High-risk tools in Max MCP Server
22 of the 415 tools in Max MCP Server are classified as high risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.
Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.
Tools at high risk
-
approve_proposalExecuteApprove a pending proposal and launch its draft campaign. SYNCHRONOUS — max-agent builds the prospect list, creates the campaign, and launches it (may take a while). Optionally ...
-
automation_activateExecutePublish the pending draft and arm its trigger — from now on it fires automatically on real records (422 with {details:[{step_id,message}]} if not runnable). A new webhook
-
automation_resumeExecuteRe-arm a paused workflow
-
automation_runExecuteFire the workflow once, now, inline — runs the draft if one exists, else the active version — and REALLY executes its actions (tasks, campaign enrolls, webhooks, signature reque...
-
enrich_organizationExecuteRun Claire deep-research on an organization and save the result onto the record. SYNCHRONOUS — waits for Claire (may take 30-180s) and returns {status} (
-
generate_message_previewExecuteUse AI to generate a personalized message for a prospect. Charges credits. Specify channel and prompt.
-
generate_workflowExecuteUse AI to generate a campaign workflow from natural language. Charges credits. Provide a prompt or structured fields.
-
launch_campaignExecuteLaunch a draft campaign — transitions draft → active and creates workflow executions for each prospect.
-
pipeline_preview_rule_assignmentExecuteDry-run an
-
pipeline_webhook_replay_deliveryExecuteRe-run a logged delivery
-
pipeline_webhook_testExecuteRun a sample JSON payload through an endpoint
-
refresh_prospect_social_profilesExecuteRecompute the prospect
-
run_prospect_profile_hookExecuteRun a profile hook immediately (synchronous, up to ~5 min). May charge credits for the provider work. Returns {status, activitiesWritten, summary}.
-
simulate_account_connectedExecuteFire a Unipile account-connected webhook event. Use to test the handler that creates/updates an account record when Unipile finishes connecting.
-
simulate_account_statusExecuteFire a Unipile account-status webhook. Use to test status changes (OK, CREDENTIALS, ERROR, CONNECTING, STOPPED). Useful for verifying that disconnected accounts are flagged corr...
-
simulate_email_trackingExecuteFire a Unipile mail_opened or mail_link_clicked tracking event. Pass label as
-
simulate_linkedin_messagingExecuteFire a Unipile LinkedIn messaging event (message_received, message_read, message_delivered, etc.). Use to test reply detection and campaign execution advancement on LinkedIn.
-
simulate_new_emailExecuteFire a Unipile mail_received webhook. Use to test inbound email handling — reply detection, chat thread creation, and campaign execution advancement.
-
simulate_new_relationExecuteFire a Unipile new_relation event (LinkedIn invitation accepted). Use to test that the connection record is updated and any waiting campaign executions are advanced.
-
sync_all_warmupsExecuteRefresh every live warm-up from Mailpool. Returns {data, unmanaged (warm-ups Mailpool runs that Max doesn
-
sync_calendars_nowExecutePull the latest events from the synced Google/Outlook calendars now: every account, or only account_id. May take minutes; an account already mid-sync is skipped. Returns {data: ...
-
sync_warmupExecuteRefresh one warm-up
Attacks that target this class
High-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.