// SCAN REPORT

AbraFlexi

64 tools. 36 can modify or destroy data without limits.

12 destructive tools with no built-in limits. Policy required.

Last updated: 12 Aug 2026

36 can modify or destroy data

28 read-only

64 tools total

Verified publisher · catalogue entry checked 04/08/2026

How to control AbraFlexi ↓

TOOL MAP

What AbraFlexi exposes to your agents

Read (28) Write / Execute (23) Destructive / Financial (12)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS

Critical Risk

The most dangerous AbraFlexi tools

Financial · Critical bank_transaction_create The name 'bank_transaction_create' in the context of AbraFlexi (an accounting ERP) indicates this tool creates bank transaction records, which carries financial risk. Financial · Critical invoice_issued_cash_payment The name combines 'invoice_issued' with 'cash_payment', indicating this tool records or processes a payment, which is a financial operation. Financial · Critical invoice_issued_deduct_advance The name contains 'invoice_issued' (a financial document) and 'deduct_advance' (reducing an advance payment), which is a financial transaction. Financial · Critical invoice_issued_deduct_zdd The name strongly suggests a financial operation involving deductions on issued invoices, which could affect monetary obligations or tax records.

36 of AbraFlexi's 64 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control AbraFlexi

PolicyLayer is an MCP gateway — it sits between your AI agents and AbraFlexi, and nothing reaches the server without passing your rules. These are the rules we recommend:

Block financial tools by default

{
  "bank_transaction_create": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Requires human approval."
      }
    ]
  }
}

Financial tools should be explicitly enabled per use case, not open by default.

Deny destructive operations

{
  "contact_delete": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Blocked by default. Requires approval."
      }
    ]
  }
}

Destructive tools should never be available to autonomous agents without human approval.

Rate limit write operations

{
  "changes_disable": {
    "limits": [
      {
        "counter": "changes_disable_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations

{
  "bank_transaction_get": {
    "limits": [
      {
        "counter": "bank_transaction_get_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

Create a free account and register AbraFlexi — nothing to install.
Add these rules — paste them, or build them visually. Tune the limits to your setup.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

ENFORCE POLICY ON ABRAFLEXI →

Instant setup, no code required.

FULL CATALOGUE

All 64 AbraFlexi tools

FINANCIAL 5 tools

Financial bank_transaction_create bank_transaction_create Financial invoice_issued_cash_payment invoice_issued_cash_payment Financial invoice_issued_deduct_advance invoice_issued_deduct_advance Financial invoice_issued_deduct_zdd invoice_issued_deduct_zdd Financial invoice_issued_match_payment invoice_issued_match_payment

DESTRUCTIVE 7 tools

Destructive contact_delete Delete a contact/company from AbraFlexi. Destructive evidence_delete Delete a record from any AbraFlexi evidence. Destructive evidence_delete_attachment Delete an attachment from a record. Destructive evidence_storno Cancel (storno) a document record in any AbraFlexi evidence. Destructive invoice_issued_delete Delete an issued invoice from AbraFlexi. Destructive invoice_issued_unlink_zdd Remove an advance tax document (ZDD) bonding from an issued invoice (Vazby ZDD). Destructive product_delete Delete a product from AbraFlexi.

EXECUTE 1 tools

Execute evidence_perform_action evidence_perform_action

WRITE 22 tools

Write changes_disable Disable change tracking for the current company (Changes API). Write changes_enable Enable change tracking for the current company (Changes API). Write contact_create contact_create Write contact_update Update an existing contact/company in AbraFlexi. Write evidence_attach_file evidence_attach_file Write evidence_batch_insert evidence_batch_insert Write evidence_batch_update evidence_batch_update Write evidence_create Create a new record in any AbraFlexi evidence. Write evidence_export_report evidence_export_report Write evidence_lock evidence_lock Write evidence_lock_for_ucetni evidence_lock_for_ucetni Write evidence_mass_update evidence_mass_update Write evidence_set_label Add a label to a record, keeping its existing labels. Write evidence_unlock Unlock a record in any AbraFlexi evidence. Write evidence_unset_label Remove specific label(s) from a record, keeping the rest. Write evidence_unset_labels Remove all labels from a record. Write evidence_update evidence_update Write invoice_issued_create invoice_issued_create Write invoice_issued_update Update an existing issued invoice in AbraFlexi. Write invoice_received_create invoice_received_create Write product_create Create a new product in AbraFlexi. Write product_update Update an existing product in AbraFlexi.

READ 28 tools

Read bank_transaction_get bank_transaction_get Read call_user_query call_user_query Read changes_get changes_get Read changes_status Check whether change tracking is currently enabled for the current company. Read contact_get contact_get Read contact_get_any_phone contact_get_any_phone Read contact_get_bank_accounts Get the bank account(s) registered for a contact. Read contact_get_cell_phone Get the cell phone number to use for a contact. Read contact_get_notification_email contact_get_notification_email Read evidence_download_attachment evidence_download_attachment Read evidence_get evidence_get Read evidence_get_attachment Get metadata for a single attachment of a record. Read evidence_get_attachment_thumbnail evidence_get_attachment_thumbnail Read evidence_get_labels Get all labels (stitky) currently assigned to a record. Read evidence_get_properties Get the list of properties (fields) supported by an evidence. Read evidence_get_qr_code evidence_get_qr_code Read evidence_get_record_changes Get the change history (Prehled zmen zaznamu) of a single record. Read evidence_get_relations_list Get the list of sub-evidences (relations) available for an evidence. Read evidence_get_reports Get the list of printable reports available for an evidence. Read evidence_get_sum evidence_get_sum Read evidence_list List all available AbraFlexi evidences. Read evidence_list_attachments List attachments (prilohy) of a record in any AbraFlexi evidence. Read invoice_issued_get invoice_issued_get Read invoice_issued_get_email Get the best recipient email address for an issued invoice. Read invoice_issued_get_recipients invoice_issued_get_recipients Read invoice_issued_overdue_days Get the number of days an invoice is overdue by, given its due date. Read invoice_received_get invoice_received_get Read product_get product_get

OTHER 1 tools

Other invoice_issued_link_zdd invoice_issued_link_zdd

EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

FAQ

Questions about AbraFlexi

Can an AI agent move money through the AbraFlexi MCP server? +

Yes. The AbraFlexi server exposes 5 financial tools including bank_transaction_create, invoice_issued_cash_payment, invoice_issued_deduct_advance. Without a policy, an autonomous agent can call these with no spend caps, no rate limits, and no approval flow. PolicyLayer lets you block financial tools by default, require human approval, or set per-tool rate limits — enforced on every call.

Can an AI agent delete data through the AbraFlexi MCP server? +

Yes. The AbraFlexi server exposes 7 destructive tools including contact_delete, evidence_delete, evidence_delete_attachment. These permanently remove resources with no undo. PolicyLayer blocks destructive tools by default so they never reach the upstream server.

How do I prevent bulk modifications through AbraFlexi? +

The AbraFlexi server has 22 write tools including changes_disable, changes_enable, contact_create. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach AbraFlexi.

How many tools does the AbraFlexi MCP server expose? +

64 tools across 3 categories: Destructive, Read, Write. 28 are read-only. 36 can modify, create, or delete data.

How do I enforce a policy on AbraFlexi? +

Register the AbraFlexi MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every AbraFlexi tool call.

Deterministic rules across all 64 AbraFlexi tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON ABRAFLEXI →

Instant setup, no code required.

64 AbraFlexi tools catalogued and risk-classified — across an index of 46,500+ MCP servers.

// WHERE THIS COMES FROM

These policies come from AbraFlexi's registry record.

The record behind this page: verified identity, auth posture, risk grade, every tool classified, recommended policy — re-checked continuously.

Teams ship this data inside their own products. See what a licence covers →