// SCAN REPORT

FeatureBoard

215 tools. 124 can modify or destroy data without limits.

15 destructive tools with no built-in limits. Policy required.

Last updated: 12 Aug 2026

124 can modify or destroy data

91 read-only

215 tools total

Community server · catalogue entry checked 05/08/2026

How to control FeatureBoard ↓

TOOL MAP

What FeatureBoard exposes to your agents

Read (91) Write / Execute (108) Destructive / Financial (15)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS

Critical Risk

The most dangerous FeatureBoard tools

Financial · High request_commercial_license This tool initiates a commercial licensing process, which constitutes committing to a financial obligation or contract. Financial · High activate_license Activating a commercial license commits a financial obligation or entitlement, binding a user or organization to licensing terms. Destructive · High cancel_booking Cancelling a booking is an irreversible action that removes a scheduled commitment. Destructive · High cleanup_worktree This tool permanently deletes tickets, which is an irreversible destructive action on project data.

124 of FeatureBoard's 215 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control FeatureBoard

PolicyLayer is an MCP gateway — it sits between your AI agents and FeatureBoard, and nothing reaches the server without passing your rules. These are the rules we recommend:

Block financial tools by default

{
  "activate_license": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Requires human approval."
      }
    ]
  }
}

Financial tools should be explicitly enabled per use case, not open by default.

Deny destructive operations

{
  "cancel_booking": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Blocked by default. Requires approval."
      }
    ]
  }
}

Destructive tools should never be available to autonomous agents without human approval.

Rate limit write operations

{
  "add_attachment": {
    "limits": [
      {
        "counter": "add_attachment_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations

{
  "auto_configure_analytics": {
    "limits": [
      {
        "counter": "auto_configure_analytics_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

Create a free account and register FeatureBoard — nothing to install.
Add these rules — paste them, or build them visually. Tune the limits to your setup.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

ENFORCE POLICY ON FEATUREBOARD →

Instant setup, no code required.

FULL CATALOGUE

All 215 FeatureBoard tools

FINANCIAL 2 tools

Financial activate_license Activate a commercial license. Two modes — provide exactly one: (1) Financial request_commercial_license Start the commercial licensing process. Records the request locally (for the licensor

DESTRUCTIVE 13 tools

Destructive cancel_booking Cancel a scheduled booking by id (from list_bookings), optionally with a reason. Idempotent: cancelling an alr Destructive cleanup_worktree Remove a ticket Destructive delete_task Permanently remove a task from its board. Destructive prune_board Guarded cleanup: deletes ONLY the ticket ids you pass, and only when confirm is true (otherwise returns a dry- Destructive remove_annotation Remove an annotation from an asset by its id (from get_media). Returns the remaining count. Destructive remove_attachment Detach a previously attached file path or URL from a ticket. Destructive remove_company_agreement Delete a contract/license from a company by id. Destructive remove_contact Remove a contact from a company by its contact id (e.g. c1). Destructive remove_media_comment Remove a comment by id (from get_media / list_media_comments). By default its reply subtree is removed too; se Destructive remove_page Delete a sub-page (by slug) and its rendered file. The home page can Destructive remove_product Remove a product from a board Destructive remove_share Delete a share draft by its id (from list_shares). Destructive remove_test_page Delete a test page by name.

EXECUTE 10 tools

Execute commit_feature If git integration is enabled for the project, commit (and optionally push) the current changes in the project Execute create_worktree Create (or reuse) an isolated git worktree for a ticket so several tickets can be worked in PARALLEL - each su Execute deploy_site Re-render the project Execute drift_remediate One-click remediation across a run Execute drift_start Begin a drift-evaluation run over a board Execute eval_model_matrix FBMCPF-148 — run a ticket Execute graduate_project One-command incubator \u2192 dedicated-repo graduation (lifecycle \ Execute set_git_config Enable/configure optional per-project git integration so finished tickets can be committed (and optionally pus Execute start_checks Fire-and-forget: spawn a DETACHED background run of the project Execute validate_packaging Run the build-preflight packaging checks against the project

WRITE 98 tools

Write add_attachment Attach a file path or URL to a ticket (stored as [Attachments: ...] on the ticket line). Idempotent: attaching Write add_company Create a company in the project Write add_company_agreement Record a contract or license on a CRM company (stored on the company, alongside contacts). kind Write add_contact Add a contact (name, email, role, phone) to a company. Contact ids are unique within the company. Write add_crm_message Add an incoming message to the CRM inbox (starts pending review). Useful for logging inbound emails/leads that Write add_decision Append a new ADR to a project Write add_feature Add a feature to a board Write add_features_bulk Add several features at once. Use this after brainstorming: you generate the ideas, this persists them. Return Write add_kb_doc Write a markdown doc into a board Write add_lead Add a sales lead to the project Write add_lead_area Define a circular geographic area (name + centre lat/lng + radius km) for the leads map. leads_map then tags e Write add_lead_interaction Append a touchpoint to a lead Write add_media_comment Add a threaded comment to a gallery asset (a discussion thread, distinct from pin annotations). Pass parentId Write add_page Add or update a sub-page of the project site (rendered to site/<slug>.html), with its own title and sections. Write add_product Add a product to a board Write add_review_comment Attach a PR-style review comment to a ticket (optionally anchored to a file and line). Unresolved review comme Write add_source Save a research source (paper, article, reference) into a board Write annotate_media Add a pin-based comment/annotation to an asset. Optional x/y locate the pin (e.g. 0-1 relative coordinates on Write append_research Capture ONE research finding into a ticket Write append_scratchpad Append a line or block to a board Write apply_site_template Seed the project website from a starter template (landing, docs, blog): sets title/tagline/theme/sections and Write assign_sprint Move one or more tickets into a sprint — sets the sprint:<name> label, replacing any existing sprint label. Write book_meeting Schedule a call, demo, or meeting with a CRM company (and optionally a specific contact within it). Validates Write capture_ask Structure ONE pasted external request — a Slack message, forwarded email body, chat snippet — into a feature o Write check_acceptance Toggle the checkbox on acceptance criterion index (1-based) of a ticket Write close_sprint Close a sprint and generate four audience-specific close-out reports (marketing, sales, technical, executive) Write convert_lead Convert a qualified lead into a CRM company, carrying over its fields (name, website→domain, a notes summary) Write create_campaign Create a marketing campaign with a recipient list and a send batch size. Recipients are validated + de-duplica Write create_project Create a new board folder with empty featurelist.md and buglist.md. Returns the derived ticket prefix. Write create_sprint Create (or update) a named sprint on a board, with optional start/end dates and a one-line goal. Write customer_portal Build a per-customer portal page for a CRM company: their contacts plus the board tickets linked to them (link Write decompose_feature Replace one feature with a set of linked subtasks. You provide the subtasks; this creates them (each linked to Write disable_login_gate Turn off the project site Write dismiss_cleanup_finding Suppress a scan_board_cleanup finding from future scans WITHOUT deleting anything — for false positives or fin Write draft_email Compose and save an email draft in the project mail center (does not send — there is no mail connector; the us Write draft_share Save a reviewable social-share draft for a gallery item — you write the copy, this persists it (never posts). Write drift_record Record a 0–100 fidelity score for one ticket in a drift run (verdict is derived: >=80 aligned, 50–79 partial, Write edit_media Directly edit an existing text/report asset (find/replace, append, or prepend) and save the result as a new ve Write edit_site_section Live editor: patch one website section by index (heading and/or body), or append a new section when index is o Write enable_login_gate Turn on an optional passcode gate for the project Write enrich_lead Record website-sourced details on a lead (only provided fields are set): website, domain, phone, industry, des Write generate_contract Fill a standard contract template with the given fields and return the draft markdown. Optionally auto-fills c Write generate_multi_model_tests For a bug/ticket, fan one generation prompt out across model tiers (default fable, opus, sonnet) — each surfac Write import_tasks Import a backlog from raw text into a board. Accepts a markdown checklist (- [ ] Title: desc), CSV (with a hea Write leads_map Geographic + pipeline rollup for the leads map: mappable points (leads with lat/lng), counts by status and by Write link_customer_ticket Link a board ticket (feature/bug) to a CRM company, stored on the company so it shows in its customer_portal. Write link_tasks Relate two tickets. kind \ Write log_bug Log a bug to a board Write log_heartbeat Append a lightweight in-flight progress ping for a ticket a sub-agent is actively working: a phase/milestone Write log_test_run Record a test run Write log_work Append a work event to the board Write mark_email_sent Record that a draft was sent (moves it into mail history with a sentAt timestamp). Does not actually send — tr Write notify_slack Post a message to THIS project Write open_pull_request Turn a ticket Write plan_budget Map a token budget onto the priority-ordered open queue BEFORE spending it: assigns tickets to days (greedy lo Write plan_work Turn a user request into board items in one step. Optionally creates the project, then adds the features and b Write post_project_update Append a dated narrative status update (Linear-style) to the project Write publish_media_to_site Publish a gallery asset as a page on the project site (media/push-to-blog). A report/HTML/text asset becomes t Write record_campaign_open Record that a recipient opened a campaign (idempotent per recipient) — for when a mail connector or manual ent Write record_dispatch Record who is actively working an In Progress ticket: appended as a Write register_email Store an email address the user explicitly typed and submitted on the tier-picker onboarding screen (the Write repair_duplicate_ids Find ticket ids that appear more than once on a board (legacy data can carry collisions like FBF-491 twice), Write report_company_bug Log a bug reported by a company: creates a board bug (FBB-), links it to the company, and records the report o Write resolve_company_bug Mark a company-reported bug resolved: sets the board bug to Done and flips the company Write resolve_review_comment Mark a review comment resolved by its id (RC-<n>). Idempotent. Once every comment on a ticket is resolved it s Write revert_media Restore a prior version of an asset as the current one. The current copy is archived first, so the revert is i Write review_crm_message Approve or reject a pending CRM inbox message by id. Records the decision and timestamp. Write save_generated_test Ingest the model-generated test variants for a ticket (submit them as variants: [{model, content}]). Tags each Write save_media Save a generated asset into a project Write save_packaging_config Persist the .mcpb packaging metadata for a project (packaging.json): name (slugified), displayName, descriptio Write save_test_page Create/overwrite a standalone HTML test/QA page under the project Write scaffold_site Generate a whole site in one shot from a single spec instead of set_site field-by-field: sets the home page (t Write set_analytics_config Configure which external analytics provider to READ site traffic from (distinct from set_site_analytics, which Write set_branding Set the project Write set_company_products Record which products a company uses/owns (replaces the list; de-duplicated). Surfaced on the company record a Write set_global_config Set FeatureBoard Write set_handoff Write a ticket Write set_lead_status Move a lead along the pipeline (new/contacted/qualified/won/lost). Records the update time. Write set_page_seo Set SEO for the home page (omit slug, or slug= Write set_project_config Update a board Write set_requirements Write a ticket Write set_scratchpad Overwrite a board Write set_site Set the project Write set_site_analytics Add an analytics snippet to every page of the site Write set_standard Set — and LOCK — how much rigor a project Write set_status Move a task between Todo / In Progress / Review / Done. Review sits between In Progress and Done when requireR Write steer_project FBMCPF-317: the churn loop Write submit_crm_intake Capture an inbound support or contact submission (support-info / crm-submit) into the CRM inbox, pending revie Write suggest_packaging AI-gen seed: derive a draft of the .mcpb packaging metadata (name, displayName, description, keywords) from th Write tag_media Add and/or remove custom tags on a media asset (updates the sidecar only — the asset bytes and version history Write unlink_customer_ticket Remove a ticket link from a CRM company. Write update_company_agreement Update a company contract/license by id — e.g. extend a license (new expiresAt), change status ( Write update_contact Edit a contact on a company (only provided fields change). Pass an empty string to clear email/role/phone. Write update_lead_location Set a lead Write update_task Update fields on an existing task. Only provided fields change. Write upload_reference Save a reference/source image under media/uploads/ (base64) to use as input for media generation — kept separa Write upload_site_asset Store an image/asset under the site Write validate_feedback Parse unstructured feedback (user notes, review comments, bug reports) into candidate tickets, each with a sug

READ 91 tools

Read auto_configure_analytics Derive the external analytics read config from the site Read bug_impact_scan Given a bug (by ticket, or an ad-hoc title/description), rank the existing features most likely affected, by k Read check_updates Explicitly check featureboard.ai for a newer FeatureBoard release. This makes exactly ONE outbound HTTPS Read churn_reconcile For Done tickets with tagged commits, compare the additions/deletions logged in the work log against the git-a Read code_file_map Recursively map the project Read company_priority_tickets List a company Read coverage_by_product Roll up, per product, how many of its tickets have at least one recorded test run vs none, so testing gaps are Read daily_plan Plan TODAY: pick the day Read drift_report Aggregate a drift run: per-ticket scores, mean fidelity, verdict counts, drift rate, and — for sampling — a 95 Read estimate_work Per-ticket token estimates for all open tickets, derived from the board Read eval_report Compare board-workflow vs chat-workflow trials using label conventions: experiment:board / experiment:chat mar Read export_audit Unified compliance/traceability export: for one ticket or the whole board, merges the existing audit primitive Read export_metrics Flat-file export of analytics for external BI/spreadsheet use, mirroring export_tasks: what: Read export_tasks Export a board Read generate_test Generate a FULL node:test file (path + content) from a prompt and/or a ticket — one test() block per described Read get_agent_monitor Live snapshot of the board Read get_board Return the FeatureBoard board UI as a self-contained HTML document, ready to render as a Cowork artifact. Read get_branding Return the project Read get_campaign Full campaign incl. recipients, open stats, and the send-batch sizes. Read get_check_results Collect the results of a background static-check run: by runId, else the newest run for a ticket, else the new Read get_company Full company record including its contacts. Throws if the company id isn Read get_email Full email message by id (from list_mail). Read get_git_config Read the project Read get_global_config Read FeatureBoard Read get_health Composite 0-100 health score with grade and breakdown: bug pressure, feature progress, momentum (recent tokens Read get_kb_doc Read one kb doc Read get_live_activity Read-only git/filesystem ground truth about what coding sub-agents are doing RIGHT NOW, for one project or Read get_media View one media asset: its metadata, size, and (by default) content — UTF-8 for text/report assets, base64 for Read get_metrics Read-only snapshot: feature/bug counts by status, completions by date, and velocity from the work log (tokens, Read get_project_config Read a board Read get_rag_explorer Return the Research RAG Explorer UI as a self-contained HTML document, ready to render as a Cowork artifact — Read get_regressions Regression view: bugs grouped under the feature they Read get_requirements Read a ticket Read get_scratchpad Read a board Read get_site Read the project Read get_site_traffic Read proxy for site traffic: fetch the configured provider Read get_source Read one source Read get_sprint_report Read the close-out reports written by close_sprint. With no sprint: list sprints that have reports. With a spr Read get_steering_status FBMCPF-319: read-only observability into the steering loop for a project — WITHOUT running or mutating a pass Read get_task Get the full details of a single task by its ticket ID (e.g. FBF-12). Read get_test_page Read one test page Read get_test_runs Read recorded test runs (most-recent first) plus a summary: total runs, latest result, and whether the latest Read get_ticket_diff Capture the code changes made for a ticket: find commits in the project Read get_ticket_history Full audit timeline for one ticket: recorded field-change events (status moves, priority moves, label/sprint c Read get_timeline_data Per-ticket worked spans for the board Read get_work_log Read work-log entries, most-recent first. Optionally filter to one ticket. Returns entries plus a velocity rol Read get_work_packet Assemble a focused brief for one ticket before you work it: scope, linked-issue details, code location + custo Read license_status Report the current licensing state: usage tier, whether writes are allowed, and (for a commercial trial) time Read list_bookings List bookings for the board, newest-first. Filter by company or status ( Read list_campaigns List marketing campaigns (newest-first) with summary stats (recipients, opens, open rate, batch count). Read list_code_files List files and folders under the project Read list_companies List the project Read list_contract_templates List the standard contract templates (NDA, MSA, SOW, commercial license) with their required fields. Read list_crm_inbox List CRM inbox messages (newest-first), optionally filtered by status (pending/approved/rejected), company, an Read list_decisions Read a project Read list_kb_docs List a board Read list_lead_areas List the defined geographic lead areas (id, name, centre, radius). Read list_leads List leads (newest-first), optionally filtered by pipeline status and/or company. Read list_mail List mail (newest-first), optionally filtered by status (draft/sent) and/or company. Sent items form the mail Read list_media List a project Read list_media_comments List an asset Read list_pages List the site Read list_projects List all boards (projects) under the configured boards folder. Read list_references List the reference/source images under media/uploads/ (inputs for generation). Read list_review_comments List review comments for a project, optionally scoped to one ticket, with their resolved state. Set includeRes Read list_shares List saved share drafts (newest-first), optionally filtered by asset and/or platform. Read list_site_assets List the assets stored under the site Read list_site_templates List the available starter website templates (landing, docs, blog) the builder can start from. Read list_sources List a board Read list_sprints List a board Read list_tasks List features and/or bugs on a board, most-recent first. Filter by type, status, product, label, or search. Read list_test_pages List the standalone HTML test pages under test-pages/. Read list_test_variants List the per-model test variants present for a ticket (test/<ticket>.<model>.test.js) and which model tiers co Read list_variations List the gallery assets that share a variation group id (alternatives generated from one prompt), for side-by- Read list_worktrees List the git worktrees for a project Read next_task Return the next open ticket to work (status Todo or In Progress), so you can pull work one item at a time. Pre Read next_wave The PLURAL of next_task: return the whole dispatchable set at once, already partitioned into file-disjoint lan Read predict_due_dates Estimate when open work will complete by dividing the backlog by the board Read prepare_research FBMCPF-263: deterministically assemble a research REQUEST packet for a ticket BEFORE implementation (no model Read rag_search FBMCPF-264/315: local retrieval over this board Read read_code_file Read a file under the project Read routing_scorecard Which model tier should actually run your tickets, measured instead of guessed (FBMCPF-351). Scores every Done Read scan_board_cleanup Read-only deep-clean scan: finds likely-duplicate tickets (grouped by title similarity, each group nominating Read scan_test_cleanup Read-only deep-clean of the project Read search_kb Keyword search across a board Read search_media Search/filter a project Read suggest_file_split Given an oversized source file (see code_file_map Read suggest_test_stub Generate a boilerplate test file (path + node:test content) for a ticket, derived from its title/description a Read test_runs_by_suite Organize recorded test runs (from log_test_run) by suite: each suite Read ticket_customers Reverse lookup: which CRM companies a board ticket is linked to (surfaces the ticket↔customer relationship). Read voice_lint Score text for AI-writing tells (overused lexical items like \

OTHER 1 tools

Other set_usage_type smoke

EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

FAQ

Questions about FeatureBoard

Can an AI agent move money through the FeatureBoard MCP server? +

Yes. The FeatureBoard server exposes 2 financial tools including activate_license, request_commercial_license. Without a policy, an autonomous agent can call these with no spend caps, no rate limits, and no approval flow. PolicyLayer lets you block financial tools by default, require human approval, or set per-tool rate limits — enforced on every call.

Can an AI agent delete data through the FeatureBoard MCP server? +

Yes. The FeatureBoard server exposes 13 destructive tools including cancel_booking, cleanup_worktree, delete_task. These permanently remove resources with no undo. PolicyLayer blocks destructive tools by default so they never reach the upstream server.

How do I prevent bulk modifications through FeatureBoard? +

The FeatureBoard server has 98 write tools including add_attachment, add_company, add_company_agreement. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach FeatureBoard.

How many tools does the FeatureBoard MCP server expose? +

215 tools across 4 categories: Destructive, Execute, Read, Write. 91 are read-only. 124 can modify, create, or delete data.

How do I enforce a policy on FeatureBoard? +

Register the FeatureBoard MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.