# create_inbox_reply_suggestion Create a draft reply suggestion that appears inline in the FavCRM Inbox composer. Use this for message.inbound events with replyPolicy="suggest"; it does not send anything to the customer. Agent View of the PolicyLayer registry record for `create_inbox_reply_suggestion`. HTML page: https://policylayer.com/tools/io-favcrm-favcrm/create-inbox-reply-suggestion ## Facts - Tool: `create_inbox_reply_suggestion` - Server: FavCRM (`https://api.favcrm.io/mcp`) — https://policylayer.com/tools/io-favcrm-favcrm.md - Homepage: https://github.com/favcrm/mcp - Risk category: Write (Medium risk) - Registry record: grade F, identity unverified - Server auth posture: open - Server CORS policy: * - Server rate-limited: no - Parameters: 6 (3 required) - Recommended policy verdict: Rate-limited ## Parameters | Parameter | Type | Required | Description | | --- | --- | --- | --- | | `body` | string | yes | Draft reply text for the merchant to review | | `agentId` | string | yes | AI colleague ID creating the suggestion | | `subject` | string | no | Optional email subject suggestion | | `metadata` | object | no | Optional metadata such as rationale, confidence, or source refs | | `conversationId` | string | yes | Inbox conversation ID | | `sourceMessageId` | string | no | Inbound message ID this draft responds to | Parameters from the server's own tool schema. ## Example call (MCP tools/call, JSON-RPC 2.0) ```json { "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "create_inbox_reply_suggestion", "arguments": { "body": "", "agentId": "", "conversationId": "" } } } ``` ## Why create_inbox_reply_suggestion is rated Medium This tool creates and modifies data (a draft reply suggestion) within the CRM system in a reversible manner. It does not execute external operations, send messages, delete data, or move money. From the tool's own definition: "The tool 'create_inbox_reply_suggestion' creates a draft reply suggestion that appears inline in the FavCRM Inbox composer." Risk signals: Accepts raw HTML/template content (body) ## Use case AI agents use create_inbox_reply_suggestion to create or update resources in FavCRM, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your FavCRM environment. ## Recommended policy (PolicyLayer) Verdict: **Rate-limited**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches FavCRM: ```json { "version": "1", "default": "deny", "tools": { "create_inbox_reply_suggestion": { "limits": [ { "counter": "create_inbox_reply_suggestion_rate", "window": "minute", "max": 30, "scope": "grant" } ] } } } ``` ## Other tools on FavCRM (219) - `cancel_booking` — Destructive — https://policylayer.com/tools/io-favcrm-favcrm/cancel-booking.md - `delete_account` — Destructive — https://policylayer.com/tools/io-favcrm-favcrm/delete-account.md - `delete_campaign` — Destructive — https://policylayer.com/tools/io-favcrm-favcrm/delete-campaign.md - `delete_category` — Destructive — https://policylayer.com/tools/io-favcrm-favcrm/delete-category.md - `delete_contact` — Destructive — https://policylayer.com/tools/io-favcrm-favcrm/delete-contact.md - `delete_custom_field` — Destructive — https://policylayer.com/tools/io-favcrm-favcrm/delete-custom-field.md - `delete_deal` — Destructive — https://policylayer.com/tools/io-favcrm-favcrm/delete-deal.md - `delete_invoice` — Destructive — https://policylayer.com/tools/io-favcrm-favcrm/delete-invoice.md - `delete_knowledge_document` — Destructive — https://policylayer.com/tools/io-favcrm-favcrm/delete-knowledge-document.md - `delete_post` — Destructive — https://policylayer.com/tools/io-favcrm-favcrm/delete-post.md - `delete_post_type` — Destructive — https://policylayer.com/tools/io-favcrm-favcrm/delete-post-type.md - `delete_post_type_field` — Destructive — https://policylayer.com/tools/io-favcrm-favcrm/delete-post-type-field.md - `delete_promotion` — Destructive — https://policylayer.com/tools/io-favcrm-favcrm/delete-promotion.md - `delete_segment` — Destructive — https://policylayer.com/tools/io-favcrm-favcrm/delete-segment.md - `delete_service_package` — Destructive — https://policylayer.com/tools/io-favcrm-favcrm/delete-service-package.md - `delete_tag` — Destructive — https://policylayer.com/tools/io-favcrm-favcrm/delete-tag.md - `delete_task` — Destructive — https://policylayer.com/tools/io-favcrm-favcrm/delete-task.md - `remove_post_block` — Destructive — https://policylayer.com/tools/io-favcrm-favcrm/remove-post-block.md - `void_invoice` — Destructive — https://policylayer.com/tools/io-favcrm-favcrm/void-invoice.md - `execute_tool` — Execute — https://policylayer.com/tools/io-favcrm-favcrm/execute-tool.md - `switch_company` — Execute — https://policylayer.com/tools/io-favcrm-favcrm/switch-company.md - `cancel_subscription` — Financial — https://policylayer.com/tools/io-favcrm-favcrm/cancel-subscription.md - `create_plan_upgrade_link` — Financial — https://policylayer.com/tools/io-favcrm-favcrm/create-plan-upgrade-link.md - `create_subscription` — Financial — https://policylayer.com/tools/io-favcrm-favcrm/create-subscription.md - `enrol_membership` — Financial — https://policylayer.com/tools/io-favcrm-favcrm/enrol-membership.md - `record_invoice_payment` — Financial — https://policylayer.com/tools/io-favcrm-favcrm/record-invoice-payment.md - `check_plan_operation` — Read — https://policylayer.com/tools/io-favcrm-favcrm/check-plan-operation.md - `get_attachment_text` — Read — https://policylayer.com/tools/io-favcrm-favcrm/get-attachment-text.md - `get_audit_log` — Read — https://policylayer.com/tools/io-favcrm-favcrm/get-audit-log.md - `get_available_slots` — Read — https://policylayer.com/tools/io-favcrm-favcrm/get-available-slots.md - …and 189 more: https://policylayer.com/tools/io-favcrm-favcrm.md ## For agents This record is a snapshot. Live verdicts and the full registry: - Check every server in your MCP config at once: `npx -y policylayer stack` - Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md) - Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events` --- Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=io-favcrm-favcrm · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/io-favcrm-favcrm