Skip to content
anlyon.devby Anlyon

Deskhand

com.grain64.deskhand/deskhanddeskhand.grain64.comstreamable-httpv1.2.0Scanned

CRM and email desk for AI agents: key per agent, undo a run. Start with one POST, no account.

30 tools: 3 do something that can't be undone, 17 change things and 10 only read.

Tools: 0 delete, 3 irreversible, 17 write, 10 read.
  • Reads private data · 7
  • Reads text others write · 6
  • Can send data out · 2
  • 2 findings

Sign-in required, no OAuth metadata. Remote posture

Anlyon alternative

20 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →
Compare with similar serversMarkdownJSONReport this listing

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

30 tools

Can't be undone 3Claude Code: ask
  • draft_emailDraft one email to a contact.Can send data outNo findings

    Why it is in this group

    • The input addresses people (input.to): what it sends cannot be taken back.

    What it can reach

    • outboundThe input takes a destination (input.to): what the tool writes goes there.
    Description, as the server wrote it
    Draft one email to a contact. Drafts are auto-approved by default (the operator can switch approval on for the workspace or for you; then the draft waits in their Approvals inbox). Approved mail that cannot be sent to the recipient yet waits in the operator's To send list and the response says so. Refuses with contact_suppressed when the contact replied, unsubscribed or bounced. One recipient per message, plain text, no attachments. Accepts only contact_id (or to), subject, body and an optional note (your one-line reason for writing it, up to 500 characters, shown to the operator on the approval card): any other argument is rejected with unknown_field. The response carries warnings (codes: open_draft_exists when another unsent draft to the same contact exists, emailed_N_days_ago when mail went out in the last 3 days, contact_status_<status>) and prior_emails; check them before drafting a second message to the same person. Requires the draft_email scope.

    Annotations the server declares

    • title: Draft an email
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_repliesReplies captured from contacts, newest first.Reads private dataReads text others write1 finding

    Why it is in this group

    • The name "list_replies" says "list": a word for reading.
    • The description's first verb is "reply": a word for sending, and what is sent cannot be taken back.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • private-dataThe description's first sentence says "contact": it reads contacts.
    • untrusted-inputThe name "list_replies" says "list" and "reply": it reads comments, which other people can write.

    Findings

    • Warn

      The server marks "list_replies" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "list_replies" says "list": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Replies captured from contacts, newest first. Requires the read_crm scope.

    Annotations the server declares

    • title: List replies
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • report_sendReport one outbox message: sent (final: the person moves to the next step; reporting sent twice is fine, a different second report is 409 already_reported), refused_cap, refused_un…Can send data outNo findings

    Why it is in this group

    • The name "report_send" says "send": a word for sending, and what is sent cannot be taken back.

    What it can reach

    • outboundThe name "report_send" says "send": it sends or publishes something to other people.
    Description, as the server wrote it
    Report one outbox message: sent (final: the person moves to the next step; reporting sent twice is fine, a different second report is 409 already_reported), refused_cap, refused_unsigned or failed_transient (the message stays in To send and gives its cap unit back), refused_suppressed (the person is suppressed and leaves the campaign). A later bounce is not a report: use add_suppression with reason bounced. Requires the manage_campaigns scope.

    Annotations the server declares

    • title: Report what happened to a message
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
Changes things 17Claude Code: ask
  • add_noteAttach a note to a contact (by id or email) or to a deal.No findings

    Why it is in this group

    • The name "add_note" says "add": a word for a change.
    Description, as the server wrote it
    Attach a note to a contact (by id or email) or to a deal. Requires the write_crm scope.

    Annotations the server declares

    • title: Add a note
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • add_suppressionNever email this address or domain again, in any campaign.No findings

    Why it is in this group

    • The name "add_suppression" says "add": a word for a change.
    Description, as the server wrote it
    Never email this address or domain again, in any campaign. Open enrollments of matching contacts stop. Removing an entry needs the operator. Requires the manage_campaigns scope.

    Annotations the server declares

    • title: Add to the suppression list
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • create_campaignCreate a campaign: an ordered sequence of email, wait and task steps run per contact, with follow-ups, stop rules (reply, bounce, unsubscribe and deal stage change stop a contact's…No findings

    Why it is in this group

    • The name "create_campaign" says "create": a word for a change.
    Description, as the server wrote it
    Create a campaign: an ordered sequence of email, wait and task steps run per contact, with follow-ups, stop rules (reply, bounce, unsubscribe and deal stage change stop a contact's sequence), a send window, caps and A/B variants. Pass steps inline, and optionally `enroll` to select contacts in the same call. It starts as a draft; call simulate_campaign, then launch_campaign. Delivery is a dry run (nothing leaves the system) until the operator switches sending on. Requires the manage_campaigns scope.

    Annotations the server declares

    • title: Create a campaign
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • create_dealOpen a deal, optionally linked to a contact (by id or email) and a company.No findings

    Why it is in this group

    • The name "create_deal" says "create": a word for a change.
    Description, as the server wrote it
    Open a deal, optionally linked to a contact (by id or email) and a company. Stages: lead, contacted, qualified, proposal, won, lost. The deal takes its contact's company unless company_id is given. Unknown arguments are rejected with unknown_field. Requires the write_crm scope.

    Annotations the server declares

    • title: Create a deal
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • create_taskCreate a follow-up task or reminder with an optional due date, on a contact or a deal.No findings

    Why it is in this group

    • The name "create_task" says "create": a word for a change.
    Description, as the server wrote it
    Create a follow-up task or reminder with an optional due date, on a contact or a deal. Requires the manage_tasks scope.

    Annotations the server declares

    • title: Create a task
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • enroll_contactsEnroll contacts by ids, tag, source/list, status, text or custom fields.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Enroll contacts by ids, tag, source/list, status, text or custom fields. Suppressed, replied, unsubscribed, bounced, address-less and blocked-domain contacts are skipped with a reason, and a contact in another running campaign is skipped (or moved with on_conflict=move). dry_run=true returns who would be enrolled and who skipped. Requires the manage_campaigns scope.

    Annotations the server declares

    • title: Enroll contacts in a campaign
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_outboxFor a campaign that sends through your own sender (relay identity): the operator-approved messages you may send now, each with its exact text, recipient, step and evidence link, pl…Reads private dataReads text others write1 finding

    Why it is in this group

    • The name "get_outbox" says "get": a word for reading.
    • The server marks it as not read-only (readOnlyHint: false).

    What it can reach

    • private-dataThe description's first sentence says "message": it reads messages.
    • untrusted-inputThe description's first sentence says "message": it reads messages, which other people can write.

    Findings

    • Warn

      The server marks "get_outbox" as not read-only (readOnlyHint: false), and its words say it reads.

      Matched text

      annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":false}; The name "get_outbox" says "get": a word for reading.

      What this check looks for
    Description, as the server wrote it
    For a campaign that sends through your own sender (relay identity): the operator-approved messages you may send now, each with its exact text, recipient, step and evidence link, plus batch_id and batch_hash. Send the text byte for byte, then call report_send for every message. 409 batch_not_approved until the operator signs the batch; 409 batch_changed if anything changed after sign-off. Requires the manage_campaigns scope.

    Annotations the server declares

    • title: Read the signed messages to send
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • launch_campaignStart a draft campaign.No findings

    Why it is in this group

    • The description's first verb is "start": a word for a change.
    Description, as the server wrote it
    Start a draft campaign. Refused with launch_blockers (postal address, sender name, an email step, enrolled contacts, a verified identity) until they are fixed. With approval on, it returns 202 and waits for the operator to approve the launch once. Requires the manage_campaigns scope.

    Annotations the server declares

    • title: Launch a campaign
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • mark_repliedRecord that a contact replied (optionally with the reply text).No findings

    Why it is in this group

    • The name "mark_replied" says "mark": a word for a change.
    Description, as the server wrote it
    Record that a contact replied (optionally with the reply text). Sets the contact to replied, cancels their pending drafts and open follow-up tasks, and stops further drafts to them. Requires the write_crm scope.

    Annotations the server declares

    • title: Mark a contact as replied
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • move_dealSet a deal's stage (lead, contacted, qualified, proposal, won, lost).No findings

    Why it is in this group

    • The name "move_deal" says "move": a word for a change.
    Description, as the server wrote it
    Set a deal's stage (lead, contacted, qualified, proposal, won, lost). Requires the write_crm scope.

    Annotations the server declares

    • title: Move a deal to a stage
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • pause_campaignFreeze a running campaign.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Freeze a running campaign. Nothing is lost: resuming shifts every pending step by the length of the pause. Requires the manage_campaigns scope.

    Annotations the server declares

    • title: Pause a campaign
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • resume_campaignResume a paused campaign.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Resume a paused campaign. Requires the manage_campaigns scope.

    Annotations the server declares

    • title: Resume a campaign
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • simulate_campaignWhat would go out over the next N days: per contact and step, the send time (UTC and local), the fully rendered subject and body, and the status (will_send, skipped_missing_variabl…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    What would go out over the next N days: per contact and step, the send time (UTC and local), the fully rendered subject and body, and the status (will_send, skipped_missing_variable, skipped_condition, blocked_by_cap, task_created), plus problems and launch_blockers. Nothing is written or sent. It uses the same planner as the real scheduler, so this is what the scheduler will do.

    Annotations the server declares

    • title: Simulate what goes out
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • stop_enrollmentStop a single enrollment (reason manual).No findings

    Why it is in this group

    • The name "stop_enrollment" says "stop": a word for a change.
    Description, as the server wrote it
    Stop a single enrollment (reason manual). Requires the manage_campaigns scope.

    Annotations the server declares

    • title: Stop one contact's sequence
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • update_campaignChange a campaign's settings and/or replace its ordered steps.No findings

    Why it is in this group

    • The name "update_campaign" says "update": a word for a change.
    Description, as the server wrote it
    Change a campaign's settings and/or replace its ordered steps. Editing the steps of a running campaign needs the operator's approval when approval is on. Requires the manage_campaigns scope.

    Annotations the server declares

    • title: Edit a campaign
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • update_contactChange fields of an existing contact, found by id or email.No findings

    Why it is in this group

    • The name "update_contact" says "update": a word for a change.
    Description, as the server wrote it
    Change fields of an existing contact, found by id or email. Custom `fields` are merged with the existing ones. Requires the write_crm scope.

    Annotations the server declares

    • title: Update a contact
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • upsert_contactCreate a contact, or update the one that already has this email (matched case-insensitively).No findings

    Why it is in this group

    • The name "upsert_contact" says "upsert": a word for a change.
    Description, as the server wrote it
    Create a contact, or update the one that already has this email (matched case-insensitively). Custom `fields` and `tags` are merged into what is stored. A company is created or reused from company_domain or company_name. Requires the write_crm scope.

    Annotations the server declares

    • title: Create or update a contact
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
Only reads 10Show 10 read-only tools
  • campaign_reportCounts per campaign, per step and per variant: enrolled, active, completed, stopped (by reason), sent, sent_dry (dry-run records, nothing delivered), skipped (by reason), replied, …Reads private dataNo findings

    Why it is in this group

    • The description's first verb is "count": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "count" and "meeting": it reads calendars.
    Description, as the server wrote it
    Counts per campaign, per step and per variant: enrolled, active, completed, stopped (by reason), sent, sent_dry (dry-run records, nothing delivered), skipped (by reason), replied, bounced, unsubscribed, meetings, deals_created. Rates say which count they divide by.

    Annotations the server declares

    • title: Campaign report
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_campaignOne campaign with its steps, status, delivery mode (dry run or live) and counters.No findings

    Why it is in this group

    • The name "get_campaign" says "get": a word for reading.
    Description, as the server wrote it
    One campaign with its steps, status, delivery mode (dry run or live) and counters.

    Annotations the server declares

    • title: Read a campaign
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_policyWhat the operator allows this agent: the workspace approval setting and, in plain words, what happens to your CRM writes and email drafts (apply or auto-approve at once, or wait fo…Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "get_policy" says "get": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "email": it reads mail.
    • untrusted-inputThe description's first sentence says "email": it reads inbound email, which other people can write.
    Description, as the server wrote it
    What the operator allows this agent: the workspace approval setting and, in plain words, what happens to your CRM writes and email drafts (apply or auto-approve at once, or wait for approval), this agent's mode (direct or propose), daily send caps and how many were used today, blocked domains, and the contact statuses that are never mailed. Read it before planning a batch of drafts.

    Annotations the server declares

    • title: Read the sending policy
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_threadSent mail and replies for one contact in time order.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "get_thread" says "get": a word for reading.

    What it can reach

    • private-dataThe name "get_thread" says "get" and "thread": it reads messages.
    • private-dataThe description's first sentence says "mail": it reads mail.
    • untrusted-inputThe name "get_thread" says "get" and "thread": it reads messages, which other people can write.
    • untrusted-inputThe description's first sentence says "mail": it reads inbound email, which other people can write.
    Description, as the server wrote it
    Sent mail and replies for one contact in time order. Requires the read_crm scope.

    Annotations the server declares

    • title: Read a contact's thread
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_campaignsCampaigns in this workspace with status, delivery mode and enrolled/sent/replied counters.No findings

    Why it is in this group

    • The name "list_campaigns" says "list": a word for reading.
    Description, as the server wrote it
    Campaigns in this workspace with status, delivery mode and enrolled/sent/replied counters. Archived ones are hidden unless status=archived.

    Annotations the server declares

    • title: List campaigns
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_due_tasksWhat is due now: overdue and due-today tasks first, then the next 7 days.No findings

    Why it is in this group

    • The name "list_due_tasks" says "list": a word for reading.
    Description, as the server wrote it
    What is due now: overdue and due-today tasks first, then the next 7 days. Tasks on contacts who replied, unsubscribed or bounced are flagged follow_up_blocked: do not chase those. Requires manage_tasks or read_crm.

    Annotations the server declares

    • title: List tasks that are due
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_email_statusStatus of this agent's emails: pending_approval (only when approval is on), approved (with a note when it waits in the manual To send hand-off), rejected (with reject_reason to lea…Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "list_email_status" says "list": a word for reading.

    What it can reach

    • private-dataThe name "list_email_status" says "list" and "email": it reads mail.
    • private-dataThe description's first sentence says "status" and "email": it reads mail.
    • untrusted-inputThe name "list_email_status" says "list" and "email": it reads inbound email, which other people can write.
    • untrusted-inputThe description's first sentence says "status" and "email": it reads inbound email, which other people can write.
    Description, as the server wrote it
    Status of this agent's emails: pending_approval (only when approval is on), approved (with a note when it waits in the manual To send hand-off), rejected (with reject_reason to learn from), sent, failed, cancelled. Each email carries warnings (open_draft_exists, emailed_N_days_ago) and prior_emails. Filter by status (comma separated), run_id or contact_id.

    Annotations the server declares

    • title: Check email drafts and sends
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_sending_identitiesThe identities a campaign can send through: the built-in dry_run identity and any the operator connected (their keys are never shown), with their delivery state.No findings

    Why it is in this group

    • The name "list_sending_identities" says "list": a word for reading.
    Description, as the server wrote it
    The identities a campaign can send through: the built-in dry_run identity and any the operator connected (their keys are never shown), with their delivery state.

    Annotations the server declares

    • title: List sending identities
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_suppressionsAddresses and domains that are never emailed.No findings

    Why it is in this group

    • The name "list_suppressions" says "list": a word for reading.
    Description, as the server wrote it
    Addresses and domains that are never emailed.

    Annotations the server declares

    • title: List the suppression list
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • search_contactsFind contacts by text (name, email, title), status, source, company or a custom field.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "search_contacts" says "search": a word for reading.

    What it can reach

    • private-dataThe name "search_contacts" says "search" and "contact": it reads contacts.
    • private-dataThe description's first sentence says "find" and "contact": it reads contacts.
    • untrusted-inputThe description's first sentence says "find" and "email": it reads inbound email, which other people can write.
    Description, as the server wrote it
    Find contacts by text (name, email, title), status, source, company or a custom field. Returns up to `limit` contacts and a next_cursor. Requires the read_crm scope.

    Annotations the server declares

    • title: Search contacts
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

84 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 2 outbound tools breaks every one.

Reads private data7
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write6
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out2
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
deny to break every path
{
  "permissions": {
    "deny": [
      "mcp__deskhand__draft_email",
      "mcp__deskhand__report_send"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Sign-in required, no OAuth metadata

Looked at Oct 29, 2026, 21:36 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable
yes
HTTP status of an anonymous initialize
401
tools/list served without credentials
no
Tools that change things, listed without credentials
0
Protocol version
not observed
WWW-Authenticate on 401
yes
resource_metadata in WWW-Authenticate
not observed
RFC 9728 protected resource metadata
not observed
Authorization servers
not observed
Legacy HTTP+SSE transport
no
Dynamic client registration
not observed
Client ID metadata documents
not observed
  • WarnThe whole server

    The endpoint asks for credentials (HTTP 401) but publishes no RFC 9728 protected resource metadata: no resource_metadata in WWW-Authenticate and no document at /.well-known/oauth-protected-resource.

    Matched text

    https://deskhand.grain64.com/api/mcp: initialize answered HTTP 401, with a WWW-Authenticate header

    What this check looks for

Findings

Matches of fixed checks, with the text they matched.

2 warn
  • Warnlist_replies

    The server marks "list_replies" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "list_replies" says "list": a word for reading.

    What this check looks for
  • Warnget_outbox

    The server marks "get_outbox" as not read-only (readOnlyHint: false), and its words say it reads.

    Matched text

    annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":false}; The name "get_outbox" says "get": a word for reading.

    What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 1.2.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http deskhand https://deskhand.grain64.com/api/mcp --header 'Authorization: <your-authorization>'
claude mcp add --transport http deskhand https://deskhand.grain64.com/api/mcp --header 'Authorization: <your-authorization>'

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__deskhand__search_contacts",
      "mcp__deskhand__list_due_tasks",
      "mcp__deskhand__list_email_status",
      "mcp__deskhand__get_thread",
      "mcp__deskhand__get_policy",
      "mcp__deskhand__get_campaign",
      "mcp__deskhand__list_campaigns",
      "mcp__deskhand__campaign_report",
      "mcp__deskhand__list_sending_identities",
      "mcp__deskhand__list_suppressions"
    ],
    "ask": [
      "mcp__deskhand__upsert_contact",
      "mcp__deskhand__update_contact",
      "mcp__deskhand__create_deal",
      "mcp__deskhand__move_deal",
      "mcp__deskhand__add_note",
      "mcp__deskhand__create_task",
      "mcp__deskhand__draft_email",
      "mcp__deskhand__list_replies",
      "mcp__deskhand__mark_replied",
      "mcp__deskhand__create_campaign",
      "mcp__deskhand__update_campaign",
      "mcp__deskhand__enroll_contacts",
      "mcp__deskhand__simulate_campaign",
      "mcp__deskhand__launch_campaign",
      "mcp__deskhand__pause_campaign",
      "mcp__deskhand__resume_campaign",
      "mcp__deskhand__stop_enrollment",
      "mcp__deskhand__get_outbox",
      "mcp__deskhand__report_send",
      "mcp__deskhand__add_suppression"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as deskhand. Review it before you use it.

Capability tags behind 9 rules
  • mcp__deskhand__search_contacts private-data, untrusted-input
  • mcp__deskhand__draft_email outbound
  • mcp__deskhand__list_email_status private-data, untrusted-input
  • mcp__deskhand__list_replies private-data, untrusted-input
  • mcp__deskhand__get_thread private-data, untrusted-input
  • mcp__deskhand__get_policy private-data, untrusted-input
  • mcp__deskhand__campaign_report private-data
  • mcp__deskhand__get_outbox private-data, untrusted-input
  • mcp__deskhand__report_send outbound

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/com.grain64.deskhand/deskhand/verify?hash=51708d745c1caba4dc4791431cd346eebee14a018938def648761d1d34f6fdf9" | jq -e '.changed == false'

Pinned hash 51708d745c1c, from Nov 4, 2026, 15:18 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/com.grain64.deskhand/deskhand/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for com.grain64.deskhand/deskhand
[![anlyon.dev](https://anlyon.dev/badge/com.grain64.deskhand/deskhand.svg)](https://anlyon.dev/servers/com.grain64.deskhand/deskhand)

Source: MCP Registry. Synced Nov 4, 2026, 15:17 UTC.