Skip to content
anlyon.devby Anlyon

AgencyBloc MCP by usefulapi

io.usefulapi/agencyblocusefulapi.iostreamable-httpv1.0.0Scanned

Read and update AgencyBloc individuals, groups, policies and agents; log activities and notes.

22 tools: 4 can delete or cancel things, 4 change things and 14 only read.

Tools: 4 delete, 0 irreversible, 4 write, 14 read.
  • Reads private data · 4
  • Reads text others write · 22
  • Can send data out · 0
  • No findings

Anlyon alternative

8 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →
Compare with similar serversMarkdownJSONReport this listing

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

22 tools

Deletes or cancels 4Claude Code: deny
  • agencybloc_create_noteWRITE: add one note (subject + body) to an agent, group, individual or policy.Reads text others writeNo findings

    Why it is in this group

    • The name "agencybloc_create_note" says "create": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    WRITE: add one note (subject + body) to an agent, group, individual or policy. AgencyBloc never allows notes to be edited or deleted through the API (audit rule), so the note is permanent. Pinning a note unpins the previously pinned one. Returns the new note id. POST notes/create.

    Annotations the server declares

    • title: Add note
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • agencybloc_update_groupWRITE: change fields of an existing group (including its name); fields you leave out are not sent.Reads text others writeNo findings

    Why it is in this group

    • The name "agencybloc_update_group" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    WRITE: change fields of an existing group (including its name); fields you leave out are not sent. Returns the groupID. POST groups/update.

    Annotations the server declares

    • title: Update group
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
  • agencybloc_update_individualWRITE: change fields of an existing individual; fields you leave out are not sent.Reads text others writeNo findings

    Why it is in this group

    • The name "agencybloc_update_individual" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    WRITE: change fields of an existing individual; fields you leave out are not sent. Tags are replaced (empty string clears them). Addresses are not changed here. Returns the individualID. POST individuals/update.

    Annotations the server declares

    • title: Update individual
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
  • agencybloc_update_policyWRITE: change fields of an existing policy (status, carrier, dates, premium ...); fields you leave out are not sent.Reads text others writeNo findings

    Why it is in this group

    • The name "agencybloc_update_policy" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    WRITE: change fields of an existing policy (status, carrier, dates, premium ...); fields you leave out are not sent. Returns the policyID. POST policies/update.

    Annotations the server declares

    • title: Update policy
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
Changes things 4Claude Code: ask
  • agencybloc_create_activityWRITE: log an activity (call, task, renewal reminder) on a group, individual, agent, carrier or lead.Reads text others writeNo findings

    Why it is in this group

    • The name "agencybloc_create_activity" says "create": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    WRITE: log an activity (call, task, renewal reminder) on a group, individual, agent, carrier or lead. Status, type, method and priority are the text values of the account's dropdowns (My Agency Settings > Data Administration); unknown values are created. When the status is not Complete the activity is a follow-up: give follow_up_user_id and follow_up_date (and start/end times), and AgencyBloc assigns it to that user. Nothing is sent to the customer. Activities cannot be edited or deleted through the API. Returns the new activityID. POST activities/create.

    Annotations the server declares

    • title: Create activity
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • agencybloc_create_groupWRITE: create a new group (employer / business account) in AgencyBloc.Reads text others writeNo findings

    Why it is in this group

    • The name "agencybloc_create_group" says "create": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    WRITE: create a new group (employer / business account) in AgencyBloc. It does not check for duplicates: search first. Returns the new groupID. POST groups/create.

    Annotations the server declares

    • title: Create group
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • agencybloc_create_individualWRITE: create a new individual (client or contact) in AgencyBloc.Reads text others writeNo findings

    Why it is in this group

    • The name "agencybloc_create_individual" says "create": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    WRITE: create a new individual (client or contact) in AgencyBloc. Needs first and last name; everything else is optional. It does not check for duplicates: search first. Returns the new individualID. POST individuals/create.

    Annotations the server declares

    • title: Create individual
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • agencybloc_create_policyWRITE: create a policy on an existing group or individual.Reads text others writeNo findings

    Why it is in this group

    • The name "agencybloc_create_policy" says "create": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    WRITE: create a policy on an existing group or individual. Needs the holder (entity_id + entity_type), coverage type, status and the carrier's full name; unknown coverage types / statuses are created in the account. Returns the new policyID. POST policies/create.

    Annotations the server declares

    • title: Create policy
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
Only reads 14Show 14 read-only tools
  • agencybloc_get_activitiesActivities by id (1-50 ids), e.g.Reads text others writeNo findings

    Why it is in this group

    • The name "agencybloc_get_activities" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Activities by id (1-50 ids), e.g. the ids shown on a policy or individual. POST activity/list.

    Annotations the server declares

    • title: Get activities
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • agencybloc_get_agentOne agent by id, with agencies, addresses and custom fields (and activities when include_activities is true).Reads text others writeNo findings

    Why it is in this group

    • The name "agencybloc_get_agent" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    One agent by id, with agencies, addresses and custom fields (and activities when include_activities is true). POST agents/detail.

    Annotations the server declares

    • title: Get agent
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • agencybloc_get_groupOne group by id, with addresses, policies and custom fields (and activities when include_activities is true).Reads text others writeNo findings

    Why it is in this group

    • The name "agencybloc_get_group" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    One group by id, with addresses, policies and custom fields (and activities when include_activities is true). POST groups/detail.

    Annotations the server declares

    • title: Get group
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • agencybloc_get_individualOne individual by id, with addresses, policies and custom fields (and activities when include_activities is true).Reads text others writeNo findings

    Why it is in this group

    • The name "agencybloc_get_individual" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    One individual by id, with addresses, policies and custom fields (and activities when include_activities is true). National ids are removed. POST individuals/detail.

    Annotations the server declares

    • title: Get individual
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • agencybloc_get_leadOne Sales Enablement record (lead) by record id.Reads text others writeNo findings

    Why it is in this group

    • The name "agencybloc_get_lead" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    One Sales Enablement record (lead) by record id. POST salesEnablement/Leads/detail.

    Annotations the server declares

    • title: Get lead
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • agencybloc_get_policyOne policy by id: holder, agent, carrier, status, dates, premium, coverages and custom fields.Reads text others writeNo findings

    Why it is in this group

    • The name "agencybloc_get_policy" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    One policy by id: holder, agent, carrier, status, dates, premium, coverages and custom fields. POST policies/detail.

    Annotations the server declares

    • title: Get policy
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • agencybloc_list_activitiesAll activities (tasks, calls, renewals) logged on one group, individual, agent, carrier or lead: date, subject, notes, status, type, method, priority and follow-up.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "agencybloc_list_activities" says "list": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "note": it reads notes.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    All activities (tasks, calls, renewals) logged on one group, individual, agent, carrier or lead: date, subject, notes, status, type, method, priority and follow-up. There is no paging. POST activities/list.

    Annotations the server declares

    • title: List activities
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • agencybloc_list_notesNotes (subject, body, author, dates, pinned flag, attachment names) on one agent, group, individual or policy, newest change first.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "agencybloc_list_notes" says "list": a word for reading.

    What it can reach

    • private-dataThe name "agencybloc_list_notes" says "list" and "note": it reads notes.
    • private-dataThe description's first sentence says "note": it reads notes.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Notes (subject, body, author, dates, pinned flag, attachment names) on one agent, group, individual or policy, newest change first. There is no paging. POST notes/list.

    Annotations the server declares

    • title: List notes
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • agencybloc_search_agentsSearch agents (producers) by name, email or phone.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "agencybloc_search_agents" says "search": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "search" and "email": it reads mail.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe description's first sentence says "search" and "email": it reads inbound email, which other people can write.
    Description, as the server wrote it
    Search agents (producers) by name, email or phone. Returns id, name, email and phones. POST agents/search.

    Annotations the server declares

    • title: Search agents
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • agencybloc_search_carriersSearch insurance carriers by name or phone.Reads text others writeNo findings

    Why it is in this group

    • The name "agencybloc_search_carriers" says "search": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Search insurance carriers by name or phone. Returns id, name, abbreviation and phones. POST carriers/search.

    Annotations the server declares

    • title: Search carriers
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • agencybloc_search_groupsSearch groups (employer / business accounts) in AgencyBloc by name, type or phone.Reads text others writeNo findings

    Why it is in this group

    • The name "agencybloc_search_groups" says "search": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Search groups (employer / business accounts) in AgencyBloc by name, type or phone. Returns id, name, type and phone. POST groups/search.

    Annotations the server declares

    • title: Search groups
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • agencybloc_search_individualsSearch individuals (clients and contacts) in AgencyBloc.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "agencybloc_search_individuals" says "search": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "search" and "contact": it reads contacts.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Search individuals (clients and contacts) in AgencyBloc. All filters are optional and combine; with none you get the first records. Returns id, name, email, birth date, phones and last-updated time (national ids such as SSN are never returned). Use updated_since to find recently changed people. POST individuals/search.

    Annotations the server declares

    • title: Search individuals
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • agencybloc_search_leads_by_phoneFind Sales Enablement records (leads) by phone number; the search is by phone only.Reads text others writeNo findings

    Why it is in this group

    • The name "agencybloc_search_leads_by_phone" says "search": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Find Sales Enablement records (leads) by phone number; the search is by phone only. Only accounts with the Sales Enablement module have them. POST salesEnablement/leads/searchphone.

    Annotations the server declares

    • title: Search leads by phone
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • agencybloc_search_policiesSearch policies by number, coverage type, carrier, holder, servicing agent, application date or last update.Reads text others writeNo findings

    Why it is in this group

    • The name "agencybloc_search_policies" says "search": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Search policies by number, coverage type, carrier, holder, servicing agent, application date or last update. Returns id, holder, policy number, carrier, status, coverage type, effective and renewal dates. Use submitted_after/updated_since for recent business. POST policies/search.

    Annotations the server declares

    • title: Search policies
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged outbound.

Reads private data4
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write22
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out0
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

No check matched anything in these tool definitions. That is not a safety guarantee.

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http agencybloc https://agencybloc.usefulapi.io/mcp
claude mcp add --transport http agencybloc https://agencybloc.usefulapi.io/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__agencybloc__agencybloc_search_individuals",
      "mcp__agencybloc__agencybloc_get_individual",
      "mcp__agencybloc__agencybloc_search_groups",
      "mcp__agencybloc__agencybloc_get_group",
      "mcp__agencybloc__agencybloc_search_policies",
      "mcp__agencybloc__agencybloc_get_policy",
      "mcp__agencybloc__agencybloc_search_agents",
      "mcp__agencybloc__agencybloc_get_agent",
      "mcp__agencybloc__agencybloc_search_carriers",
      "mcp__agencybloc__agencybloc_list_activities",
      "mcp__agencybloc__agencybloc_get_activities",
      "mcp__agencybloc__agencybloc_list_notes",
      "mcp__agencybloc__agencybloc_search_leads_by_phone",
      "mcp__agencybloc__agencybloc_get_lead"
    ],
    "ask": [
      "mcp__agencybloc__agencybloc_create_individual",
      "mcp__agencybloc__agencybloc_create_group",
      "mcp__agencybloc__agencybloc_create_policy",
      "mcp__agencybloc__agencybloc_create_activity"
    ],
    "deny": [
      "mcp__agencybloc__agencybloc_update_individual",
      "mcp__agencybloc__agencybloc_update_group",
      "mcp__agencybloc__agencybloc_update_policy",
      "mcp__agencybloc__agencybloc_create_note"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as agencybloc. Review it before you use it.

Capability tags behind 22 rules
  • mcp__agencybloc__agencybloc_search_individuals private-data, untrusted-input
  • mcp__agencybloc__agencybloc_get_individual untrusted-input
  • mcp__agencybloc__agencybloc_search_groups untrusted-input
  • mcp__agencybloc__agencybloc_get_group untrusted-input
  • mcp__agencybloc__agencybloc_search_policies untrusted-input
  • mcp__agencybloc__agencybloc_get_policy untrusted-input
  • mcp__agencybloc__agencybloc_search_agents private-data, untrusted-input
  • mcp__agencybloc__agencybloc_get_agent untrusted-input
  • mcp__agencybloc__agencybloc_search_carriers untrusted-input
  • mcp__agencybloc__agencybloc_list_activities private-data, untrusted-input
  • mcp__agencybloc__agencybloc_get_activities untrusted-input
  • mcp__agencybloc__agencybloc_list_notes private-data, untrusted-input
  • mcp__agencybloc__agencybloc_search_leads_by_phone untrusted-input
  • mcp__agencybloc__agencybloc_get_lead untrusted-input
  • mcp__agencybloc__agencybloc_create_individual untrusted-input
  • mcp__agencybloc__agencybloc_update_individual untrusted-input
  • mcp__agencybloc__agencybloc_create_group untrusted-input
  • mcp__agencybloc__agencybloc_update_group untrusted-input
  • mcp__agencybloc__agencybloc_create_policy untrusted-input
  • mcp__agencybloc__agencybloc_update_policy untrusted-input
  • mcp__agencybloc__agencybloc_create_activity untrusted-input
  • mcp__agencybloc__agencybloc_create_note untrusted-input

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/io.usefulapi/agencybloc/verify?hash=efd52111d182ddb82f4fcc2d3878d6acce3e07f13586472f153d558dc38286b2" | jq -e '.changed == false'

Pinned hash efd52111d182, from Oct 24, 2026, 13:17 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/io.usefulapi/agencybloc/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for io.usefulapi/agencybloc
[![anlyon.dev](https://anlyon.dev/badge/io.usefulapi/agencybloc.svg)](https://anlyon.dev/servers/io.usefulapi/agencybloc)

Source: MCP Registry · repository. Synced Oct 24, 2026, 13:17 UTC.