Access levels of skills and MCP servers

Broad access

• monday.com MCPMCP server
  • Creates, changes and deletes items and columns in the workspace
  • Dynamic mode runs arbitrary API mutations
• moysklad-mcp-ruMCP server
  • Write tools create, post and delete documents in live accounting
  • The account token moves stock and money once writing is enabled
• moysklad-mcp-ruMCP server
  • With writes enabled it creates, posts and deletes documents that move stock and money
  • Stores access tokens for several companies' records
• muCLI
  • The agent runs terminal commands and edits files, and in Full access mode it does so without confirmations
  • In Judge mode a judge model grants command permissions, and its mistake lets something through
  • Judge question fields go to an outside service until a local judge is switched on
• multi-agent-shogunWorkflow
  • Ten agents work autonomously: Claude Code starts with the `--dangerously-skip-permissions` flag, meaning no permission prompts
  • The `first_setup.sh` script installs system packages through `sudo apt-get`, edits `~/.bashrc` and connects Memory MCP
  • The ntfy topic name acts as a password: anyone who knows it can read notifications and send messages to the shogun
• myclaudePlugin
  • The installer writes to ~/.claude: CLAUDE.md, commands, agents, skills, a binary and hooks in settings.json, and an update overwrites module files
  • The Codex, Gemini and OpenCode backends edit code and run tests on your machine
  • The tip to set the Codex approval policy to never turns off its confirmation prompts
• n8n MCP ServerMCP server
  • Writes to an external automation system: creates, changes, activates, deletes and runs workflows
  • Takes on the n8n API key's permissions and can affect production scenarios
• n8n Workflow Builder MCP ServerMCP server
  • The n8n key lets an assistant create, overwrite and permanently delete workflows and execution records
  • Workflows it runs can send HTTP requests and use connected services through your credentials
  • Execution data the assistant reads may contain personal data and secrets
• n8n-MCPMCP server
  • With an API key it creates, edits and runs workflows in your n8n
  • Holds an n8n access key
• n8n-skillsPlugin
  • Through n8n-mcp the agent creates and edits workflows and credentials in a live n8n
  • The self-hosting skill configures a server and generates secrets
• nacCLI
  • Threads run commands and edit files on your machine
  • ChatGPT sign-in tokens and provider API keys are stored locally and sent with requests to those services
• no-mistakesCLI
  • The pipeline agent reads the whole branch diff, runs tests and lint and edits the code itself
  • The gate pushes the branch to the remote, opens a PR and uses a guarded force-push to repair CI
  • A background process runs permanently as a system service and keeps runs in a local database
• no_humanPlugin
  • The coder agent writes code and commits in your repository and opens a pull request
  • Review uses your Claude token, and the GitHub Action needs an Anthropic key in repository secrets
  • Tickets and pull request links pass between the tracker, the local server and agents
• notebooklm-pyCLI
  • Authenticates to a Google account and works through undocumented APIs, creating and deleting notebooks
  • Master-token mode is a full-account credential that must be stored carefully
• notebooklm-skillSkill
  • The skill keeps your Google account session in storage_state.json and acts as you in NotebookLM
  • The agent creates and deletes notebooks, and sources and files go to Google
  • A browser and the unofficial web API make network requests that Google may restrict
• nuphus-mcpMCP server
  • The agent gets the same rights as you: mouse, keyboard, clipboard, windows and browser cookies
  • By default write tools run without confirmation until you turn on --confirm-write
• octo-cliCLI
  • Sends messages and mail and edits and deletes documents, spreadsheets and files in the name of a bot or a real person (the `uk_*` token, the `--on-behalf-of` parameter)
  • Stores profiles and tokens in the `~/.octo-cli` directory and reads them from environment variables
  • Goes to the Octo server over the network, and the `octo-cli api` command calls any method of its gateway
• oh-my-agentCLI
  • The install script is piped from the network and installs third-party tools
  • Hooks run project scripts and control agent sessions
• oh-my-claudecodePlugin
  • Autopilot and agent teams write code, run shell commands and edit project files
  • It can run without the user supervising every step
• oh-my-codexCLI
  • Runs agents that execute commands and change code
  • The --madmax mode disables approvals and the sandbox
• oh-my-openagentPlugin
  • Autonomous modes run commands and change code without per-step approval
  • The light edition can enable broader Codex permissions
• oh-my-opencode-slimPlugin
  • Agents read and edit project files and run commands on behalf of OpenCode, with background specialists working in parallel
  • Code and questions go to several model providers at once when the council is used
  • Built-in MCP servers call external documentation and GitHub code search services
• ohmy-seo: MCP servers for Direct, Metrika and WebmasterMCP server
  • Can create, change and pause real Direct campaigns and bids when the write flag is enabled
  • Stores OAuth tokens for ad and analytics accounts in a local database
• oil-iconSkill
  • The setup page stores external service keys in the system credential store
  • Scripts install Python dependencies and may pull a background-removal model
  • The agent calls a paid image generation service when no built-in tool exists
• optim-agentSkill
  • Runs your evaluation command many times: for model training that means hours of compute and money
  • Writes trial logs to the project's .optim-agent-runs folder and appends it to .git/info/exclude
  • In AgentSampler mode launches an installed command-line agent for every trial
• otermCLI
  • The built-in `shell` tool runs shell commands at the model's request with no directory limit
  • The `filesystem` capability reads and writes files in the launch directory, and MCP servers start as separate processes
  • Hosted-provider keys come from the environment and chat text goes to the chosen provider, while web search and URL fetching reach the network
• outlook-mcpMCP server
  • Reads and sends mail, changes calendar and files
  • Handles a client secret and access tokens
  • Can trigger Power Automate flows
• patent-disclosure-skill for Chinese patentsSkill
  • Runs Python scripts and a controlled browser, and for STEP files sets up a separate CadQuery environment
  • Reads confidential invention materials and builds queries to the CNIPA publication site from them
  • Writes Word, Markdown and spreadsheet files into the project's outputs folder and, when configured, into an Obsidian vault
• pbi-cliCLI
  • Commands create, change and delete tables, measures, security roles and report pages in your model
  • The utility runs DAX queries and connects to the data of the open Power BI Desktop model
  • The custom visuals skill runs npm and builds a TypeScript project on your machine
• pentest-ai (ptai)CLI
  • Performs real offensive actions against a target
  • Works with credentials and network services
• pentest-ai-agentsPlugin
  • Offensive agents deal with exploits, payloads and post-exploitation against real targets
  • Shell-capable agents run security tools and network commands on hosts
• pg_probackupCLI
  • Operates on data files and WAL of a production database
  • Restore and backup deletion change data irreversibly
• phiCLI
  • The agent reads and edits project files and runs shell commands, and the `--yolo` flag and `autopilot` mode remove approval prompts
  • The install script runs through curl and bash, and provider keys sit in the `~/.phi/config.yaml` file
  • Skills from a project's `.agents/skills` directory are picked up without confirmation and can carry someone else's instructions
• pi-extensionsPlugin
  • Pi extensions run with your user's full permissions, as the developer warns
  • `pi-accounts` switches subscription OAuth accounts, `pi-sync` uploads settings and optionally sessions to external storage and `pi-dotenv` loads environment variables
  • `pi-langfuse` sends runs, costs and tool calls to Langfuse and `pi-notify` sends reminders to Telegram
• pi-fabricPlugin
  • Agent programs run as the session and call Pi tools, including file writes and commands
  • Choosing CPython or the Node or Bun modes removes the sandbox and gives code OS privileges
  • Agent swarms and recursion multiply model spend, so budgets and depth limits matter
• polyakov-claude-skillsPlugin
  • ssh-remote-connection runs commands on remote servers
  • Direct and Metrika skills access ad accounts and can make changes
  • Requires many API keys and network calls
• portlessCLI
  • Adds its own root certificate to the system trust store and takes port 443 with a sudo request
  • Edits /etc/hosts and can install a root-owned service that starts at boot
  • The --funnel and --ngrok flags expose the dev server to the internet, and --lan opens it to the whole local network
• power-bi-agentic-developmentPlugin
  • Skills and the Fabric CLI change models, publish reports and edit tenant settings
  • Hooks automatically run checks and scripts when files change
• ppt-mcp: PowerPoint MCP with 156 toolsMCP server
  • The agent creates, edits, saves and closes presentations in a running PowerPoint and can load pictures from a URL
  • The server sees the content of all open presentations, so pin the target file with ppt_activate_presentation
• prek skill for agentsSkill
  • The `prek install` command puts shims into the Git hooks directory, and they run on every commit and push
  • prek downloads hooks from remote repositories, builds their environments and runs them, so it executes third-party code
  • Formatters and fixing hooks edit files in the working tree, and `prek update` goes to the network for new revisions
• project-starterPlugin
  • Hooks run scripts and external tools on edits and commits
  • Commands perform git operations up to push and PR creation
• pstackSkill
  • Playbooks run commands, write code and can drive a pull request all the way to merge through GitHub
  • Long-run mode keeps working without asking, and confirmation remains only before irreversible actions
  • Arena, swarm and interrogate launch many subagents on different models at once, which burns limits and money fast
• purple SSHMCP server
  • Without `--read-only` the agent runs commands on your servers over SSH and stops or restarts containers
  • It uses your SSH keys and the configuration in `~/.ssh`, so access is limited only by what those keys open
  • In read mode the agent sees addresses, users and container lists of every host in the config
• pyaterochka-mcpMCP server
  • MCP can trigger real orders and charges after confirmation.
  • Works with private APIs and payment methods.
  • Handles personal data and user session tokens.
• pydantic-deepagentsCLI
  • Runs code and commands, even if in a Docker sandbox
  • Sends data to external models with keys
• python-1c-mcpMCP server
  • Through OData the agent sees all published 1C data, including counterparties and employees, which is personal data
  • Starts a server that reads 1C database data through published OData
  • The package has no tools to create, edit or post documents
• qa-mcp: native 1C TestClient QAMCP server
  • The Windows bridge performs lifecycle operations and bounded desktop input in a real 1C session
  • UI operations and mutations require disposable test data; the README explicitly warns against using production databases
• qqqaCLI
  • The qa command writes files and runs shell commands from the model's answer, and the `-y` flag removes confirmation
  • API keys live in environment variables or `~/.qq/config.json`, and requests, piped data and history fragments go to the chosen model provider
  • The codex, claude_cli and gemini_cli profiles launch the installed binaries of other agents with their authorization
• ralphexWorkflow
  • Edits the repository autonomously
  • Token spending is hard to predict
  • Unattended runs may follow a different billing scheme
• redbookCLI
  • The tool reads Chrome cookies holding the live session of your account and can save them to a file on disk in plain text
  • The commands publish notes, write comments and reply in bulk under your name, and other users see these actions
  • The platform restricts accounts for frequent automated actions, from reduced reach to a ban