Critical-risk tools in Max MCP Server
51 of the 415 tools in Max MCP Server are classified as critical risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.
Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.
Tools at critical risk
-
automation_cancel_runDestructiveCancel a queued or waiting (delayed) run; 409 if it already ran or is running. Returns {data: Run}.
-
automation_deleteDestructivePermanently delete a workflow with all its versions and run history. Returns {data: {deleted: true}}.
-
automation_discard_draftDestructiveArchive the pending draft, keeping the active version (409 if there is no draft; 404 where the draft lifecycle is not enabled). Returns {data: Version}.
-
bulk_delete_organizationsDestructiveDelete multiple organizations. Set deleteProspects=true to cascade-delete linked prospects.
-
bulk_delete_prospectsDestructiveDelete multiple prospects by IDs.
-
cancel_meetingDestructiveCancel a recorded meeting by its meetings.id UUID. If the meeting has a Cal.com booking uid it is cancelled on Cal.com first, then the row is marked cancelled. Optionally pass a...
-
cancel_meeting_seriesDestructiveCancel a recurring Cal.com series from one occurrence (meeting_id): scope
-
cancel_warmupDestructiveStop a warm-up at the end of its paid period (no refund; ends immediately if unpaid). resume_warmup undoes a pending cancellation.
-
clear_failed_requestsDestructiveDrain the dead-letter queue. Returns the number of entries removed. Use after manually replaying or after resolving the upstream issue.
-
decline_meetingDestructiveReject a pending Cal.com booking request by meeting_id, with an optional reason. Irreversible; Cal.com notifies the attendee. Returns {data: meeting row} with status
-
delete_calendar_eventDestructiveDelete an event from a synced Google/Outlook calendar by event_id + account_id. Irreversible; the provider may notify attendees. Returns {success: true}; 404 if the event is not...
-
delete_campaignDestructivePermanently delete a campaign and all its workflow executions. Prefer archive for soft removal.
-
delete_campaign_attachmentDestructiveRemove a file from the campaign attachment library. Refused (409) while any campaign step — or a prospect already enrolled in one — still sends it; detach it with set_campaign_s...
-
delete_dealDestructivePermanently delete a deal, its line items and attached files. Irreversible. Fails (500) if documents are linked to it. Returns {success: true}.
-
delete_deal_attachmentDestructivePermanently delete a file attached to a deal. Irreversible. Returns {success: true}.
-
delete_deal_pipelineDestructivePermanently delete an EMPTY deal pipeline; 409 pipeline_in_use if it holds deals (archive it instead). The last pipeline can
-
delete_deal_stageDestructiveDelete a custom deal stage (default stages can
-
delete_deal_stage_ruleDestructiveDelete a deal stage entry rule. Returns {success: true}.
-
delete_icpDestructivePermanently delete an ICP and its record links (searches it produced are kept). Prefer update_icp status=archived. Returns {data: {id}}.
-
delete_meeting_linkDestructivePermanently delete a booking page and its lead submissions; its address stops working. The CRM people it captured and their timelines stay. To take a page offline but keep it, u...
-
delete_organizationDestructiveDelete an organization. Linked prospects get organization_id = null.
-
delete_prospectDestructiveDelete a prospect permanently.
-
delete_prospect_listDestructiveDelete a prospect list (prospects themselves are NOT deleted).
-
delete_prospect_profile_hookDestructiveDelete a profile hook permanently.
-
delete_saved_viewDestructivePermanently delete a saved view (creator or signed-in admin only). Records are untouched. Returns {data: {id}}.
-
delete_schedule_presetDestructiveDelete a saved schedule. Campaigns keep their own copy, so this never changes how an existing campaign sends.
-
disconnect_data_supplierDestructiveRevoke the workspace
-
pipeline_delete_campaign_routeDestructiveDelete a campaign outcome route. Returns {success}.
-
pipeline_delete_canvas_draftDestructiveDelete an unpublished change set. Returns an empty body (204) on success.
-
pipeline_delete_linkDestructiveDelete a pipeline link (stops its auto_move handoff). Returns {success}.
-
pipeline_delete_pipelineDestructivePermanently delete a non-default pipeline with its stages and links. If it holds prospects pass reassign_to, else 409 reassign_required. Returns {success}.
-
pipeline_delete_placementDestructiveForget a canvas node
-
pipeline_delete_stageDestructivePermanently delete a custom column (system columns can
-
pipeline_delete_stage_ruleDestructivePermanently delete a stage rule. Returns {success}.
-
pipeline_webhook_deleteDestructivePermanently delete an endpoint with its branches and delivery log; its URL stops accepting posts. Returns {data: {id}}.
-
pipeline_webhook_route_deleteDestructivePermanently delete a routing branch; payloads it matched fall through to the remaining branches. Returns {data: {id}}.
-
remove_campaign_audience_prospectsDestructiveTake people out of a campaign and stop any in-flight executions so they get no further outreach. Enrollment is kept as
-
remove_deal_line_itemDestructiveRemove a line item from an OPEN deal (soft-removed, kept in history). Returns {data: {id}}.
-
remove_deal_prospectDestructiveUnlink a contact (prospect_id) from a deal. A won deal must keep at least one contact. Returns {success: true}.
-
remove_prospects_from_listDestructiveRemove prospects from a prospect list by their UUIDs.
-
revoke_campaign_share_linkDestructiveDisable a campaign
-
revoke_organization_share_linkDestructiveDisable an organization
-
revoke_people_share_linkDestructiveDisable the People database public share link; the URL stops working. Admin only.
-
revoke_prospect_list_share_linkDestructiveDisable a list
-
revoke_prospect_share_linkDestructiveDisable a prospect
-
social_cancel_invitationDestructiveWithdraw a pending invitation sent by the account (LinkedIn only).
-
stop_campaignDestructiveStop an active or paused campaign permanently — cannot be resumed.
-
create_mailpool_orderFinancialCHARGES THE WORKSPACE: buys domains and pre-configured sending mailboxes from Mailpool (real supplier purchase; not reversible). Confirm domains, mailboxes and price with the us...
-
resume_warmupFinancialMAY CHARGE THE WORKSPACE: undoes a pending cancellation (free), or pays a past-due warm-up
-
start_warmupFinancialCHARGES THE WORKSPACE: buys email warm-up for each mailbox, billed the first day now and then daily until cancel_warmup. Confirm the mailboxes and price (get_warmup_pricing) wit...
-
verify_emailsFinancialQueue email verification (Bouncer) for prospect_ids or a whole list_id. CHARGES CREDITS (402 if insufficient). Async: returns 202 {job_id, job_ids, total}; a cron writes deliver...
Attacks that target this class
Critical-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.