// SCAN REPORT

Lofty MCP Server

120 tools. 54 can modify or destroy data without limits.

7 destructive tools with no built-in limits. Policy required.

Last updated: 2 Jul 2026

54 can modify or destroy data

66 read-only

120 tools total

Community server · catalogue entry verified 02/07/2026

How to control Lofty MCP Server ↓

TOOL MAP

What Lofty MCP Server exposes to your agents

Read (66) Write / Execute (47) Destructive / Financial (7)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS

Critical Risk

The most dangerous Lofty MCP Server tools

Destructive · High deleteCalendar This tool deletes calendar items by ID, which is an irreversible operation that cannot be undone. Destructive · High deleteLead Lead deletion is irreversible and removes valuable business data from the CRM system. Destructive · High deleteManualLogType This tool permanently removes a manual log type configuration from the Lofty CRM system. Destructive · High deleteNote This tool permanently removes data (a note) without the ability to undo the operation.

54 of Lofty MCP Server's 120 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control Lofty MCP Server

PolicyLayer is an MCP gateway — it sits between your AI agents and Lofty MCP Server, and nothing reaches the server without passing your rules. These are the rules we recommend:

Deny destructive operations

{
  "deleteCalendar": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Blocked by default. Requires approval."
      }
    ]
  }
}

Destructive tools should never be available to autonomous agents without human approval.

Rate limit write operations

{
  "addAgent": {
    "limits": [
      {
        "counter": "addagent_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations

{
  "about": {
    "limits": [
      {
        "counter": "about_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

Create a free account and register Lofty MCP Server — nothing to install.
Add these rules — paste them, or build them visually. Tune the limits to your setup.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

ENFORCE POLICY ON LOFTY →

Instant setup, no code required.

FULL CATALOGUE

All 120 Lofty MCP Server tools

DESTRUCTIVE 7 tools

Destructive deleteCalendar Delete a calendar item by ID (v2 API). Calendar IDs are composite strings like Destructive deleteLead Delete a lead by ID. A reason is required. Destructive deleteManualLogType Delete a manual log type by ID. Destructive deleteNote Delete a note by ID. Destructive deleteTaskV1 Delete a task by ID (v1 API). Destructive deleteTaskV2 Delete a task by ID (v2 API). Destructive deleteWebhook Delete a webhook subscription by its subscribe ID.

EXECUTE 2 tools

Execute generatePrepareInsight Generate AI prepare insight for a lead. Execute sendAppPushTaskReminder Send an app push task reminder notification.

WRITE 45 tools

Write addAgent Add a new agent profile. Write addAgentTag Add tags to an agent. Write addCustomField Add or update a custom field value. Write addOffice Add a new office to the organization. Write addTransaction Add a new transaction to a lead. Write addWorkingLeads Add leads to the working leads list. Write assignLead Assign a lead to a user. Write batchCreatePlanTasks Batch create plan tasks for a lead. Write createCalendar Create a calendar item (v2 API). type: TASK | APPOINTMENT. For TASK provide taskWay and assignedRole; for APPO Write createLead Create a new lead. Write createLeadAnalysis Create an AI lead analysis for a lead. Write createManualLogType Create a new manual log type. Write createNote Create a note on a lead. Write createTaskV1 Create a task (v1 API). Type: Other | Call | Email | Text. AssignedRole: Agent | Assistant. Write createTaskV2 Create a task or appointment (v2 API). Type: Other | Call | Email | Text | Appointment. For Appointment type, Write createWebhook Subscribe to a Lofty webhook event. Write finishCalendar Mark a calendar item as finished (v2 API). Calendar IDs are composite strings like Write finishTaskV2 Mark a task as finished (v2 API). Write generateCallScript Generate an AI call script for a lead. Write generateCallSummary Generate an AI call summary for a call. Write logLeadActivity Log an activity event against a lead. Write muteLead Mute or unmute a working lead. Write saveSalesAgentSettings Save/update sales agent settings. Write sendEmail Send an email message to a lead. Write sendOpportunityNotification Send an opportunity notification to an agent. Write sendSms Send an SMS message to a lead. Write sendSmsViaAiNumber Send an SMS to the agent via the AI number. Write sendSystemEmailToAgent Send a system email message to an agent. Write sendSystemSmsToAgent Send a system SMS message to an agent. Write unfinishCalendar Reopen a finished calendar item (v2 API). Calendar IDs are composite strings like Write unfinishTaskV2 Mark a finished task as unfinished / reopen it (v2 API). Write updateBrokermintTransaction Update a Brokermint transaction (callback format — body passed through as-is). Write updateCalendar Update a calendar item by ID (v2 API). Calendar IDs are composite strings like Write updateCompany Update company information. Write updateLead Update an existing lead by ID. Write updateLeadInquiry Update a lead Write updateLeadProperty Update a lead Write updateNote Update an existing note by ID. Write updateOffice Update an existing office. Write updateRoutingRule Update a routing rule for a business type. Write updateSupplementRule Update supplement routing rule for a business type. Write updateTaskV1 Update a task by ID (v1 API). Type: Other | Call | Email | Text. AssignedRole: Agent | Assistant. Write updateTaskV2 Update a task by ID (v2 API). Updatable fields: content, startAt, endAt, timeZoneCode, address. Write updateTransaction Update an existing transaction for a lead. Write updateTransactionPropertyAddress Update the property address for a transaction.

READ 66 tools

Read about Returns metadata about this MCP server: name, version, author, and description. Read checkWorkingLead Check if a specific lead is in the working leads list. Read getAssigneeInfo Look up the assignee agent for a lead by phone, email, or external ID. Read getAvailableMeetings Get available meeting slots for a lead (v2 API). Requires leadId. Read getCallByCommId Get a call communication record by its communication ID (v2). Read getCallRecord Get a single call record by call ID. Read getCallRecordUrl Get the recording URL for a call by call ID. Read getCallSummary Get AI call summary for a lead. Read getCurrentSalesAgent Get the current authenticated sales agent profile. Read getEmailByCommId Get an email communication record by its communication ID (v2). Read getLead Get a single lead by ID. Read getLeadActivitiesV1 Get activity history for a lead (v1, page-based). Read getLeadActivitiesV2 Get activity history for a lead (v2, cursor/offset-based with timezone support). Read getLeadPond Get a specific lead pond by ID. Read getListingsByAgent Get listings associated with a specific agent by agent ID. Read getManualLogType Get a manual log type by ID. Read getMe Get the current authenticated user profile. Read getMemberByAccount Get a member by their account (email address). Read getMemberById Get a member/user by their numeric user ID. Read getMuteStatus Get the mute status for a lead. Read getNote Get a single note by ID. Read getOrgInfo Get organization info. Read getPermissionProfiles Get permission profiles for the organization. Read getPlanTasksByLead Get plan tasks for a specific lead. Read getPublishedListings Get published listings for a site, with optional pagination. Read getSalesAgentByLead Get the sales agent assigned to a specific lead. Read getSalesAgentQuota Get the current sales agent quota. Read getSalesAgentSettings Get sales agent settings. Read getSupplementRule Get supplement routing rule for a business type. Read getSystemLogs Get system logs for a specific lead, with optional offset and limit for pagination. Read getTaskV1 Get a single task by ID (v1 API). Read getTaskV2 Get a single task by ID (v2 API). Read getTextByCommId Get a text/SMS communication record by its communication ID (v2). Read getTransaction Get a specific transaction for a lead. Read getTransactionCustomFields Get the list of custom fields defined for transactions. Read getTransactionPropertyAddress Get the property address for a specific transaction. Read getVendors List vendors. Read getWorkingLeads List working leads for the current sales agent. Read help Returns help information including safe mode status, getting started instructions, and where to report bugs. Read listAppointments List appointments for a lead (v1 API). Requires leadId. Read listAssignMembers List assign members for a business type. Read listCallHistory List call communication history for a lead. Read listCallHistoryV2 List call communication history for a lead (v2 endpoint). Read listCalls List call records for a lead. Read listCustomFields List all custom fields defined for the team. Read listEmailHistory List email communication history for a lead. Read listLeadAnalysis List AI lead analysis entries for a lead. Read listLeadPonds List all lead ponds for the team. Read listLeads List leads with optional filters. Returns a paginated list. Read listLeadTransactions List all transactions for a lead. Read listManualLogTypes List all manual log types. Read listMembers List all members in the team. Read listMyTasksV2 List tasks assigned to the authenticated user (v2 API). No required params. Read listNotes List notes for a lead. Read listPipelines List all lead pipelines for the team. Read listRoutingRoles List all routing roles. Read listRoutingRules List routing rules for a business type. Read listTasksV1 List tasks for a lead (v1 API). Requires leadId. Read listTasksV2 List tasks for a lead (v2 API). Requires leadId. Read listTextHistory List SMS/text communication history for a lead. Read listWebhooks List all webhook subscriptions for the account. Read queryCalendars Query calendar items for a lead (v2 API). Requires leadId. Read searchCommunicationsByAgent Search communications by agent with optional filters. Read searchListingsV2 Search listings using advanced filters such as price range, bedrooms, bathrooms, property type, and location ( Read searchTransactionsV2 Search transactions with optional filters (v2 endpoint).

EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

FAQ

Questions about Lofty MCP Server

Can an AI agent delete data through the Lofty MCP Server MCP server? +

Yes. The Lofty MCP Server server exposes 7 destructive tools including deleteCalendar, deleteLead, deleteManualLogType. These permanently remove resources with no undo. PolicyLayer blocks destructive tools by default so they never reach the upstream server.

How do I prevent bulk modifications through Lofty MCP Server? +

The Lofty MCP Server server has 45 write tools including addAgent, addAgentTag, addCustomField. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach Lofty MCP Server.

How many tools does the Lofty MCP Server MCP server expose? +

120 tools across 3 categories: Destructive, Read, Write. 66 are read-only. 54 can modify, create, or delete data.

How do I enforce a policy on Lofty MCP Server? +

Register the Lofty MCP Server MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every Lofty MCP Server tool call.

Deterministic rules across all 120 Lofty MCP Server tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON LOFTY →

Instant setup, no code required.

120 Lofty MCP Server tools catalogued and risk-classified — across an index of 43,000+ MCP servers.