Skip to content
anlyon.devby Anlyon

SuiteDash MCP by usefulapi

io.usefulapi/suitedashusefulapi.iostreamable-httpv1.0.0Scanned

Read and update SuiteDash contacts, companies and projects; create leads and clients.

16 tools: 6 can delete or cancel things and 10 only read.

Tools: 6 delete, 0 irreversible, 0 write, 10 read.
  • Reads private data · 5
  • Reads text others write · 16
  • Can send data out · 0
  • No findings

Anlyon alternative

6 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →
Compare with similar serversMarkdownJSONReport this listing

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

16 tools

Deletes or cancels 6Claude Code: deny
  • suitedash_create_companyWRITE: create a CRM company (name and role are required) with an optional primary contact.Reads text others writeNo findings

    Why it is in this group

    • The name "suitedash_create_company" says "create": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    WRITE: create a CRM company (name and role are required) with an optional primary contact. With create_primary_contact_if_not_exists the primary contact is created from the given names/email when no contact has that email. If send_welcome_email is true SuiteDash EMAILS the primary contact a portal invitation: leave it false unless the user asked. POST /company.

    Annotations the server declares

    • title: Create company
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • suitedash_create_contactWRITE: create a CRM contact in SuiteDash.Reads text others writeNo findings

    Why it is in this group

    • The name "suitedash_create_contact" says "create": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    WRITE: create a CRM contact in SuiteDash. role and names are required; email is required except for a Lead. Optionally link the contact to a company by name (set create_company_if_not_exists to create it). If send_welcome_email is true SuiteDash EMAILS the contact a portal access invitation: leave it false unless the user asked for that. POST /contact.

    Annotations the server declares

    • title: Create contact
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • suitedash_subscribe_to_marketingWRITE: subscribe people (by email) to one or more marketing audiences (numeric audience ids from SuiteDash > Marketing).Reads text others writeNo findings

    Why it is in this group

    • The name "suitedash_subscribe_to_marketing" says "subscribe": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    WRITE: subscribe people (by email) to one or more marketing audiences (numeric audience ids from SuiteDash > Marketing). Unknown emails may be created as marketing contacts. This enrolls real people in email marketing and can start campaigns or automations tied to those audiences: only do it for people who have consented, and only when the user asked. The reply holds the outcome per person. POST /marketing/subscribe.

    Annotations the server declares

    • title: Subscribe contacts to marketing audiences
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
  • suitedash_update_companyWRITE: update fields of an existing CRM company (found by UID or name); only the fields you pass change, and null clears a field.Reads text others writeNo findings

    Why it is in this group

    • The name "suitedash_update_company" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    WRITE: update fields of an existing CRM company (found by UID or name); only the fields you pass change, and null clears a field. Tags and custom fields passed here replace the current values. PUT /company/{identifier}.

    Annotations the server declares

    • title: Update company
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
  • suitedash_update_contactWRITE: update fields of an existing CRM contact (found by UID or email); only the fields you pass change, and null clears a field.Reads text others writeNo findings

    Why it is in this group

    • The name "suitedash_update_contact" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    WRITE: update fields of an existing CRM contact (found by UID or email); only the fields you pass change, and null clears a field. Tags and custom fields passed here replace the current values. If send_welcome_email is true SuiteDash EMAILS the contact a portal invitation (only if none was sent before): leave it unset unless the user asked. PUT /contact/{identifier}.

    Annotations the server declares

    • title: Update contact
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
  • suitedash_update_projectWRITE: update fields of an existing project (found by UID, name, name fragment or most recent); only the fields you pass change.Reads text others writeNo findings

    Why it is in this group

    • The name "suitedash_update_project" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    WRITE: update fields of an existing project (found by UID, name, name fragment or most recent); only the fields you pass change. The status must be one of the account's project statuses (see suitedash_get_project_fields). The description and client text accept HTML. PUT /project/{type}/{identifier}.

    Annotations the server declares

    • title: Update project
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
Only reads 10Show 10 read-only tools
  • suitedash_get_companyOne CRM company by UID or exact name, with primary contact, category, tags, address and custom fields.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "suitedash_get_company" says "get": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "contact": it reads contacts.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    One CRM company by UID or exact name, with primary contact, category, tags, address and custom fields. GET /company/{identifier}.

    Annotations the server declares

    • title: Get company
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • suitedash_get_company_fieldsThe company field schema of this account: every default and custom field (public, private and target custom fields under their UIDs) with type, required flag and the actions allowe…Reads text others writeNo findings

    Why it is in this group

    • The name "suitedash_get_company_fields" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    The company field schema of this account: every default and custom field (public, private and target custom fields under their UIDs) with type, required flag and the actions allowed. GET /company/meta.

    Annotations the server declares

    • title: Get company field schema
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • suitedash_get_contactOne CRM contact by UID or primary email, with companies, tags, address and custom fields.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "suitedash_get_contact" says "get": a word for reading.

    What it can reach

    • private-dataThe name "suitedash_get_contact" says "get" and "contact": it reads contacts.
    • private-dataThe description's first sentence says "contact": it reads contacts.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe description's first sentence says "email": it reads inbound email, which other people can write.
    Description, as the server wrote it
    One CRM contact by UID or primary email, with companies, tags, address and custom fields. GET /contact/{identifier}.

    Annotations the server declares

    • title: Get contact
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • suitedash_get_contact_fieldsThe contact field schema of this account: every default and custom field with its type, whether it is required, and which actions (read/create/update) allow it.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "suitedash_get_contact_fields" says "get": a word for reading.

    What it can reach

    • private-dataThe name "suitedash_get_contact_fields" says "get" and "contact": it reads contacts.
    • private-dataThe description's first sentence says "contact": it reads contacts.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    The contact field schema of this account: every default and custom field with its type, whether it is required, and which actions (read/create/update) allow it. Custom fields appear under their UID: use these UIDs in custom_fields. GET /contact/meta.

    Annotations the server declares

    • title: Get contact field schema
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • suitedash_get_projectOne project with its description, client and secondary clients, teammates, team, leader, economics (estimated value, currency, sector) and custom fields.Reads text others writeNo findings

    Why it is in this group

    • The name "suitedash_get_project" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    One project with its description, client and secondary clients, teammates, team, leader, economics (estimated value, currency, sector) and custom fields. Find it by UID (default), exact name, a name fragment, or the most recent one. GET /project/{type}/{identifier}.

    Annotations the server declares

    • title: Get project
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • suitedash_get_project_fieldsThe project field schema of this account: default and custom fields (under their UIDs) with type, required flag and allowed actions.Reads text others writeNo findings

    Why it is in this group

    • The name "suitedash_get_project_fields" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    The project field schema of this account: default and custom fields (under their UIDs) with type, required flag and allowed actions. GET /project/meta.

    Annotations the server declares

    • title: Get project field schema
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • suitedash_list_companiesList CRM companies 10 per page (idle companies are not available): name, role, category, phones, website, address, tags, primary contact and custom fields.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "suitedash_list_companies" says "list": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "list" and "contact": it reads contacts.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe description's first sentence says "list" and "website": it reads web pages, which anyone can write.
    Description, as the server wrote it
    List CRM companies 10 per page (idle companies are not available): name, role, category, phones, website, address, tags, primary contact and custom fields. Filter by creation time and sort by name or creation date. GET /companies.

    Annotations the server declares

    • title: List companies
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • suitedash_list_contactsList CRM contacts (leads, prospects, clients) 10 per page: name, emails, phones, role, tags, companies, address and custom fields.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "suitedash_list_contacts" says "list": a word for reading.

    What it can reach

    • private-dataThe name "suitedash_list_contacts" says "list" and "contact": it reads contacts.
    • private-dataThe description's first sentence says "list" and "contact": it reads contacts.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe description's first sentence says "list" and "email": it reads inbound email, which other people can write.
    Description, as the server wrote it
    List CRM contacts (leads, prospects, clients) 10 per page: name, emails, phones, role, tags, companies, address and custom fields. Filter by creation time and sort by name or creation date. GET /contacts.

    Annotations the server declares

    • title: List contacts
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • suitedash_list_projectsList projects 10 per page: name, status, start/end dates, due time.Reads text others writeNo findings

    Why it is in this group

    • The name "suitedash_list_projects" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    List projects 10 per page: name, status, start/end dates, due time. Filter by creation time and sort by name, creation, start or end date. Use suitedash_get_project for the client, team and economics. GET /projects.

    Annotations the server declares

    • title: List projects
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • suitedash_list_worldsList the account's Worlds (client groupings), 10 per page.Reads text others writeNo findings

    Why it is in this group

    • The name "suitedash_list_worlds" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    List the account's Worlds (client groupings), 10 per page. Only available with the WORLDS Power-Up; otherwise SuiteDash answers 403. GET /worlds.

    Annotations the server declares

    • title: List worlds
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged outbound.

Reads private data5
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write16
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out0
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

No check matched anything in these tool definitions. That is not a safety guarantee.

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http suitedash https://suitedash.usefulapi.io/mcp
claude mcp add --transport http suitedash https://suitedash.usefulapi.io/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__suitedash__suitedash_list_contacts",
      "mcp__suitedash__suitedash_get_contact",
      "mcp__suitedash__suitedash_get_contact_fields",
      "mcp__suitedash__suitedash_list_companies",
      "mcp__suitedash__suitedash_get_company",
      "mcp__suitedash__suitedash_get_company_fields",
      "mcp__suitedash__suitedash_list_projects",
      "mcp__suitedash__suitedash_get_project",
      "mcp__suitedash__suitedash_get_project_fields",
      "mcp__suitedash__suitedash_list_worlds"
    ],
    "ask": [],
    "deny": [
      "mcp__suitedash__suitedash_create_contact",
      "mcp__suitedash__suitedash_update_contact",
      "mcp__suitedash__suitedash_create_company",
      "mcp__suitedash__suitedash_update_company",
      "mcp__suitedash__suitedash_update_project",
      "mcp__suitedash__suitedash_subscribe_to_marketing"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as suitedash. Review it before you use it.

Capability tags behind 16 rules
  • mcp__suitedash__suitedash_list_contacts private-data, untrusted-input
  • mcp__suitedash__suitedash_get_contact private-data, untrusted-input
  • mcp__suitedash__suitedash_get_contact_fields private-data, untrusted-input
  • mcp__suitedash__suitedash_create_contact untrusted-input
  • mcp__suitedash__suitedash_update_contact untrusted-input
  • mcp__suitedash__suitedash_list_companies private-data, untrusted-input
  • mcp__suitedash__suitedash_get_company private-data, untrusted-input
  • mcp__suitedash__suitedash_get_company_fields untrusted-input
  • mcp__suitedash__suitedash_create_company untrusted-input
  • mcp__suitedash__suitedash_update_company untrusted-input
  • mcp__suitedash__suitedash_list_projects untrusted-input
  • mcp__suitedash__suitedash_get_project untrusted-input
  • mcp__suitedash__suitedash_get_project_fields untrusted-input
  • mcp__suitedash__suitedash_update_project untrusted-input
  • mcp__suitedash__suitedash_subscribe_to_marketing untrusted-input
  • mcp__suitedash__suitedash_list_worlds untrusted-input

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/io.usefulapi/suitedash/verify?hash=fe52067e89b384369234445f6cf700ce91f2db596549888448a964aa291f8e58" | jq -e '.changed == false'

Pinned hash fe52067e89b3, from Oct 24, 2026, 11:18 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/io.usefulapi/suitedash/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for io.usefulapi/suitedash
[![anlyon.dev](https://anlyon.dev/badge/io.usefulapi/suitedash.svg)](https://anlyon.dev/servers/io.usefulapi/suitedash)

Source: MCP Registry · repository. Synced Oct 24, 2026, 11:18 UTC.