// SCAN REPORT

MCP Fullstack

66 tools. 33 can modify or destroy data without limits.

6 destructive tools with no built-in limits. Policy required.

Last updated: 4 Jul 2026

33 can modify or destroy data

33 read-only

66 tools total

Community server · catalogue entry verified 04/07/2026

How to control MCP Fullstack ↓

TOOL MAP

What MCP Fullstack exposes to your agents

Read (33) Write / Execute (27) Destructive / Financial (6)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS

Critical Risk

The most dangerous MCP Fullstack tools

Destructive · High messages.delete_message Message deletion removes data that cannot be recovered. Destructive · High render.deployment_cancel Cancelling a deployment stops an in-progress release permanently; the deployment cannot be resumed from where it left off, making this effectively irreversible. Destructive · Critical secrets.delete Deleting secrets is an irreversible operation that destroys authentication credentials, API keys, or other sensitive data. Destructive · High supabase.storage_delete The tool performs an irreversible deletion operation on stored files.

33 of MCP Fullstack's 66 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control MCP Fullstack

PolicyLayer is an MCP gateway — it sits between your AI agents and MCP Fullstack, and nothing reaches the server without passing your rules. These are the rules we recommend:

Deny destructive operations

{
  "messages.delete_message": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Blocked by default. Requires approval."
      }
    ]
  }
}

Destructive tools should never be available to autonomous agents without human approval.

Rate limit write operations

{
  "db.end_connection": {
    "limits": [
      {
        "counter": "db.end_connection_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations

{
  "messages.get_thread": {
    "limits": [
      {
        "counter": "messages.get_thread_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

Create a free account and register MCP Fullstack — nothing to install.
Add these rules — paste them, or build them visually. Tune the limits to your setup.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

ENFORCE POLICY ON MCP FULLSTACK →

Instant setup, no code required.

FULL CATALOGUE

All 66 MCP Fullstack tools

DESTRUCTIVE 6 tools

Destructive messages.delete_message Delete a message Destructive render.deployment_cancel Cancel a deployment Destructive secrets.delete Delete a secret Destructive supabase.storage_delete Delete file from Supabase Storage Destructive vercel.deployment_cancel Cancel a deployment Destructive vercel.domain_remove Remove domain from project

EXECUTE 14 tools

Execute browser.end_session End a browser session Execute browser.start_session Start a new browser session Execute db.start_connection Start a new database connection Execute render.deploy Deploy a Render service Execute render.redeploy Redeploy a Render service Execute render.scale Scale a service Execute supabase.functions_invoke Invoke Supabase Edge Function Execute supabase.rest Make REST API call to Supabase Execute supabase.rpc Call Supabase RPC function Execute supabase.sql Execute SQL query on Supabase Execute tracking.funnels_run Run funnel analysis Execute vercel.deploy Deploy to Vercel Execute vercel.promote Promote deployment to production Execute vercel.redeploy Redeploy a Vercel deployment

WRITE 13 tools

Write db.end_connection End a database connection Write messages.create_thread Create a new message thread Write messages.mark_read Mark a message as read Write messages.post_message Post a message to a thread Write messages.update_message Update a message body Write render.env_set Set environment variables Write secrets.put Store a secret value Write supabase.storage_put Upload file to Supabase Storage Write tracking.capture Capture analytics event Write tracking.identify Identify user traits Write tracking.pageview Track pageview Write vercel.domain_add Add domain to project Write vercel.env_set Set environment variables

READ 33 tools

Read messages.get_thread Get a thread with optional messages Read messages.inbox Get inbox messages for a target Read messages.list_threads List message threads with filtering Read render.deployment_get Get deployment details Read render.deployments_list List deployments for a service Read render.env_list List environment variables Read render.logs Get service logs Read render.service_get Get Render service details Read render.service_status Get service status and metrics Read render.services_list List Render services Read search.crawl Crawl multiple web pages starting from seed URLs Read search.extract Extract structured data from HTML content Read search.fetch Fetch a URL with HTTP request options Read search.web Search the web using various search engines Read secrets.get Retrieve a secret value Read secrets.list List secret keys Read supabase.auth_admin Supabase Auth admin operations Read supabase.health Check Supabase health status Read supabase.projects_info Get Supabase project information Read supabase.storage_get_signed_url Get signed URL for Supabase Storage object Read tracking.ask_question_about_recording Ask AI question about recording Read tracking.feature_flag_eval Evaluate feature flags for user Read tracking.feature_flags_list List feature flags Read tracking.recording_frames Extract frames from recording Read tracking.recordings_list List session recordings Read tracking.sessions_list List tracking sessions Read vercel.deployment_get Get deployment details Read vercel.deployments_list List Vercel deployments Read vercel.domains_list List project domains Read vercel.env_list List environment variables Read vercel.logs Get deployment logs Read vercel.project_get Get Vercel project details Read vercel.projects_list List Vercel projects

EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

FAQ

Questions about MCP Fullstack

Can an AI agent delete data through the MCP Fullstack MCP server? +

Yes. The MCP Fullstack server exposes 6 destructive tools including messages.delete_message, render.deployment_cancel, secrets.delete. These permanently remove resources with no undo. PolicyLayer blocks destructive tools by default so they never reach the upstream server.

How do I prevent bulk modifications through MCP Fullstack? +

The MCP Fullstack server has 13 write tools including db.end_connection, messages.create_thread, messages.mark_read. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach MCP Fullstack.

How many tools does the MCP Fullstack MCP server expose? +

66 tools across 4 categories: Destructive, Execute, Read, Write. 33 are read-only. 33 can modify, create, or delete data.

How do I enforce a policy on MCP Fullstack? +

Register the MCP Fullstack MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every MCP Fullstack tool call.

Deterministic rules across all 66 MCP Fullstack tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON MCP FULLSTACK →

Instant setup, no code required.

66 MCP Fullstack tools catalogued and risk-classified — across an index of 43,000+ MCP servers.