Munin MCP Policy · 242 Tools

POLICY

How to control Munin

PolicyLayer is an MCP gateway — it sits between your AI agents and Munin, and nothing reaches the server without passing your rules. These are the rules we recommend:

Block financial tools by default

{
  "cancel_subscription": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Requires human approval."
      }
    ]
  }
}

Financial tools should be explicitly enabled per use case, not open by default.

Deny destructive operations

{
  "analytics_revoke_tracker": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Blocked by default. Requires approval."
      }
    ]
  }
}

Destructive tools should never be available to autonomous agents without human approval.

Rate limit write operations

{
  "analytics_create_tracker": {
    "limits": [
      {
        "counter": "analytics_create_tracker_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations

{
  "analytics_export_config": {
    "limits": [
      {
        "counter": "analytics_export_config_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

Create a free account and register Munin — nothing to install.
Add these rules — paste them, or build them visually. Tune the limits to your setup.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

ENFORCE POLICY ON MUNIN →

Instant setup, no code required.

FULL CATALOGUE

All 242 Munin tools

FINANCIAL 2 tools

Financial cancel_subscription Cancels one of the calling customer’s subscriptions at the end of the period. Financial outreach_withdraw_proposal Retract one pending outreach proposal that should no longer be reviewed — a duplicate draft, a prospect who tu

DESTRUCTIVE 16 tools

Destructive analytics_revoke_tracker Revoke the API key bound to a tracker. After this, the key is rejected by the ingest endpoints — any pages sti Destructive analytics_rotate_tracker_key Revoke any active Destructive bookings_cancel_booking Cancel an existing booking by Destructive bookings_cancel_my_booking Cancel one of the calling end-user’s own bookings by Destructive cms_delete_asset Delete an asset and remove the underlying file from storage. Fails with a conflict if the asset is still refer Destructive cms_delete_collection Delete a collection. Cascades to all entries, versions, and references. Destructive cms_delete_entry Delete an entry. Cascades to its versions and references. Destructive connectors_delete_connection Delete a connection and its stored credentials. Lookups through this connection stop working immediately. Destructive conv_delete_attachment Permanently delete an image attached to a conversation message. The stored file is erased. An attachment on a Destructive conv_rotate_widget_key Revoke any active widget keys bound to this channel and mint a fresh Destructive crm_delete_segment Delete a segment. Outreach campaigns referencing it will fail until reassigned. Destructive kb_delete_document Delete a knowledge-base document. Pass Destructive kb_dismiss_curation_candidate Reject a curation candidate: deletes the draft from the Destructive outreach_cancel_scheduled_send Call off a scheduled outreach send before the worker delivers it, returning the proposal to Destructive slack_unlink_user Remove a Slack-user ↔ Munin-member link. Their next thread reply or button click is rejected until re-linked ( Destructive webhooks_delete Delete a webhook. Pending deliveries are cascade-deleted; in-flight HTTP attempts finish their current run.

EXECUTE 8 tools

Execute conv_request_callback Place an outbound phone call to the contact in this conversation. Use this only when the user has asked to be Execute conv_retry_delivery Re-queue the outbound delivery of an outgoing message that permanently failed to send. Outbound email and SMS Execute conv_send_email_channel_test Send a real test email through this channel Execute conv_send_sms_channel_test Send a real test SMS through an SMS channel (Twilio, MessageBird), addressed to Execute conv_test_email_channel Test an email channel\ Execute conv_test_voice_sms_channel Verify a voice or SMS channel’s stored credentials with its vendor (no message sent). The result shape is vend Execute outreach_approve_proposal Approve one pending outreach proposal, authorizing it to go out: an initial proposal creates the outbound conv Execute seo_submit_urls Submit up to 500 URLs on a verified property to the search engine for (re)crawling, e.g. after publishing or u

WRITE 98 tools

Write analytics_create_tracker Create a tracker and mint a public Write analytics_import Import analytics Write analytics_rotate_tracker_identity_secret Mint a fresh HMAC secret for verifying visitor-identity claims sent to Write analytics_update_tracker Update a tracker Write bookings_create_booking Create a booking in the connected booking system for a guest email at a date and time, for a given party size. Write bookings_create_my_booking Create a booking for the calling end-user at a date and time for a party size. The booking is made under the e Write bookings_update_booking Change an existing booking (date, time, party size, or note) by Write bookings_update_my_booking Change one of the calling end-user’s own bookings (date, time, party size, or note) by Write cms_complete_asset_upload Mark a previously-requested asset upload as complete. Write cms_create_collection Define a new collection. Fields is an ORDERED array of { name, type, required?, options? } — field order is th Write cms_create_entry Create a new entry in a collection. Write cms_create_locale Add a locale. Code is ISO 639-1 (e.g. Write cms_import Import CMS Write cms_publish_entry Flip an entry to status= Write cms_request_asset_upload Mint a presigned upload for a new asset. Only usable from clients that can issue raw HTTP PUT/POST themselves. Write cms_restore_version Roll an entry back to an earlier version. Creates a new current version with that historical data. Returns the Write cms_schedule_publish Schedule an entry to flip to published at a future ISO 8601 datetime. The schedule worker drains due rows ever Write cms_set_default_locale Set which locale is treated as the org\ Write cms_unpublish_entry Revert an entry to status= Write cms_update_collection Patch a collection. When supplied, Write cms_update_entry Update an entry. Pass Write cms_upload_asset_from_base64 Upload a small asset inline as base64 (≤100 KB decoded). The right choice when you have generated the asset in Write cms_upload_asset_from_url Fetch a publicly reachable HTTPS asset and store it as a CMS asset in one call. Use this when your runtime can Write connectors_create_connection Create a connection to a third-party system. Write connectors_set_allowed_tools Replace the set of tools a connected custom MCP server exposes to customers. Pass the exact tool names from co Write connectors_update_connection Rename, activate/deactivate, or reconfigure a connection. When passing Write conv_assign_conversation Assign a conversation to a user (pass user id) or unassign (pass null). Useful for routing escalated conversat Write conv_change_status Change a conversation\ Write conv_configure_email_channel Create or update an email channel Write conv_configure_redaction Set how inbound conversation text is treated when it contains a national identity number. Applies to messages Write conv_configure_voice_sms_channel Create or update a voice or SMS channel for any supported vendor. Pass Write conv_create_topic Add a new conversation topic. Slug must be lowercase letters, digits, hyphens. The optional description define Write conv_create_widget_channel Create a chat-widget channel and mint a widget API key ( Write conv_import Import conversation Write conv_request_channel_credentials Return a one-time link a human opens to enter a channel’s secret credentials in the dashboard — secrets are ne Write conv_request_human Flag the current conversation as needing human attention. Use this when you can\ Write conv_rotate_widget_identity_secret Generate a fresh per-channel HMAC secret used to verify browser-side Write conv_send_message Append a message to a conversation. Pass Write conv_set_subject Set a conversation Write conv_set_topic Tag a conversation with one of the org\ Write conv_set_topic_automation Set the automation mode for one topic. A topic mode overrides the per-conversation mode for every conversation Write conv_strip_message_signature Replace an inbound message Write conv_update_topic Rename a topic, rewrite its description, or change its colour. Omitted fields are left alone. The description Write conv_update_widget_channel Update a chat-widget channel\ Write crm_apply_merge_proposal Atomically apply a pending merge proposal: copies Write crm_bulk_create_contacts Bulk-create contacts with dedupe + compliance checks: rows whose email or phone already match a do_not_contact Write crm_change_deal_stage Move a deal to a new stage. If the destination stage is a won/lost terminal, Write crm_create_company Create a new company. Write crm_create_contact Create a new contact. Search with crm_lookup_contact first to avoid duplicates. Write crm_create_deal Create a new deal in a pipeline. If Write crm_create_pipeline Create a new sales pipeline with at least one stage. Stages are inserted in array order; mark a stage Write crm_create_segment Create a saved contact segment. Write crm_dismiss_merge_proposal Mark a pending merge proposal as dismissed (the operator decided these are not the same person). The next CRM Write crm_import Import CRM Write crm_log_activity Record an activity (note / call / email / meeting / task) against a contact, company, or deal. If Write crm_log_my_activity Record an activity attributed to the calling end-user agent (e.g. a voice agent logging Write crm_propose_merge File a structured proposal that two contacts are the same person. Pass Write crm_set_address_deliverability Record whether mail can reach an email address. Write crm_set_ai_summary Set the AI-generated summary and/or next-action for a contact, company, or deal. These live in dedicated colum Write crm_set_contact_consent Record the lawful basis and source for contacting this person. Required before they can appear in any outreach Write crm_update_contact Update fields on a contact. Only keys present in Write crm_update_my_contact Update the calling end-user\ Write crm_update_segment Patch a segment: rename, edit description, or replace the filter. Write feedback_approve Approve a feedback item: transmits the contents to Munin developers and records who approved it. Attribution i Write feedback_create_item Submit feedback about Munin. Stays local until an org admin approves or dismisses it. Set includeOrgName / inc Write feedback_vote_on_roadmap_item Cast this instance\ Write identity_resolve Find the end-user identity that an email address, phone number, external id, or analytics visitor id belongs t Write kb_create_document Create a knowledge-base document inside a space. Body should be markdown. Set Write kb_create_space Create a new knowledge-base space. Slug must be unique within your org and only contain lowercase letters, dig Write kb_import Import knowledge-base Write kb_import_website Crawl a public website and populate the knowledge base from it: one KB document per page. Runs asynchronously Write kb_propose_curation_candidate File a draft FAQ-style document into the Write kb_publish_curation_candidate Promote a reviewed curation candidate into a target KB space as a new document. Copies the doc to the target s Write kb_publish_curation_revision Apply a reviewed revision candidate to the document it revises, as a new version of that document, then remove Write kb_restore_version Roll a document back to an earlier version. Creates a new current version with that historical content. Return Write kb_update_document Update a knowledge-base document. Pass Write outreach_create_campaign Create an outbound-campaign definition. Operators write Write outreach_dismiss_proposal Dismiss one pending outreach proposal without sending, optionally recording a reason. The decision (actor and Write outreach_import Import outreach Write outreach_propose_reply File a drafted reply to an inbound message on an outreach-originated conversation, for human approval. The con Write outreach_update_campaign Patch fields on a campaign — rename, swap segment, adjust cadence, toggle enabled, toggle the automation flags Write outreach_update_proposal Rewrite the draft on one pending outreach proposal in place, keeping the same proposal id, campaign, and conta Write slack_disconnect Disconnect the org\ Write slack_send_test_message Post a test message to the configured default Slack channel to verify the connection end-to-end. Fails with a Write slack_set_routing Point conversation mirroring at a Slack channel. purpose Write social_create_post_draft Store a single social post draft for a person to review and publish. Use this to hand over any piece of text m Write social_dismiss_post_draft Close a draft nobody intends to publish, optionally recording why. Dismissing one variant leaves the rest of i Write social_mark_draft_posted Record that a draft was published by hand on the platform itself, optionally with the permalink. Use this when Write social_propose_post_set Store several drafts of the same post as one reviewable set, each with its own label for the angle it takes. T Write social_publish_post_draft Publish a pending draft to the platform from the calling person Write social_set_post_draft_link_placement Move the link of a draft that has not been decided yet between the post body and the first comment. Posting th Write social_set_post_draft_media Attach an image or video to a draft that has not been decided yet, or clear the one it carries by passing a nu Write social_update_post_draft Replace the body of a draft that has not been decided yet. The platform character limit is re-checked against Write system_alerts_acknowledge Mark an alert as acknowledged. Does not resolve it; only signals that someone is on it. Write system_alerts_resolve Manually resolve the open alert for the given source+subject. Writers normally self-resolve; use this when the Write webhooks_create Create a webhook subscription. Write webhooks_rotate_secret Generate a new Write webhooks_update Patch a webhook subscription. Pass only the fields you want to change. Replacing

READ 118 tools

Read analytics_export_config Export this org\ Read analytics_export_events Export this org\ Read analytics_get_contact_journey Chronological list of page-view and search events recorded for one identified visitor. Pass either Read analytics_get_funnel Compute a conversion funnel over page-view events: how many distinct visitors reached each ordered step, and w Read analytics_get_subject_engagement View counts, unique visitors, and average dwell/read-depth for one subject (e.g. one CMS entry) over a recent Read analytics_get_views_over_time Daily view + unique-visitor counts over a recent window. Returns one row per UTC day, ordered oldest → newest, Read analytics_list_referrer_hosts External traffic sources grouped by the host portion of Read analytics_list_top_countries Visitor and view counts grouped by ISO 3166-1 alpha-2 country code over a recent window. Requires the backend Read analytics_list_top_subjects List the most-viewed subjects (CMS entries, landing pages, etc.) over a recent window. Use this to see what co Read analytics_list_trackers List analytics trackers for the current org with their key prefix, allowed origins, and revocation state. Plai Read analytics_list_traffic_sources Views and unique visitors grouped by Read analytics_list_zero_result_searches List recent public search queries that returned zero results. The single best input for Read bookings_check_availability List open time slots for a date and party size at the connected booking system, so you can offer real times be Read bookings_get_my_booking Fetch one of the calling end-user’s bookings, including party size, start time, and duration. Identify it by Read bookings_list_guest_bookings List a guest’s bookings by email (most recent first), e.g. while handling their support conversation. Read bookings_list_my_bookings List the calling end-user’s restaurant/venue bookings (most recent first). Scoped server-side to the email on Read bookings_lookup_booking Fetch one booking for a guest email, including party size, start time, and duration. Identify it by Read cms_export Export this org Read cms_get_collection Read one collection by id or slug, including its field definitions. Read cms_get_entry Read one entry in full, including complete long-text fields. Data is projected through the collection Read cms_get_preview_link Mint a signed, short-lived (1 hour) preview link for one entry so a draft can be viewed on the customer fronte Read cms_link_translation Move an entry into the translation group of another entry in the same collection, so the two are recognized as Read cms_list_asset_usage List everything that uses the given asset: CMS entries under Read cms_list_assets List media-library assets in your org. In hosts that support MCP Apps this renders a thumbnail gallery with pe Read cms_list_collections List CMS collections (content types) defined for your org. Scaffolding a frontend from Lovable/Bolt/v0/Replit/ Read cms_list_entries List entries as summaries: identifiers, status, derived title, short fields verbatim, and long text shortened Read cms_list_entry_translations List every locale variant of one entry — the entries sharing its translation group — with each variant Read cms_list_inbound_references List entries that link to the given entry. Useful before deleting — see Read cms_list_locales List configured locales for your org. The default locale is used when an entry omits one. Read cms_list_versions List all prior versions of an entry, newest first. Read cms_search_entries Hybrid full-text + semantic search across CMS entries. Each hit carries a match excerpt, the derived title, an Read cms_unlink_translation Detach an entry from its translation group and give it a fresh group of its own. Its former siblings keep thei Read commerce_get_my_order Fetch one of the calling end-user’s orders, including line items and shipment tracking. Identify it by Read commerce_get_product Fetch one published product from the connected store, including description and per-variant price and availabi Read commerce_list_customer_orders List a customer’s recent store orders by email (newest first), e.g. while handling their support conversation. Read commerce_list_my_orders List the calling end-user’s recent store orders (newest first). Scoped server-side to the email on the end-use Read commerce_lookup_order Fetch one order for a customer email, including line items and shipment tracking. Identify the order by Read commerce_search_products Search the connected store’s live product catalog by name or SKU. Returns published products with price range, Read connectors_get_authorize_url Return the vendor OAuth link that grants Munin access for a connection, for vendors that authorize by redirect Read connectors_list_connections List this org’s connections to third-party systems with domain, non-secret settings, active state, and the res Read connectors_list_server_tools List the tools a connected custom MCP server offers, each flagged with whether it is currently exposed to cust Read connectors_list_vendors List the third-party systems Munin can connect to, grouped by domain (commerce, bookings, seo) with the config Read connectors_request_credentials Return a one-time link a human opens to enter a connection’s secret credentials in the dashboard, so the secre Read connectors_test_connection Verify a connection’s stored credentials against the vendor with a read-only probe (no external data is change Read conv_export Export this org Read conv_get_conversation Read one conversation including every public + internal message. Read conv_get_email_open_stats Aggregate email open tracking per email channel over a recent window (default 30 days, max 365). Returns for e Read conv_get_redaction_policy Read this org Read conv_list_channel_options Discover the selectable options a channel’s vendor offers using the channel’s stored credentials — e.g. Threll Read conv_list_channels List conversation channels of every kind configured for your org — email, chat (widget), SMS and voice. Read conv_list_conversations List conversations for your org, newest activity first. Filter by status (open / snoozed / closed / spam), ass Read conv_list_topic_automation List every conversation topic with its automation mode ( Read conv_list_topics List conversation topics (Billing, Support, Refunds, …) for your org, each with the description its operators Read conv_list_voice_sms_vendors List the voice/SMS channel vendors you can configure, with each vendor’s Read conv_redact_existing_messages Apply the org Read conv_request_handover Flag a conversation as needing human attention. Use this when you have reached the limit of what you can resol Read conv_search_messages Substring search over message bodies. Returns the matching messages newest first; use conv_get_conversation to Read crm_export Export this org Read crm_get_contact Read one contact, including AI fields, tags, custom fields, and compliance flags. Read crm_get_my_contact Read the CRM contact linked to the calling end-user. RLS restricts visibility to that single row. Read crm_get_segment Read one segment, including its filter definition. Read crm_list_activities List CRM activities filtered by contact, deal, or company. Read crm_list_address_deliverability List email addresses this org can no longer reach, newest state change first. Deliverability is separate from Read crm_list_companies List companies in your org. Read crm_list_contacts List contacts in your org, newest-updated first. Filter by company or tag. Read crm_list_contacts_in_segment Resolve a segment to its current contacts. ALWAYS excludes suppressed contacts (do_not_contact OR unsubscribed Read crm_list_deals List deals, optionally filtered by pipeline or stage. Read crm_list_merge_proposals List CRM merge proposals, defaulting to Read crm_list_pipelines List sales pipelines for your org with their stages in position order. Read crm_list_segments List saved contact segments. A segment is a named CRM filter — used as the audience for outreach campaigns and Read crm_lookup_contact Find an existing contact by email and/or phone before creating a new one. Returns null if no match. Read crm_search_contacts Substring search across name, email, phone, and title. Returns contacts ordered newest-updated first. Read feedback_dismiss Dismiss a pending feedback item, optionally recording a reason. Nothing is sent to Munin; the item is kept, wi Read feedback_get_item Read a single feedback item by id. Read feedback_list_pending_items List feedback items in the local outbox awaiting admin action. Read feedback_search_roadmap Search the public Munin roadmap for items matching a query. Call this before feedback_create_item to find an e Read get_invoice_link A short-lived link to one of the calling customer’s invoices. Read get_opening_hours Support opening hours. Needs no customer identity. Read identity_get Read one end user with a cross-channel summary: which channel types they have written on, how many conversatio Read kb_export Export this org\ Read kb_get_document Read one knowledge-base document, including its full body, tags, Read kb_get_document_by_slug Read a knowledge-base document by its space slug and document slug — used when a stable identifier (e.g. Read kb_get_website_import_status Check the progress of a website import started with Read kb_list_curation_candidates List pending curation candidates awaiting review — drafts filed into the Read kb_list_curation_decisions List curation candidates that were already decided — dismissed (with the reason, when one was given) or publis Read kb_list_documents List knowledge-base documents in your org, newest-updated first, with each document\ Read kb_list_spaces List knowledge-base spaces in your org. Read kb_list_versions List all prior versions of a knowledge-base document, newest first. Read kb_propose_curation_revision File a proposed new body for a document that already exists, into the Read kb_search Search the knowledge base by natural-language query. Combines full-text search and vector similarity for the b Read list_subscriptions The calling customer Read outreach_export Export this org Read outreach_get_campaign Read a single campaign by id, including brief and cadence rules. Read outreach_get_proposal Read one outreach proposal by id, including the full curator Read outreach_list_campaigns List outbound-campaign definitions for this org. Each row carries the brief, the targeted CRM segment, the ema Read outreach_list_due_followups List outreach conversations whose next sequence step is due now. A row is returned when the campaign is enable Read outreach_list_proposals List drafted outreach proposals, newest first. Defaults to all statuses and to 25 rows; pass Read outreach_propose_first_touch File one first-touch outreach draft per (campaign, contact) for human approval — an email body, an SMS body, o Read outreach_propose_followup File a drafted sequence follow-up (step N of the campaign Read ping Verify the MCP pipe; echoes a message and returns the resolved org id, org name and actor type. Read seo_inspect_url Fetch what the search engine knows about one URL on a verified property: whether it is indexed, plus whichever Read seo_list_pages List the property’s pages by search impressions over a date window, each with impressions, clicks, ctr and avg Read seo_list_properties List the verified sites the connected search-engine account can report on. Use it to discover the Read seo_list_queries List the search queries a property was impressed and clicked for, aggregated over a date window and sorted by Read slack_get_install_url Return the Slack OAuth link that connects a Slack workspace to this org. The link must be opened and approved Read slack_get_status Show the org\ Read slack_link_user Manually link a Slack user (U… member ID) to a Munin org member so their thread replies and button clicks are Read slack_list_channels List the public channels in the org Read slack_list_user_links List the Slack-user ↔ Munin-member links used to attribute thread replies and button clicks. Links are created Read social_get_post_draft Read a single social post draft by id, including its tracked share URL. Read social_list_connected_accounts List the people in this organisation who have connected a social account Munin can post from, with the platfor Read social_list_platforms List the social platforms Munin can draft posts for, with the character and link limits each one enforces. Rea Read social_list_post_drafts List social post drafts for the org, newest first. Filter by platform, status, or the set id that groups the v Read system_alerts_get Read a single alert by id. Read system_alerts_list List operational alerts for the org. Defaults to open alerts only; pass includeResolved to see history. Read webhooks_list List all webhook subscriptions for your org. Secrets are not returned — they are only shown once at creation. Read webhooks_list_deliveries List delivery attempts for one webhook, newest first. Each row has attempt count, statusCode, durationMs, erro Read webhooks_list_event_types List the known event type strings emitted across modules (cms, crm, kb, conv, outreach, system). Use the retur

EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

FAQ

Questions about Munin

Can an AI agent move money through the Munin MCP server? +

Yes. The Munin server exposes 2 financial tools including cancel_subscription, outreach_withdraw_proposal. Without a policy, an autonomous agent can call these with no spend caps, no rate limits, and no approval flow. PolicyLayer lets you block financial tools by default, require human approval, or set per-tool rate limits — enforced on every call.

Can an AI agent delete data through the Munin MCP server? +

Yes. The Munin server exposes 16 destructive tools including analytics_revoke_tracker, analytics_rotate_tracker_key, bookings_cancel_booking. These permanently remove resources with no undo. PolicyLayer blocks destructive tools by default so they never reach the upstream server.

How do I prevent bulk modifications through Munin? +

The Munin server has 98 write tools including analytics_create_tracker, analytics_import, analytics_rotate_tracker_identity_secret. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach Munin.

How many tools does the Munin MCP server expose? +

242 tools across 4 categories: Destructive, Financial, Read, Write. 118 are read-only. 124 can modify, create, or delete data.

How do I enforce a policy on Munin? +

Register the Munin MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Munin

What Munin exposes to your agents

The most dangerous Munin tools

How to control Munin

All 242 Munin tools

Related servers

Questions about Munin

Enforce policy on every Munin tool call.