Skip to content
anlyon.devby Anlyon

DealMachine

io.github.DealMachine/dealmachineDealMachinestreamable-httpv0.3.1Scanned

Find US property owners, including LLCs, plus owner phones and emails. Needs a DealMachine account.

129 tools: 66 can delete or cancel things, 8 change things and 55 only read.

Tools: 66 delete, 0 irreversible, 8 write, 55 read.
  • Reads private data · 30
  • Reads text others write · 45
  • Can send data out · 32
  • 10 findings

Tools listed without sign-in. Remote posture

Anlyon alternative

74 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →
Compare with similar serversMarkdownJSONReport this listing

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

129 tools

Deletes or cancels 66Claude Code: deny
  • dealmachine_compsFind comparable sales + active listings for up to 25 subject properties.No findings

    Why it is in this group

    • The description's first verb is "find": a word for reading.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Find comparable sales + active listings for up to 25 subject properties. Costs 1 property data credit per subject found. Location/criteria optional (sensible defaults).

    Annotations the server declares

    • title: Find Comparable Properties
    • readOnlyHint: false
    • openWorldHint: false
    • destructiveHint: true
    • idempotentHint: false
  • dealmachine_delete_lists_list_idDelete list.No findings

    Why it is in this group

    • The name "dealmachine_delete_lists_list_id" says "delete": a word for removing or ending something.
    • The description says "cannot be undone".
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Delete list. Delete a list and all its items. This action cannot be undone. Requires user approval and confirmed=true before changes or credit use. Writes are never retried automatically.

    Annotations the server declares

    • title: Delete list
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • dealmachine_delete_lists_list_id_itemsRemove items from list.No findings

    Why it is in this group

    • The name "dealmachine_delete_lists_list_id_items" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Remove items from list. Remove specific property or person IDs from a list. Requires user approval and confirmed=true before changes or credit use. Writes are never retried automatically.

    Annotations the server declares

    • title: Remove items from list
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • dealmachine_delete_mail_designs_idDelete design.Reads text others writeNo findings

    Why it is in this group

    • The name "dealmachine_delete_mail_designs_id" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Delete design. Delete a design. Designs used in active campaigns cannot be deleted. Requires user approval and confirmed=true before changes or credit use. Writes are never retried automatically.

    Annotations the server declares

    • title: Delete design
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • dealmachine_delete_mail_return_addresses_idDelete return address.Reads text others writeNo findings

    Why it is in this group

    • The name "dealmachine_delete_mail_return_addresses_id" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Delete return address. Delete a return address. The default return address cannot be deleted — set another as default first. Requires user approval and confirmed=true before changes or credit use. Writes are never retried automatically.

    Annotations the server declares

    • title: Delete return address
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • dealmachine_delete_prospects_idRemove prospect.No findings

    Why it is in this group

    • The name "dealmachine_delete_prospects_id" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Remove prospect. Archive the prospect and end its mail. Its notes, files, and activity are kept; it can be added again later. Pass `?cascade=false` to keep its list memberships and open opportunities. Mail always ends. Requires user approval and confirmed=true before changes or credit use. Writes are never retried automatically.

    Annotations the server declares

    • title: Remove prospect
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • dealmachine_delete_prospects_id_files_file_idDelete prospect file.No findings

    Why it is in this group

    • The name "dealmachine_delete_prospects_id_files_file_id" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Delete prospect file. Requires user approval and confirmed=true before changes or credit use. Writes are never retried automatically.

    Annotations the server declares

    • title: Delete prospect file
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • dealmachine_delete_prospects_id_notes_note_idDelete prospect note.No findings

    Why it is in this group

    • The name "dealmachine_delete_prospects_id_notes_note_id" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Delete prospect note. Requires user approval and confirmed=true before changes or credit use. Writes are never retried automatically.

    Annotations the server declares

    • title: Delete prospect note
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • dealmachine_delete_prospects_id_photos_photo_idDelete prospect photo.No findings

    Why it is in this group

    • The name "dealmachine_delete_prospects_id_photos_photo_id" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Delete prospect photo. Requires user approval and confirmed=true before changes or credit use. Writes are never retried automatically.

    Annotations the server declares

    • title: Delete prospect photo
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • dealmachine_delete_prospects_id_tags_tag_idRemove tag from prospect.No findings

    Why it is in this group

    • The name "dealmachine_delete_prospects_id_tags_tag_id" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Remove tag from prospect. Requires user approval and confirmed=true before changes or credit use. Writes are never retried automatically.

    Annotations the server declares

    • title: Remove tag from prospect
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • dealmachine_delete_tags_idDelete tag.No findings

    Why it is in this group

    • The name "dealmachine_delete_tags_id" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Delete tag. Delete a workspace tag. Returns 409 while prospects still carry it unless `force=true`, which removes it from them first. Requires user approval and confirmed=true before changes or credit use. Writes are never retried automatically.

    Annotations the server declares

    • title: Delete tag
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • dealmachine_delete_tasks_idDelete task.No findings

    Why it is in this group

    • The name "dealmachine_delete_tasks_id" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Delete task. Delete a task. Requires user approval and confirmed=true before changes or credit use. Writes are never retried automatically.

    Annotations the server declares

    • title: Delete task
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • dealmachine_delete_webhooks_idDelete webhook.Reads text others writeNo findings

    Why it is in this group

    • The name "dealmachine_delete_webhooks_id" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Delete webhook. Removes the webhook and its delivery log. Nothing more is sent to the URL. Requires user approval and confirmed=true before changes or credit use. Writes are never retried automatically.

    Annotations the server declares

    • title: Delete webhook
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • dealmachine_enrich_addressFinds who owns a US property from its street address, given as full_address or as street, city, state and zip.No findings

    Why it is in this group

    • The description's first verb is "find": a word for reading.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Finds who owns a US property from its street address, given as full_address or as street, city, state and zip. Returns the property details; with contact_audience=owners it also returns the owners with their names, phones (with DNC flags) and emails. Contacts are left out unless contact_audience is set. Needs a connected DealMachine account with paid access. A matched property costs one property credit and returned contacts cost people credits; nothing is charged when no property matches.

    Annotations the server declares

    • title: Enrich Property by Address
    • readOnlyHint: false
    • openWorldHint: false
    • destructiveHint: true
    • idempotentHint: false
  • dealmachine_enrich_apnFinds who owns a property from its Assessor's Parcel Number: one apn, or up to 250 in data sharing the same location and options.No findings

    Why it is in this group

    • The description's first verb is "find": a word for reading.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Finds who owns a property from its Assessor's Parcel Number: one apn, or up to 250 in data sharing the same location and options. A location narrows the match, and APN formatting is normalized automatically. Returns the property details; with contact_audience=owners it also returns the owners with their names, phones (with DNC flags) and emails. Contacts are left out unless contact_audience is set. Needs a connected DealMachine account with paid access. Each matched property costs one property credit and returned contacts cost people credits.

    Annotations the server declares

    • title: Enrich Property by APN
    • readOnlyHint: false
    • openWorldHint: false
    • destructiveHint: true
    • idempotentHint: false
  • dealmachine_enrich_emailLooks up a person by email address (email, required).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Looks up a person by email address (email, required). Returns their name, contact information including phones and emails, and demographics; include_properties=true adds the properties associated with them. Needs a connected DealMachine account with paid access. Each matched person costs one people credit and each included property one property credit; nothing is charged when no one matches.

    Annotations the server declares

    • title: Enrich Person by Email
    • readOnlyHint: false
    • openWorldHint: false
    • destructiveHint: true
    • idempotentHint: false
  • dealmachine_enrich_latlngFinds the property closest to a latitude and longitude, within 300 feet, and who owns it.No findings

    Why it is in this group

    • The description's first verb is "find": a word for reading.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Finds the property closest to a latitude and longitude, within 300 feet, and who owns it. Returns the property details; with contact_audience=owners it also returns the owners with their names, phones (with DNC flags) and emails. Contacts are left out unless contact_audience is set. Needs a connected DealMachine account with paid access. A matched property costs one property credit and returned contacts cost people credits; nothing is charged when no property matches.

    Annotations the server declares

    • title: Enrich Property by Coordinates
    • readOnlyHint: false
    • openWorldHint: false
    • destructiveHint: true
    • idempotentHint: false
  • dealmachine_enrich_nameFinds people by name: one last_name, optionally with first_name and middle_initial, or up to 250 names in data sharing location, pagination and options.No findings

    Why it is in this group

    • The description's first verb is "find": a word for reading.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Finds people by name: one last_name, optionally with first_name and middle_initial, or up to 250 names in data sharing location, pagination and options. A location narrows the match. Returns paginated people with contact information including phones and emails; include_properties=true adds the properties associated with them. `estimate_cost=true` returns people and associated-property counts without records or credit use. Needs a connected DealMachine account with paid access. Each returned person costs one people credit and associated properties cost property credits; batching reduces requests, not credits.

    Annotations the server declares

    • title: Enrich People by Name
    • readOnlyHint: false
    • openWorldHint: false
    • destructiveHint: true
    • idempotentHint: false
  • dealmachine_enrich_phoneLooks up a person by phone number (phone, required).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Looks up a person by phone number (phone, required). Returns their name, contact information including phones and emails, and demographics; include_properties=true adds the properties associated with them. Needs a connected DealMachine account with paid access. Each matched person costs one people credit and each included property one property credit; nothing is charged when no one matches.

    Annotations the server declares

    • title: Enrich Person by Phone
    • readOnlyHint: false
    • openWorldHint: false
    • destructiveHint: true
    • idempotentHint: false
  • dealmachine_mail_campaign_add_propertiesAdds properties to a Ready, Active or Paused campaign and spends wallet dollars.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "dealmachine_mail_campaign_add_properties" says "add": a word for a change.
    • The input addresses people (input.recipient): what it sends cannot be taken back.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "dealmachine_mail_campaign_add_properties" says "add" and "mail": it writes something other people read.
    Description, as the server wrote it
    Adds properties to a Ready, Active or Paused campaign and spends wallet dollars. Each added property starts at step 1 on its own schedule; properties already in the campaign are untouched. Before calling this, call dealmachine_mail_read with operation add_properties_estimate and the property count, tell the user the charge due today (pay_today_cents) and the amount charged later as mail goes out (pay_later_cents), and get their approval. A paused campaign charges nothing today; each piece is charged as it goes out after it resumes (charged_on_resume). Auto-reload must be on when the campaign has more than one step, a repeating step, or any delay. The response lists added_count and each skipped property with its reason: already_in_campaign, do_not_contact, no_mailing_address, duplicate_mailing_address, archived_prospect or not_found. Find campaigns that accept properties with dealmachine_mail_read search_campaigns and accepting_properties=true.

    Annotations the server declares

    • title: Add Properties to Mail Campaign
    • readOnlyHint: false
    • openWorldHint: true
    • destructiveHint: true
    • idempotentHint: false
  • dealmachine_mail_campaign_archiveArchives an ended campaign.Reads text others writeNo findings

    Why it is in this group

    • The name "dealmachine_mail_campaign_archive" says "archive": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Archives an ended campaign. End active, paused, ready or draft campaigns first; otherwise the API returns 409 CAMPAIGN_NOT_ENDED without changing the campaign. Cancels unsent mail, releases reservations, stops reminders and hides it from default lists. History stays under status=archived. Already submitted mail may still ship. Confirm with the user first.

    Annotations the server declares

    • title: Archive Mail Campaign
    • readOnlyHint: false
    • openWorldHint: true
    • destructiveHint: true
    • idempotentHint: false
  • dealmachine_mail_campaign_cancelCancels a mail campaign, kept for existing clients.Reads text others writeNo findings

    Why it is in this group

    • The name "dealmachine_mail_campaign_cancel" says "cancel": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Cancels a mail campaign, kept for existing clients. A started campaign ends as with dealmachine_mail_campaign_end; a draft is cancelled; a campaign that has already ended is returned unchanged. Unsent mail stops, while mail already submitted still delivers.

    Annotations the server declares

    • title: Cancel Mail Campaign
    • readOnlyHint: false
    • openWorldHint: true
    • destructiveHint: true
    • idempotentHint: false
  • dealmachine_mail_campaign_endEnds a Ready, Active or Paused mail campaign permanently.Reads text others writeNo findings

    Why it is in this group

    • The description says "cannot be undone".
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Ends a Ready, Active or Paused mail campaign permanently. Unsent mail is stopped, no properties can be added, and it can never be resumed. Mail already printed or with the carrier still delivers. To reuse its steps, create a new campaign. A draft has not started and cannot be ended (campaign_is_draft). Warn the user that ending cannot be undone.

    Annotations the server declares

    • title: End Mail Campaign
    • readOnlyHint: false
    • openWorldHint: true
    • destructiveHint: true
    • idempotentHint: false
  • dealmachine_mail_campaign_sendLaunches a draft mail campaign and spends wallet dollars for its recipients and scheduled steps.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "dealmachine_mail_campaign_send" says "send": a word for sending, and what is sent cannot be taken back.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "dealmachine_mail_campaign_send" says "send": it sends or publishes something to other people.
    Description, as the server wrote it
    Launches a draft mail campaign and spends wallet dollars for its recipients and scheduled steps.

    Annotations the server declares

    • title: Send Mail Campaign
    • readOnlyHint: false
    • openWorldHint: true
    • destructiveHint: true
    • idempotentHint: false
  • dealmachine_patch_lists_list_idUpdate list.No findings

    Why it is in this group

    • The name "dealmachine_patch_lists_list_id" says "patch": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Update list. Update the name of a list. Requires user approval and confirmed=true before changes or credit use. Writes are never retried automatically.

    Annotations the server declares

    • title: Update list
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • dealmachine_patch_mail_campaigns_idUpdate campaign.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "dealmachine_patch_mail_campaigns_id" says "patch": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "dealmachine_patch_mail_campaigns_id" says "patch" and "mail": it writes something other people read.
    Description, as the server wrote it
    Update campaign. Update a draft campaign. Only draft campaigns can be updated. Audience updates must use exactly one of property_ids, contact_ids, or list_ids. Sending steps replaces the whole step set, so include every step you want to keep. To add properties to a ready, active or paused campaign, use POST /campaigns/{id}/properties. Requires user approval and confirmed=true before changes or credit use. Writes are never retried automatically.

    Annotations the server declares

    • title: Update campaign
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • dealmachine_patch_mail_designs_idUpdate design.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "dealmachine_patch_mail_designs_id" says "patch": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "dealmachine_patch_mail_designs_id" says "patch" and "mail": it writes something other people read.
    Description, as the server wrote it
    Update design. Update a design. Supplied HTML is validated before saving. Publishing revalidates both effective draft sides and requires complete front and back HTML. Custom HTML with one outer div declaring inline width and height: 4x6 = 1800 x 1200, 6x9 = 2700 x 1800, 6x11 = 3300 x 1800 CSS pixels. Use inline styles only. Stylesheets, scripts, SVG and embedded documents are unsupported. Put spacing, borders and layout inside the outer div; root transforms, margins and padding are unsupported. Each side must be nonempty and at most 2 MB. Invalid or ambiguous canvases return 400 VALIDATION_ERROR before saving. The API parses and sanitizes HTML without running a browser. Requires user approval and confirmed=true before changes or credit use. Writes are never retried automatically.

    Annotations the server declares

    • title: Update design
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • dealmachine_patch_mail_return_addresses_idUpdate return address.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "dealmachine_patch_mail_return_addresses_id" says "patch": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "dealmachine_patch_mail_return_addresses_id" says "patch" and "mail": it writes something other people read.
    Description, as the server wrote it
    Update return address. Update a return address. If address fields change, the new address is re-validated via USPS. Requires user approval and confirmed=true before changes or credit use. Writes are never retried automatically.

    Annotations the server declares

    • title: Update return address
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • dealmachine_patch_mail_settingsUpdate mail settings.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "dealmachine_patch_mail_settings" says "patch": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "dealmachine_patch_mail_settings" says "patch" and "mail": it writes something other people read.
    Description, as the server wrote it
    Update mail settings. Update one or more organization-level mail settings. Only the fields you include are changed; omitted fields are left untouched. Pass null to clear a setting back to its default. Requires user approval and confirmed=true before changes or credit use. Writes are never retried automatically.

    Annotations the server declares

    • title: Update mail settings
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • dealmachine_patch_prospectsMove prospects in bulk.No findings

    Why it is in this group

    • The name "dealmachine_patch_prospects" says "patch": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Move prospects in bulk. Move the prospects for up to 1,000 records between active, opportunity, and archived in one call: the bulk form of the single update, and what the app’s selection action bar runs. Records that are not prospects are skipped, as are prospects already in the requested lifecycle; the response counts each. Archiving always ends each prospect’s mail and, unless `cascade` is false, closes its open opportunities. List memberships are kept either way. Requires user approval and confirmed=true before changes or credit use. Writes are never retried automatically.

    Annotations the server declares

    • title: Move prospects in bulk
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • dealmachine_patch_prospects_id_notes_note_idEdit prospect note.No findings

    Why it is in this group

    • The name "dealmachine_patch_prospects_id_notes_note_id" says "patch": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Edit prospect note. Requires user approval and confirmed=true before changes or credit use. Writes are never retried automatically.

    Annotations the server declares

    • title: Edit prospect note
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • dealmachine_patch_tags_idUpdate tag.No findings

    Why it is in this group

    • The name "dealmachine_patch_tags_id" says "patch": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Update tag. Rename, describe, recolor, reorder, or archive a workspace tag. Built-in tags return 403. Requires user approval and confirmed=true before changes or credit use. Writes are never retried automatically.

    Annotations the server declares

    • title: Update tag
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • dealmachine_patch_tasks_idUpdate task.No findings

    Why it is in this group

    • The name "dealmachine_patch_tasks_id" says "patch": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Update task. Update a task. Set `is_completed` to `true` to mark as done. Requires user approval and confirmed=true before changes or credit use. Writes are never retried automatically.

    Annotations the server declares

    • title: Update task
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • dealmachine_patch_webhooks_idUpdate webhook.Reads text others writeNo findings

    Why it is in this group

    • The name "dealmachine_patch_webhooks_id" says "patch": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Update webhook. Change the URL, events, batch size, contact opt-in, or turn the webhook on or off. Re-enabling clears its failure count. Requires user approval and confirmed=true before changes or credit use. Writes are never retried automatically.

    Annotations the server declares

    • title: Update webhook
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • dealmachine_people_getReturns one person by DealMachine person ID (id, required), with their name, phones, emails, optional extended fields and associated properties.Reads private dataReads text others write1 finding

    Why it is in this group

    • The name "dealmachine_people_get" says "get": a word for reading.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • private-dataThe description's first sentence says "return" and "email": it reads mail.
    • untrusted-inputThe description's first sentence says "return" and "email": it reads inbound email, which other people can write.

    Findings

    • Warn

      The server marks "dealmachine_people_get" destructive (destructiveHint: true), and its name says "get", a word for reading.

      Matched text

      annotations: {"readOnlyHint":false,"destructiveHint":true,"idempotentHint":false,"openWorldHint":false}; The name "dealmachine_people_get" says "get": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Returns one person by DealMachine person ID (id, required), with their name, phones, emails, optional extended fields and associated properties. Needs a connected DealMachine account with paid access. The person costs one people credit; chargeable property fields or associated properties can consume property credits.

    Annotations the server declares

    • title: Get Person Details
    • readOnlyHint: false
    • openWorldHint: false
    • destructiveHint: true
    • idempotentHint: false
  • dealmachine_people_get_manyReturns up to 250 people by DealMachine person ID (ids, required), with their names, phones, emails, optional extended fields and associated properties.Reads private dataReads text others write1 finding

    Why it is in this group

    • The name "dealmachine_people_get_many" says "get": a word for reading.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • private-dataThe description's first sentence says "return" and "email": it reads mail.
    • untrusted-inputThe description's first sentence says "return" and "email": it reads inbound email, which other people can write.

    Findings

    • Warn

      The server marks "dealmachine_people_get_many" destructive (destructiveHint: true), and its name says "get", a word for reading.

      Matched text

      annotations: {"readOnlyHint":false,"destructiveHint":true,"idempotentHint":false,"openWorldHint":false}; The name "dealmachine_people_get_many" says "get": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Returns up to 250 people by DealMachine person ID (ids, required), with their names, phones, emails, optional extended fields and associated properties. Needs a connected DealMachine account with paid access. Each found person costs one people credit; chargeable property fields or associated properties can consume property credits.

    Annotations the server declares

    • title: Get Multiple People
    • readOnlyHint: false
    • openWorldHint: false
    • destructiveHint: true
    • idempotentHint: false
  • dealmachine_post_addresses_validateValidate addresses.Can send data outNo findings

    Why it is in this group

    • The name "dealmachine_post_addresses_validate" says "post": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • outboundThe name "dealmachine_post_addresses_validate" says "post": it sends or publishes something to other people.
    Description, as the server wrote it
    Validate addresses. Validate and standardize US addresses using USPS address data. Returns USPS-standardized versions of each submitted address along with a validation status indicating whether the address is deliverable. Requires user approval and confirmed=true before changes or credit use. Writes are never retried automatically.

    Annotations the server declares

    • title: Validate addresses
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • dealmachine_post_enrichment_reverse_geocodeReverse geocode.Can send data outNo findings

    Why it is in this group

    • The name "dealmachine_post_enrichment_reverse_geocode" says "post": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • outboundThe name "dealmachine_post_enrichment_reverse_geocode" says "post": it sends or publishes something to other people.
    Description, as the server wrote it
    Reverse geocode. Look up properties by latitude/longitude coordinates (reverse geocoding). Returns the closest property within 300 feet. Requires user approval and confirmed=true before changes or credit use. Writes are never retried automatically.

    Annotations the server declares

    • title: Reverse geocode
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • dealmachine_post_lists_list_id_buildBuild list from search filters.Can send data outNo findings

    Why it is in this group

    • The name "dealmachine_post_lists_list_id_build" says "post": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • outboundThe name "dealmachine_post_lists_list_id_build" says "post": it sends or publishes something to other people.
    Description, as the server wrote it
    Build list from search filters. Add the records matching the given filters and locations to this list. Records already on the list stay, so building again adds to it. Runs asynchronously: the response is this list with status `building`; poll `GET /v1/lists/{list_id}` until status is `completed`. Requires user approval and confirmed=true before changes or credit use. Writes are never retried automatically.

    Annotations the server declares

    • title: Build list from search filters
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • dealmachine_post_lists_list_id_exportExport list.Can send data outNo findings

    Why it is in this group

    • The name "dealmachine_post_lists_list_id_export" says "post": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • outboundThe name "dealmachine_post_lists_list_id_export" says "post": it sends or publishes something to other people.
    Description, as the server wrote it
    Export list. Export all items from a completed list. The list must have status "completed" before export. Credits are charged per record. Requires user approval and confirmed=true before changes or credit use. Writes are never retried automatically.

    Annotations the server declares

    • title: Export list
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • dealmachine_post_lists_list_id_importImport IDs into list.Can send data outNo findings

    Why it is in this group

    • The name "dealmachine_post_lists_list_id_import" says "post": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • outboundThe name "dealmachine_post_lists_list_id_import" says "post": it sends or publishes something to other people.
    Description, as the server wrote it
    Import IDs into list. Add property or person ids to this list, matching the list's source_type. Records already on the list stay, so importing again adds to it. Runs asynchronously: the response is this list with status `building`; poll `GET /v1/lists/{list_id}` until status is `completed`. Requires user approval and confirmed=true before changes or credit use. Writes are never retried automatically.

    Annotations the server declares

    • title: Import IDs into list
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • dealmachine_post_mail_campaignsCreate campaign.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "dealmachine_post_mail_campaigns" says "post" and "mail": it sends a message, which cannot be taken back.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "dealmachine_post_mail_campaigns" says "post" and "mail": it sends something to other people.
    Description, as the server wrote it
    Create campaign. Create a new mail campaign. Each step can reference an existing design or provide a design_prompt to generate one; designs are HTML, so generation is instant (no polling required). Provide at most one audience type: property IDs, contact IDs, or saved list IDs. With an audience, set launch=true to send immediately, or leave it as a draft and call POST /campaigns/{id}/send later. Set accepts_properties=true to keep adding properties with POST /campaigns/{id}/properties after it starts; without it the campaign works as before and ends when its mail is done. Without an audience, the campaign is saved as ready with no properties and no charge, and it accepts properties: add them any time with POST /campaigns/{id}/properties. Saving as ready needs a name that does not start with "Draft - " and a design on every step. Requires user approval and confirmed=true before changes or credit use. Writes are never retried automatically.

    Annotations the server declares

    • title: Create campaign
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • dealmachine_post_mail_campaigns_id_pausePause campaign.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "dealmachine_post_mail_campaigns_id_pause" says "post" and "mail": it sends a message, which cannot be taken back.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "dealmachine_post_mail_campaigns_id_pause" says "post" and "mail": it sends something to other people.
    Description, as the server wrote it
    Pause campaign. Pause an active campaign, or a ready campaign that accepts properties. Properties added while it is paused wait at step 1 until it is resumed. Mail already submitted to the vendor will still be delivered. An ended campaign cannot be paused. Requires user approval and confirmed=true before changes or credit use. Writes are never retried automatically.

    Annotations the server declares

    • title: Pause campaign
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • dealmachine_post_mail_campaigns_id_resumeResume campaign.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "dealmachine_post_mail_campaigns_id_resume" says "post" and "mail": it sends a message, which cannot be taken back.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "dealmachine_post_mail_campaigns_id_resume" says "post" and "mail": it sends something to other people.
    Description, as the server wrote it
    Resume campaign. Resume a paused campaign. An ended campaign cannot be resumed. Requires user approval and confirmed=true before changes or credit use. Writes are never retried automatically.

    Annotations the server declares

    • title: Resume campaign
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • dealmachine_post_mail_designsCreate design.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "dealmachine_post_mail_designs" says "post" and "mail": it sends a message, which cannot be taken back.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "dealmachine_post_mail_designs" says "post" and "mail": it sends something to other people.
    Description, as the server wrote it
    Create design. Create a mail design from custom HTML, or save a prompt as a draft. Custom HTML with one outer div declaring inline width and height: 4x6 = 1800 x 1200, 6x9 = 2700 x 1800, 6x11 = 3300 x 1800 CSS pixels. Use inline styles only. Stylesheets, scripts, SVG and embedded documents are unsupported. Put spacing, borders and layout inside the outer div; root transforms, margins and padding are unsupported. Each side must be nonempty and at most 2 MB. Invalid or ambiguous canvases return 400 VALIDATION_ERROR before saving. The API parses and sanitizes HTML without running a browser. Publishing requires complete validated front and back HTML. Prompt-only designs cannot be auto-published. Requires user approval and confirmed=true before changes or credit use. Writes are never retried automatically.

    Annotations the server declares

    • title: Create design
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • dealmachine_post_mail_return_addressesCreate return address.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "dealmachine_post_mail_return_addresses" says "post" and "mail": it sends a message, which cannot be taken back.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "dealmachine_post_mail_return_addresses" says "post" and "mail": it sends something to other people.
    Description, as the server wrote it
    Create return address. Create a new return address. The address is validated via USPS before saving. If the address is invalid, the request is rejected. Requires user approval and confirmed=true before changes or credit use. Writes are never retried automatically.

    Annotations the server declares

    • title: Create return address
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • dealmachine_post_mail_return_addresses_id_defaultSet default return address.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "dealmachine_post_mail_return_addresses_id_default" says "post" and "mail": it sends a message, which cannot be taken back.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "dealmachine_post_mail_return_addresses_id_default" says "post" and "mail": it sends something to other people.
    Description, as the server wrote it
    Set default return address. Set a return address as the default for your organization. Requires user approval and confirmed=true before changes or credit use. Writes are never retried automatically.

    Annotations the server declares

    • title: Set default return address
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • dealmachine_post_people_exportExport people to CSV.Can send data outNo findings

    Why it is in this group

    • The name "dealmachine_post_people_export" says "post": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • outboundThe name "dealmachine_post_people_export" says "post": it sends or publishes something to other people.
    Description, as the server wrote it
    Export people to CSV. Export matching people as a CSV file. Returns signed download URLs. Limited to 1,000,000 records per export. Pass limit to export only the first N matching records. The request is synchronous — the response is returned once the export is complete (typically up to 30 seconds). Requires user approval and confirmed=true before changes or credit use. Writes are never retried automatically.

    Annotations the server declares

    • title: Export people to CSV
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • dealmachine_post_phones_dncCheck DNC status.Can send data outNo findings

    Why it is in this group

    • The name "dealmachine_post_phones_dnc" says "post": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • outboundThe name "dealmachine_post_phones_dnc" says "post": it sends or publishes something to other people.
    Description, as the server wrote it
    Check DNC status. Check Do Not Call (DNC) registry status and phone type for an array of phone numbers. Returns DNC status and phone type without performing a full person enrichment. Requires user approval and confirmed=true before changes or credit use. Writes are never retried automatically.

    Annotations the server declares

    • title: Check DNC status
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • dealmachine_post_prospects_id_filesRegister uploaded file.Can send data outNo findings

    Why it is in this group

    • The name "dealmachine_post_prospects_id_files" says "post": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • outboundThe name "dealmachine_post_prospects_id_files" says "post": it sends or publishes something to other people.
    Description, as the server wrote it
    Register uploaded file. Step two: after the PUT succeeds, record the file on the prospect. Requires user approval and confirmed=true before changes or credit use. Writes are never retried automatically.

    Annotations the server declares

    • title: Register uploaded file
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • dealmachine_post_prospects_id_files_upload_urlGet file upload URL.Can send data outNo findings

    Why it is in this group

    • The name "dealmachine_post_prospects_id_files_upload_url" says "post": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • outboundThe name "dealmachine_post_prospects_id_files_upload_url" says "post": it sends or publishes something to other people.
    Description, as the server wrote it
    Get file upload URL. Step one of attaching a file: returns a presigned URL to PUT the bytes to (valid 5 minutes, max 25 MB) and the `s3_key` to register afterwards with `POST /files`. Requires user approval and confirmed=true before changes or credit use. Writes are never retried automatically.

    Annotations the server declares

    • title: Get file upload URL
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • dealmachine_post_prospects_id_photosAdd prospect photo.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "dealmachine_post_prospects_id_photos" says "post": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "dealmachine_post_prospects_id_photos" says "post": it sends or publishes something to other people.
    Description, as the server wrote it
    Add prospect photo. Attach a photo to the prospect’s property from base64 (small images) or a public https URL (up to 10 MB). Needs an API key created by a user. Requires user approval and confirmed=true before changes or credit use. Writes are never retried automatically.

    Annotations the server declares

    • title: Add prospect photo
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • dealmachine_post_prospects_id_tags_tag_idAdd tag to prospect.Can send data outNo findings

    Why it is in this group

    • The name "dealmachine_post_prospects_id_tags_tag_id" says "post": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • outboundThe name "dealmachine_post_prospects_id_tags_tag_id" says "post": it sends or publishes something to other people.
    Description, as the server wrote it
    Add tag to prospect. Requires user approval and confirmed=true before changes or credit use. Writes are never retried automatically.

    Annotations the server declares

    • title: Add tag to prospect
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • dealmachine_post_tagsCreate tag.Can send data outNo findings

    Why it is in this group

    • The name "dealmachine_post_tags" says "post": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • outboundThe name "dealmachine_post_tags" says "post": it sends or publishes something to other people.
    Description, as the server wrote it
    Create tag. Add a workspace tag. Names are unique per workspace and cannot reuse a built-in tag’s name. Up to 200 tags per workspace. Requires user approval and confirmed=true before changes or credit use. Writes are never retried automatically.

    Annotations the server declares

    • title: Create tag
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • dealmachine_post_tags_reorderReorder tags.Can send data outNo findings

    Why it is in this group

    • The name "dealmachine_post_tags_reorder" says "post": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • outboundThe name "dealmachine_post_tags_reorder" says "post": it sends or publishes something to other people.
    Description, as the server wrote it
    Reorder tags. Set the display order of workspace tags. IDs not listed keep their order after the listed ones. Requires user approval and confirmed=true before changes or credit use. Writes are never retried automatically.

    Annotations the server declares

    • title: Reorder tags
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • dealmachine_post_tasksCreate task.Can send data outNo findings

    Why it is in this group

    • The name "dealmachine_post_tasks" says "post": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • outboundThe name "dealmachine_post_tasks" says "post": it sends or publishes something to other people.
    Description, as the server wrote it
    Create task. Create a new task. Optionally link it to an opportunity, property, or person. Requires user approval and confirmed=true before changes or credit use. Writes are never retried automatically.

    Annotations the server declares

    • title: Create task
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • dealmachine_post_webhooks_id_deliveries_delivery_id_redeliverRedeliver.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "dealmachine_post_webhooks_id_deliveries_delivery_id_redeliver" says "post": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "dealmachine_post_webhooks_id_deliveries_delivery_id_redeliver" says "post": it sends or publishes something to other people.
    Description, as the server wrote it
    Redeliver. Queue one delivery to be sent again. Pass `delivery_id=all` with `since` to requeue every delivery after a time. Requires user approval and confirmed=true before changes or credit use. Writes are never retried automatically.

    Annotations the server declares

    • title: Redeliver
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • dealmachine_post_webhooks_id_rotate_secretRotate webhook secret.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "dealmachine_post_webhooks_id_rotate_secret" says "post": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "dealmachine_post_webhooks_id_rotate_secret" says "post": it sends or publishes something to other people.
    Description, as the server wrote it
    Rotate webhook secret. Issue a new signing secret. The old one keeps validating signatures for 24 hours so your consumer can switch over. Requires user approval and confirmed=true before changes or credit use. Writes are never retried automatically.

    Annotations the server declares

    • title: Rotate webhook secret
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • dealmachine_post_webhooks_id_testSend test event.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "dealmachine_post_webhooks_id_test" says "post": a word for a change.
    • The description's first verb is "send": a word for sending, and what is sent cannot be taken back.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "dealmachine_post_webhooks_id_test" says "post": it sends or publishes something to other people.
    Description, as the server wrote it
    Send test event. Sends one `ping` event to the URL right now, signed like a real delivery, and returns what came back. Requires user approval and confirmed=true before changes or credit use. Writes are never retried automatically.

    Annotations the server declares

    • title: Send test event
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • dealmachine_property_exportCreates a downloadable CSV of properties or property-owner contacts matching locations and filters.No findings

    Why it is in this group

    • The description's first verb is "create": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Creates a downloadable CSV of properties or property-owner contacts matching locations and filters. Defaults to owner contact rows (`contact_audience=owners`, `anchor=person`) with names, phones, emails, and property addresses. `contact_audience=none` or `anchor=property` produces property rows without contacts. Exported records can consume credits.

    Annotations the server declares

    • title: Export Property Owner Leads
    • readOnlyHint: false
    • openWorldHint: false
    • destructiveHint: true
    • idempotentHint: false
  • dealmachine_property_getReturns one property by DealMachine property ID (id, required), with its owners and their names, phones and emails by default.Reads private dataReads text others write1 finding

    Why it is in this group

    • The name "dealmachine_property_get" says "get": a word for reading.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • private-dataThe description's first sentence says "return" and "email": it reads mail.
    • untrusted-inputThe description's first sentence says "return" and "email": it reads inbound email, which other people can write.

    Findings

    • Warn

      The server marks "dealmachine_property_get" destructive (destructiveHint: true), and its name says "get", a word for reading.

      Matched text

      annotations: {"readOnlyHint":false,"destructiveHint":true,"idempotentHint":false,"openWorldHint":false}; The name "dealmachine_property_get" says "get": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Returns one property by DealMachine property ID (id, required), with its owners and their names, phones and emails by default. `contact_audience=none` returns property-only data. Needs a connected DealMachine account with paid access. Enriched data costs one property credit unless `enrich=false`; owner contacts cost people credits.

    Annotations the server declares

    • title: Get Property Details
    • readOnlyHint: false
    • openWorldHint: false
    • destructiveHint: true
    • idempotentHint: false
  • dealmachine_property_get_manyReturns up to 25 properties by DealMachine property ID (ids, required), with their owners and their names, phones and emails by default.Reads private dataReads text others write1 finding

    Why it is in this group

    • The name "dealmachine_property_get_many" says "get": a word for reading.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • private-dataThe description's first sentence says "return" and "email": it reads mail.
    • untrusted-inputThe description's first sentence says "return" and "email": it reads inbound email, which other people can write.

    Findings

    • Warn

      The server marks "dealmachine_property_get_many" destructive (destructiveHint: true), and its name says "get", a word for reading.

      Matched text

      annotations: {"readOnlyHint":false,"destructiveHint":true,"idempotentHint":false,"openWorldHint":false}; The name "dealmachine_property_get_many" says "get": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Returns up to 25 properties by DealMachine property ID (ids, required), with their owners and their names, phones and emails by default. `contact_audience=none` returns property-only data. Needs a connected DealMachine account with paid access. Owner contacts cost people credits; same-cycle repeats are free.

    Annotations the server declares

    • title: Get Multiple Properties
    • readOnlyHint: false
    • openWorldHint: false
    • destructiveHint: true
    • idempotentHint: false
  • dealmachine_prospect_tags_setReplaces the tags on a prospect with exactly the given tag IDs; an empty list clears them.No findings

    Why it is in this group

    • The name "dealmachine_prospect_tags_set" says "set": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Replaces the tags on a prospect with exactly the given tag IDs; an empty list clears them. Free.

    Annotations the server declares

    • title: Set DealMachine Prospect Tags
    • readOnlyHint: false
    • openWorldHint: false
    • destructiveHint: true
    • idempotentHint: true
  • dealmachine_prospect_updateMoves a prospect between active, opportunity, and archived, or stars it.No findings

    Why it is in this group

    • The name "dealmachine_prospect_update" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Moves a prospect between active, opportunity, and archived, or stars it. Archiving ends its mail. With cascade enabled, it also closes open opportunities. List memberships are kept either way. Free.

    Annotations the server declares

    • title: Update DealMachine Prospect
    • readOnlyHint: false
    • openWorldHint: false
    • destructiveHint: true
    • idempotentHint: true
Changes things 8Claude Code: ask
  • dealmachine_list_add_itemsAdds property or person IDs to an existing list (max 10,000 per request; duplicates are skipped).No findings

    Why it is in this group

    • The name "dealmachine_list_add_items" says "list": a word for reading.
    • The description's first verb is "add": a word for a change.
    Description, as the server wrote it
    Adds property or person IDs to an existing list (max 10,000 per request; duplicates are skipped). Filed records become prospects unless `add_as_prospects` is false. Free; no credits are charged.

    Annotations the server declares

    • title: Add Records to DealMachine List
    • readOnlyHint: false
    • openWorldHint: false
    • destructiveHint: false
    • idempotentHint: true
  • dealmachine_list_createCreates a list in the workspace, optionally pre-filled with up to 250 property or person IDs.No findings

    Why it is in this group

    • The name "dealmachine_list_create" says "list": a word for reading.
    • The description's first verb is "create": a word for a change.
    Description, as the server wrote it
    Creates a list in the workspace, optionally pre-filled with up to 250 property or person IDs. Filed records become prospects unless `add_as_prospects` is false. Free; no credits are charged.

    Annotations the server declares

    • title: Create DealMachine List
    • readOnlyHint: false
    • openWorldHint: false
    • destructiveHint: false
    • idempotentHint: false
  • dealmachine_post_activity_searchSearch activity.Can send data out1 finding

    Why it is in this group

    • The name "dealmachine_post_activity_search" says "post": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • outboundThe name "dealmachine_post_activity_search" says "post": it sends or publishes something to other people.

    Findings

    • Warn

      The server marks "dealmachine_post_activity_search" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "dealmachine_post_activity_search" says "post": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Search activity. Query your past searches, enrichments, and exports. Filter by activity type, date range, or specific entity IDs — or use free-text search. This endpoint does not consume credits. Retrieves data without changing records or spending credits. Requires confirmed=true for this request.

    Annotations the server declares

    • title: Search activity
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • dealmachine_post_prospects_checkCheck prospect state.Can send data out1 finding

    Why it is in this group

    • The name "dealmachine_post_prospects_check" says "post": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • outboundThe name "dealmachine_post_prospects_check" says "post": it sends or publishes something to other people.

    Findings

    • Warn

      The server marks "dealmachine_post_prospects_check" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "dealmachine_post_prospects_check" says "post": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Check prospect state. For up to 500 record IDs, say which are prospects and where they are. Use it to avoid duplicate adds. Retrieves data without changing records or spending credits. Requires confirmed=true for this request.

    Annotations the server declares

    • title: Check prospect state
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • dealmachine_prospect_addTracks one record or up to 1,000 records as prospects in the workspace.No findings

    Why it is in this group

    • The name "dealmachine_prospect_add" says "add": a word for a change.
    Description, as the server wrote it
    Tracks one record or up to 1,000 records as prospects in the workspace. Records that are prospects already are returned unchanged; archived ones come back to active. Free; no credits are charged.

    Annotations the server declares

    • title: Add DealMachine Prospects
    • readOnlyHint: false
    • openWorldHint: false
    • destructiveHint: false
    • idempotentHint: true
  • dealmachine_prospect_note_addAdds a note (up to 10,000 characters) to a prospect.No findings

    Why it is in this group

    • The name "dealmachine_prospect_note_add" says "add": a word for a change.
    Description, as the server wrote it
    Adds a note (up to 10,000 characters) to a prospect. Free.

    Annotations the server declares

    • title: Add DealMachine Prospect Note
    • readOnlyHint: false
    • openWorldHint: false
    • destructiveHint: false
    • idempotentHint: false
  • dealmachine_signupStart a free DealMachine account.1 finding

    Why it is in this group

    • The description's first verb is "start": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "dealmachine_signup" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "start": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Start a free DealMachine account. Returns the secure browser signup URL. Ask the user to finish signup and connect DealMachine using OAuth. Never ask for passwords, payment details or API keys in chat. Signup does not purchase a plan.

    Annotations the server declares

    • title: Start a free DealMachine account
    • readOnlyHint: true
    • openWorldHint: false
    • destructiveHint: false
    • idempotentHint: true
  • dealmachine_webhook_createRegisters an https URL to receive prospect and list events.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "dealmachine_webhook_create" says "create": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Registers an https URL to receive prospect and list events. Returns the signing secret once; relay it to the user. Free.

    Annotations the server declares

    • title: Create DealMachine Webhook
    • readOnlyHint: false
    • openWorldHint: true
    • destructiveHint: false
    • idempotentHint: false
Only reads 55Show 55 read-only tools
  • dealmachine_accountRead your active plan and remaining data credits.No findings

    Why it is in this group

    • The description's first verb is "read": a word for reading.
    Description, as the server wrote it
    Read your active plan and remaining data credits. Free accounts can use this. After Stripe payment, check plan.is_paid and the current balance before retrying approved enrichment. A checkout URL or the user saying they paid is not proof of activation.

    Annotations the server declares

    • title: View plan and available credits
    • readOnlyHint: true
    • openWorldHint: false
    • destructiveHint: false
    • idempotentHint: true
  • dealmachine_fieldsReturns available DealMachine data fields with field ID, source type, data type, and description.No findings

    Why it is in this group

    • The description's first verb is "return": a word for reading.
    Description, as the server wrote it
    Returns available DealMachine data fields with field ID, source type, data type, and description. A `search` value performs a fuzzy match across field metadata; without it, the response includes all pages. This read-only request is free of data credit charges, but an uncached read counts toward the API request limit. Reuse these definitions for subsequent lookups; identical requests are cached for 15 minutes.

    Annotations the server declares

    • title: List DealMachine Data Fields
    • readOnlyHint: true
    • openWorldHint: false
    • destructiveHint: false
    • idempotentHint: true
  • dealmachine_filtersReturns DealMachine search filters with filter IDs, source types, operators, and valid options.No findings

    Why it is in this group

    • The description's first verb is "return": a word for reading.
    Description, as the server wrote it
    Returns DealMachine search filters with filter IDs, source types, operators, and valid options. A `search` value performs a fuzzy concept match across labels, aliases, and option values; without it, the response includes all pages. This read-only request is free of data credit charges, but an uncached read counts toward the API request limit. Reuse these definitions for subsequent lookups; identical requests are cached for 15 minutes.

    Annotations the server declares

    • title: List DealMachine Search Filters
    • readOnlyHint: true
    • openWorldHint: false
    • destructiveHint: false
    • idempotentHint: true
  • dealmachine_get_activity_activity_idGet activity.No findings

    Why it is in this group

    • The name "dealmachine_get_activity_activity_id" says "get": a word for reading.
    Description, as the server wrote it
    Get activity. Retrieve the full details of a specific activity record, including the complete original request parameters and paginated entity IDs. Retrieves data without changing records or spending credits.

    Annotations the server declares

    • title: Get activity
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • dealmachine_get_addresses_autocompleteAutocomplete property addresses.No findings

    Why it is in this group

    • The name "dealmachine_get_addresses_autocomplete" says "get": a word for reading.
    Description, as the server wrote it
    Autocomplete property addresses. Return fast, bounded street-address suggestions from DealMachine property data. Every suggestion includes a DealMachine property ID and may include a normalized city or county location. Retrieves data without changing records or spending credits.

    Annotations the server declares

    • title: Autocomplete property addresses
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • dealmachine_get_driving_drivesList drives.Reads private dataNo findings

    Why it is in this group

    • The name "dealmachine_get_driving_drives" says "get": a word for reading.

    What it can reach

    • private-dataThe name "dealmachine_get_driving_drives" says "get" and "drive": it reads files.
    • private-dataThe description's first sentence says "list" and "drive": it reads files.
    Description, as the server wrote it
    List drives. List recorded drives for the workspace. Each drive reports how many prospects were added. Retrieves data without changing records or spending credits.

    Annotations the server declares

    • title: List drives
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • dealmachine_get_driving_drives_idGet drive.Reads private dataNo findings

    Why it is in this group

    • The name "dealmachine_get_driving_drives_id" says "get": a word for reading.

    What it can reach

    • private-dataThe name "dealmachine_get_driving_drives_id" says "get" and "drive": it reads files.
    • private-dataThe description's first sentence says "get" and "drive": it reads files.
    Description, as the server wrote it
    Get drive. Get a recorded drive with its route, events, visits, and links to prospects added during it. Retrieves data without changing records or spending credits.

    Annotations the server declares

    • title: Get drive
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • dealmachine_get_exportsList exports.No findings

    Why it is in this group

    • The name "dealmachine_get_exports" says "get": a word for reading.
    Description, as the server wrote it
    List exports. List past exports for your organization with optional pagination and status filtering. Retrieves data without changing records or spending credits.

    Annotations the server declares

    • title: List exports
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • dealmachine_get_exports_exportIdGet export by ID.No findings

    Why it is in this group

    • The name "dealmachine_get_exports_exportId" says "get": a word for reading.
    Description, as the server wrote it
    Get export by ID. Retrieve a single export by its ID. Only exports belonging to your organization are accessible. Retrieves data without changing records or spending credits.

    Annotations the server declares

    • title: Get export by ID
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • dealmachine_get_listsList all lists.No findings

    Why it is in this group

    • The name "dealmachine_get_lists" says "get": a word for reading.
    Description, as the server wrote it
    List all lists. List all saved lists for your organization with pagination, search, filtering, and sorting. Retrieves data without changing records or spending credits.

    Annotations the server declares

    • title: List all lists
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • dealmachine_get_lists_list_idGet list by ID.No findings

    Why it is in this group

    • The name "dealmachine_get_lists_list_id" says "get": a word for reading.
    Description, as the server wrote it
    Get list by ID. Retrieve a list by its ID including build status, progress, and total count. Retrieves data without changing records or spending credits.

    Annotations the server declares

    • title: Get list by ID
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • dealmachine_get_lists_list_id_itemsGet list items.No findings

    Why it is in this group

    • The name "dealmachine_get_lists_list_id_items" says "get": a word for reading.
    Description, as the server wrote it
    Get list items. Retrieve paginated items in a list. Retrieves data without changing records or spending credits.

    Annotations the server declares

    • title: Get list items
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • dealmachine_get_locations_locationIdGet location.No findings

    Why it is in this group

    • The name "dealmachine_get_locations_locationId" says "get": a word for reading.
    Description, as the server wrote it
    Get location. Retrieve a specific location by its ID. Retrieves data without changing records or spending credits.

    Annotations the server declares

    • title: Get location
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • dealmachine_get_mail_analytics_summaryGet mail analytics summary.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "dealmachine_get_mail_analytics_summary" says "get": a word for reading.

    What it can reach

    • private-dataThe name "dealmachine_get_mail_analytics_summary" says "get" and "mail": it reads mail.
    • private-dataThe description's first sentence says "get" and "mail": it reads mail.
    • untrusted-inputThe name "dealmachine_get_mail_analytics_summary" says "get" and "mail": it reads inbound email, which other people can write.
    • untrusted-inputThe description's first sentence says "get" and "mail": it reads inbound email, which other people can write.
    Description, as the server wrote it
    Get mail analytics summary. Get account-wide mail analytics: totals across all campaigns (sent, delivered, failed, opens, unique openers, average open rate) plus a paginated list of campaigns with per-campaign engagement. Retrieves data without changing records or spending credits.

    Annotations the server declares

    • title: Get mail analytics summary
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • dealmachine_get_mail_analytics_timeseriesGet mail analytics time series.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "dealmachine_get_mail_analytics_timeseries" says "get": a word for reading.

    What it can reach

    • private-dataThe name "dealmachine_get_mail_analytics_timeseries" says "get" and "mail": it reads mail.
    • private-dataThe description's first sentence says "get" and "mail": it reads mail.
    • untrusted-inputThe name "dealmachine_get_mail_analytics_timeseries" says "get" and "mail": it reads inbound email, which other people can write.
    • untrusted-inputThe description's first sentence says "get" and "mail": it reads inbound email, which other people can write.
    Description, as the server wrote it
    Get mail analytics time series. Get an account-wide time series for a single metric — sent, delivered, scans (QR/link views), or open_rate — bucketed by day or week. Missing buckets are filled with zeroes so the series is continuous. For "scans", each point also includes secondary_value (total scans vs unique properties). Retrieves data without changing records or spending credits.

    Annotations the server declares

    • title: Get mail analytics time series
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • dealmachine_get_mail_campaignsList campaigns.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "dealmachine_get_mail_campaigns" says "get": a word for reading.

    What it can reach

    • private-dataThe name "dealmachine_get_mail_campaigns" says "get" and "mail": it reads mail.
    • untrusted-inputThe name "dealmachine_get_mail_campaigns" says "get" and "mail": it reads inbound email, which other people can write.
    Description, as the server wrote it
    List campaigns. List mail campaigns for your organization with optional filtering. Each campaign has one of six statuses: draft, ready, active, paused, ended or archived. Use accepting_properties=true to list the campaigns properties can be added to now. Archived campaigns are excluded unless status=archived is supplied. Retrieves data without changing records or spending credits.

    Annotations the server declares

    • title: List campaigns
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • dealmachine_get_mail_campaigns_idGet campaign.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "dealmachine_get_mail_campaigns_id" says "get": a word for reading.

    What it can reach

    • private-dataThe name "dealmachine_get_mail_campaigns_id" says "get" and "mail": it reads mail.
    • untrusted-inputThe name "dealmachine_get_mail_campaigns_id" says "get" and "mail": it reads inbound email, which other people can write.
    Description, as the server wrote it
    Get campaign. Get a single campaign by ID with steps. Retrieves data without changing records or spending credits.

    Annotations the server declares

    • title: Get campaign
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • dealmachine_get_mail_campaigns_id_analyticsCampaign analytics.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "dealmachine_get_mail_campaigns_id_analytics" says "get": a word for reading.

    What it can reach

    • private-dataThe name "dealmachine_get_mail_campaigns_id_analytics" says "get" and "mail": it reads mail.
    • untrusted-inputThe name "dealmachine_get_mail_campaigns_id_analytics" says "get" and "mail": it reads inbound email, which other people can write.
    Description, as the server wrote it
    Campaign analytics. Get delivery and engagement analytics for a campaign. Retrieves data without changing records or spending credits.

    Annotations the server declares

    • title: Campaign analytics
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • dealmachine_get_mail_campaigns_id_cost_estimateEstimate campaign cost.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "dealmachine_get_mail_campaigns_id_cost_estimate" says "get": a word for reading.

    What it can reach

    • private-dataThe name "dealmachine_get_mail_campaigns_id_cost_estimate" says "get" and "mail": it reads mail.
    • untrusted-inputThe name "dealmachine_get_mail_campaigns_id_cost_estimate" says "get" and "mail": it reads inbound email, which other people can write.
    Description, as the server wrote it
    Estimate campaign cost. Get a cost estimate for launching a campaign, including wallet balance check. Retrieves data without changing records or spending credits.

    Annotations the server declares

    • title: Estimate campaign cost
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • dealmachine_get_mail_campaigns_id_properties_estimateEstimate adding properties.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "dealmachine_get_mail_campaigns_id_properties_estimate" says "get": a word for reading.

    What it can reach

    • private-dataThe name "dealmachine_get_mail_campaigns_id_properties_estimate" says "get" and "mail": it reads mail.
    • untrusted-inputThe name "dealmachine_get_mail_campaigns_id_properties_estimate" says "get" and "mail": it reads inbound email, which other people can write.
    Description, as the server wrote it
    Estimate adding properties. What adding a number of properties to the campaign would cost: the charge due today, the amount charged later as later pieces go out, and whether your wallet or auto-reload covers it. Nothing is added or charged. The count is an upper bound; properties skipped when you add them are not charged. For a paused campaign the charge due today is 0 and charged_on_resume is true: each piece is charged as it goes out after the campaign resumes. Retrieves data without changing records or spending credits.

    Annotations the server declares

    • title: Estimate adding properties
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • dealmachine_get_mail_campaigns_id_recipientsList campaign recipients.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "dealmachine_get_mail_campaigns_id_recipients" says "get": a word for reading.

    What it can reach

    • private-dataThe name "dealmachine_get_mail_campaigns_id_recipients" says "get" and "mail": it reads mail.
    • untrusted-inputThe name "dealmachine_get_mail_campaigns_id_recipients" says "get" and "mail": it reads inbound email, which other people can write.
    Description, as the server wrote it
    List campaign recipients. List recipients enrolled in a campaign with their delivery status. Retrieves data without changing records or spending credits.

    Annotations the server declares

    • title: List campaign recipients
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • dealmachine_get_mail_designsList designs.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "dealmachine_get_mail_designs" says "get": a word for reading.

    What it can reach

    • private-dataThe name "dealmachine_get_mail_designs" says "get" and "mail": it reads mail.
    • untrusted-inputThe name "dealmachine_get_mail_designs" says "get" and "mail": it reads inbound email, which other people can write.
    Description, as the server wrote it
    List designs. List mail designs for your organization. Retrieves data without changing records or spending credits.

    Annotations the server declares

    • title: List designs
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • dealmachine_get_mail_designs_idGet design.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "dealmachine_get_mail_designs_id" says "get": a word for reading.

    What it can reach

    • private-dataThe name "dealmachine_get_mail_designs_id" says "get" and "mail": it reads mail.
    • untrusted-inputThe name "dealmachine_get_mail_designs_id" says "get" and "mail": it reads inbound email, which other people can write.
    Description, as the server wrote it
    Get design. Get a single design by ID, including HTML content. Retrieves data without changing records or spending credits.

    Annotations the server declares

    • title: Get design
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • dealmachine_get_mail_return_addressesList return addresses.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "dealmachine_get_mail_return_addresses" says "get": a word for reading.

    What it can reach

    • private-dataThe name "dealmachine_get_mail_return_addresses" says "get" and "mail": it reads mail.
    • untrusted-inputThe name "dealmachine_get_mail_return_addresses" says "get" and "mail": it reads inbound email, which other people can write.
    Description, as the server wrote it
    List return addresses. List all return addresses for your organization. Default address is listed first. Retrieves data without changing records or spending credits.

    Annotations the server declares

    • title: List return addresses
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • dealmachine_get_mail_return_addresses_idGet return address.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "dealmachine_get_mail_return_addresses_id" says "get": a word for reading.

    What it can reach

    • private-dataThe name "dealmachine_get_mail_return_addresses_id" says "get" and "mail": it reads mail.
    • untrusted-inputThe name "dealmachine_get_mail_return_addresses_id" says "get" and "mail": it reads inbound email, which other people can write.
    Description, as the server wrote it
    Get return address. Get a single return address by ID. Retrieves data without changing records or spending credits.

    Annotations the server declares

    • title: Get return address
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • dealmachine_get_mail_settingsGet mail settings.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "dealmachine_get_mail_settings" says "get": a word for reading.

    What it can reach

    • private-dataThe name "dealmachine_get_mail_settings" says "get" and "mail": it reads mail.
    • private-dataThe description's first sentence says "get" and "mail": it reads mail.
    • untrusted-inputThe name "dealmachine_get_mail_settings" says "get" and "mail": it reads inbound email, which other people can write.
    • untrusted-inputThe description's first sentence says "get" and "mail": it reads inbound email, which other people can write.
    Description, as the server wrote it
    Get mail settings. Get the organization-level mail settings that act as defaults for new campaigns — default postcard size, sender name, contact frequency limit, QR code URL, and signature image. Retrieves data without changing records or spending credits.

    Annotations the server declares

    • title: Get mail settings
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • dealmachine_get_mail_wallet_balanceGet wallet balance.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "dealmachine_get_mail_wallet_balance" says "get": a word for reading.

    What it can reach

    • private-dataThe name "dealmachine_get_mail_wallet_balance" says "get" and "mail": it reads mail.
    • untrusted-inputThe name "dealmachine_get_mail_wallet_balance" says "get" and "mail": it reads inbound email, which other people can write.
    Description, as the server wrote it
    Get wallet balance. Get the current wallet balance, including pending charges and auto-reload settings. Retrieves data without changing records or spending credits.

    Annotations the server declares

    • title: Get wallet balance
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • dealmachine_get_mail_wallet_pricingGet mail pricing.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "dealmachine_get_mail_wallet_pricing" says "get": a word for reading.

    What it can reach

    • private-dataThe name "dealmachine_get_mail_wallet_pricing" says "get" and "mail": it reads mail.
    • private-dataThe description's first sentence says "get" and "mail": it reads mail.
    • untrusted-inputThe name "dealmachine_get_mail_wallet_pricing" says "get" and "mail": it reads inbound email, which other people can write.
    • untrusted-inputThe description's first sentence says "get" and "mail": it reads inbound email, which other people can write.
    Description, as the server wrote it
    Get mail pricing. Get postcard pricing for your plan. Prices are in cents per postcard. Retrieves data without changing records or spending credits.

    Annotations the server declares

    • title: Get mail pricing
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • dealmachine_get_mail_wallet_transactionsList wallet transactions.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "dealmachine_get_mail_wallet_transactions" says "get": a word for reading.

    What it can reach

    • private-dataThe name "dealmachine_get_mail_wallet_transactions" says "get" and "mail": it reads mail.
    • untrusted-inputThe name "dealmachine_get_mail_wallet_transactions" says "get" and "mail": it reads inbound email, which other people can write.
    Description, as the server wrote it
    List wallet transactions. List wallet transaction history with optional filtering. Retrieves data without changing records or spending credits.

    Annotations the server declares

    • title: List wallet transactions
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • dealmachine_get_prospects_by_recordGet prospect by record.No findings

    Why it is in this group

    • The name "dealmachine_get_prospects_by_record" says "get": a word for reading.
    Description, as the server wrote it
    Get prospect by record. Look up the prospect that tracks a property, person, or company, if there is one. Retrieves data without changing records or spending credits.

    Annotations the server declares

    • title: Get prospect by record
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • dealmachine_get_prospects_countsCount prospects.No findings

    Why it is in this group

    • The name "dealmachine_get_prospects_counts" says "get": a word for reading.
    Description, as the server wrote it
    Count prospects. Prospect counts by lifecycle and record type, for the workspace or one list. Retrieves data without changing records or spending credits.

    Annotations the server declares

    • title: Count prospects
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • dealmachine_get_prospects_id_activityList prospect activity.No findings

    Why it is in this group

    • The name "dealmachine_get_prospects_id_activity" says "get": a word for reading.
    Description, as the server wrote it
    List prospect activity. Everything that happened to the prospect’s record in this workspace, newest first: prospect changes, notes, tags, files, lists, mail, and CRM events. Retrieves data without changing records or spending credits.

    Annotations the server declares

    • title: List prospect activity
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • dealmachine_get_prospects_id_filesList prospect files.Reads private dataNo findings

    Why it is in this group

    • The name "dealmachine_get_prospects_id_files" says "get": a word for reading.

    What it can reach

    • private-dataThe name "dealmachine_get_prospects_id_files" says "get" and "file": it reads files.
    • private-dataThe description's first sentence says "list" and "file": it reads files.
    Description, as the server wrote it
    List prospect files. Retrieves data without changing records or spending credits.

    Annotations the server declares

    • title: List prospect files
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • dealmachine_get_prospects_id_files_file_id_downloadDownload prospect file.Reads private dataNo findings

    Why it is in this group

    • The name "dealmachine_get_prospects_id_files_file_id_download" says "get": a word for reading.

    What it can reach

    • private-dataThe name "dealmachine_get_prospects_id_files_file_id_download" says "get" and "file": it reads files.
    • private-dataThe description's first sentence says "file": it reads files.
    Description, as the server wrote it
    Download prospect file. Redirects to a 5-minute signed URL. Pass `?redirect=false` to get the URL as JSON instead. Retrieves data without changing records or spending credits.

    Annotations the server declares

    • title: Download prospect file
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • dealmachine_get_prospects_id_notesList prospect notes.Reads private dataNo findings

    Why it is in this group

    • The name "dealmachine_get_prospects_id_notes" says "get": a word for reading.

    What it can reach

    • private-dataThe name "dealmachine_get_prospects_id_notes" says "get" and "note": it reads notes.
    • private-dataThe description's first sentence says "list" and "note": it reads notes.
    Description, as the server wrote it
    List prospect notes. Notes on the prospect, newest first. Retrieves data without changing records or spending credits.

    Annotations the server declares

    • title: List prospect notes
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • dealmachine_get_prospects_id_notes_note_idGet prospect note.Reads private dataNo findings

    Why it is in this group

    • The name "dealmachine_get_prospects_id_notes_note_id" says "get": a word for reading.

    What it can reach

    • private-dataThe name "dealmachine_get_prospects_id_notes_note_id" says "get" and "note": it reads notes.
    • private-dataThe description's first sentence says "get" and "note": it reads notes.
    Description, as the server wrote it
    Get prospect note. Retrieves data without changing records or spending credits.

    Annotations the server declares

    • title: Get prospect note
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • dealmachine_get_prospects_id_photosList prospect photos.No findings

    Why it is in this group

    • The name "dealmachine_get_prospects_id_photos" says "get": a word for reading.
    Description, as the server wrote it
    List prospect photos. Photos of the prospect’s property, newest first. Property prospects only. Retrieves data without changing records or spending credits.

    Annotations the server declares

    • title: List prospect photos
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • dealmachine_get_prospects_id_tagsList prospect tags.No findings

    Why it is in this group

    • The name "dealmachine_get_prospects_id_tags" says "get": a word for reading.
    Description, as the server wrote it
    List prospect tags. The tag catalog with an `assigned` flag for this prospect. Retrieves data without changing records or spending credits.

    Annotations the server declares

    • title: List prospect tags
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • dealmachine_get_subscriptionGet subscription status.No findings

    Why it is in this group

    • The name "dealmachine_get_subscription" says "get": a word for reading.
    Description, as the server wrote it
    Get subscription status. Get your current subscription status, including plan details, billing cycle, and credit caps. Retrieves data without changing records or spending credits.

    Annotations the server declares

    • title: Get subscription status
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • dealmachine_get_tags_idGet tag.No findings

    Why it is in this group

    • The name "dealmachine_get_tags_id" says "get": a word for reading.
    Description, as the server wrote it
    Get tag. Retrieves data without changing records or spending credits.

    Annotations the server declares

    • title: Get tag
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • dealmachine_get_tasksList tasks.No findings

    Why it is in this group

    • The name "dealmachine_get_tasks" says "get": a word for reading.
    Description, as the server wrote it
    List tasks. List all tasks for the organization. Optionally filter by status, search, or assignee. Retrieves data without changing records or spending credits.

    Annotations the server declares

    • title: List tasks
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • dealmachine_get_tasks_idGet task.No findings

    Why it is in this group

    • The name "dealmachine_get_tasks_id" says "get": a word for reading.
    Description, as the server wrote it
    Get task. Get a single task by ID. Retrieves data without changing records or spending credits.

    Annotations the server declares

    • title: Get task
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • dealmachine_get_webhooks_eventsList webhook event types.No findings

    Why it is in this group

    • The name "dealmachine_get_webhooks_events" says "get": a word for reading.
    Description, as the server wrote it
    List webhook event types. Every event a webhook can subscribe to, with a description and a full example request body. Retrieves data without changing records or spending credits.

    Annotations the server declares

    • title: List webhook event types
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • dealmachine_get_webhooks_idGet webhook.No findings

    Why it is in this group

    • The name "dealmachine_get_webhooks_id" says "get": a word for reading.
    Description, as the server wrote it
    Get webhook. Retrieves data without changing records or spending credits.

    Annotations the server declares

    • title: Get webhook
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • dealmachine_get_webhooks_id_deliveriesList webhook deliveries.No findings

    Why it is in this group

    • The name "dealmachine_get_webhooks_id_deliveries" says "get": a word for reading.
    Description, as the server wrote it
    List webhook deliveries. The delivery log for one webhook, newest first: status, attempts, response code and time, and any error. Retrieves data without changing records or spending credits.

    Annotations the server declares

    • title: List webhook deliveries
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • dealmachine_get_webhooks_id_deliveries_delivery_idGet webhook delivery.No findings

    Why it is in this group

    • The name "dealmachine_get_webhooks_id_deliveries_delivery_id" says "get": a word for reading.
    Description, as the server wrote it
    Get webhook delivery. One delivery with the full event body that was (or will be) sent. Retrieves data without changing records or spending credits.

    Annotations the server declares

    • title: Get webhook delivery
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • dealmachine_people_countCount matching people without consuming credits.No findings

    Why it is in this group

    • The name "dealmachine_people_count" says "count": a word for reading.
    Description, as the server wrote it
    Count matching people without consuming credits. Filters use the people catalog.

    Annotations the server declares

    • title: Count Matching People
    • readOnlyHint: true
    • openWorldHint: false
    • destructiveHint: false
    • idempotentHint: true
  • dealmachine_property_countCounts properties matching locations (required) and filters, such as is_corporate_owned for corporation, LLC or business owners, or with anchor=people their matching contacts.Reads private dataNo findings

    Why it is in this group

    • The name "dealmachine_property_count" says "count": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "count" and "contact": it reads contacts.
    Description, as the server wrote it
    Counts properties matching locations (required) and filters, such as is_corporate_owned for corporation, LLC or business owners, or with anchor=people their matching contacts. Use the same anchor, contact_audience and require_phone as the search. Needs a connected DealMachine account; counting consumes no credits.

    Annotations the server declares

    • title: Count Matching Properties
    • readOnlyHint: true
    • openWorldHint: false
    • destructiveHint: false
    • idempotentHint: true
  • dealmachine_prospect_getReturns one prospect by prospect ID, or by the record it tracks, with its lifecycle, status (Hot, Warm, Cold, Follow up, Do Not Contact; read only), tags, and note and file counts.Reads private dataNo findings

    Why it is in this group

    • The name "dealmachine_prospect_get" says "get": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "return" and "contact": it reads contacts.
    Description, as the server wrote it
    Returns one prospect by prospect ID, or by the record it tracks, with its lifecycle, status (Hot, Warm, Cold, Follow up, Do Not Contact; read only), tags, and note and file counts. Free.

    Annotations the server declares

    • title: Get DealMachine Prospect
    • readOnlyHint: true
    • openWorldHint: false
    • destructiveHint: false
    • idempotentHint: true
  • dealmachine_tags_listLists the prospect tag catalog: the built-in tags every workspace has plus the workspace’s own, with how many prospects carry each.No findings

    Why it is in this group

    • The name "dealmachine_tags_list" says "list": a word for reading.
    Description, as the server wrote it
    Lists the prospect tag catalog: the built-in tags every workspace has plus the workspace’s own, with how many prospects carry each. Free.

    Annotations the server declares

    • title: List DealMachine Tags
    • readOnlyHint: true
    • openWorldHint: false
    • destructiveHint: false
    • idempotentHint: true
  • dealmachine_usageReturns live credit usage for the current billing cycle, including the total cap, spendable balance, monthly and additional pools, and usage by entity type.No findings

    Why it is in this group

    • The description's first verb is "return": a word for reading.
    Description, as the server wrote it
    Returns live credit usage for the current billing cycle, including the total cap, spendable balance, monthly and additional pools, and usage by entity type. This read-only request is free.

    Annotations the server declares

    • title: View DealMachine Credit Usage
    • readOnlyHint: true
    • openWorldHint: false
    • destructiveHint: false
    • idempotentHint: true
  • dealmachine_webhook_listLists the workspace’s outbound webhooks with their event types and delivery health, plus the catalog of event types when asked.No findings

    Why it is in this group

    • The name "dealmachine_webhook_list" says "list": a word for reading.
    Description, as the server wrote it
    Lists the workspace’s outbound webhooks with their event types and delivery health, plus the catalog of event types when asked. Free.

    Annotations the server declares

    • title: List DealMachine Webhooks
    • readOnlyHint: true
    • openWorldHint: false
    • destructiveHint: false
    • idempotentHint: true
  • dealmachine_whoamiReturns whether the current credential is valid, the active organization name, and the authentication type.Reads private data1 finding

    Why it is in this group

    • The name "dealmachine_whoami" says "whoami": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "return" and "credential": it reads secrets.

    Findings

    • Info

      The description mentions "credential".

      Matched text

      description: "Returns whether the current credential is valid, the active organization name,..."

      What this check looks for
    Description, as the server wrote it
    Returns whether the current credential is valid, the active organization name, and the authentication type. This read-only request is free.

    Annotations the server declares

    • title: Check DealMachine Authentication
    • readOnlyHint: true
    • openWorldHint: false
    • destructiveHint: false
    • idempotentHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

43200 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 30 private-data tools breaks every one.

Reads private data30
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write45
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out32
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
deny to break every path
{
  "permissions": {
    "deny": [
      "mcp__dealmachine__dealmachine_get_driving_drives",
      "mcp__dealmachine__dealmachine_get_driving_drives_id",
      "mcp__dealmachine__dealmachine_get_mail_analytics_summary",
      "mcp__dealmachine__dealmachine_get_mail_analytics_timeseries",
      "mcp__dealmachine__dealmachine_get_mail_campaigns",
      "mcp__dealmachine__dealmachine_get_mail_campaigns_id",
      "mcp__dealmachine__dealmachine_get_mail_campaigns_id_analytics",
      "mcp__dealmachine__dealmachine_get_mail_campaigns_id_cost_estimate",
      "mcp__dealmachine__dealmachine_get_mail_campaigns_id_properties_estimate",
      "mcp__dealmachine__dealmachine_get_mail_campaigns_id_recipients",
      "mcp__dealmachine__dealmachine_get_mail_designs",
      "mcp__dealmachine__dealmachine_get_mail_designs_id",
      "mcp__dealmachine__dealmachine_get_mail_return_addresses",
      "mcp__dealmachine__dealmachine_get_mail_return_addresses_id",
      "mcp__dealmachine__dealmachine_get_mail_settings",
      "mcp__dealmachine__dealmachine_get_mail_wallet_balance",
      "mcp__dealmachine__dealmachine_get_mail_wallet_pricing",
      "mcp__dealmachine__dealmachine_get_mail_wallet_transactions",
      "mcp__dealmachine__dealmachine_get_prospects_id_files",
      "mcp__dealmachine__dealmachine_get_prospects_id_files_file_id_download",
      "mcp__dealmachine__dealmachine_get_prospects_id_notes",
      "mcp__dealmachine__dealmachine_get_prospects_id_notes_note_id",
      "mcp__dealmachine__dealmachine_people_get",
      "mcp__dealmachine__dealmachine_people_get_many",
      "mcp__dealmachine__dealmachine_people_search",
      "mcp__dealmachine__dealmachine_property_count",
      "mcp__dealmachine__dealmachine_property_get",
      "mcp__dealmachine__dealmachine_property_get_many",
      "mcp__dealmachine__dealmachine_prospect_get",
      "mcp__dealmachine__dealmachine_whoami"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Tools listed without sign-in

Looked at Oct 29, 2026, 21:53 UTC, unchanged since Oct 29, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable
yes
HTTP status of an anonymous initialize
200
tools/list served without credentials
yes
Tools that change things, listed without credentials
73
Protocol version
2025-06-18
WWW-Authenticate on 401
not observed
resource_metadata in WWW-Authenticate
not observed
RFC 9728 protected resource metadata
https://mcp.dealmachine.com/.well-known/oauth-protected-resource
Authorization servers
https://dealmachine.com
Legacy HTTP+SSE transport
no
Dynamic client registration
yes
Client ID metadata documents
no
  • HighThe whole server

    The endpoint served tools/list without credentials, and the list has 73 tools that change things (65 destructive, 8 write). Whether a call also works without credentials was not tested: tools are never called.

    Matched text

    https://mcp.dealmachine.com: tools/list returned 128 tools to an anonymous client, including dealmachine_enrich_address (destructive), dealmachine_enrich_latlng (destructive), dealmachine_enrich_apn (destructive), dealmachine_enrich_email (destructive), dealmachine_enrich_phone (destructive) and 68 more

    What this check looks for

Posture changes

  1. Oct 29, 2026
    • Tools that change things, listed without credentials: 29 to 73

Findings

Matches of fixed checks, with the text they matched.

9 warn1 info
  • Warndealmachine_signup

    The server marks "dealmachine_signup" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "start": a word for a change.

    What this check looks for
  • Warndealmachine_property_search

    The server marks "dealmachine_property_search" destructive (destructiveHint: true), and its name says "search", a word for reading.

    Matched text

    annotations: {"readOnlyHint":false,"destructiveHint":true,"idempotentHint":false,"openWorldHint":false}; The name "dealmachine_property_search" says "search": a word for reading.

    What this check looks for
  • Warndealmachine_property_get

    The server marks "dealmachine_property_get" destructive (destructiveHint: true), and its name says "get", a word for reading.

    Matched text

    annotations: {"readOnlyHint":false,"destructiveHint":true,"idempotentHint":false,"openWorldHint":false}; The name "dealmachine_property_get" says "get": a word for reading.

    What this check looks for
  • Warndealmachine_property_get_many

    The server marks "dealmachine_property_get_many" destructive (destructiveHint: true), and its name says "get", a word for reading.

    Matched text

    annotations: {"readOnlyHint":false,"destructiveHint":true,"idempotentHint":false,"openWorldHint":false}; The name "dealmachine_property_get_many" says "get": a word for reading.

    What this check looks for
  • Warndealmachine_people_search

    The server marks "dealmachine_people_search" destructive (destructiveHint: true), and its name says "search", a word for reading.

    Matched text

    annotations: {"readOnlyHint":false,"destructiveHint":true,"idempotentHint":false,"openWorldHint":false}; The name "dealmachine_people_search" says "search": a word for reading.

    What this check looks for
  • Warndealmachine_people_get

    The server marks "dealmachine_people_get" destructive (destructiveHint: true), and its name says "get", a word for reading.

    Matched text

    annotations: {"readOnlyHint":false,"destructiveHint":true,"idempotentHint":false,"openWorldHint":false}; The name "dealmachine_people_get" says "get": a word for reading.

    What this check looks for
Show 4 more findings
  • Warndealmachine_people_get_many

    The server marks "dealmachine_people_get_many" destructive (destructiveHint: true), and its name says "get", a word for reading.

    Matched text

    annotations: {"readOnlyHint":false,"destructiveHint":true,"idempotentHint":false,"openWorldHint":false}; The name "dealmachine_people_get_many" says "get": a word for reading.

    What this check looks for
  • Warndealmachine_post_activity_search

    The server marks "dealmachine_post_activity_search" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "dealmachine_post_activity_search" says "post": a word for a change.

    What this check looks for
  • Warndealmachine_post_prospects_check

    The server marks "dealmachine_post_prospects_check" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "dealmachine_post_prospects_check" says "post": a word for a change.

    What this check looks for
  • Infodealmachine_whoami

    The description mentions "credential".

    Matched text

    description: "Returns whether the current credential is valid, the active organization name,..."

    What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

  1. PostureRemote posture changed. Tools that change things, listed without credentials: 29 -> 73.View diff
    • Tools that change things, listed without credentials: 29 to 73
All changes to this server

Install

Pinned to version 0.3.1. Values in angle brackets are yours to fill in.

claude mcp add --transport http dealmachine https://mcp.dealmachine.com
claude mcp add --transport http dealmachine https://mcp.dealmachine.com

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__dealmachine__dealmachine_account",
      "mcp__dealmachine__dealmachine_filters",
      "mcp__dealmachine__dealmachine_fields",
      "mcp__dealmachine__dealmachine_usage",
      "mcp__dealmachine__dealmachine_whoami",
      "mcp__dealmachine__dealmachine_property_count",
      "mcp__dealmachine__dealmachine_people_count",
      "mcp__dealmachine__dealmachine_location_search",
      "mcp__dealmachine__dealmachine_get_activity_activity_id",
      "mcp__dealmachine__dealmachine_get_addresses_autocomplete",
      "mcp__dealmachine__dealmachine_get_driving_drives",
      "mcp__dealmachine__dealmachine_get_driving_drives_id",
      "mcp__dealmachine__dealmachine_get_exports",
      "mcp__dealmachine__dealmachine_get_exports_exportId",
      "mcp__dealmachine__dealmachine_get_lists",
      "mcp__dealmachine__dealmachine_get_lists_list_id",
      "mcp__dealmachine__dealmachine_get_lists_list_id_items",
      "mcp__dealmachine__dealmachine_get_locations_locationId",
      "mcp__dealmachine__dealmachine_get_mail_analytics_summary",
      "mcp__dealmachine__dealmachine_get_mail_analytics_timeseries",
      "mcp__dealmachine__dealmachine_get_mail_campaigns",
      "mcp__dealmachine__dealmachine_get_mail_campaigns_id",
      "mcp__dealmachine__dealmachine_get_mail_campaigns_id_analytics",
      "mcp__dealmachine__dealmachine_get_mail_campaigns_id_cost_estimate",
      "mcp__dealmachine__dealmachine_get_mail_campaigns_id_properties_estimate",
      "mcp__dealmachine__dealmachine_get_mail_campaigns_id_recipients",
      "mcp__dealmachine__dealmachine_get_mail_designs",
      "mcp__dealmachine__dealmachine_get_mail_designs_id",
      "mcp__dealmachine__dealmachine_get_mail_return_addresses",
      "mcp__dealmachine__dealmachine_get_mail_return_addresses_id",
      "mcp__dealmachine__dealmachine_get_mail_settings",
      "mcp__dealmachine__dealmachine_get_mail_wallet_balance",
      "mcp__dealmachine__dealmachine_get_mail_wallet_pricing",
      "mcp__dealmachine__dealmachine_get_mail_wallet_transactions",
      "mcp__dealmachine__dealmachine_get_prospects_id_activity",
      "mcp__dealmachine__dealmachine_get_prospects_id_files",
      "mcp__dealmachine__dealmachine_get_prospects_id_files_file_id_download",
      "mcp__dealmachine__dealmachine_get_prospects_id_notes",
      "mcp__dealmachine__dealmachine_get_prospects_id_notes_note_id",
      "mcp__dealmachine__dealmachine_get_prospects_id_photos",
      "mcp__dealmachine__dealmachine_get_prospects_id_tags",
      "mcp__dealmachine__dealmachine_get_prospects_by_record",
      "mcp__dealmachine__dealmachine_get_prospects_counts",
      "mcp__dealmachine__dealmachine_get_subscription",
      "mcp__dealmachine__dealmachine_get_tags_id",
      "mcp__dealmachine__dealmachine_get_tasks",
      "mcp__dealmachine__dealmachine_get_tasks_id",
      "mcp__dealmachine__dealmachine_get_webhooks_id",
      "mcp__dealmachine__dealmachine_get_webhooks_id_deliveries",
      "mcp__dealmachine__dealmachine_get_webhooks_id_deliveries_delivery_id",
      "mcp__dealmachine__dealmachine_get_webhooks_events",
      "mcp__dealmachine__dealmachine_prospect_get",
      "mcp__dealmachine__dealmachine_prospect_search",
      "mcp__dealmachine__dealmachine_tags_list",
      "mcp__dealmachine__dealmachine_webhook_list"
    ],
    "ask": [
      "mcp__dealmachine__dealmachine_signup",
      "mcp__dealmachine__dealmachine_post_activity_search",
      "mcp__dealmachine__dealmachine_post_prospects_check",
      "mcp__dealmachine__dealmachine_list_create",
      "mcp__dealmachine__dealmachine_list_add_items",
      "mcp__dealmachine__dealmachine_prospect_add",
      "mcp__dealmachine__dealmachine_prospect_note_add",
      "mcp__dealmachine__dealmachine_webhook_create"
    ],
    "deny": [
      "mcp__dealmachine__dealmachine_enrich_address",
      "mcp__dealmachine__dealmachine_enrich_latlng",
      "mcp__dealmachine__dealmachine_enrich_apn",
      "mcp__dealmachine__dealmachine_enrich_email",
      "mcp__dealmachine__dealmachine_enrich_phone",
      "mcp__dealmachine__dealmachine_enrich_name",
      "mcp__dealmachine__dealmachine_property_search",
      "mcp__dealmachine__dealmachine_property_export",
      "mcp__dealmachine__dealmachine_property_get",
      "mcp__dealmachine__dealmachine_property_get_many",
      "mcp__dealmachine__dealmachine_comps",
      "mcp__dealmachine__dealmachine_people_search",
      "mcp__dealmachine__dealmachine_people_get",
      "mcp__dealmachine__dealmachine_people_get_many",
      "mcp__dealmachine__dealmachine_delete_lists_list_id",
      "mcp__dealmachine__dealmachine_delete_lists_list_id_items",
      "mcp__dealmachine__dealmachine_delete_mail_designs_id",
      "mcp__dealmachine__dealmachine_delete_mail_return_addresses_id",
      "mcp__dealmachine__dealmachine_delete_prospects_id",
      "mcp__dealmachine__dealmachine_delete_prospects_id_files_file_id",
      "mcp__dealmachine__dealmachine_delete_prospects_id_notes_note_id",
      "mcp__dealmachine__dealmachine_delete_prospects_id_photos_photo_id",
      "mcp__dealmachine__dealmachine_delete_prospects_id_tags_tag_id",
      "mcp__dealmachine__dealmachine_delete_tags_id",
      "mcp__dealmachine__dealmachine_delete_tasks_id",
      "mcp__dealmachine__dealmachine_delete_webhooks_id",
      "mcp__dealmachine__dealmachine_patch_lists_list_id",
      "mcp__dealmachine__dealmachine_patch_mail_campaigns_id",
      "mcp__dealmachine__dealmachine_patch_mail_designs_id",
      "mcp__dealmachine__dealmachine_patch_mail_return_addresses_id",
      "mcp__dealmachine__dealmachine_patch_mail_settings",
      "mcp__dealmachine__dealmachine_patch_prospects",
      "mcp__dealmachine__dealmachine_patch_prospects_id_notes_note_id",
      "mcp__dealmachine__dealmachine_patch_tags_id",
      "mcp__dealmachine__dealmachine_patch_tasks_id",
      "mcp__dealmachine__dealmachine_patch_webhooks_id",
      "mcp__dealmachine__dealmachine_post_addresses_validate",
      "mcp__dealmachine__dealmachine_post_enrichment_reverse_geocode",
      "mcp__dealmachine__dealmachine_post_lists_list_id_build",
      "mcp__dealmachine__dealmachine_post_lists_list_id_export",
      "mcp__dealmachine__dealmachine_post_lists_list_id_import",
      "mcp__dealmachine__dealmachine_post_mail_campaigns",
      "mcp__dealmachine__dealmachine_post_mail_campaigns_id_pause",
      "mcp__dealmachine__dealmachine_post_mail_campaigns_id_resume",
      "mcp__dealmachine__dealmachine_post_mail_designs",
      "mcp__dealmachine__dealmachine_post_mail_return_addresses",
      "mcp__dealmachine__dealmachine_post_mail_return_addresses_id_default",
      "mcp__dealmachine__dealmachine_post_people_export",
      "mcp__dealmachine__dealmachine_post_phones_dnc",
      "mcp__dealmachine__dealmachine_post_prospects_id_files",
      "mcp__dealmachine__dealmachine_post_prospects_id_files_upload_url",
      "mcp__dealmachine__dealmachine_post_prospects_id_photos",
      "mcp__dealmachine__dealmachine_post_prospects_id_tags_tag_id",
      "mcp__dealmachine__dealmachine_post_tags",
      "mcp__dealmachine__dealmachine_post_tags_reorder",
      "mcp__dealmachine__dealmachine_post_tasks",
      "mcp__dealmachine__dealmachine_post_webhooks_id_deliveries_delivery_id_redeliver",
      "mcp__dealmachine__dealmachine_post_webhooks_id_rotate_secret",
      "mcp__dealmachine__dealmachine_post_webhooks_id_test",
      "mcp__dealmachine__dealmachine_prospect_update",
      "mcp__dealmachine__dealmachine_prospect_tags_set",
      "mcp__dealmachine__dealmachine_mail_campaign_send",
      "mcp__dealmachine__dealmachine_mail_campaign_add_properties",
      "mcp__dealmachine__dealmachine_mail_campaign_archive",
      "mcp__dealmachine__dealmachine_mail_campaign_end",
      "mcp__dealmachine__dealmachine_mail_campaign_cancel"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as dealmachine. Review it before you use it.

Capability tags behind 69 rules
  • mcp__dealmachine__dealmachine_whoami private-data
  • mcp__dealmachine__dealmachine_property_count private-data
  • mcp__dealmachine__dealmachine_property_get private-data, untrusted-input
  • mcp__dealmachine__dealmachine_property_get_many private-data, untrusted-input
  • mcp__dealmachine__dealmachine_people_search private-data, untrusted-input
  • mcp__dealmachine__dealmachine_people_get private-data, untrusted-input
  • mcp__dealmachine__dealmachine_people_get_many private-data, untrusted-input
  • mcp__dealmachine__dealmachine_delete_mail_designs_id untrusted-input
  • mcp__dealmachine__dealmachine_delete_mail_return_addresses_id untrusted-input
  • mcp__dealmachine__dealmachine_delete_webhooks_id untrusted-input
  • mcp__dealmachine__dealmachine_get_driving_drives private-data
  • mcp__dealmachine__dealmachine_get_driving_drives_id private-data
  • mcp__dealmachine__dealmachine_get_mail_analytics_summary private-data, untrusted-input
  • mcp__dealmachine__dealmachine_get_mail_analytics_timeseries private-data, untrusted-input
  • mcp__dealmachine__dealmachine_get_mail_campaigns private-data, untrusted-input
  • mcp__dealmachine__dealmachine_get_mail_campaigns_id private-data, untrusted-input
  • mcp__dealmachine__dealmachine_get_mail_campaigns_id_analytics private-data, untrusted-input
  • mcp__dealmachine__dealmachine_get_mail_campaigns_id_cost_estimate private-data, untrusted-input
  • mcp__dealmachine__dealmachine_get_mail_campaigns_id_properties_estimate private-data, untrusted-input
  • mcp__dealmachine__dealmachine_get_mail_campaigns_id_recipients private-data, untrusted-input
  • mcp__dealmachine__dealmachine_get_mail_designs private-data, untrusted-input
  • mcp__dealmachine__dealmachine_get_mail_designs_id private-data, untrusted-input
  • mcp__dealmachine__dealmachine_get_mail_return_addresses private-data, untrusted-input
  • mcp__dealmachine__dealmachine_get_mail_return_addresses_id private-data, untrusted-input
  • mcp__dealmachine__dealmachine_get_mail_settings private-data, untrusted-input
  • mcp__dealmachine__dealmachine_get_mail_wallet_balance private-data, untrusted-input
  • mcp__dealmachine__dealmachine_get_mail_wallet_pricing private-data, untrusted-input
  • mcp__dealmachine__dealmachine_get_mail_wallet_transactions private-data, untrusted-input
  • mcp__dealmachine__dealmachine_get_prospects_id_files private-data
  • mcp__dealmachine__dealmachine_get_prospects_id_files_file_id_download private-data
  • mcp__dealmachine__dealmachine_get_prospects_id_notes private-data
  • mcp__dealmachine__dealmachine_get_prospects_id_notes_note_id private-data
  • mcp__dealmachine__dealmachine_patch_mail_campaigns_id untrusted-input, outbound
  • mcp__dealmachine__dealmachine_patch_mail_designs_id untrusted-input, outbound
  • mcp__dealmachine__dealmachine_patch_mail_return_addresses_id untrusted-input, outbound
  • mcp__dealmachine__dealmachine_patch_mail_settings untrusted-input, outbound
  • mcp__dealmachine__dealmachine_patch_webhooks_id untrusted-input
  • mcp__dealmachine__dealmachine_post_activity_search outbound
  • mcp__dealmachine__dealmachine_post_addresses_validate outbound
  • mcp__dealmachine__dealmachine_post_enrichment_reverse_geocode outbound
  • mcp__dealmachine__dealmachine_post_lists_list_id_build outbound
  • mcp__dealmachine__dealmachine_post_lists_list_id_export outbound
  • mcp__dealmachine__dealmachine_post_lists_list_id_import outbound
  • mcp__dealmachine__dealmachine_post_mail_campaigns untrusted-input, outbound
  • mcp__dealmachine__dealmachine_post_mail_campaigns_id_pause untrusted-input, outbound
  • mcp__dealmachine__dealmachine_post_mail_campaigns_id_resume untrusted-input, outbound
  • mcp__dealmachine__dealmachine_post_mail_designs untrusted-input, outbound
  • mcp__dealmachine__dealmachine_post_mail_return_addresses untrusted-input, outbound
  • mcp__dealmachine__dealmachine_post_mail_return_addresses_id_default untrusted-input, outbound
  • mcp__dealmachine__dealmachine_post_people_export outbound
  • mcp__dealmachine__dealmachine_post_phones_dnc outbound
  • mcp__dealmachine__dealmachine_post_prospects_id_files outbound
  • mcp__dealmachine__dealmachine_post_prospects_id_files_upload_url outbound
  • mcp__dealmachine__dealmachine_post_prospects_id_photos untrusted-input, outbound
  • mcp__dealmachine__dealmachine_post_prospects_id_tags_tag_id outbound
  • mcp__dealmachine__dealmachine_post_prospects_check outbound
  • mcp__dealmachine__dealmachine_post_tags outbound
  • mcp__dealmachine__dealmachine_post_tags_reorder outbound
  • mcp__dealmachine__dealmachine_post_tasks outbound
  • mcp__dealmachine__dealmachine_post_webhooks_id_deliveries_delivery_id_redeliver untrusted-input, outbound
  • mcp__dealmachine__dealmachine_post_webhooks_id_rotate_secret untrusted-input, outbound
  • mcp__dealmachine__dealmachine_post_webhooks_id_test untrusted-input, outbound
  • mcp__dealmachine__dealmachine_prospect_get private-data
  • mcp__dealmachine__dealmachine_mail_campaign_send untrusted-input, outbound
  • mcp__dealmachine__dealmachine_mail_campaign_add_properties untrusted-input, outbound
  • mcp__dealmachine__dealmachine_mail_campaign_archive untrusted-input
  • mcp__dealmachine__dealmachine_mail_campaign_end untrusted-input
  • mcp__dealmachine__dealmachine_mail_campaign_cancel untrusted-input
  • mcp__dealmachine__dealmachine_webhook_create untrusted-input, outbound

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/io.github.DealMachine/dealmachine/verify?hash=243f331696abe8d0bf122556f12b1f34c8b1a27fba47087b92231e3fb13a59c3" | jq -e '.changed == false'

Pinned hash 243f331696ab, from Nov 4, 2026, 18:18 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/io.github.DealMachine/dealmachine/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for io.github.DealMachine/dealmachine
[![anlyon.dev](https://anlyon.dev/badge/io.github.DealMachine/dealmachine.svg)](https://anlyon.dev/servers/io.github.DealMachine/dealmachine)

Source: MCP Registry · repository. Synced Nov 4, 2026, 18:17 UTC.