// SCAN REPORT

Frontmcp

210 tools. 107 can modify or destroy data without limits.

11 destructive tools with no built-in limits. Policy required.

Last updated: 7 Jul 2026

107 can modify or destroy data

103 read-only

210 tools total

Community server · catalogue entry checked 07/07/2026

How to control Frontmcp ↓

TOOL MAP

What Frontmcp exposes to your agents

Read (103) Write / Execute (68) Destructive / Financial (11)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS

Critical Risk

The most dangerous Frontmcp tools

Destructive · High clear-audit-log Audit logs are critical for security, compliance, and accountability. Destructive · High notes-reset This tool permanently removes all notes without an undo mechanism. Destructive · Medium clear-replay-buffer Clearing a replay buffer removes historical data that cannot be recovered. Destructive · Medium clear-session-notifications Clearing captured notifications removes data that cannot be recovered after the operation, making it a destructive action.

107 of Frontmcp's 210 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control Frontmcp

PolicyLayer is an MCP gateway — it sits between your AI agents and Frontmcp, and nothing reaches the server without passing your rules. These are the rules we recommend:

Deny destructive operations

{
  "clear-audit-log": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Blocked by default. Requires approval."
      }
    ]
  }
}

Destructive tools should never be available to autonomous agents without human approval.

Rate limit write operations

{
  "activities-log": {
    "limits": [
      {
        "counter": "activities-log_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations

{
  "activities-list": {
    "limits": [
      {
        "counter": "activities-list_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

Create a free account and register Frontmcp — nothing to install.
Add these rules — paste them, or build them visually. Tune the limits to your setup.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

ENFORCE POLICY ON FRONTMCP →

Instant setup, no code required.

FULL CATALOGUE

All 210 Frontmcp tools

DESTRUCTIVE 11 tools

Destructive clear-audit-log Clear all audit log entries Destructive clear-replay-buffer Clear the replay buffer for a channel Destructive clear-session-notifications Clear captured notifications for a session Destructive crm-reset Reset CRM store to initial seed data (for testing) Destructive delete-vault-entry Delete an authorization vault entry Destructive notes-reset Clear all notes from the store (for testing) Destructive remove_job Remove a dynamic job by name. Destructive remove_workflow Remove a dynamic workflow by name. Destructive reset-stats Reset execution statistics for fresh testing Destructive secret Set/get/list/delete a session secret via this.secureStore Destructive users-delete Delete a user from the CRM

EXECUTE 29 tools

Execute admin_action Admin action not allowed by any skill - used for authorization testing Execute admin-background-job Admin-only background job. Authority check runs before task creation. Execute admin-only A tool restricted to admin role (RBAC roles.any) Execute browser_test A tool defined in the browser Execute build-shell Build an HTML shell with CSP, data injection, and optional bridge runtime Execute cancellable-wait Sleeps up to maxMs unless the task runner aborts us. Execute cold-start-test Tests cold start behavior in serverless environments Execute concurrency-mutex A mutex tool (maxConcurrent: 1, no queue) Execute concurrency-queued A mutex tool with queue (maxConcurrent: 1, queueTimeout: 3s) Execute deploy_application Deploy application to specified environment Execute emit-app-event Emit an app event to the ChannelEventBus for testing channel sources Execute execute_job Execute a registered job by name. Supports inline (synchronous) and background execution. Execute execute_workflow Execute a registered workflow by name. Supports inline and background execution. Execute expensive-operation Simulates an expensive computation with caching enabled Execute experimental-agent Experimental tool gated behind experimental-agent flag (disabled) Execute gated-acme Runs only when the per-session Execute load-component Resolve a UI source (npm, import, or function) into a loadable component Execute long-running-task Simulates a long-running task with progress notifications Execute node_runtime_tool Tool only available in Node.js runtime Execute non-cached Simulates a computation without caching Execute platform-test-full Full UI tool with all options for comprehensive platform testing Execute register_job Register a dynamic job that runs in a sandboxed environment. Execute session-isolation Test session isolation between different clients Execute simulate-file-event Simulate a file system event for the file-watcher channel Execute simulate-incoming Simulate an incoming message from the messaging service (for testing) Execute standalone_deploy_tool Tool only available in standalone deployment Execute test-progress-method Tests the this.progress() method for sending progress notifications Execute trigger-progress Send a progress/log notification to the client Execute trigger-resource-change Trigger a resource list changed notification

WRITE 39 tools

Write activities-log Log a new activity for a user Write add Adds two numbers together Write add-credential Add a credential to an authorization vault entry Write add-numbers Adds two numbers together Write admin-memo File an admin-only memo. Requires the Write authorize-app Authorize an application for a vault entry Write channel-reply Reply to a notification channel. Use this to send a message back through a two-way channel Write complete-pending-auth Complete or cancel a pending incremental auth request Write complete-task Mark a task as completed Write counter_increment Increment the counter using plugin context extension (this.counter) Write create-event Create a new calendar event Write create-note Create a new note Write create-pending-auth Create a pending incremental auth request Write create-task Create a new task Write create-vault-entry Create a new authorization vault entry for a user/client Write generate_offer_letter Generate a PDF offer letter for a candidate with compensation details. Write github_add_comment Add a comment to a GitHub pull request Write html-card Generate an HTML card component Write html-table Generate an HTML table from data Write increment-counter Increment a session-scoped counter to verify state continuity Write manage-channel-subscription Subscribe or unsubscribe a session from a specific channel Write mdx-doc Generate an MDX document with sections Write push-targeted-notification Push a channel notification targeted to a specific session (simulates job/agent completion) Write register_workflow Register a dynamic workflow with step definitions. Write register-test-session Register a fake session with channel capability for isolation testing Write remember_this Remember something for later. Store a value that can be recalled in future conversations. Write remember-value Store a value in session memory Write resolve-imports Rewrite bare import specifiers to CDN URLs using esm.sh resolver Write send-channel-notification Manually send a notification through the channel system Write send-message Send a message through the messaging service. The recipient will receive it and may reply, which will appear a Write sendElicitationResult Submit user response for a pending elicitation request. Write set-session-data Store data in the session Write slack_notify Send a notification message to a Slack channel Write store_set Store a key-value pair using the GLOBAL DataStoreService provider Write update-session-state Update transport session state Write update-vault-entry Update an authorization vault entry Write users-create Create a new user in the CRM Write users-update Update an existing user

READ 103 tools

Read activities-list List activities, optionally filtered by user Read activities-stats Get activity statistics Read analyze-text Analyze text and return statistics Read beta-search Beta search tool gated behind beta-search flag (enabled) Read big-report Expensive report generator, task-only. Read check-config Check if a config key exists and get typed values Read check-flag Programmatically check a feature flag via this.featureFlags Read check-memory Check if a memory exists Read check-session Check current session and retrieve state Read combined-guard A tool with rate limit, concurrency, and timeout guards Read confirm-action Demonstrates simple confirmation elicitation. Asks user to confirm an action before proceeding. Read crash Intentionally kills the worker process to exercise orphan detection. Read current_platform_tool Tool matching the current OS platform Read debug_providers Debug tool that reports provider resolution details Read default-true Tool with object-style featureFlag ref and defaultValue: true for a non-existent flag Read echo Echoes the input back with node metadata Read editor-or-admin A tool accessible to editors OR admins (anyOf combinator) Read elicit-secret Ask the calling client for a secret via elicitation. Read employee_directory Browse the employee directory with optional filters by department and status. Returns structured employee data Read employee_profile View a detailed employee profile card with tenure and salary information. Read fetch-types Fetch TypeScript .d.ts type definitions for given import statements Read flaky Returns isError: true on demand; validates task failure propagation. Read forget Forget a previously remembered value. Read forget-value Forget a previously stored value Read get_deployment_mode Returns only the deployment mode from runtime context Read get_job_status Get the execution status of a job run by runId. Read get_machine_id Returns the current machine ID Read get_runtime_context Returns the full runtime context (platform, runtime, deployment, env) Read get_workflow_status Get the execution status of a workflow run with per-step results. Read get-all-config Get all environment variables (returns count, keys, and a sample) Read get-app-info Get application info from GLOBAL scope provider (singleton) Read get-audit-log Retrieve the audit log entries Read get-auth-info Returns current auth context (for testing) Read get-cache-stats Get execution statistics to verify cache behavior Read get-config Get an environment variable value with optional default Read get-credentials Get credentials from an authorization vault entry Read get-data Retrieves data by key from mock database Read get-replay-buffer Get the replay buffer contents for a channel Read get-request-info Get request info from CONTEXT scope provider (per-request instance) Read get-required-config Get a required environment variable (throws if not found) Read get-session-data Retrieve data from the session Read get-session-info Get current session information and request count Read get-session-notifications Get all channel notifications received by a specific session Read get-user-input Demonstrates text input elicitation. Asks user to provide text input. Read get-vault-entry Retrieve an authorization vault entry by ID Read github_get_pr Get details of a GitHub pull request Read github-repos List GitHub repositories using upstream OAuth token Read github-user Get GitHub user information using upstream OAuth token Read greet Greets a user by name Read headcount_by_department Show a bar chart of headcount broken down by department. Read hybrid-status Generate a hybrid status widget with pre-rendered shell and dynamic data. Read isolated-hello A simple hello tool in the isolated standalone app Read list_jobs List registered jobs with optional filtering by tags or labels. Read list_memories List all remembered keys in a scope. Read list_workflows List registered workflows with optional filtering by tags or labels. Read list-events List all calendar events Read list-notes List all notes Read list-reply-log List all replies received by the chat-bridge channel (for testing two-way communication) Read list-sent-messages List all messages sent through the messaging service (for testing) Read list-tasks List all tasks Read markdown-list Generate a markdown list Read markdown-report Generate a markdown report Read mdx-interactive Generate an interactive MDX component with custom components Read multi-step-wizard Demonstrates multiple sequential elicitations. A wizard that collects name and color preference in two steps. Read node-info Returns information about the current node Read org_chart Generate a Mermaid-based org chart showing the reporting structure. Read parent-hello A simple hello tool in the parent/root scope Read permissions-required A tool requiring specific permissions (RBAC permissions.all) Read ping Health-check tool that is always available (excluded from consent) Read platform-test-basic Basic UI tool for platform testing Read profile-multi A tool using multiple profiles (authenticated AND matchTenant) Read public-note Echoes a message. No authorities — accepts any authenticated caller. Read rate-limited A rate-limited echo tool (3 requests per 5 seconds) Read react-chart Generate a React bar chart visualization. Returns interactive chart with data points. Read react-form Generate a dynamic React form component. Returns interactive form with configurable fields. Read react-weather Get weather with a React widget UI (FileSource bundled). Read read-credential Read a per-session credential via this.credentials Read recall Recall something that was previously remembered. Read recall-value Recall a previously stored value from memory Read rollback_deployment Rollback deployment to previous version Read salary_distribution Show a pie chart of salary band distribution across employees. Read SearchMintlify Search across the Mintlify knowledge base to find relevant information Read serverless-info Returns deployment environment information Read session-info Get information about the current transport session Read slow-echo Sleeps then echoes. Reports the PID that actually executed the tool. Read slow-operation Delays response by specified milliseconds - useful for timeout testing Read slow-tool A slow tool that inherits the default 5000ms app timeout Read slow-weather Pretend-slow weather lookup — both synchronous and task-augmented callable. Read static-badge Generate a static badge widget. Uses static serving mode (pre-rendered HTML). Read store_get Get a value from the GLOBAL DataStoreService provider Read team_growth Show a line chart of quarterly hiring trends over time. Read tenant-read Read data for a tenant — caller must belong to the same tenant (ABAC). Read test-config-fallback Test config fallback resolution with entity context Read test-notify-method Tests the this.notify() method for sending notifications to the current session Read throw-internal-error Throws an InternalMcpError (server error) Read throw-not-found Throws a ResourceNotFoundError if resource does not exist Read throw-validation-error Throws an InvalidInputError if validation fails Read timeout-tool A tool with a 500ms timeout Read unguarded An unguarded echo tool (no rate limit, no concurrency, no timeout) Read unregister-test-session Unregister a fake session Read users-get Get a specific user by ID Read users-list List all users in the CRM system Read whoami Read the upstream IdP token via orchestration (remote-proxy mode)

OTHER 24 tools

Other always_available A tool with no availableWhen constraint — always visible Other always-enabled Tool gated behind an always-enabled feature flag Other audited-tool A tool that is audited by the audit plugin hooks Other browser_only_tool Tool only available in browser runtime (should be filtered) Other combinator-tool A tool testing nested combinators (anyOf with allOf and not) Other development_only_tool Tool only available when NODE_ENV=development Other failing-tool A tool that always fails (for testing error handling) Other gated-globex Requires the Other gated-optional Declares globex as optional (required:false) — must never be gated Other hidden_but_available Hidden tool on current platform Other impossible_platform_tool Tool for a non-matching platform (should be filtered) Other instant-echo Synchronous-only tool (default forbidden taskSupport). Other multi_constraint_fail_tool Tool with one matching and one non-matching constraint (should be filtered) Other multi_constraint_tool Tool with platform + runtime + deployment constraints Other my-tool my-tool Other production_only_tool Tool only available when NODE_ENV=production Other profile-admin A tool using the Other public-tool A tool with no authorities — accessible to everyone Other serverless_only_tool Tool only available in serverless deployment (should be filtered) Other successful-tool A tool that always succeeds (for comparison) Other tenant-scoped A tool that validates tenant match (ABAC with dynamic fromInput) Other test_env_only_tool Tool only available when NODE_ENV=test Other throw-custom-error Throws a custom PublicMcpError with specified code and message Other unflagged Tool without any feature flag - always visible

EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

FAQ

Questions about Frontmcp

Can an AI agent delete data through the Front MCP server? +

Yes. The Frontmcp server exposes 11 destructive tools including clear-audit-log, clear-replay-buffer, clear-session-notifications. These permanently remove resources with no undo. PolicyLayer blocks destructive tools by default so they never reach the upstream server.

How do I prevent bulk modifications through Frontmcp? +

The Frontmcp server has 39 write tools including activities-log, add, add-credential. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach Frontmcp.

How many tools does the Front MCP server expose? +

210 tools across 4 categories: Destructive, Execute, Read, Write. 103 are read-only. 107 can modify, create, or delete data.

How do I enforce a policy on Frontmcp? +

Register the Front MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every Frontmcp tool call.

Deterministic rules across all 210 Frontmcp tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON FRONTMCP →

Instant setup, no code required.

210 Frontmcp tools catalogued and risk-classified — across an index of 46,500+ MCP servers.

// WHERE THIS COMES FROM

These policies come from Front's registry record.

The record behind this page: verified identity, auth posture, risk grade, every tool classified, recommended policy — re-checked continuously.

Teams ship this data inside their own products. See what a licence covers →