// SCAN REPORT

Open Mcp Apps

32 tools. 18 can modify or destroy data without limits.

3 destructive tools with no built-in limits. Policy required.

Last updated: 28 Sept 2026

18 can modify or destroy data

14 read-only

32 tools total

Community server · catalogue entry checked 28/09/2026

How to control Open Mcp Apps ↓

TOOL MAP

What Open Mcp Apps exposes to your agents

Read (14) Write / Execute (15) Destructive / Financial (3)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS

Critical Risk

The most dangerous Open Mcp Apps tools

Destructive · High data_delete_item Permanently deletes data irreversibly; cannot be undone by the tool user. Destructive · High delete_app Permanently removes app registry entries; cannot be undone without restoration. Destructive · High file_delete This tool destroys data irreversibly by permanently deleting files. Execute · High call_function Executes arbitrary code declared by apps with unknown effects and capabilities.

18 of Open Mcp Apps's 32 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control Open Mcp Apps

PolicyLayer is an MCP gateway — it sits between your AI agents and Open Mcp Apps, and nothing reaches the server without passing your rules. These are the rules we recommend:

Deny destructive operations

{
  "data_delete_item": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Blocked by default. Requires approval."
      }
    ]
  }
}

Destructive tools should never be available to autonomous agents without human approval.

Rate limit write operations

{
  "apply_data_writes": {
    "limits": [
      {
        "counter": "apply_data_writes_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations

{
  "app_store_list": {
    "limits": [
      {
        "counter": "app_store_list_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

Create a free account and register Open Mcp Apps — nothing to install.
Add these rules — paste them, or build them visually. Tune the limits to your setup.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

ENFORCE POLICY ON OPEN MCP APPS →

Instant setup, no code required.

FULL CATALOGUE

All 32 Open Mcp Apps tools

DESTRUCTIVE 3 tools

Destructive data_delete_item Delete an item permanently. May return reason:\ Destructive delete_app Delete an app from the registry. Default data:\ Destructive file_delete Permanently delete one file an app has stored.

EXECUTE 1 tools

Execute call_function Run a function an app declares (manifest.functions) — data in, data out, no UI needed. The body is code the ap

WRITE 14 tools

Write apply_data_writes Apply up to 200 writes in ONE transaction — for applying many known rows in one go instead of one call per row Write data_add_item Add an item to a collection. Write data_move_item Move an item to another group and/or position (e.g. kanban column). Write data_update_item Shallow-merge fields into an item (set a key to null to remove it). Uses optimistic concurrency. Write edit_app Surgical edits to an app WITHOUT round-tripping the whole source. Two edit forms, mixable: RANGE {offset, leng Write file_write Store a file for an app (create or overwrite by path). Write file_write_begin Start a chunked upload for a file too big for file_write Write file_write_chunk Append the next chunk of bytes (base64) to an upload started with file_write_begin. Send chunks strictly in or Write file_write_commit Finalize an upload as an app file (create or overwrite by path) — the chunked equivalent of file_write. The up Write install_from_app_store Install (or update) a ready-made app from the built-in App Store into the user Write promote_app Upgrade a kind:\ Write restore_app Roll an app back to one of its earlier checkpoints: re-saves that checkpoint Write save_app Create or update a UI app in the persistent registry. Two slots, each optional on update (an omitted slot keep Write security_set Privileged writer for reserved settings keys (security: / policy:) — the ONLY tool that can write them; the ge

READ 14 tools

Read app_store_list Browse the built-in App Store: ready-made, high-quality apps shipped with the engine that the user can install Read data_changes What happened in a collection after a ledger position YOU hold — including edits the USER made in the widget, Read data_list Read items in full — every field, plus the item id you need to update or delete it. No UI (use open_app for th Read file_list List the files an app (app) has stored — a PAGE of {path, size, mime, version} plus usage totals; limit/cursor Read file_read Read one file an app has stored, as a WINDOW of its bytes: offset/length select it, data_base64 carries exactl Read get_app Read an app Read get_app_guide The authoring contract for creating or editing an app: the window.oma API, the available CSS design tokens, th Read get_app_html Internal: returns raw app HTML plus its trust tier and capability grants for the universal loader widget. Not Read get_data_version The cheapest possible change check: returns the store Read get_ui_preference_schema The engine-owned catalog of SHARED preferences (key, type, label, default, options) that the settings app rend Read list_app_checkpoints List an app Read list_apps List UI apps in the registry (reusable across all chats). Lists the user Read list_data_collections List every data collection that exists (name, item count, last activity). Use when unsure where data lives, wh Read preview_app_store_entry Internal: returns an App Store entry

EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

FAQ

Questions about Open Mcp Apps

Can an AI agent delete data through the Open Mcp Apps MCP server? +

Yes. The Open Mcp Apps server exposes 3 destructive tools including data_delete_item, delete_app, file_delete. These permanently remove resources with no undo. PolicyLayer blocks destructive tools by default so they never reach the upstream server.

How do I prevent bulk modifications through Open Mcp Apps? +

The Open Mcp Apps server has 14 write tools including apply_data_writes, data_add_item, data_move_item. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach Open Mcp Apps.

How many tools does the Open Mcp Apps MCP server expose? +

32 tools across 4 categories: Destructive, Execute, Read, Write. 14 are read-only. 18 can modify, create, or delete data.

How do I enforce a policy on Open Mcp Apps? +

Register the Open Mcp Apps MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every Open Mcp Apps tool call.

Deterministic rules across all 32 Open Mcp Apps tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON OPEN MCP APPS →

Instant setup, no code required.

32 Open Mcp Apps tools catalogued and risk-classified — across an index of 46,500+ MCP servers.

// WHERE THIS COMES FROM

These policies come from Open Mcp Apps's registry record.

The record behind this page: verified identity, auth posture, risk grade, every tool classified, recommended policy — re-checked continuously.

Teams ship this data inside their own products. See what a licence covers →