reads yesterday's AI conversations from `~/.codex/sessions`, which may hold personal and work data
  • `ljg-push` runs `git push` over ssh to the author's repository and switches branches of the local clone
  • `ljg-card` installs dependencies and downloads Chromium, and the skills create files and run Bun scripts
• llmwikiPlugin
  • The tool reads the full session histories of all your agents in the home directory, and they can hold keys, passwords and personal data
  • The installer can add a SessionStart hook to ~/.claude/settings.json, and the built site can be published to GitHub Pages
• lsbotMCP server
  • The agent gets shell command execution, file writes and batch deletion and process termination on your machine
  • Scheduled tasks call tools without your involvement, and the install runs a script from a third-party domain
• mancodeCLI
  • Writes agent instruction files into the project: AGENTS.md, Cursor rules, skills
  • The secrets vault injects macOS keychain values into commands you approved
  • The .mancode folder accumulates plans and verification results and may capture sensitive context, so review it before committing
• marketplaces-mcp-ruMCP server
  • Can change prices, stock and orders in seller accounts
  • Stores account API keys locally
  • Methods outside the verified core are imported from specs and not hand-checked
• mcp-1cMCP server
  • The --install command adds an extension and updates the base configuration
  • The agent reads live data and the event log
• mcp-1c test-base serverMCP server
  • exec runs arbitrary BSL code with no restriction at the extension level
  • The author explicitly warns not to publish this on a production base
• mcp-bitrix24MCP server
  • Creates, closes and reopens tasks in a live Bitrix24 portal
  • The webhook carries whatever rights were set when it was created; issue a separate webhook scoped to just the needed methods
• mcp-email-serverMCP server
  • Reads private mail and attachments, and the mailbox password is stored on your machine
  • Can send and forward mail in your name, as well as delete and move messages
  • The email_command tool runs arbitrary IMAP and SMTP commands when the owner enables it for an account
• mcp-google-sheetsMCP server
  • Writes and changes data in your Google Sheets and Google Drive
  • Can grant spreadsheet access to other users by email
  • Handles service account keys or OAuth credentials
• mcp-installerMCP server
  • Installs and runs third-party packages from npm and PyPI
  • Edits the client config and launches arbitrary MCP servers
• mcp-klingMCP server
  • Local files go to a third-party Supabase storage whose address is hardcoded in the server, and get a public link
  • Kling API keys give access to your account's resources
  • Results are downloaded to disk by default
• mcp-logseq: MCP server for LogseqMCP server
  • The agent can create, change and delete pages and blocks of your graph unless a write namespace list is set
  • Notes are read in full, and with hosted embeddings their text is sent to a third-party provider
• mcp-maigretMCP server
  • The server launches Docker containers on your machine at the agent's command
  • Requests to many third-party sites come from your IP, and some sites may rate-limit or block it
  • Reports collect information about people's accounts, so a lawful basis and the account owner's consent matter
• mcp-server-macos-useMCP server
  • The server clicks and types in any app, so the agent can send an email, delete a file or press a pay button
  • Accessibility and screen recording permissions allow reading window contents, including passwords on screen
  • Every response saves a screenshot and the full interface tree to disk
• mcp-server-wereadMCP server
  • WEREAD_COOKIE is your WeRead account session: while the cookie is valid, the server reads the account's data with your rights
  • With CookieCloud the cookies are synced through a server; the documentation names cc.chenge.ink, which you can replace with your own
• mcp-server-yandex-market-sellerMCP server
  • Can change product prices and stock on a live store
  • Can perform actions on orders, returns and shipments
  • The entire API is reachable through the generic ym_execute, including write operations
• mcp-server-yandex-metrikaMCP server
  • Can delete counters, goals, filters, segments and access grants
  • A token with metrika:write scope grants full control over the account's counters
  • Can upload offline conversions and expenses, affecting attribution data
• mcp-telegram (dryeab)MCP server
  • The server writes and deletes messages in your name in private chats, groups and channels
  • The session and API hash open the account's whole correspondence, and downloaded media land on disk
• mcp-telegram (sparfenyuk)MCP server
  • The session opens the account's private conversations: the assistant sees every dialog and message the server returns
  • The API hash and sign-in session give access to the account, and a leaked hash cannot be reissued
• mcp2cliCLI
  • Can call write operations on external APIs, including POST requests and GraphQL mutations
  • Via --mcp-stdio it spawns arbitrary server commands and stores OAuth tokens and secrets in a cache
• mcpcCLI
  • Calls arbitrary tools on connected MCP servers
  • Stores OAuth tokens and bearer keys
  • Supports experimental x402 crypto payments
• mcpoCLI
  • Exposes MCP server tools, which may run commands, over the network
  • Unsafe without an API key and network restrictions
• mcptoonCLI
  • The sync command writes other agents' configs, and importing servers reads their entries
  • Through call and exec the agent calls any connected server and runs code in a sandbox
  • It stores connections and OAuth data: secrets are saved by reference to an environment variable or a file
• md2wechatCLI
  • Creates drafts and uploads images into a WeChat account, that is, writes to an external system
  • Handles WeChat credentials and external service keys
  • Calls a paid API and image generation providers over the network
• mem-agent-mcp: local memory for an agentMCP server
  • The server reads personal notes with details about you and your relatives and runs memory code on your computer
  • In HTTP mode through a tunnel, ChatGPT connects without authentication: the tunnel address opens your memory to anyone who knows it
  • The GitHub and Google Docs connectors need access tokens that must be handled with care
• memX: long-term memory for agentsPlugin
  • Hooks record every dialog turn, and the content goes to the chosen model provider to build the memory
  • The npx install pulls fresh code straight from GitHub without pinning a version, and the provider key goes into the config as plain text by default
  • A local service runs in the background on 127.0.0.1:3878, and the memory holds working facts about the project
• memory-lancedb-proPlugin
  • Auto-capture reads conversation content and saves it to disk, and entries can include passwords and personal data
  • Entry text is sent to the embedding provider, reranker and extraction model under your key
  • The `delete`, `delete-bulk`, `upgrade` and `migrate` commands remove and rewrite the store
• mirroir-mcpMCP server
  • The agent controls a real phone: taps, text input, launching and closing apps
  • The screen can show private messages, mail and banking apps, and screenshots go to the model
  • Without a permissions file only 11 non-mutating tools are available, and action rights are opened by hand
• mlx-serveCLI
  • The MLX Core app's agent mode runs shell commands on the Mac unless the sandbox with an isolated virtual machine is on
  • The server opens port `11234`, and models can be shared across the local network through Bonjour
  • Launchers write agent settings: Codex runs against your own home folder, and the fx entry lands in `~/.fx/settings.json`