Skip to content

Funkel AI

by funkel.ai · remote · no sign-in to list tools · v1.0.0 · published by ai.funkel

Run LinkedIn and email outreach: find leads, manage campaigns, and reply to prospects.

Deletes · 19Final · 1Changes · 4

51 tools: 19 can delete or cancel things, 1 do something that can't be undone, 4 change things and 27 only read.

Scanned Oct 21, 2026

6 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http funkel https://api.funkel.ai/mcp

Findings

Matches of fixed checks, with the text they matched.

3 warn3 info
  • The server marks "prepare_conversation_reply" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "prepare_conversation_reply" says "reply": a word for sending, and what is sent cannot be taken back.

    What this check looks for
  • The server marks "search_external_leads" as not read-only (readOnlyHint: false), and its words say it reads.

    Matched text

    annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":true}; The name "search_external_leads" says "search": a word for reading.

    What this check looks for
  • The server marks "draft_icp_edit" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "draft_icp_edit" says "edit": a word for a change.

    What this check looks for
  • The description mentions "credentials".

    Matched text

    description: "...bility, and dashboard link. No provider credentials or raw unbounded configuration are retu..."

    What this check looks for
  • The description mentions "credentials".

    Matched text

    description: "...tion. Existing keys update. No provider credentials or tokens are accepted. Over MCP: call..."

    What this check looks for
  • The description mentions "credentials".

    Matched text

    description: "...ey, value, and source only. No provider credentials or tokens are returned."

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

51 tools

Deletes or cancels 19Claude Code: deny
  • approve_leadsApprove or reject one or more discovered leads.No findings

    Why it is in this group

    • The name "approve_leads" says "approve": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Approve or reject one or more discovered leads. Two-phase: first call returns a confirmation token + preview; the user reviews an inline card and confirms; second call (with confirmation_token) commits the status flip. action='approve' requires campaign_id (the campaign the leads will be associated with); action='reject' does not. The tool stamps each lead's status + reviewed_at + campaign_id; downstream campaign-engine pipelines ingest approved leads through their normal path. Over MCP: call this tool once, without confirmation_token. It runs right away and returns the result.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • openWorldHint: true
    • idempotentHint: false
  • configure_agent_sourceConfigure X or Hacker News searches for one owned agent and set source listening.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Configure X or Hacker News searches for one owned agent and set source listening. First call get_agent_sources. If no source exists, propose 1-10 precise searches from the user's request and saved ICP; do not invent a broad search without showing it. If a source exists, show its current searches and only replace them when the user asks to change them. This tool previews the exact searches, enabled state, and LinkedIn resolution choice, then requires explicit approval. It does not activate a draft or paused agent. For an already configured source whose searches need no change, use set_agent_source_listening instead. X needs a connected X account for collection. Hacker News uses its public search provider. Over MCP: call this tool once, without confirmation_token. It runs right away and returns the result.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • openWorldHint: true
    • idempotentHint: false
  • control_operator_taskPause, resume, cancel, or retry a durable Operator task after exact approval.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Pause, resume, cancel, or retry a durable Operator task after exact approval. Supply its current version. Retry also requires one failed idempotent local-read step; completed effects cannot replay. A pause may not stop an already executing provider call. Over MCP: call this tool once, without confirmation_token. It runs right away and returns the result.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • openWorldHint: true
    • idempotentHint: false
  • create_agentCreate a new draft agent under the request's scoped app.No findings

    Why it is in this group

    • The name "create_agent" says "create": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Create a new draft agent under the request's scoped app. Two-phase: first call previews every setting; second call after user confirmation creates it. The agent's ICP starts from the app's saved ICP; icp_filters keys you supply override only those keys, every other saved field (job_titles, mandatory_keywords, excluded_companies, company_sizes, ...) is kept as-is. Do not restate the full ICP from memory for a vague request like "set it up" — omit icp_filters entirely to inherit the saved ICP untouched, and only pass the specific keys the user actually asked to change. To deliberately clear a list field, pass it as an empty array. excluded_companies stores exact current employer names. If supplied a LinkedIn company URL, Operator saves its slug name there and retains the URL separately for competitor signals; ask the user to verify the name in the approval. Supply signals only when the user selects exact agent discovery signals; each signal must include its supported platform, category, key, label, enabled state, and config. An explicit empty signals array creates no signals. Without signals, defaults seed from the merged ICP filters. A requested keyword such as product launch can be a keyword_tracking_product_launch signal with config.keyword='product launch'. Ask for missing signal details; never claim a requested setting was saved if this schema cannot represent it. Over MCP: call this tool once, without confirmation_token. It runs right away and returns the result.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • openWorldHint: false
    • idempotentHint: false
  • create_campaign_draftCreate a draft campaign in the selected product.No findings

    Why it is in this group

    • The name "create_campaign_draft" says "create": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Create a draft campaign in the selected product. First show the exact campaign, agent, destination list, and any agent retargeting for approval. With agent_id and no list_id, use the agent's destination list; if absent, assign the product default list to both. An explicit different list retargets a draft agent only after approval. Never activate, discover, enroll, or send. If workflow_steps are omitted, create the standard 4-step flow. For custom steps ask about type, delay, message mode, template, and final step. In message_template use only {FirstName}, {LastName}, and {Company}. Over MCP: call this tool once, without confirmation_token. It runs right away and returns the result.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • openWorldHint: false
    • idempotentHint: false
  • create_noteCreate a scoped note or reminder after an explicit confirmation of the exact lead, body, and due date.No findings

    Why it is in this group

    • The name "create_note" says "create": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Create a scoped note or reminder after an explicit confirmation of the exact lead, body, and due date. One request_key can be applied only once; a changed intent with the same key fails. Over MCP: call this tool once, without confirmation_token. It runs right away and returns the result.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • openWorldHint: false
    • idempotentHint: false
  • create_reminderCreate a scoped note or reminder after an explicit confirmation of the exact lead, body, and due date.No findings

    Why it is in this group

    • The name "create_reminder" says "create": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Create a scoped note or reminder after an explicit confirmation of the exact lead, body, and due date. One request_key can be applied only once; a changed intent with the same key fails. Over MCP: call this tool once, without confirmation_token. It runs right away and returns the result.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • openWorldHint: false
    • idempotentHint: false
  • enable_agentEnable (activate) a paused or draft agent so it begins discovering leads on its schedule.No findings

    Why it is in this group

    • The name "enable_agent" says "enable": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Enable (activate) a paused or draft agent so it begins discovering leads on its schedule. Two-phase: first call returns a confirmation token + preview; the user reviews and confirms; second call (with confirmation_token) commits. Over MCP: call this tool once, without confirmation_token. It runs right away and returns the result.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • openWorldHint: true
    • idempotentHint: false
  • enable_campaignEnable (resume) a paused or draft campaign.No findings

    Why it is in this group

    • The name "enable_campaign" says "enable": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Enable (resume) a paused or draft campaign. The campaign engine starts scheduling actions per the campaign's workflow. Two-phase: first call returns a confirmation token + preview; the user reviews and confirms; second call (with confirmation_token) commits. Activation pre-conditions (workflow steps, connected accounts) are validated by the underlying campaign service — the tool surfaces any failure as a structured error. Over MCP: call this tool once, without confirmation_token. It runs right away and returns the result.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • openWorldHint: true
    • idempotentHint: false
  • import_search_leads_to_listImport lead rows from a prior search_external_leads session into a lead list.No findings

    Why it is in this group

    • The name "import_search_leads_to_list" says "import": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Import lead rows from a prior search_external_leads session into a lead list. Two-phase: first call returns a confirmation token + preview; the user reviews an inline card and confirms; second call with confirmation_token commits. provider_ids omitted means import every lead in the search session. Supply list_id for an existing list, or list_name to create a new list during the confirmed commit. After a committed result returns list_id, use that exact list_id when creating a campaign from the imported search leads. Over MCP: call this tool once, without confirmation_token. It runs right away and returns the result.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • openWorldHint: false
    • idempotentHint: false
  • pause_agentPause an active agent so it stops discovering new leads.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Pause an active agent so it stops discovering new leads. The agent's existing leads remain in the list. Two-phase: first call returns a confirmation token + preview; the user reviews an inline card and confirms or cancels; second call (with confirmation_token) commits the pause. Always include agent_name + app_name so the preview is human-readable. Over MCP: call this tool once, without confirmation_token. It runs right away and returns the result.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • openWorldHint: true
    • idempotentHint: false
  • pause_campaignPause an active campaign.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Pause an active campaign. The campaign engine stops scheduling actions. Two-phase: first call returns a confirmation token + preview; the user reviews an inline card and confirms or cancels; second call (with confirmation_token) commits the pause. Always include campaign_name + app_name so the preview is human-readable. Over MCP: call this tool once, without confirmation_token. It runs right away and returns the result.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • openWorldHint: true
    • idempotentHint: false
  • rename_listRename one unarchived list in the selected product after explicit approval.No findings

    Why it is in this group

    • The name "rename_list" says "rename": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Rename one unarchived list in the selected product after explicit approval. Supply its current name to reject stale changes; include the full new description. Over MCP: call this tool once, without confirmation_token. It runs right away and returns the result.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • openWorldHint: false
    • idempotentHint: false
  • save_preferenceSave one selected-product Operator preference after explicit approval.1 finding

    Why it is in this group

    • The name "save_preference" says "save": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    Findings

    • Info

      The description mentions "credentials".

      Matched text

      description: "...tion. Existing keys update. No provider credentials or tokens are accepted. Over MCP: call..."

      What this check looks for
    Description, as the server wrote it
    Save one selected-product Operator preference after explicit approval. The value is bounded JSON data, not a system instruction. Existing keys update. No provider credentials or tokens are accepted. Over MCP: call this tool once, without confirmation_token. It runs right away and returns the result.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • openWorldHint: false
    • idempotentHint: false
  • send_conversation_replySend one exact prepared reply to the latest inbound message after explicit human approval.No findings

    Why it is in this group

    • The name "send_conversation_reply" says "send": a word for sending, and what is sent cannot be taken back.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Send one exact prepared reply to the latest inbound message after explicit human approval. Provide the complete prepare_conversation_reply result, its attachment_id when present, and a stable request_key. A timeout is uncertain and cannot be retried automatically. LinkedIn files are supported; email files are unavailable. Over MCP: call this tool once, without confirmation_token. It runs right away and returns the result.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • openWorldHint: true
    • idempotentHint: false
  • set_agent_source_listeningPause or resume only an existing X or Hacker News source on an agent.No findings

    Why it is in this group

    • The name "set_agent_source_listening" says "set": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Pause or resume only an existing X or Hacker News source on an agent. First read get_agent_sources. If configured is false or searches are empty, use configure_agent_source instead. The first call shows exact approval; a second user-approved call commits. Saved searches, budgets, LinkedIn resolution and other sources stay unchanged. A draft or paused agent does not collect until activated. Over MCP: call this tool once, without confirmation_token. It runs right away and returns the result.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • openWorldHint: true
    • idempotentHint: false
  • update_campaign_settingsChange a campaign's manual review, send window, or sender assignments in the selected product.No findings

    Why it is in this group

    • The name "update_campaign_settings" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Change a campaign's manual review, send window, or sender assignments in the selected product. Read get_campaign first and copy its updated_at as expected_updated_at. Omitted settings remain unchanged. Explicit null sender clears one platform. First call returns an exact approval preview; approved execution saves all changes atomically. It never activates, enrolls, or sends. Over MCP: call this tool once, without confirmation_token. It runs right away and returns the result.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • openWorldHint: false
    • idempotentHint: false
  • update_campaign_workflowUpdate message content on existing steps in a draft or paused campaign.No findings

    Why it is in this group

    • The name "update_campaign_workflow" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Update message content on existing steps in a draft or paused campaign. Prefer one-based message_order, which counts only message-bearing steps and automatically skips invite/follow steps: message_order 1, 2, 3 targets the first, second, and third messages even when raw workflow step 1 is an invite. step_order remains available only when an exact raw workflow order is already known. Provide exactly one selector plus the exact message_template for every item. In message_template use only {FirstName}, {LastName}, and {Company} personalization variables. This is a two-phase confirmed action: first call without confirmation_token returns a confirmation card; approved execution applies the exact stored workflow_messages through the campaign service. It never launches or sends. Always include campaign_name and app_name for a human-readable preview. Over MCP: call this tool once, without confirmation_token. It runs right away and returns the result.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • openWorldHint: false
    • idempotentHint: false
  • update_icpApply an ICP edit (description and/or filters JSON) to one agent.No findings

    Why it is in this group

    • The name "update_icp" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Apply an ICP edit (description and/or filters JSON) to one agent. Two-phase: first call returns a confirmation token + preview; the user reviews the diff inline and confirms; second call (with confirmation_token) commits. ALWAYS call draft_icp_edit first so the user sees a before/after; never call update_icp directly without staging a diff. Pre-populate agent_name in the schema args so the preview is human-readable. Over MCP: call this tool once, without confirmation_token. It runs right away and returns the result.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • openWorldHint: false
    • idempotentHint: false
Can't be undone 1Claude Code: ask
  • prepare_conversation_replyPrepare one exact local inbound reply.1 finding

    Why it is in this group

    • The name "prepare_conversation_reply" says "reply": a word for sending, and what is sent cannot be taken back.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "prepare_conversation_reply" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "prepare_conversation_reply" says "reply": a word for sending, and what is sent cannot be taken back.

      What this check looks for
    Description, as the server wrote it
    Prepare one exact local inbound reply. Returns recipient, sender, channel, inbound revision, final signed body, and optional owned file identity. Never sends. Files are available only for supported connected LinkedIn conversations in the selected product.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • idempotentHint: true
Changes things 4Claude Code: ask
  • create_listCreate a new lead list scoped to the request's app.No findings

    Why it is in this group

    • The name "create_list" says "create": a word for a change.
    Description, as the server wrote it
    Create a new lead list scoped to the request's app. Use this when the user wants to organise leads into a named bucket (e.g. 'Q4 Targets', 'Hot Founders'). The new list starts empty; populate it later via approve_leads with action='approve' and the new list_id, or by editing the list manually. Over MCP: call this tool once, without confirmation_token. It runs right away and returns the result.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: false
    • idempotentHint: false
  • draft_icp_editStage a proposed ICP edit for one agent.1 finding

    Why it is in this group

    • The name "draft_icp_edit" says "edit": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "draft_icp_edit" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "draft_icp_edit" says "edit": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Stage a proposed ICP edit for one agent. Returns a diff envelope (current vs proposed, fields_changed) so the user can review the change inline before applying it. Does NOT write — to actually apply the edit, call update_icp (confirm-tier) with the same agent_id and proposed fields. Use this when the user describes a change in plain language ('target Series A founders in EU' etc.); never call update_icp directly without first staging here so the user sees the before/after.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • idempotentHint: true
  • draft_messageGenerate a personalised draft for one lead.No findings

    Why it is in this group

    • The description's first verb is "generate": a word for a change.
    Description, as the server wrote it
    Generate a personalised draft for one lead. Reads the lead's profile (industry, role, headline, optional reference hook) and returns a single message body. Does NOT send. After the user reviews and approves, call send_message to actually deliver. ALWAYS call get_lead first to inspect reply_state — refuse to draft for opted-out / replied / rejected leads. Over MCP: call this tool once, without confirmation_token. It runs right away and returns the result.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: true
    • idempotentHint: false
  • search_external_leadsSearch LinkedIn for fresh people leads from the request user's connected account.1 finding

    Why it is in this group

    • The name "search_external_leads" says "search": a word for reading.
    • The server marks it as not read-only (readOnlyHint: false).

    Findings

    • Warn

      The server marks "search_external_leads" as not read-only (readOnlyHint: false), and its words say it reads.

      Matched text

      annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":true}; The name "search_external_leads" says "search": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Search LinkedIn for fresh people leads from the request user's connected account. Use this when the user describes leads to find by words, roles, companies, or market terms, rather than asking to search existing saved leads. Returns a server-owned session_id and up to 10 lead previews. To import the results, call import_search_leads_to_list with that session_id after the user asks to import all or selected leads. Over MCP: call this tool once, without confirmation_token. It runs right away and returns the result.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: true
    • idempotentHint: false
Only reads 27Claude Code: allow
  • find_leadsSearch leads in the app the request is scoped to.No findings

    Why it is in this group

    • The name "find_leads" says "find": a word for reading.
    Description, as the server wrote it
    Search leads in the app the request is scoped to. Returns bounded named summaries and IDs, never full rows. Use get_lead to load full detail for a specific id. Default source is 'discovered' (agent-found, awaiting approval); pass source='approved' to search leads already in campaigns. Optional 'search' keyword runs an ILIKE across name/company/headline; optional 'status' narrows by lead status. If results are thin, surface the count and ASK the user before broadening the filters — do not silently relax constraints.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • idempotentHint: true
  • get_accessRead current account access for Operator and campaign actions in the selected product.No findings

    Why it is in this group

    • The name "get_access" says "get": a word for reading.
    Description, as the server wrote it
    Read current account access for Operator and campaign actions in the selected product. Operator requires active paid or lifetime entitlement; campaign actions also accept active beta. Feature flags are account-wide. This snapshot is not an action authorization or credit quote.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • idempotentHint: true
  • get_agent_sourcesRead X and Hacker News listening settings for one owned agent, including sources not configured yet.No findings

    Why it is in this group

    • The name "get_agent_sources" says "get": a word for reading.
    Description, as the server wrote it
    Read X and Hacker News listening settings for one owned agent, including sources not configured yet. Use list_agents to identify the agent. If configured is false, use configure_agent_source to propose exact searches and enable listening after approval. If configured is true and searches exist, use set_agent_source_listening to toggle without changing searches. A draft or paused agent does not collect until activated. LinkedIn signal groups are separate.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • idempotentHint: true
  • get_analyticsReturn product- or campaign-scoped activity in a UTC lookback interval.No findings

    Why it is in this group

    • The name "get_analytics" says "get": a word for reading.
    Description, as the server wrote it
    Return product- or campaign-scoped activity in a UTC lookback interval. Completed actions and invitations use executed_at; connections and recorded replies use lead event timestamps. These are separate event counts, not one conversion cohort. Default 7 days, max 90.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • idempotentHint: true
  • get_campaignRead one campaign in the selected product.No findings

    Why it is in this group

    • The name "get_campaign" says "get": a word for reading.
    Description, as the server wrote it
    Read one campaign in the selected product. Returns updated_at for exact approved settings changes, plus workflow, sender assignments, schedule, review mode, observed action state, and readiness blockers. Empty templates are not claimed as generated messages. No sending or activation occurs.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • idempotentHint: true
  • get_conversation_contextReturn bounded conversation context for one lead or conversation in the request scope: lead profile, product/campaign context, last real messages, recent notes, open reminders, and…No findings

    Why it is in this group

    • The name "get_conversation_context" says "get": a word for reading.
    Description, as the server wrote it
    Return bounded conversation context for one lead or conversation in the request scope: lead profile, product/campaign context, last real messages, recent notes, open reminders, and Reply Assistant follow-up suggestions. Use this before meeting prep, reply planning, or questions about what happened with a lead. Read-only; does not draft or send messages.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • idempotentHint: true
  • get_daily_prioritiesRank up to four live operational starting points with source IDs and links.No findings

    Why it is in this group

    • The name "get_daily_priorities" says "get": a word for reading.
    Description, as the server wrote it
    Rank up to four live operational starting points with source IDs and links. Connected senders and insights count across the account; leads, actions, campaigns, and unread messages count within the selected product. Read only.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • idempotentHint: true
  • get_inbox_queueList reply-needed conversations or due follow-ups in the selected product.No findings

    Why it is in this group

    • The name "get_inbox_queue" says "get": a word for reading.
    Description, as the server wrote it
    List reply-needed conversations or due follow-ups in the selected product. One predicate determines both the total and page. AI drafts are not counted as sent replies. Limit 50; use offset for later pages.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • idempotentHint: true
  • get_insightRead one insight and its evidence for the selected product, or an explicitly account-scoped insight.No findings

    Why it is in this group

    • The name "get_insight" says "get": a word for reading.
    Description, as the server wrote it
    Read one insight and its evidence for the selected product, or an explicitly account-scoped insight. Read-only; proposed changes never run here.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • idempotentHint: true
  • get_leadReturn full detail for a single lead by id, INCLUDING the derived reply_state and opt_out flags.No findings

    Why it is in this group

    • The name "get_lead" says "get": a word for reading.
    Description, as the server wrote it
    Return full detail for a single lead by id, INCLUDING the derived reply_state and opt_out flags. Always call this before drafting or sending a message — a lead whose reply_state is 'replied', 'rejected', or 'opted_out', or whose opt_out is true, must NEVER be drafted to or messaged. Use source='approved' for leads in active campaigns; default 'discovered' is for agent-found leads awaiting approval.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • idempotentHint: true
  • get_listRead one unarchived list in the selected product and its exact member count.No findings

    Why it is in this group

    • The name "get_list" says "get": a word for reading.
    Description, as the server wrote it
    Read one unarchived list in the selected product and its exact member count. Does not return contacts; use list_list_contacts.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • idempotentHint: true
  • get_operator_taskRead one durable Operator task in the selected product with its step states, action states, safe summaries, version, and progress.No findings

    Why it is in this group

    • The name "get_operator_task" says "get": a word for reading.
    Description, as the server wrote it
    Read one durable Operator task in the selected product with its step states, action states, safe summaries, version, and progress. Does not return executable arguments or raw provider errors.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • idempotentHint: true
  • get_product_contextRead the selected product's name, site, description, ICP summary, language, Product Brain availability, and dashboard link.1 finding

    Why it is in this group

    • The name "get_product_context" says "get": a word for reading.

    Findings

    • Info

      The description mentions "credentials".

      Matched text

      description: "...bility, and dashboard link. No provider credentials or raw unbounded configuration are retu..."

      What this check looks for
    Description, as the server wrote it
    Read the selected product's name, site, description, ICP summary, language, Product Brain availability, and dashboard link. No provider credentials or raw unbounded configuration are returned.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • idempotentHint: true
  • get_reply_attemptRead one reply attempt by its stable request_key in the selected product.No findings

    Why it is in this group

    • The name "get_reply_attempt" says "get": a word for reading.
    Description, as the server wrote it
    Read one reply attempt by its stable request_key in the selected product. Returns actual delivery evidence and next_action. Uncertain delivery requires manual provider review unless an exact outgoing provider message is confirmed. Never retries or sends.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • idempotentHint: true
  • get_scheduleList pending, approved, or failed scheduled actions in the selected product, optionally for one campaign.No findings

    Why it is in this group

    • The name "get_schedule" says "get": a word for reading.
    Description, as the server wrote it
    List pending, approved, or failed scheduled actions in the selected product, optionally for one campaign. Returns one bounded page and its exact total. Completed actions are not included.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • idempotentHint: true
  • get_scheduled_actionRead one action in the selected product: campaign, lead, type, state, scheduled and executed timestamps.No findings

    Why it is in this group

    • The name "get_scheduled_action" says "get": a word for reading.
    Description, as the server wrote it
    Read one action in the selected product: campaign, lead, type, state, scheduled and executed timestamps. Does not return provider metadata or a message body.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • idempotentHint: true
  • get_sender_healthShow account-wide connected sender health and separate readiness for campaign assignments in the selected product.No findings

    Why it is in this group

    • The name "get_sender_health" says "get": a word for reading.
    Description, as the server wrote it
    Show account-wide connected sender health and separate readiness for campaign assignments in the selected product. An account-wide connection does not prove a campaign has a usable sender.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • idempotentHint: true
  • list_agentsList the specialist agents in the product/app the request is scoped to.No findings

    Why it is in this group

    • The name "list_agents" says "list": a word for reading.
    Description, as the server wrote it
    List the specialist agents in the product/app the request is scoped to. Returns a summary (count, brief one-liner, and a list of {id, name, status, type, role, one-line icp_summary}). Internal agent types are mapped to product-facing roles such as lead_finder. Full ICP filters / config are collapsed to a one-liner — call get_agent (later) to load full detail. Use this to ground questions like 'how many specialist agents do I have?' or 'which Lead Finder agents are active?'.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • idempotentHint: true
  • list_appsList the products/apps owned by the request scope's user.No findings

    Why it is in this group

    • The name "list_apps" says "list": a word for reading.
    Description, as the server wrote it
    List the products/apps owned by the request scope's user. Returns a summary (count, brief one-liner, and a list of {id, name, description, url}) with no timestamps or internal flags. Use this for product inventory or explicit product-switch/disambiguation questions. A normal product-scoped request already carries an app_id in Scope; do not call this just to discover which product to use for product-aware actions.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • idempotentHint: true
  • list_campaignsList the campaigns in the app the request is scoped to (excludes archived).No findings

    Why it is in this group

    • The name "list_campaigns" says "list": a word for reading.
    Description, as the server wrote it
    List the campaigns in the app the request is scoped to (excludes archived). Returns a summary (count, brief one-liner, and a list of {id, name, status, agent_id, list_id}). Settings JSON is intentionally omitted; call get_campaign for current workflow, sender, and action detail. Status values: 'draft', 'active', 'paused'.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • idempotentHint: true
  • list_insightsList account-scoped and selected-product-scoped open insights.No findings

    Why it is in this group

    • The name "list_insights" says "list": a word for reading.
    Description, as the server wrote it
    List account-scoped and selected-product-scoped open insights. Each item labels its actual scope; account insights are not product-only. Exact total and bounded pages.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • idempotentHint: true
  • list_list_contactsList contacts in one unarchived list in the selected product.No findings

    Why it is in this group

    • The name "list_list_contacts" says "list": a word for reading.
    Description, as the server wrote it
    List contacts in one unarchived list in the selected product. Returns exact total and bounded pages. Does not expose email or provider identifiers.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • idempotentHint: true
  • list_listsList unarchived lead lists in the selected product.No findings

    Why it is in this group

    • The name "list_lists" says "list": a word for reading.
    Description, as the server wrote it
    List unarchived lead lists in the selected product. Returns exact total and bounded pages. A list's cached lead count is not used for the total.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • idempotentHint: true
  • list_operator_filesList up to 20 files uploaded to any of your Operator threads in the selected product.No findings

    Why it is in this group

    • The name "list_operator_files" says "list": a word for reading.
    Description, as the server wrote it
    List up to 20 files uploaded to any of your Operator threads in the selected product. Returns file IDs and metadata only, never bytes or extracted text. A file can be used for a same-product LinkedIn reply, not another product or email reply.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • idempotentHint: true
  • list_operator_tasksList durable Operator tasks in the selected product.No findings

    Why it is in this group

    • The name "list_operator_tasks" says "list": a word for reading.
    Description, as the server wrote it
    List durable Operator tasks in the selected product. Returns bounded pages, exact total, task status, version, and links. Read-only.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • idempotentHint: true
  • list_preferencesList up to 20 saved Operator preferences for the user and product in the request scope.1 finding

    Why it is in this group

    • The name "list_preferences" says "list": a word for reading.

    Findings

    • Info

      The description mentions "credentials".

      Matched text

      description: "...ey, value, and source only. No provider credentials or tokens are returned."

      What this check looks for
    Description, as the server wrote it
    List up to 20 saved Operator preferences for the user and product in the request scope. Values are bounded, labeled customer data, and never override user instructions or system rules. Returns key, value, and source only. No provider credentials or tokens are returned.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • idempotentHint: true
  • list_remindersList open or done lead reminders in the selected product with exact total and bounded pages.No findings

    Why it is in this group

    • The name "list_reminders" says "list": a word for reading.
    Description, as the server wrote it
    List open or done lead reminders in the selected product with exact total and bounded pages. Default is open. This read does not complete a reminder.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • idempotentHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http funkel https://api.funkel.ai/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__funkel__list_apps",
      "mcp__funkel__get_product_context",
      "mcp__funkel__list_lists",
      "mcp__funkel__get_list",
      "mcp__funkel__list_list_contacts",
      "mcp__funkel__get_schedule",
      "mcp__funkel__get_scheduled_action",
      "mcp__funkel__list_reminders",
      "mcp__funkel__list_insights",
      "mcp__funkel__get_insight",
      "mcp__funkel__list_operator_tasks",
      "mcp__funkel__get_operator_task",
      "mcp__funkel__get_access",
      "mcp__funkel__list_agents",
      "mcp__funkel__get_agent_sources",
      "mcp__funkel__list_campaigns",
      "mcp__funkel__get_campaign",
      "mcp__funkel__get_daily_priorities",
      "mcp__funkel__get_sender_health",
      "mcp__funkel__get_analytics",
      "mcp__funkel__find_leads",
      "mcp__funkel__get_lead",
      "mcp__funkel__get_conversation_context",
      "mcp__funkel__get_inbox_queue",
      "mcp__funkel__list_operator_files",
      "mcp__funkel__get_reply_attempt",
      "mcp__funkel__list_preferences"
    ],
    "ask": [
      "mcp__funkel__prepare_conversation_reply",
      "mcp__funkel__search_external_leads",
      "mcp__funkel__draft_message",
      "mcp__funkel__create_list",
      "mcp__funkel__draft_icp_edit"
    ],
    "deny": [
      "mcp__funkel__create_note",
      "mcp__funkel__create_reminder",
      "mcp__funkel__save_preference",
      "mcp__funkel__rename_list",
      "mcp__funkel__control_operator_task",
      "mcp__funkel__set_agent_source_listening",
      "mcp__funkel__configure_agent_source",
      "mcp__funkel__update_campaign_settings",
      "mcp__funkel__send_conversation_reply",
      "mcp__funkel__import_search_leads_to_list",
      "mcp__funkel__create_campaign_draft",
      "mcp__funkel__update_campaign_workflow",
      "mcp__funkel__enable_campaign",
      "mcp__funkel__pause_campaign",
      "mcp__funkel__enable_agent",
      "mcp__funkel__pause_agent",
      "mcp__funkel__approve_leads",
      "mcp__funkel__update_icp",
      "mcp__funkel__create_agent"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as funkel. Review it before you use it.