Skip to content

Knack MCP by usefulapi

by usefulapi.io · remote · no sign-in to list tools · v1.16.3 · published by io.usefulapi

Read, create, update and delete records; inspect objects, fields and schema in your Knack database.

Deletes · 3Changes · 1
CompareRegistry entry

9 tools: 3 can delete or cancel things, 1 change things and 5 only read.

Scanned Oct 21, 2026

1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http knack https://knack.usefulapi.io/mcp

Findings

Matches of fixed checks, with the text they matched.

1 warn
  • Warnknack_request

    The server marks "knack_request" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true}; The name "knack_request" says "request": a word for a change.

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

9 tools

Deletes or cancels 3Claude Code: deny
  • knack_create_recordMUTATES Knack data — creates a new record in an object.No findings

    Why it is in this group

    • The name "knack_create_record" says "create": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    MUTATES Knack data — creates a new record in an object. Knack API: POST /objects/{object_key}/records. Provide `fields` as an object keyed by field key, e.g. { "field_1": "Acme", "field_2": 100 }. Auto Increment / Formula / Equation fields are read-only and cannot be set. Returns the created record.

    Annotations the server declares

    • title: Create a record
    • destructiveHint: true
  • knack_delete_recordMUTATES Knack data — permanently DELETES a record (irreversible).No findings

    Why it is in this group

    • The name "knack_delete_record" says "delete": a word for removing or ending something.
    • The description says "permanently DELETES".
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    MUTATES Knack data — permanently DELETES a record (irreversible). Knack API: DELETE /objects/{object_key}/records/{record_id}. Knack returns { delete: true } on success.

    Annotations the server declares

    • title: Delete a record
    • destructiveHint: true
  • knack_update_recordMUTATES Knack data — updates a record.No findings

    Why it is in this group

    • The name "knack_update_record" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    MUTATES Knack data — updates a record. Knack API: PUT /objects/{object_key}/records/{record_id}. Provide `fields` as an object keyed by field key; only the included fields change, e.g. { "field_1": "Acme Inc" }. Auto Increment / Formula / Equation fields are read-only. Returns the updated record.

    Annotations the server declares

    • title: Update a record
    • destructiveHint: true
Changes things 1Claude Code: ask
  • knack_requestPower-user escape hatch: GET any Knack API path not wrapped by a dedicated tool (e.g.1 finding

    Why it is in this group

    • The name "knack_request" says "request": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "knack_request" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true}; The name "knack_request" says "request": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Power-user escape hatch: GET any Knack API path not wrapped by a dedicated tool (e.g. view-based reads). READ-ONLY — only GET is allowed. Path starts with a slash (e.g. "/objects/object_1/records"). Knack API: GET {path}.

    Annotations the server declares

    • title: Raw Knack API GET
    • readOnlyHint: true
Only reads 5Claude Code: allow
  • knack_get_applicationFetch a Knack application's full schema/metadata — its objects (tables), fields, and scenes.No findings

    Why it is in this group

    • The name "knack_get_application" says "get": a word for reading.
    Description, as the server wrote it
    Fetch a Knack application's full schema/metadata — its objects (tables), fields, and scenes. Knack API: GET /applications/{app_id}. Returns the raw JSON as-is. app_id defaults to the configured KNACK_APPLICATION_ID.

    Annotations the server declares

    • title: Get application schema
    • readOnlyHint: true
  • knack_get_recordFetch a single record by id.No findings

    Why it is in this group

    • The name "knack_get_record" says "get": a word for reading.
    Description, as the server wrote it
    Fetch a single record by id. Knack API: GET /objects/{object_key}/records/{record_id}. Returns the bare record (with both field_x and field_x_raw values).

    Annotations the server declares

    • title: Get a record
    • readOnlyHint: true
  • knack_list_fieldsList the fields of ONE object as [{ key, name, type, required }].No findings

    Why it is in this group

    • The name "knack_list_fields" says "list": a word for reading.
    Description, as the server wrote it
    List the fields of ONE object as [{ key, name, type, required }]. Fetches GET /applications/{app_id} and returns the fields of the object whose key === objectKey (e.g. "object_1"). app_id defaults to the configured KNACK_APPLICATION_ID.

    Annotations the server declares

    • title: List fields for an object
    • readOnlyHint: true
  • knack_list_objectsList an application's objects (tables) as a compact array [{ key, name, fieldCount }].No findings

    Why it is in this group

    • The name "knack_list_objects" says "list": a word for reading.
    Description, as the server wrote it
    List an application's objects (tables) as a compact array [{ key, name, fieldCount }]. Convenience over GET /applications/{app_id}. app_id defaults to the configured KNACK_APPLICATION_ID.

    Annotations the server declares

    • title: List objects (tables)
    • readOnlyHint: true
  • knack_list_recordsList an object's records.No findings

    Why it is in this group

    • The name "knack_list_records" says "list": a word for reading.
    Description, as the server wrote it
    List an object's records. Knack API: GET /objects/{object_key}/records. Returns the paged envelope { total_pages, current_page, total_records, records: [...] } as-is. Records carry both field_x (formatted) and field_x_raw (structured) values. Page with page / rows_per_page (max 1000), sort with sort_field / sort_order, and filter with the `filters` object.

    Annotations the server declares

    • title: List records
    • readOnlyHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.16.3. Values in angle brackets are yours to fill in.

claude mcp add --transport http knack https://knack.usefulapi.io/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__knack__knack_get_application",
      "mcp__knack__knack_list_objects",
      "mcp__knack__knack_list_fields",
      "mcp__knack__knack_list_records",
      "mcp__knack__knack_get_record"
    ],
    "ask": [
      "mcp__knack__knack_request"
    ],
    "deny": [
      "mcp__knack__knack_create_record",
      "mcp__knack__knack_update_record",
      "mcp__knack__knack_delete_record"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as knack. Review it before you use it.