// SCAN REPORT

Novaposhta

50 tools. 16 can modify or destroy data without limits.

5 destructive tools with no built-in limits. Policy required.

Last updated: 5 Jul 2026

16 can modify or destroy data

34 read-only

50 tools total

Community server · catalogue entry verified 05/07/2026

How to control Novaposhta ↓

TOOL MAP

What Novaposhta exposes to your agents

Read (34) Write / Execute (11) Destructive / Financial (5)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS

Critical Risk

The most dangerous Novaposhta tools

Destructive · High address_delete This tool permanently removes address data from a logistics/shipping system. Destructive · High contact_person_delete This tool irreversibly deletes contact person data from the Nova Poshta system. Destructive · High counterparty_delete This tool irreversibly deletes data (counterparty records) from the Nova Poshta system. Destructive · High waybill_delete This tool irreversibly deletes waybills (shipping/logistics documents), which represent committed business transactions.

16 of Novaposhta's 50 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control Novaposhta

PolicyLayer is an MCP gateway — it sits between your AI agents and Novaposhta, and nothing reaches the server without passing your rules. These are the rules we recommend:

Deny destructive operations

{
  "address_delete": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Blocked by default. Requires approval."
      }
    ]
  }
}

Destructive tools should never be available to autonomous agents without human approval.

Rate limit write operations

{
  "address_save": {
    "limits": [
      {
        "counter": "address_save_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations

{
  "address_get_settlement_country_region": {
    "limits": [
      {
        "counter": "address_get_settlement_country_region_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

Create a free account and register Novaposhta — nothing to install.
Add these rules — paste them, or build them visually. Tune the limits to your setup.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

ENFORCE POLICY ON NOVAPOSHTA →

Instant setup, no code required.

FULL CATALOGUE

All 50 Novaposhta tools

DESTRUCTIVE 5 tools

Destructive address_delete Delete counterparty address by reference using Address/delete (doc 1.25). Allowed only before the address part Destructive contact_person_delete Delete contact person by reference using ContactPerson/delete (doc 1.27). Nova Poshta allows deletions via API Destructive counterparty_delete Delete counterparty by reference using Counterparty/delete (doc 1.22). IMPORTANT: Docs explicitly state only R Destructive waybill_delete Delete one or multiple waybills by their DocumentRef via InternetDocument/delete (doc 1.2). Waybills can only Destructive waybill_delete_batch Batch delete multiple waybills by their DocumentRef via InternetDocument/delete (doc 1.2). Alias for waybill_d

WRITE 11 tools

Write address_save Create new address for a counterparty via Address/save (doc 1.24). Requires API key plus CounterpartyRef, Stre Write address_update Update existing counterparty address with Address/update (doc 1.25). Nova Poshta docs stress you can edit an a Write contact_person_save Create new contact person for a counterparty via ContactPerson/save (doc 1.26). Docs require entering all fiel Write contact_person_update Update existing contact person details via ContactPerson/update (doc 1.27). Only legal entities may edit full Write counterparty_save Create new counterparty (private person or organization) with Counterparty/save (docs 1.20–1.21). Provide City Write counterparty_update Update existing counterparty details via Counterparty/update (doc 1.22). Nova Poshta only lets you edit a coun Write waybill_create Create a standard Nova Poshta waybill (Internet document) via InternetDocument/save (doc 1.2). This is the bas Write waybill_create_batch Batch create multiple waybills sequentially via InternetDocument/save (doc 1.2). Processes each waybill one by Write waybill_create_for_postomat Create a waybill for postomat delivery via InternetDocument/save (doc 1.2). Postomats have size/weight restric Write waybill_create_with_options Create a Nova Poshta waybill with additional options and services via InternetDocument/save (doc 1.2). Support Write waybill_update Update an existing waybill. Per doc 1.2 the same InternetDocument request envelope is used for update calls, s

READ 34 tools

EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

FAQ

Questions about Novaposhta

Can an AI agent delete data through the Novaposhta MCP server? +

Yes. The Novaposhta server exposes 5 destructive tools including address_delete, contact_person_delete, counterparty_delete. These permanently remove resources with no undo. PolicyLayer blocks destructive tools by default so they never reach the upstream server.

How do I prevent bulk modifications through Novaposhta? +

The Novaposhta server has 11 write tools including address_save, address_update, contact_person_save. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach Novaposhta.

How many tools does the Novaposhta MCP server expose? +

50 tools across 3 categories: Destructive, Read, Write. 34 are read-only. 16 can modify, create, or delete data.

How do I enforce a policy on Novaposhta? +

Register the Novaposhta MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every Novaposhta tool call.

Deterministic rules across all 50 Novaposhta tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON NOVAPOSHTA →

Instant setup, no code required.

50 Novaposhta tools catalogued and risk-classified — across an index of 43,000+ MCP servers.