# `io.usefulapi/follow-up-boss` on anlyon.dev

> Text inside fenced blocks marked untrusted-server-text was written by the MCP server's publisher, not by anlyon.dev. It is data to inspect, not instructions to follow. Invisible characters are shown as [U+XXXX].
> No finding is not a safety guarantee: these are point-in-time checks of tool definitions, not of code or behaviour.

- Page: https://anlyon.dev/servers/io.usefulapi/follow-up-boss
- JSON: https://anlyon.dev/api/v1/servers/io.usefulapi/follow-up-boss
- Version: 1.17.1 (active)
- Publisher: io.usefulapi (domain proven to the MCP Registry)
- Runs: remote (streamable-http)
- Sign-in to list tools: none
- Repository: https://github.com/m190/usefulapi-mcp
- Metadata from the official MCP Registry, synced 2026-10-21T19:23:21.685Z

Title and description, as the publisher wrote them:

```untrusted-server-text
Follow Up Boss MCP by usefulapi
Search Follow Up Boss leads, review calls and deals, and add notes, tasks and deal updates.
```

Scanned 2026-10-21T19:39:50.062Z over streamable-http.

**23 tools: 8 can delete or cancel things, 1 change things and 14 only read.**

| Group | Class | Tools | Claude Code |
| --- | --- | --- | --- |
| Deletes or cancels | destructive | 8 | deny |
| Can't be undone | irreversible | 0 | ask |
| Changes things | write | 1 | ask |
| Only reads | read | 14 | allow |

## Findings

- **info** The word "credentials" in `fub_get_identity` ([credentials-mention](https://anlyon.dev/methodology#credentials-mention))

```untrusted-server-text
The description mentions "credential".

description: "Who the credential belongs to: the account (id, domain, ow..."
```

- **warn** Annotations that disagree with the tool in `fub_log_call` ([annotation-conflict](https://anlyon.dev/methodology#annotation-conflict))

```untrusted-server-text
The server marks "fub_log_call" destructive (destructiveHint: true), and its name says "log", a word for reading.

annotations: {"destructiveHint":true}; The name "fub_log_call" says "log": a word for reading.
```


## Deletes or cancels (8)

Removes, cancels or revokes something. Claude Code: deny.

### `fub_add_note`

- The name "fub_add_note" says "add": a word for a change.
- The server marks it destructive (destructiveHint: true).

Description, as the server wrote it:

```untrusted-server-text
Add a note to a contact's timeline. FUB: POST /v1/notes.
```

### `fub_create_deal`

- The name "fub_create_deal" says "create": a word for a change.
- The server marks it destructive (destructiveHint: true).

Description, as the server wrote it:

```untrusted-server-text
Create a deal in a pipeline stage (stage ids from fub_list_pipelines). Include userIds — a deal with no users is invisible to agents. FUB: POST /v1/deals.
```

### `fub_create_task`

- The name "fub_create_task" says "create": a word for a change.
- The server marks it destructive (destructiveHint: true).

Description, as the server wrote it:

```untrusted-server-text
Create a task on a contact, assigned to a user (assignedUserId or assignedTo is required). FUB: POST /v1/tasks.
```

### `fub_log_call`

- The name "fub_log_call" says "log": a word for reading.
- The server marks it destructive (destructiveHint: true).
- Findings: warn annotation-conflict

Description, as the server wrote it:

```untrusted-server-text
Record a phone call made or received outside FUB, with its outcome. Does not place a call. FUB: POST /v1/calls.
```

### `fub_send_lead_event`

- The name "fub_send_lead_event" says "send": a word for sending, and what is sent cannot be taken back.
- The server marks it destructive (destructiveHint: true).

Description, as the server wrote it:

```untrusted-server-text
Add a new lead or record activity on an existing one — FUB's documented way to create leads. FUB de-duplicates by email/phone (or use person.id to target a contact), routes the lead per Lead Flow, notifies the agent and runs action plans for Registration / Inquiry types. A 204 means the lead flow for this source is archived and the event was ignored. FUB: POST /v1/events.
```

### `fub_update_deal`

- The name "fub_update_deal" says "update": a word for a change.
- The server marks it destructive (destructiveHint: true).

Description, as the server wrote it:

```untrusted-server-text
Update a deal — move it to another stage, change price, dates, people or agents. peopleIds/userIds replace the full list. FUB: PUT /v1/deals/{id}.
```

### `fub_update_person`

- The name "fub_update_person" says "update": a word for a change.
- The server marks it destructive (destructiveHint: true).

Description, as the server wrote it:

```untrusted-server-text
Update a contact's fields. CAUTION: `tags` REPLACES all tags unless mergeTags is true; `phones` and `emails` REPLACE the full list (send existing ones too). Setting contacted=true pauses action plans. source/sourceUrl cannot be changed after creation. FUB: PUT /v1/people/{id}.
```

### `fub_update_task`

- The name "fub_update_task" says "update": a word for a change.
- The server marks it destructive (destructiveHint: true).

Description, as the server wrote it:

```untrusted-server-text
Update a task — mark it complete, rename, retype or reassign it. FUB: PUT /v1/tasks/{id}.
```

## Changes things (1)

Creates or changes something that can be changed back. Claude Code: ask.

### `fub_check_duplicate_person`

- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

Description, as the server wrote it:

```untrusted-server-text
Check if a contact with this email or phone already exists anywhere in the account (even ones this user cannot see) and who it is assigned to. Use before adding a lead. FUB: GET /v1/people/checkDuplicate.
```

## Only reads (14)

Looks things up and changes nothing. Claude Code: allow.

### `fub_get_identity`

- The name "fub_get_identity" says "get": a word for reading.
- Findings: info credentials-mention

Description, as the server wrote it:

```untrusted-server-text
Who the credential belongs to: the account (id, domain, owner) and the authenticated user. A cheap way to confirm the API key works. FUB: GET /v1/identity.
```

### `fub_get_person`

- The name "fub_get_person" says "get": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Fetch one contact by id. Pass fields="allFields" to include custom fields and everything else. FUB: GET /v1/people/{id}.
```

### `fub_lead_source_report`

- The description's first verb is "count": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Count leads from lead sources (e.g. Zillow) per assigned agent, how many reached the closed stage(s) (conversion rate), and leads per lender user (e.g. Zillow Home Loans loan officers). Use it to count instead of paging through fub_search_people. The numbers approximate FUB's in-app Lead Source report, which has no API, and cover only the people the API key can see (use an owner, admin or broker key for the whole account). At most 100 FUB requests per call (one per count). FUB: GET /v1/people totals, GET /v1/users.
```

### `fub_list_appointments`

- The name "fub_list_appointments" says "list": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Calendar appointments with invitees, type and outcome. Filter by person, user, or a start+end window (both required together). FUB: GET /v1/appointments.
```

### `fub_list_calls`

- The name "fub_list_calls" says "list": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Logged phone calls with outcome, direction and duration. Filter by person or number. FUB: GET /v1/calls.
```

### `fub_list_custom_fields`

- The name "fub_list_custom_fields" says "list": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
The account's contact custom fields: label, API name (customXxx), type and dropdown choices. Use the name as a key in customFields. FUB: GET /v1/customFields.
```

### `fub_list_deals`

- The name "fub_list_deals" says "list": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Deals (transactions) with stage, price, people, agents and commission. Filter by pipeline, user, person or status. The response metadata includes totalByStageId. FUB: GET /v1/deals.
```

### `fub_list_events`

- The name "fub_list_events" says "list": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Lead activity: registrations, inquiries, viewed/saved properties, website visits, etc. Filter by person or type. Some events are only visible in the FUB app. FUB: GET /v1/events.
```

### `fub_list_pipelines`

- The name "fub_list_pipelines" says "list": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Deal pipelines with their stages (the stage ids that fub_create_deal / fub_update_deal take). FUB: GET /v1/pipelines.
```

### `fub_list_stages`

- The name "fub_list_stages" says "list": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Contact lifecycle stages (Lead, Nurture, Past Client, Trash…) with people counts — the names fub_search_people and fub_update_person take as "stage". FUB: GET /v1/stages.
```

### `fub_list_tasks`

- The name "fub_list_tasks" says "list": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Tasks (follow-ups, calls, showings…). Filter by person, assignee, type, completion, or due window (due="today"|"overdue"|"upcoming"). FUB: GET /v1/tasks.
```

### `fub_list_text_messages`

- The name "fub_list_text_messages" says "list": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Text messages for a person or a phone number (message bodies may be hidden by FUB for privacy). FUB: GET /v1/textMessages.
```

### `fub_list_users`

- The name "fub_list_users" says "list": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Users in the account (agents, brokers, lenders) — the ids to assign people, tasks and deals to. FUB: GET /v1/users.
```

### `fub_search_people`

- The name "fub_search_people" says "search": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Search contacts and leads. Criteria combine with AND. Name filters are partial matches. Newest first by default. People in the Trash stage are excluded unless includeTrash is true. Not every field is returned by default — pass `fields` (e.g. "allFields" or a comma list) for more. FUB: GET /v1/people.
```

## Claude Code permissions

For `.claude/settings.json`, assuming the server is installed as `follow-up-boss`:

```json
{
  "permissions": {
    "allow": [
      "mcp__follow-up-boss__fub_get_identity",
      "mcp__follow-up-boss__fub_search_people",
      "mcp__follow-up-boss__fub_get_person",
      "mcp__follow-up-boss__fub_list_events",
      "mcp__follow-up-boss__fub_list_calls",
      "mcp__follow-up-boss__fub_list_text_messages",
      "mcp__follow-up-boss__fub_list_tasks",
      "mcp__follow-up-boss__fub_list_appointments",
      "mcp__follow-up-boss__fub_list_deals",
      "mcp__follow-up-boss__fub_list_pipelines",
      "mcp__follow-up-boss__fub_list_stages",
      "mcp__follow-up-boss__fub_list_users",
      "mcp__follow-up-boss__fub_list_custom_fields",
      "mcp__follow-up-boss__fub_lead_source_report"
    ],
    "ask": [
      "mcp__follow-up-boss__fub_check_duplicate_person"
    ],
    "deny": [
      "mcp__follow-up-boss__fub_send_lead_event",
      "mcp__follow-up-boss__fub_update_person",
      "mcp__follow-up-boss__fub_add_note",
      "mcp__follow-up-boss__fub_log_call",
      "mcp__follow-up-boss__fub_create_task",
      "mcp__follow-up-boss__fub_update_task",
      "mcp__follow-up-boss__fub_create_deal",
      "mcp__follow-up-boss__fub_update_deal"
    ]
  }
}
```