Skip to content
anlyon.devby Anlyon

CentralStationCRM MCP by usefulapi

io.usefulapi/centralstationcrmusefulapi.iostreamable-httpv1.1.0Scanned

Read CentralStationCRM people, companies, deals, tasks; create and update people, companies, deals.

33 tools: 4 can delete or cancel things, 5 change things and 24 only read.

Tools: 4 delete, 0 irreversible, 5 write, 24 read.
  • Reads private data · 12
  • Reads text others write · 33
  • Can send data out · 1
  • No findings

Tools listed without sign-in. Remote posture

Anlyon alternative

9 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →
Compare with similar serversMarkdownJSONReport this listing

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

33 tools

Deletes or cancels 4Claude Code: deny
  • centralstationcrm_update_companyWRITE: change fields of a company.Reads text others writeNo findings

    Why it is in this group

    • The name "centralstationcrm_update_company" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    WRITE: change fields of a company. Only the fields you give are sent. PUT /companies/{id}.

    Annotations the server declares

    • title: Update company
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
  • centralstationcrm_update_dealWRITE: change fields of a deal, for example move it to another stage or set its state to won or lost.Reads text others writeNo findings

    Why it is in this group

    • The name "centralstationcrm_update_deal" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    WRITE: change fields of a deal, for example move it to another stage or set its state to won or lost. Only the fields you give are sent. PUT /deals/{id}.

    Annotations the server declares

    • title: Update deal
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
  • centralstationcrm_update_personWRITE: change fields of a person.Reads text others writeNo findings

    Why it is in this group

    • The name "centralstationcrm_update_person" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    WRITE: change fields of a person. Only the fields you give are sent; the rest stays. PUT /people/{id}.

    Annotations the server declares

    • title: Update person
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
  • centralstationcrm_update_taskWRITE: change a task, for example mark it done (finished = true), rename it or reschedule it.Reads text others writeNo findings

    Why it is in this group

    • The name "centralstationcrm_update_task" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    WRITE: change a task, for example mark it done (finished = true), rename it or reschedule it. Only the fields you give are sent. PUT /tasks/{id}.

    Annotations the server declares

    • title: Update task
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
Changes things 5Claude Code: ask
  • centralstationcrm_create_companyWRITE: create a company.Reads text others writeNo findings

    Why it is in this group

    • The name "centralstationcrm_create_company" says "create": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    WRITE: create a company. Nothing is sent to the contact. POST /companies.

    Annotations the server declares

    • title: Create company
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • centralstationcrm_create_dealWRITE: create a deal (sales opportunity).Reads text others writeNo findings

    Why it is in this group

    • The name "centralstationcrm_create_deal" says "create": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    WRITE: create a deal (sales opportunity). Use list_deal_types for pipeline and stage ids. Pipelines with a monetary value or target date need value and target_date (value_type defaults to total); the vendor says what is missing. Nothing is sent to the contact. POST /deals.

    Annotations the server declares

    • title: Create deal
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • centralstationcrm_create_noteWRITE: add a note to the history of one or more people, companies, deals or projects.Reads text others writeNo findings

    Why it is in this group

    • The name "centralstationcrm_create_note" says "create": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    WRITE: add a note to the history of one or more people, companies, deals or projects. Nothing is sent to the contact. POST /protocols.

    Annotations the server declares

    • title: Create note
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • centralstationcrm_create_personWRITE: create a contact person (last name required), optionally with email addresses and phone numbers.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "centralstationcrm_create_person" says "create": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a destination (input.phones): what the tool writes goes there.
    Description, as the server wrote it
    WRITE: create a contact person (last name required), optionally with email addresses and phone numbers. Nothing is sent to the contact. POST /people.

    Annotations the server declares

    • title: Create person
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • centralstationcrm_create_taskWRITE: create a task (to-do, call, email, visit...) optionally attached to a person, company or deal and assigned to a user.Reads text others writeNo findings

    Why it is in this group

    • The name "centralstationcrm_create_task" says "create": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    WRITE: create a task (to-do, call, email, visit...) optionally attached to a person, company or deal and assigned to a user. Nothing is sent to the contact. POST /tasks.

    Annotations the server declares

    • title: Create task
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
Only reads 24Show 24 read-only tools
  • centralstationcrm_count_recordsTotal number of people, companies, deals or projects (optionally only those with a tag).Reads text others writeNo findings

    Why it is in this group

    • The name "centralstationcrm_count_records" says "count": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Total number of people, companies, deals or projects (optionally only those with a tag). GET /<resource>/count.

    Annotations the server declares

    • title: Count records
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • centralstationcrm_get_companyOne company by id, optionally with related records (people, deals, tags, tasks, contact details, addresses).Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "centralstationcrm_get_company" says "get": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "contact": it reads contacts.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    One company by id, optionally with related records (people, deals, tags, tasks, contact details, addresses). GET /companies/{id}.

    Annotations the server declares

    • title: Get company
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • centralstationcrm_get_current_userThe CentralStationCRM user this API key belongs to: id, name, login email, the account (subdomain) it is signed in to, timezone.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "centralstationcrm_get_current_user" says "get": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "email": it reads mail.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe description's first sentence says "email": it reads inbound email, which other people can write.
    Description, as the server wrote it
    The CentralStationCRM user this API key belongs to: id, name, login email, the account (subdomain) it is signed in to, timezone. Use the user id to assign records or tasks. GET /user.

    Annotations the server declares

    • title: Get current user
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • centralstationcrm_get_dealOne deal by id, optionally with its tags, people, company, tasks and calendar events.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "centralstationcrm_get_deal" says "get": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "calendar": it reads calendars.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    One deal by id, optionally with its tags, people, company, tasks and calendar events. GET /deals/{id}.

    Annotations the server declares

    • title: Get deal
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • centralstationcrm_get_deal_statsNumber and total value of all deals (optionally only those with a tag), with the account currency.Reads text others writeNo findings

    Why it is in this group

    • The name "centralstationcrm_get_deal_stats" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Number and total value of all deals (optionally only those with a tag), with the account currency. GET /deals/stats.

    Annotations the server declares

    • title: Get deal statistics
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • centralstationcrm_get_noteOne note / history entry by id.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "centralstationcrm_get_note" says "get": a word for reading.

    What it can reach

    • private-dataThe name "centralstationcrm_get_note" says "get" and "note": it reads notes.
    • private-dataThe description's first sentence says "note": it reads notes.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    One note / history entry by id. GET /protocols/{id}.

    Annotations the server declares

    • title: Get note
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • centralstationcrm_get_personOne person by id, optionally with related records (companies, deals, tags, tasks, email addresses, phone numbers, addresses).Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "centralstationcrm_get_person" says "get": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "email": it reads mail.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe description's first sentence says "email": it reads inbound email, which other people can write.
    Description, as the server wrote it
    One person by id, optionally with related records (companies, deals, tags, tasks, email addresses, phone numbers, addresses). GET /people/{id}.

    Annotations the server declares

    • title: Get person
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • centralstationcrm_get_projectOne project by id, optionally with its tags, people, company, tasks and calendar events.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "centralstationcrm_get_project" says "get": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "calendar": it reads calendars.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    One project by id, optionally with its tags, people, company, tasks and calendar events. GET /projects/{id}.

    Annotations the server declares

    • title: Get project
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • centralstationcrm_get_taskOne task by id.Reads text others writeNo findings

    Why it is in this group

    • The name "centralstationcrm_get_task" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    One task by id. GET /tasks/{id}.

    Annotations the server declares

    • title: Get task
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • centralstationcrm_list_calendar_eventsList calendar events (appointments, meetings) of the account.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "centralstationcrm_list_calendar_events" says "list": a word for reading.

    What it can reach

    • private-dataThe name "centralstationcrm_list_calendar_events" says "list" and "calendar": it reads calendars.
    • private-dataThe description's first sentence says "list" and "calendar": it reads calendars.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    List calendar events (appointments, meetings) of the account. Filter by upcoming/old and date range. GET /cal_events.

    Annotations the server declares

    • title: List calendar events
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • centralstationcrm_list_companiesList companies.Reads text others writeNo findings

    Why it is in this group

    • The name "centralstationcrm_list_companies" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    List companies. Optionally filter by tag and order by name, creation or last update. Use search_companies to find one by name. GET /companies.

    Annotations the server declares

    • title: List companies
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • centralstationcrm_list_deal_typesList the deal types (pipelines) with their stages.Reads text others writeNo findings

    Why it is in this group

    • The name "centralstationcrm_list_deal_types" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    List the deal types (pipelines) with their stages. Use the ids (and stage ids) to create deals and to move them between stages. GET /deal_types.

    Annotations the server declares

    • title: List deal pipelines
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • centralstationcrm_list_dealsList deals (sales opportunities) with value, state (open_0/25/50/75, won, lost), pipeline and stage ids, target date.Reads text others writeNo findings

    Why it is in this group

    • The name "centralstationcrm_list_deals" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    List deals (sales opportunities) with value, state (open_0/25/50/75, won, lost), pipeline and stage ids, target date. Filter by company, responsible user, pipeline or state; order by date, value, state or name. GET /deals.

    Annotations the server declares

    • title: List deals
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • centralstationcrm_list_notesList protocols: notes, logged emails and other history entries.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "centralstationcrm_list_notes" says "list": a word for reading.

    What it can reach

    • private-dataThe name "centralstationcrm_list_notes" says "list" and "note": it reads notes.
    • private-dataThe description's first sentence says "list" and "note": it reads notes.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe description's first sentence says "list" and "email": it reads inbound email, which other people can write.
    Description, as the server wrote it
    List protocols: notes, logged emails and other history entries. Filter by the person, company, deal or project they belong to. GET /protocols.

    Annotations the server declares

    • title: List notes
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • centralstationcrm_list_peopleList contact people.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "centralstationcrm_list_people" says "list": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "list" and "contact": it reads contacts.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    List contact people. Optionally filter by tag and order by name, creation or last update. Use search_people to find a person by name, email or phone. GET /people.

    Annotations the server declares

    • title: List people
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • centralstationcrm_list_projectsList projects with state, target date and company.Reads text others writeNo findings

    Why it is in this group

    • The name "centralstationcrm_list_projects" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    List projects with state, target date and company. Filter by tag; order by date, state or name. GET /projects.

    Annotations the server declares

    • title: List projects
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • centralstationcrm_list_tagsList all tag names used in the account.Reads text others writeNo findings

    Why it is in this group

    • The name "centralstationcrm_list_tags" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    List all tag names used in the account. GET /tags/list.

    Annotations the server declares

    • title: List tags
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • centralstationcrm_list_tasksList tasks (to-dos, calls, emails, visits) of the account.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "centralstationcrm_list_tasks" says "list": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "list" and "email": it reads mail.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe description's first sentence says "list" and "email": it reads inbound email, which other people can write.
    Description, as the server wrote it
    List tasks (to-dos, calls, emails, visits) of the account. Filter by open/closed state, due-date range and responsible user. GET /tasks.

    Annotations the server declares

    • title: List tasks
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • centralstationcrm_list_usersList the users of the CentralStationCRM account (id, name, email).Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "centralstationcrm_list_users" says "list": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "list" and "email": it reads mail.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe description's first sentence says "list" and "email": it reads inbound email, which other people can write.
    Description, as the server wrote it
    List the users of the CentralStationCRM account (id, name, email). Use the ids for responsible-user filters and for assigning records. GET /users.

    Annotations the server declares

    • title: List users
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • centralstationcrm_search_allFull-text search across people, companies, deals and projects for a term.Reads text others writeNo findings

    Why it is in this group

    • The name "centralstationcrm_search_all" says "search": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Full-text search across people, companies, deals and projects for a term. GET /search.

    Annotations the server declares

    • title: Search everything
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • centralstationcrm_search_companiesFind companies by name.Reads text others writeNo findings

    Why it is in this group

    • The name "centralstationcrm_search_companies" says "search": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Find companies by name. GET /companies/search.

    Annotations the server declares

    • title: Search companies
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • centralstationcrm_search_dealsFind deals by name.Reads text others writeNo findings

    Why it is in this group

    • The name "centralstationcrm_search_deals" says "search": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Find deals by name. GET /deals/search.

    Annotations the server declares

    • title: Search deals
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • centralstationcrm_search_peopleFind people by last name, first name, email address or phone number (email and phone cannot be combined).Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "centralstationcrm_search_people" says "search": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "find" and "email": it reads mail.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe description's first sentence says "find" and "email": it reads inbound email, which other people can write.
    Description, as the server wrote it
    Find people by last name, first name, email address or phone number (email and phone cannot be combined). Give at least one criterion. GET /people/search.

    Annotations the server declares

    • title: Search people
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • centralstationcrm_search_projectsFind projects by name.Reads text others writeNo findings

    Why it is in this group

    • The name "centralstationcrm_search_projects" says "search": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Find projects by name. GET /projects/search.

    Annotations the server declares

    • title: Search projects
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

396 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 1 outbound tool breaks every one.

Reads private data12
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write33
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out1
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
deny to break every path
{
  "permissions": {
    "deny": [
      "mcp__centralstationcrm__centralstationcrm_create_person"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Tools listed without sign-in

Looked at Oct 24, 2026, 16:19 UTC, unchanged since Oct 24, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable
yes
HTTP status of an anonymous initialize
200
tools/list served without credentials
yes
Tools that change things, listed without credentials
9
Protocol version
2025-06-18
WWW-Authenticate on 401
not observed
resource_metadata in WWW-Authenticate
not observed
RFC 9728 protected resource metadata
https://centralstationcrm.usefulapi.io/.well-known/oauth-protected-resource/mcp
Authorization servers
https://centralstationcrm.usefulapi.io
Legacy HTTP+SSE transport
no
Dynamic client registration
yes
Client ID metadata documents
no
  • HighThe whole server

    The endpoint served tools/list without credentials, and the list has 9 tools that change things (4 destructive, 5 write). Whether a call also works without credentials was not tested: tools are never called.

    Matched text

    https://centralstationcrm.usefulapi.io/mcp: tools/list returned 33 tools to an anonymous client, including centralstationcrm_update_person (destructive), centralstationcrm_update_company (destructive), centralstationcrm_update_deal (destructive), centralstationcrm_update_task (destructive), centralstationcrm_create_person (write) and 4 more

    What this check looks for

Findings

Matches of fixed checks, with the text they matched.

No check matched anything in these tool definitions. That is not a safety guarantee.

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 1.1.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http centralstationcrm https://centralstationcrm.usefulapi.io/mcp
claude mcp add --transport http centralstationcrm https://centralstationcrm.usefulapi.io/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__centralstationcrm__centralstationcrm_get_current_user",
      "mcp__centralstationcrm__centralstationcrm_list_users",
      "mcp__centralstationcrm__centralstationcrm_list_people",
      "mcp__centralstationcrm__centralstationcrm_search_people",
      "mcp__centralstationcrm__centralstationcrm_get_person",
      "mcp__centralstationcrm__centralstationcrm_list_companies",
      "mcp__centralstationcrm__centralstationcrm_search_companies",
      "mcp__centralstationcrm__centralstationcrm_get_company",
      "mcp__centralstationcrm__centralstationcrm_list_deals",
      "mcp__centralstationcrm__centralstationcrm_search_deals",
      "mcp__centralstationcrm__centralstationcrm_get_deal",
      "mcp__centralstationcrm__centralstationcrm_get_deal_stats",
      "mcp__centralstationcrm__centralstationcrm_list_deal_types",
      "mcp__centralstationcrm__centralstationcrm_list_projects",
      "mcp__centralstationcrm__centralstationcrm_search_projects",
      "mcp__centralstationcrm__centralstationcrm_get_project",
      "mcp__centralstationcrm__centralstationcrm_list_tasks",
      "mcp__centralstationcrm__centralstationcrm_get_task",
      "mcp__centralstationcrm__centralstationcrm_list_notes",
      "mcp__centralstationcrm__centralstationcrm_get_note",
      "mcp__centralstationcrm__centralstationcrm_list_calendar_events",
      "mcp__centralstationcrm__centralstationcrm_search_all",
      "mcp__centralstationcrm__centralstationcrm_list_tags",
      "mcp__centralstationcrm__centralstationcrm_count_records"
    ],
    "ask": [
      "mcp__centralstationcrm__centralstationcrm_create_person",
      "mcp__centralstationcrm__centralstationcrm_create_company",
      "mcp__centralstationcrm__centralstationcrm_create_deal",
      "mcp__centralstationcrm__centralstationcrm_create_task",
      "mcp__centralstationcrm__centralstationcrm_create_note"
    ],
    "deny": [
      "mcp__centralstationcrm__centralstationcrm_update_person",
      "mcp__centralstationcrm__centralstationcrm_update_company",
      "mcp__centralstationcrm__centralstationcrm_update_deal",
      "mcp__centralstationcrm__centralstationcrm_update_task"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as centralstationcrm. Review it before you use it.

Capability tags behind 33 rules
  • mcp__centralstationcrm__centralstationcrm_get_current_user private-data, untrusted-input
  • mcp__centralstationcrm__centralstationcrm_list_users private-data, untrusted-input
  • mcp__centralstationcrm__centralstationcrm_list_people private-data, untrusted-input
  • mcp__centralstationcrm__centralstationcrm_search_people private-data, untrusted-input
  • mcp__centralstationcrm__centralstationcrm_get_person private-data, untrusted-input
  • mcp__centralstationcrm__centralstationcrm_list_companies untrusted-input
  • mcp__centralstationcrm__centralstationcrm_search_companies untrusted-input
  • mcp__centralstationcrm__centralstationcrm_get_company private-data, untrusted-input
  • mcp__centralstationcrm__centralstationcrm_list_deals untrusted-input
  • mcp__centralstationcrm__centralstationcrm_search_deals untrusted-input
  • mcp__centralstationcrm__centralstationcrm_get_deal private-data, untrusted-input
  • mcp__centralstationcrm__centralstationcrm_get_deal_stats untrusted-input
  • mcp__centralstationcrm__centralstationcrm_list_deal_types untrusted-input
  • mcp__centralstationcrm__centralstationcrm_list_projects untrusted-input
  • mcp__centralstationcrm__centralstationcrm_search_projects untrusted-input
  • mcp__centralstationcrm__centralstationcrm_get_project private-data, untrusted-input
  • mcp__centralstationcrm__centralstationcrm_list_tasks private-data, untrusted-input
  • mcp__centralstationcrm__centralstationcrm_get_task untrusted-input
  • mcp__centralstationcrm__centralstationcrm_list_notes private-data, untrusted-input
  • mcp__centralstationcrm__centralstationcrm_get_note private-data, untrusted-input
  • mcp__centralstationcrm__centralstationcrm_list_calendar_events private-data, untrusted-input
  • mcp__centralstationcrm__centralstationcrm_search_all untrusted-input
  • mcp__centralstationcrm__centralstationcrm_list_tags untrusted-input
  • mcp__centralstationcrm__centralstationcrm_count_records untrusted-input
  • mcp__centralstationcrm__centralstationcrm_create_person untrusted-input, outbound
  • mcp__centralstationcrm__centralstationcrm_update_person untrusted-input
  • mcp__centralstationcrm__centralstationcrm_create_company untrusted-input
  • mcp__centralstationcrm__centralstationcrm_update_company untrusted-input
  • mcp__centralstationcrm__centralstationcrm_create_deal untrusted-input
  • mcp__centralstationcrm__centralstationcrm_update_deal untrusted-input
  • mcp__centralstationcrm__centralstationcrm_create_task untrusted-input
  • mcp__centralstationcrm__centralstationcrm_update_task untrusted-input
  • mcp__centralstationcrm__centralstationcrm_create_note untrusted-input

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/io.usefulapi/centralstationcrm/verify?hash=8390e3adcf4161fa8969a814ed69553c133174a3cf8db93c0e88fe36c16e7b45" | jq -e '.changed == false'

Pinned hash 8390e3adcf41, from Oct 24, 2026, 16:19 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/io.usefulapi/centralstationcrm/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for io.usefulapi/centralstationcrm
[![anlyon.dev](https://anlyon.dev/badge/io.usefulapi/centralstationcrm.svg)](https://anlyon.dev/servers/io.usefulapi/centralstationcrm)

Source: MCP Registry · repository. Synced Oct 24, 2026, 16:18 UTC.