// SCAN REPORT

FavCRM

220 tools. 132 can modify or destroy data without limits.

24 destructive tools with no built-in limits. Policy required.

Last updated:

132 can modify or destroy data
88 read-only
220 tools total

Community server · catalogue entry checked 06/07/2026 · full schemas captured for 204 of 220 tools

How to control FavCRM ↓

TOOL MAP

What FavCRM exposes to your agents

Read (88) Write / Execute (108) Destructive / Financial (24)

Running more than one server? Check your whole stack →

CONTEXT-WINDOW COST

What FavCRM costs in tokens

46,401 tokens of tool definitions, loaded on every request
23% of a 200k context window
4,393 heaviest tool: replace_post_block

Full per-tool breakdown → Model it in the token calculator →

MOST DANGEROUS TOOLS
Critical Risk

The most dangerous FavCRM tools

Financial · High cancel_subscription Cancelling a subscription directly affects financial obligations by terminating recurring billing. Financial · Critical create_plan_upgrade_link This tool initiates or modifies paid subscription commitments via Stripe, directly involving financial obligations. Financial · Critical create_subscription This tool creates a recurring financial obligation by enrolling a member in a subscription with real monetary charges at a defined billing cycle. Financial · High enrol_membership The tool directly triggers or initiates payment obligations for paid membership tiers.

132 of FavCRM's 220 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control FavCRM

PolicyLayer is an MCP gateway — it sits between your AI agents and FavCRM, and nothing reaches the server without passing your rules. These are the rules we recommend:

Block financial tools by default
{
  "cancel_subscription": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Requires human approval."
      }
    ]
  }
}

Financial tools should be explicitly enabled per use case, not open by default.

Deny destructive operations
{
  "cancel_booking": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Blocked by default. Requires approval."
      }
    ]
  }
}

Destructive tools should never be available to autonomous agents without human approval.

Rate limit write operations
{
  "accept_team_invite_request": {
    "limits": [
      {
        "counter": "accept_team_invite_request_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations
{
  "check_plan_operation": {
    "limits": [
      {
        "counter": "check_plan_operation_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

  1. Create a free account and register FavCRM — nothing to install.
  2. Add these rules — paste them, or build them visually. Tune the limits to your setup.
  3. Point your MCP client (Claude, Cursor, anything) at your gateway URL.
ENFORCE POLICY ON FAVCRM →

Instant setup, no code required.

FULL CATALOGUE

All 220 FavCRM tools

FINANCIAL 5 tools
Financial cancel_subscription Cancel a subscription. Destructive — turns off auto-renew and prevents further billing cycles. Existing paid p Financial create_plan_upgrade_link Create a Stripe Checkout link for a new paid subscription, or a Stripe Billing Portal link for an existing Str Financial create_subscription Create a recurring subscription for a member. Bind to a membership tier or set a custom amount + cycle. Financial enrol_membership Enrol a member into a membership tier. Free tiers enrol immediately; paid tiers return PAYMENT_REQUIRED unless Financial record_invoice_payment Record a manual payment against an invoice (cash, bank transfer, cheque, card terminal). Updates invoice statu
DESTRUCTIVE 19 tools
Destructive cancel_booking Cancel a booking. Optionally provide a reason. Destructive delete_account Soft-delete a CRM account/customer. This releases the primary phone for future reuse while keeping account his Destructive delete_campaign Delete a campaign. Only allowed in DRAFT status; sent campaigns are kept for audit history. Destructive delete_category Delete a CMS post category. Posts in the category are not deleted; they are simply unlinked. Destructive delete_contact Delete a secondary contact. Primary contacts are protected; set another primary contact or delete the account Destructive delete_custom_field Delete a custom field definition and its stored values. Destructive delete_deal Soft-delete a CRM deal from the sales pipeline. Destructive delete_invoice Delete a DRAFT invoice. Only invoices that have never been sent can be deleted; otherwise use void_invoice. Destructive delete_knowledge_document Soft-delete a knowledge document. The agent loses access immediately, but the document can be restored with re Destructive delete_post Delete a CMS post by ID. Soft-deleted posts can be restored with restore_post. Destructive delete_post_type Delete a custom post type. Built-in types cannot be deleted. Fails if any posts of this type still exist — del Destructive delete_post_type_field Remove a field from a post type schema. Blocked when posts of this type still have data in the field unless fo Destructive delete_promotion Delete a promotion. Past usage records are preserved. Destructive delete_segment Delete a customer segment. Destructive delete_service_package Delete a service package by ID. Destructive delete_tag Delete a CRM tag and remove it from all tagged entities. Destructive delete_task Soft-delete a CRM task. Destructive remove_post_block Remove the block at the given index (0-based). All subsequent blocks shift up by one. Destructive void_invoice Void an invoice. Destructive — invoice can no longer be paid or edited; existing payments are preserved as his
EXECUTE 2 tools
Execute execute_tool Execute an available FavCRM tool by name after discovering it with search_tools. Target tool availability, inp Execute switch_company Switch the current session to a different company/organisation. Returns a new access token scoped to the targe
WRITE 106 tools
Write accept_team_invite_request Step 1 of agentic team invite acceptance. Validates an invite token and sends a 6-digit verification code to t Write accept_team_invite_verify Step 2 of agentic team invite acceptance. Verifies the emailed code, joins the invited user to the company, an Write add_knowledge_text Add a free-form text document to the knowledge base. Use for pasted policies, FAQs, internal notes, brand voic Write append_post_block Append one or more blocks to the end of a post. Each block must be a valid block object: { id, version, type, Write archive_survey Archive a survey and remove it from active survey lists. Write assign_staff_to_service Assign a staff member to a booking service. Pass users.id from list_staff.userId. Write attach_post_cover_from_job Attach a previously generated ai-media job's output as the post's featuredImage. Use when generate_post_cover Write attach_tags Attach one or more tags to a member/account. Useful for segmenting members after filtering. Write clone Duplicate an existing record (product, tier, campaign, post, service package, promotion, gift offer). Creates Write commit_customer_import Commit a previewed customer import. Pass the same rows and sessionId returned by preview_customer_import. Crea Write complete_booking Mark a booking as completed. Triggers commission calculation if configured. Write confirm_booking Confirm a pending booking. Write create_account Create a CRM account/customer with a primary contact. Optionally enroll the account as a member; use enrol_mem Write create_booking Create a new booking for a member. Use get_available_slots first to find valid times, then create the booking Write create_broadcast Create a DRAFT WhatsApp or SMS broadcast campaign. The broadcast is NOT sent — admin must review and send it f Write create_campaign Create a marketing campaign (email, SMS, or WhatsApp) in DRAFT. For email channelConfig, use subject + htmlBod Write create_category Create a CMS post category (e.g. "Equipment", "Injection — Botox"). For sub-categories, use namespaced names — Write create_contact Create a contact on an existing CRM account. Write create_custom_field Create a custom field definition for CRM entities. Use options for select or multiselect fields. Write create_deal Create a CRM sales pipeline deal, optionally linked to a customer account and contact. Write create_inbox_reply_suggestion Create a draft reply suggestion that appears inline in the FavCRM Inbox composer. Use this for message.inbound Write create_invoice Create a new invoice for a customer. Optionally include line items inline. Returns the new invoiceId. Write create_note Add a note to a member/account, booking, ticket, or invoice. Write create_offer_rule Create an upsell/cross-sell offer rule as draft. Specify trigger type, conditions, and suggested products with Write create_outlet Create a shop outlet/location. Optionally pass id to preserve a legacy UUID during migration. Write create_post Create a new CMS post (blog_post, page, or any custom post type). The post type must already exist — use list_ Write create_post_type Define a new custom post type (e.g. "treatment", "service"). Required before creating posts of that type. Afte Write create_post_type_field Add a custom field to a post type schema. The field key becomes the key in meta when creating/updating posts. Write create_product Create a new shop product as DRAFT. Merchant can review and activate from the portal. Write create_product_category Create a product category. Use parentId to create subcategories under an existing category. Write create_promotion Create a promotion / discount code. type=percentage or fixed_amount; value is the discount as a string ("10" = Write create_resource Create a bookable resource (room, equipment, vehicle). Used by services that have requiresResource=true. Write create_segment Create a new customer segment. Use STATIC for manual member lists, DYNAMIC for criteria-based auto-filtering. Write create_service Create a bookable service. Sets duration, price, capacity, and policies. Use list_service_categories first if Write create_service_category Create a service category (e.g. "Treatments", "Classes") to group bookable services. Write create_service_package Create a service package/prepaid session bundle. Use applicableType=SELECTED with applicableItems to limit the Write create_service_schedule Create a bookable schedule window for a service, including recurring weekly/daily availability. Write create_survey Create a survey with custom question blocks. Publish it later or set status to published for immediate portal Write create_survey_invitation Create a token-auth survey invitation for a specific member/account or contact. Write create_tag Create a CRM tag for customer segmentation and organization. Write create_task Create a task. Optionally link to a CRM account or assign to a team member. Write create_team_member_invite Invite a team member to this company and return a one-time MCP accept token. The invited user must verify an e Write create_template Create and submit a WhatsApp message template to Meta for approval. Text templates only (header text, body wit Write create_ticket Create a support ticket for a member issue. Write create_variation Add a variation (size, color, etc.) to an existing product. Write create_whatsapp_connect_link Create a short-lived browser link for WhatsApp Business Embedded Signup. The user must open the link because M Write detach_tags Detach one tag from one or more member/account records. Write earn_loyalty_points Credit loyalty points or stamps to a member. Use field="points" for points, "stamps" for stamps. Server record Write find_or_create_workroom_thread Find or create a Workroom DM thread between a merchant user and an AI colleague. Use this when an inbound even Write generate_image Generate an AI image via kie.ai and return its public R2 URL. Use to mint reusable URLs for content blocks (im Write generate_post_cover Generate an AI image and attach it as a post's featuredImage. Submits a kie.ai job, polls until complete, copi Write issue_rewards Issue a gift/reward to multiple members. Requires a gift offer ID and member IDs. Write link_resource_to_service Link a room/resource to a booking service. Write mark_invoice_sent Mark an invoice as sent to the customer (transitions DRAFT → OPEN). Use after delivering the invoice via email Write mark_no_show Mark a booking as no-show when the customer did not attend. Write pause_subscription Pause an active subscription (status → past_due, no further auto-renew). Use resume_subscription to reactivate Write post_workroom_message Post an internal message from an AI colleague into a Workroom thread. Use this to report findings, ask the own Write register_organisation_request Step 1 of agentic signup. Sends a 6-digit verification code to the email. After the user reads the code, call Write register_organisation_verify Step 2 of agentic signup. Confirms the 6-digit code and creates the workspace. Returns an API key the agent sh Write reorder_post_blocks Reorder blocks by passing block IDs in the desired order. The id list must contain every existing block id exa Write reorder_post_type_fields Reorder fields on a post type. Pass field IDs in the desired display order; sortOrder is updated to match. Write replace_post_block Replace a single block at the given index (0-based). Avoids fetching the full post and re-sending all blocks v Write report_agent_issue Report a FavCRM platform issue when an agent finds a missing MCP path, tool failure, confusing schema, CLI/doc Write request_send_approval Create a merchant-owned Workroom approval request for a customer-facing send. The agent must not call send_mes Write restore_campaign Restore a previously deleted campaign. Write restore_category Restore a previously deleted CMS post category. Write restore_invoice Restore a previously deleted DRAFT invoice. Write restore_knowledge_document Restore a previously deleted knowledge document. Write restore_post Restore a previously deleted CMS post. Write restore_post_type Restore a previously deleted custom post type. Write restore_post_type_field Restore a previously deleted field on a post type schema. Write restore_promotion Restore a previously deleted promotion. Write restore_service_package Restore a previously deleted service package by ID. Write resume_subscription Resume a paused subscription back to active. Write revert_audit_action Revert an audited action by restoring the captured before snapshot. Only works for allowlisted target tables w Write scrape_knowledge_url Fetch a URL's content into the knowledge base. Server crawls the URL, stores the response body in R2, returns Write set_custom_field_values Set or clear custom field values for a CRM entity. Values are stored as strings; pass null to clear a value. Write set_primary_contact Set a contact as the primary contact for its CRM account and demote other contacts on that account. Write set_resource_availability Add an availability window for a resource. Use day-of-week + recurring=true for weekly schedules, or a specifi Write set_segment_members Replace the members of a STATIC customer segment with the given account IDs. The segment is converted to STATI Write set_staff_availability Add an availability window for a staff member (companyMembers.id). Use day-of-week + recurring for weekly sche Write update_account Update CRM account/customer profile fields such as name, phone, email, life stage, owner, notes, or member cod Write update_booking_settings Update global booking settings. Pass only the fields you want to change. Write update_campaign Update an existing campaign. Channel cannot be changed after creation. Pass only fields to change. Write update_category Update a CMS post category. Write update_contact Update fields on an existing contact. Write update_custom_field Update a custom field definition label, type, options, required flag, or sort order. Write update_deal Update a CRM deal. Pass only fields to change; use null for nullable links/fields to clear them. Write update_deal_stage Move a deal to a different pipeline stage. Write update_order_status Update the status of a shop order (e.g. confirm, ship, cancel). Write update_outlet Update an existing shop outlet/location by ID. Write update_post Update an existing CMS post (any post type). Only provided fields are changed. Write update_post_type Update a custom post type. Built-in types (blog_post, page) cannot be modified. Write update_post_type_field Update a field on a post type schema. Changing fieldType or flipping required=true is blocked when posts alrea Write update_product Update an existing product. Only provided fields are changed. Write update_promotion Update an existing promotion. Pass only the fields you want to change. Write update_segment Update an existing customer segment by id. Pass only the fields to change; criteria replaces the existing rule Write update_service Update an existing booking service. Pass only the fields you want to change. Write update_service_package Update an existing service package. Pass only the fields you want to change. Write update_service_schedule Update a service schedule window. Pass only fields to change. Write update_survey Update a survey draft or publishing configuration. Use questionBlocks to replace the ordered form block list. Write update_tag Rename or recolor an existing CRM tag. Write update_task Update a task (status, priority, assignee, due date, completion). Write update_ticket_status Update the status of an existing support ticket. Write upload_post_cover_from_url Download an external image URL into R2 and attach it as the post's featuredImage. Replaces the manual flow of Write upsert_survey_workflow Create or update a survey automation workflow, usually triggered by survey_response_submitted.
READ 88 tools
Read check_plan_operation Preflight whether an intended operation is allowed by token scopes, enabled modules, subscription state, and q Read get_attachment_text Read the text/Markdown content of a file attached to a Workroom thread or sent by a customer (PDF, image, or d Read get_audit_log Fetch a single audit log entry by ID, including before/after snapshots when available. Read get_available_slots Find available booking slots for a service on a specific date. Read get_booking_detail Get full booking details including line items, status history, and participants. Read get_booking_settings Get global booking settings for the customer booking flow, cancellation rules, visibility options, and confirm Read get_booking_stats Get booking counts: today, this week, this month, and breakdown by status. Read get_contact Fetch a single contact by ID. Read get_conversation_messages Get messages from a specific conversation thread. Shows the chat history between the merchant and a contact. Read get_custom_field Get a custom field definition by ID. Read get_custom_field_values Get custom field values for a CRM entity such as an account, contact, deal, or booking. Read get_dashboard_stats Get high-level business KPIs: member count, new members this week, active subscriptions, total points issued, Read get_deal Get detailed CRM deal information by ID. Read get_invoice Fetch a single invoice with line items, payment history, and customer detail. Read get_invoice_stats Outstanding totals, overdue counts, and revenue this period. Used by the weekly-snapshot playbook. Read get_knowledge_document Fetch a single knowledge document with metadata + extraction/review status. Reviewed content is served via GET Read get_loyalty_balance Get a member's current loyalty balance — points, stamps, credits, lifetime totals, and active membership tier. Read get_member_profile Get detailed profile for a specific member/account by ID. Read get_membership_tier Get a specific membership tier by ID. Read get_offer_rule Get offer rule detail including associated products and discounts. Read get_order Get full order detail including line items. Read get_plan_status Show the current organisation plan, subscription/payment state, enabled modules, and quota usage. Use before d Read get_post Get detailed CMS post including content blocks, categories, and tags. Read get_product Get full product detail including images, options, and variations. Read get_promotion Get details of a specific promotion/coupon code. Read get_segment Get customer segment details including type, criteria, and live member count. Read get_segment_members Get the members that belong to a specific segment. Read get_service_detail Get full service details including addons, staff, resources, and tier pricing. Read get_service_package Get service package detail including applicability and selected booking service/event items. Read get_subscription Fetch a single subscription with customer, tier, billing cycle, and renewal info. Read get_survey Get survey detail, including blocks, publishing status, visibility, settings, and response count. Read get_survey_responses List responses for a survey. Read get_survey_stats Get response and invitation metrics for a survey overview dashboard. Read get_task Get detailed task information by ID. Read get_ticket_stats Get ticket counts grouped by status. Read get_whatsapp_connection_status Check whether WhatsApp Business is connected for this company, including WABA/phone metadata and the latest ag Read list_audit_logs List recent audit log entries for this company. Filter by action, resource, resourceId, user, source, outcome, Read list_bookings List bookings with filters for date range, status, service, staff, or member. Read list_campaigns List marketing campaigns (email, SMS, WhatsApp) with delivery stats. Read list_categories List CMS post categories. Read list_contacts List contacts (people linked to CRM accounts), optionally filtered by account or search. Read list_conversations List messaging conversations across channels (WhatsApp, SMS, email, etc). Shows unread counts and last message Read list_custom_fields List custom field definitions for CRM entities such as account, contact, deal, or booking. Read list_deals List CRM deals (sales pipeline) with optional filters. Read list_image_models List AI image-generation models exposed to merchants (sanitized — provider/cost details hidden). Use to pick a Read list_invoices List invoices with optional filters. Use status "OVERDUE" to find unpaid invoices past due date. Read list_knowledge_documents List merchant knowledge base documents (uploads + scraped URLs). Use reviewStatus/syncable to see what is read Read list_my_companies List all companies/organisations the current user has access to. Use this to see available orgs before switchi Read list_notes List notes attached to a member/account, booking, or ticket. Read list_notification_logs List notification delivery logs for the current company. Recipients are masked by default for incident-respons Read list_offer_rules List upsell/cross-sell offer rules with optional filters. Read list_orders List shop orders with optional status and search filters. Read list_outlets List shop outlets/locations for the company. Read list_plan_options List active FavCRM plans with prices, quotas, included modules, and whether each is the current plan. Read list_post_type_fields List the custom field schema for a post type. Use this before creating posts to know which keys to pass in met Read list_post_types List all post types defined for this company (built-in: blog_post, page; plus any custom types). Read list_posts List CMS posts (blog posts and/or pages) with optional filters. Read list_product_categories List all product categories for the shop. Read list_products List shop products with optional filters by name, status, or category. Read list_promotions List promotion/coupon codes with optional status filter. Read list_resources List booking resources (rooms, equipment, etc.). Read list_reward_schemes List loyalty reward schemes (points/stamps programs) configured for this business. Read list_segments List customer segments. Segments group members by criteria for targeted campaigns. Read list_service_categories List service categories (groups for booking services like "Treatments", "Classes"). Read list_service_packages List service packages/prepaid session bundles with optional search, status, sorting, and pagination. Read list_service_schedules List schedule windows for booking services. Read list_services List booking services with name, price, duration, and status. Read list_shipping_methods List all shipping methods configured for the shop. Read list_staff List staff/team members in the business. Read list_subscriptions List member subscriptions. Filter by status to find active, cancelled, or past-due subscriptions. Read list_survey_invitations List survey invitation history without exposing token hashes or old invitation tokens. Read list_survey_workflows List automation workflows attached to a survey. Read list_surveys List surveys with optional status/search filters. Read list_tags List all available tags for the merchant. Read list_tasks List tasks with optional status, assignee, and account filters. Read list_templates List the company's WhatsApp message templates with their Meta approval status (PENDING / APPROVED / REJECTED). Read list_tickets List support tickets with optional filters. Read list_tiers List all membership tiers with member counts and stats. Read preview_customer_import Preview a bulk customer import (max 2000 rows). Matches existing accounts by phone/email and shows create vs u Read preview_segment_count Preview how many customers would match dynamic segment criteria before creating or updating a segment. Read query_company_knowledge Search this company's reviewed knowledge base and return grounded snippets with source document IDs. Use for m Read query_favcrm_platform Search FavCRM MCP tools, enabled skills, and feature areas for how to use the platform. Use before guessing to Read search_audit_logs Search audit logs by free text across action, resource, resource ID, changes JSON, and metadata JSON. Read search_crm Search across CRM accounts and contacts by name, email, or phone. Read search_members Search and filter members/accounts. Supports text search, date ranges, booking/activity history, membership ti Read search_tools Search the available FavCRM tool catalog for relevant operations. Use this when the curated direct tool list d Read validate_campaign Validate a campaign before sending. Resolves contactable recipient count and previews the final email subject/ Read validate_promotion Check if a promotion code is valid for a given order. Returns isValid, discount amount, and an error code/mess
EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

UnClick 1658 tools
adminautomation
Nodebench 824 tools
adminautomation
Yaver 812 tools
adminautomation
Binance MCP Server 734 tools
adminautomation
Crow 587 tools
adminautomation
Fortimanager 584 tools
adminautomation
TinyFn 572 tools
adminautomation
Mcp 571 tools
adminautomation
FAQ

Questions about FavCRM

Can an AI agent move money through the FavCRM MCP server? +

Yes. The FavCRM server exposes 5 financial tools including cancel_subscription, create_plan_upgrade_link, create_subscription. Without a policy, an autonomous agent can call these with no spend caps, no rate limits, and no approval flow. PolicyLayer lets you block financial tools by default, require human approval, or set per-tool rate limits — enforced on every call.

Can an AI agent delete data through the FavCRM MCP server? +

Yes. The FavCRM server exposes 19 destructive tools including cancel_booking, delete_account, delete_campaign. These permanently remove resources with no undo. PolicyLayer blocks destructive tools by default so they never reach the upstream server.

How do I prevent bulk modifications through FavCRM? +

The FavCRM server has 106 write tools including accept_team_invite_request, accept_team_invite_verify, add_knowledge_text. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach FavCRM.

How many tools does the FavCRM MCP server expose? +

220 tools across 4 categories: Destructive, Execute, Read, Write. 88 are read-only. 132 can modify, create, or delete data.

How do I enforce a policy on FavCRM? +

Register the FavCRM MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every FavCRM tool call.

Deterministic rules across all 220 FavCRM tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON FAVCRM →

Instant setup, no code required.

220 FavCRM tools catalogued and risk-classified — across an index of 46,500+ MCP servers.

// WHERE THIS COMES FROM

These policies come from FavCRM's registry record.

The record behind this page: verified identity, auth posture, risk grade, every tool classified, recommended policy — re-checked continuously.

Teams ship this data inside their own products. See what a licence covers →

// GET IN TOUCH

Have a question or want to learn more? Send us a message.

Message sent.

We'll get back to you soon.