{ "last_checked": "2026-11-06", "about": "Official endpoints, known third-party and community servers, retired and legacy servers, vendor namespaces, regions and config-level read-only checks for the marketing stack. scripts/mcp_inventory.py reads it for scanner rules S01, S02, S06, S07, S11 and S13. Each vendor records when and where it was checked; re-check any entry older than 30 days against the vendor's MCP page before relying on it, and add vendors you connect that are missing.", "read_only_check_types": { "url_query": "the URL query must carry key=value", "url_query_not": "the URL query must not carry key=value", "url_query_or_header": "the URL query key or the named header must be present, and equal one of values when values are listed; the header wins", "env": "the server's env must set key=value", "env_set": "the server's env must set key to any value; the file it names is not opened", "env_off": "the server's env must not turn key on; unset, empty, 0, false, no and off all pass", "arg_absent": "the args must not contain value", "path_contains": "the URL path must contain value; any of fail_if_contains makes it a FAIL", "enforces": "true when passing the check makes the connection read-only; defaults to true for FAIL checks and false for WARN checks, which are advisory" }, "vendor_scopes_note": "vendor_scopes lists npm scopes and GitHub organisations the vendor owns. A package there that no rule matches is reported as a vendor package missing from the registry (WARN), not as a lookalike.", "wrappers": [ { "match_package": "mcp-remote", "note": "third-party proxy that bridges a remote server to stdio; prefer the client's native url entry, and pin a reviewed version if the proxy stays", "affected_from": "0.0.5", "fixed": "0.1.16", "advisory": "GHSA-6xpm-ggf7-wc3p, CVE-2025-6514 (OS command injection from a malicious server's authorization endpoint)" } ], "vendors": [ { "id": "hubspot", "name": "HubSpot", "category": "crm", "keywords": ["hubspot"], "vendor_scopes": ["@hubspot/", "github.com/hubspot/"], "official": [ {"kind": "remote", "match_host": "mcp.hubspot.com", "url": "https://mcp.hubspot.com", "write_capable": true}, { "kind": "local", "match_package": "@hubspot/mcp-server", "write_capable": true, "status": "beta", "note": "HubSpot's beta local server, which runs on a private app access token", "read_only_layer": "a private app with read scopes only, plus client blocks on its write tools" }, { "kind": "local", "match_package": "@hubspot/cli", "write_capable": true, "purpose": "developer", "note": "HubSpot's developer MCP server for app and CMS work, not a route to CRM data; keep it out of profiles that hold marketing servers" } ], "deprecated": [ { "match_package": "@hubspot/mcp-server", "severity": "WARN", "status": "a legacy beta with no release since 2025-06-18", "replacement": "the remote server https://mcp.hubspot.com with OAuth (the beta local server uses a private app token)" } ], "identity_tool": "get_user_details, then get_organization_details", "read_only_layer": "a View-only user with Create off, plus a client allowlist of the read tools (where the client has none, block every manage_* tool and submit_feedback)", "checked": "2026-11-01 (npm registry for @hubspot/mcp-server 0.4.0)", "source": "https://developers.hubspot.com/docs/apps/developer-platform/build-apps/integrate-with-the-remote-hubspot-mcp-server" }, { "id": "salesforce", "name": "Salesforce", "category": "crm", "keywords": ["salesforce", "sfdc"], "vendor_scopes": ["@salesforce/", "github.com/salesforcecli/", "github.com/forcedotcom/"], "official": [ { "kind": "remote", "match_host": "api.salesforce.com", "match_path_contains": "/platform/mcp/", "url": "https://api.salesforce.com/platform/mcp/v1/platform/sobject-reads", "write_capable": true, "read_only_checks": [ { "type": "path_contains", "value": "sobject-reads", "fail_if_contains": ["sobject-deletes", "sobject-all", "sobject-mutations"], "severity": "WARN", "why": "only the sobject-reads server has no create, update or delete tools", "enforces": true } ] } ], "deprecated": [ { "match_host": "api.salesforce.com", "match_path_contains": "v1-beta", "replacement": "the GA endpoint under /platform/mcp/v1/, reauthorised (beta tokens do not work with GA)" }, { "match_package": "@salesforce/mcp", "eol": "2026-11-02", "replacement": "the hosted sobject-reads server for CRM data, or forcedotcom/sf-skills for developer work" } ], "identity_tool": "ask for the authenticated user and org, then compare with Setup", "read_only_layer": "the sobject-reads endpoint, signed in as the pilot user", "checked": "2026-10-27 (article research; Salesforce pages block automated fetches, confirm in a browser)", "source": "https://developer.salesforce.com/docs/platform/hosted-mcp-servers/references/reference/servers-reference.html" }, { "id": "ga4", "name": "Google Analytics 4", "category": "analytics", "keywords": ["google-analytics", "ga4"], "vendor_scopes": ["github.com/googleanalytics/"], "official": [ { "kind": "local", "match_package": "analytics-mcp", "write_capable": false, "read_only_checks": [ { "type": "arg_absent", "value": "--allow-write", "severity": "FAIL", "why": "the flag enables create_property_annotation, create_custom_dimension and create_key_event, and needs the analytics.edit scope" }, { "type": "env_off", "key": "ANALYTICS_MCP_ALLOW_WRITE", "severity": "FAIL", "why": "the variable does what --allow-write does" } ] }, { "kind": "local", "match_package": "github.com/googleanalytics/google-analytics-mcp", "write_capable": false, "read_only_checks": [ { "type": "arg_absent", "value": "--allow-write", "severity": "FAIL", "why": "the flag enables create_property_annotation, create_custom_dimension and create_key_event, and needs the analytics.edit scope" }, { "type": "env_off", "key": "ANALYTICS_MCP_ALLOW_WRITE", "severity": "FAIL", "why": "the variable does what --allow-write does" } ] } ], "identity_tool": "get_account_summaries", "read_only_layer": "Google's server started without --allow-write or ANALYTICS_MCP_ALLOW_WRITE, with a credential minted for analytics.readonly", "note": "mint the credential with analytics.readonly, never analytics.edit.", "checked": "2026-11-06", "source": "https://github.com/googleanalytics/google-analytics-mcp" }, { "id": "google_ads", "name": "Google Ads", "category": "ads", "keywords": ["google-ads", "googleads", "adwords"], "vendor_scopes": ["github.com/googleads/"], "official": [ { "kind": "local", "match_package": "google-ads-mcp", "write_capable": true, "read_only_checks": [ { "type": "env_set", "key": "GOOGLE_ADS_MCP_TOOLS_CONFIG", "severity": "FAIL", "unverified": " (the scanner does not open the file: confirm labels: false and assets: false, and compare T2 with the three read tools)", "why": "the bundled tools config turns on create_asset, upload_video_asset, manage_labels and manage_label_associations. Point this variable at a file with labels: false and assets: false" } ] }, { "kind": "local", "match_package": "github.com/googleads/google-ads-mcp", "write_capable": true, "read_only_checks": [ { "type": "env_set", "key": "GOOGLE_ADS_MCP_TOOLS_CONFIG", "severity": "FAIL", "unverified": " (the scanner does not open the file: confirm labels: false and assets: false, and compare T2 with the three read tools)", "why": "the bundled tools config turns on create_asset, upload_video_asset, manage_labels and manage_label_associations. Point this variable at a file with labels: false and assets: false" } ] } ], "identity_tool": "customers_list_accessible_customers", "read_only_layer": "a tools config with labels: false and assets: false, named by GOOGLE_ADS_MCP_TOOLS_CONFIG; its adwords credential can still write elsewhere", "note": "its adwords credential can write through other clients and scripts, so record it as write-capable.", "checked": "2026-11-06", "source": "https://github.com/googleads/google-ads-mcp" }, { "id": "meta_ads", "name": "Meta Ads", "category": "ads", "keywords": ["meta-ads", "facebook-ads", "fb-ads", "metaads"], "official": [ { "kind": "remote", "match_host": "mcp.facebook.com", "match_path_contains": "/ads", "url": "https://mcp.facebook.com/ads", "write_capable": true } ], "identity_tool": "check the live tool list for the account tools, then confirm the act_ ID, currency and time zone in Ads Manager", "read_only_layer": "a grant of ads_mcp_management plus ads_read and never ads_management (system users must have the Employee role)", "checked": "2026-11-01", "source": "https://developers.facebook.com/documentation/ads-commerce/ads-ai-connectors/ads-mcp-server/ads-mcp-server-get-started" }, { "id": "gtm", "name": "Google Tag Manager", "category": "tagging", "keywords": ["tagmanager", "tag-manager", "gtm"], "official": [], "third_party_known": [ { "match_host": "gtm-mcp.stape.io", "publisher": "Stape", "note": "the hosted endpoint requests all seven Tag Manager scopes, so use an identity with Read permission only, or the container export" }, { "match_package": "google-tag-manager-mcp-server", "publisher": "Stape", "note": "local CLI; narrow it with a Read-permission identity and GTM_SCOPES set to the tagmanager.readonly scope", "read_only_checks": [ { "type": "env", "key": "GTM_SCOPES", "value": "https://www.googleapis.com/auth/tagmanager.readonly", "severity": "WARN", "why": "GTM_SCOPES narrows service-account credentials to read; a refresh token keeps the scopes it was minted with", "enforces": true } ] } ], "community_known": [ {"match_package": "a1-x-tech/mcp-google-tagmanager", "note": "review before use"} ], "deprecated": [ { "match_package": "jinchliu/tagmanager-mcp", "publisher": "community", "replacement": "Stape's local CLI with tagmanager.readonly, or the container export (archived September 2026)" } ], "identity_tool": "gtm_auth_status", "read_only_layer": "the container export, or Read permission with tagmanager.readonly (hand off to gtm-container-audit)", "checked": "2026-11-01", "source": "https://github.com/stape-io/google-tag-manager-mcp-server" }, { "id": "mixpanel", "name": "Mixpanel", "category": "analytics", "keywords": ["mixpanel"], "vendor_scopes": ["@mixpanel/", "github.com/mixpanel/"], "official": [ {"kind": "remote", "match_host": "mcp.mixpanel.com", "url": "https://mcp.mixpanel.com/mcp", "region": "us", "write_capable": true}, {"kind": "remote", "match_host": "mcp-eu.mixpanel.com", "url": "https://mcp-eu.mixpanel.com/mcp", "region": "eu", "write_capable": true}, {"kind": "remote", "match_host": "mcp-in.mixpanel.com", "url": "https://mcp-in.mixpanel.com/mcp", "region": "in", "write_capable": true} ], "identity_tool": "Get-Projects or List-Organizations", "read_only_layer": "a project role without write access plus client blocks (Mixpanel has no read-only switch)", "checked": "2026-11-01", "source": "https://docs.mixpanel.com/docs/mcp" }, { "id": "amplitude", "name": "Amplitude", "category": "analytics", "keywords": ["amplitude"], "vendor_scopes": ["@amplitude/", "github.com/amplitude/"], "official": [ { "kind": "remote", "match_host": "mcp.amplitude.com", "url": "https://mcp.amplitude.com/mcp", "region": "us", "write_capable": true, "read_only_checks": [ { "type": "url_query_not", "key": "discovery", "value": "progressive", "severity": "WARN", "why": "progressive discovery lists discovery tools instead of the tools themselves, so T2 and client blocks cannot see them" } ] }, { "kind": "remote", "match_host": "mcp.eu.amplitude.com", "url": "https://mcp.eu.amplitude.com/mcp", "region": "eu", "write_capable": true, "read_only_checks": [ { "type": "url_query_not", "key": "discovery", "value": "progressive", "severity": "WARN", "why": "progressive discovery lists discovery tools instead of the tools themselves, so T2 and client blocks cannot see them" } ] } ], "identity_tool": "get_amplitude_context", "read_only_layer": "Viewer on the project, or on Enterprise a custom role with Use MCP (read) only, plus a client allowlist of the read tools (where the client has none, block use_amp*, share_amp_entities, manage_* and run_amp)", "checked": "2026-11-06", "source": "https://amplitude.com/docs/amplitude-ai/amplitude-mcp" }, { "id": "posthog", "name": "PostHog", "category": "analytics", "keywords": ["posthog"], "vendor_scopes": ["@posthog/", "github.com/posthog/"], "official": [ { "kind": "remote", "match_host": "mcp.posthog.com", "url": "https://mcp.posthog.com/mcp", "region": "auto", "write_capable": true, "read_only_checks": [ { "type": "url_query_or_header", "key": "readonly", "header": "x-posthog-read-only", "values": ["true", "1"], "severity": "FAIL", "why": "without it the create, update and delete tools stay listed" }, { "type": "url_query_or_header", "key": "project_id", "header": "x-posthog-project-id", "severity": "WARN", "why": "without it the server can switch projects; pin the project from stack.md" }, { "type": "url_query_or_header", "key": "mode", "header": "x-posthog-mcp-mode", "values": ["tools"], "severity": "WARN", "why": "Claude clients and Codex default to CLI mode, which lists one exec tool, so T2 and client blocks cannot see the individual tools (Cursor defaults to tools mode)" } ] } ], "identity_tool": "one known insight from the pinned project (switch-project and switch-organization tools are absent in tools mode)", "read_only_layer": "readonly=true, project_id and mode=tools on the URL or as headers", "checked": "2026-11-01", "source": "https://posthog.com/docs/model-context-protocol/faq" }, { "id": "braze", "name": "Braze", "category": "lifecycle", "keywords": ["braze"], "vendor_scopes": ["@braze/", "github.com/braze-inc/"], "official": [ {"kind": "remote", "match_host": "mcp.braze.com", "url": "https://mcp.braze.com/mcp", "region": "us", "write_capable": true}, {"kind": "remote", "match_host": "mcp.braze.eu", "url": "https://mcp.braze.eu/mcp", "region": "eu", "write_capable": true} ], "deprecated": [ {"match_package": "braze-mcp-server", "replacement": "the remote server with OAuth (the local beta server gets no updates)"} ], "identity_tool": "get_workspaces", "read_only_layer": "a dashboard user without edit rights plus the Use MCP Server permission (Braze has no read-only toggle)", "checked": "2026-11-01", "source": "https://www.braze.com/docs/user_guide/brazeai/mcp_server/setup" }, { "id": "klaviyo", "name": "Klaviyo", "category": "lifecycle", "keywords": ["klaviyo"], "vendor_scopes": ["github.com/klaviyo/"], "official": [ { "kind": "remote", "match_host": "mcp.klaviyo.com", "url": "https://mcp.klaviyo.com/mcp", "write_capable": true, "read_only_checks": [ { "type": "url_query", "key": "read-only", "value": "true", "severity": "FAIL", "why": "without it the write tools (send, suppress, merge, delete) stay listed; listed directory connectors ignore URL parameters, so use a custom connector" }, { "type": "url_query", "key": "disable-tools-with-user-generated-content", "value": "true", "severity": "WARN", "why": "tools that read customer-written content (events, profiles, reviews) stay listed" } ] }, { "kind": "local", "match_package": "klaviyo-mcp-server", "write_capable": true, "read_only_checks": [ { "type": "env", "key": "READ_ONLY", "value": "true", "severity": "FAIL", "why": "without it the local server lists its write tools; pair it with a read-scoped private key" }, { "type": "env", "key": "ALLOW_USER_GENERATED_CONTENT", "value": "false", "severity": "WARN", "why": "tools that read customer-written content stay listed" } ] } ], "identity_tool": "get_account_details", "read_only_layer": "a custom connector with read-only=true, or the local server with a read-scoped key and READ_ONLY=true", "checked": "2026-11-01", "source": "https://developers.klaviyo.com/en/docs/connect_to_the_klaviyo_mcp_server" }, { "id": "intercom", "name": "Intercom", "category": "lifecycle", "keywords": ["intercom"], "vendor_scopes": ["@intercom/", "github.com/intercom/"], "official": [ {"kind": "remote", "match_host": "mcp.intercom.com", "url": "https://mcp.intercom.com/mcp", "region": "us", "write_capable": true}, {"kind": "remote", "match_host": "mcp.eu.intercom.com", "url": "https://mcp.eu.intercom.com/mcp", "region": "eu", "write_capable": true} ], "deprecated": [ {"match_path_contains": "/sse", "replacement": "the /mcp Streamable HTTP endpoint"} ], "identity_tool": "a call with no customer content where one exists, such as list_articles with per_page 1; otherwise search with limit 1, then fetch and use only the app link", "read_only_layer": "client blocks on add_internal_note, create_article, update_article and the Fin Operator tools (Intercom has no read-only mode)", "checked": "2026-11-01", "source": "https://developers.intercom.com/docs/guides/mcp" }, { "id": "customerio", "name": "Customer.io", "category": "lifecycle", "keywords": ["customer.io", "customerio", "customer-io"], "vendor_scopes": ["@customerio/", "github.com/customerio/"], "official": [ {"kind": "remote", "match_host": "mcp.customer.io", "url": "https://mcp.customer.io/mcp", "region": "auto", "write_capable": true}, {"kind": "remote", "match_host": "mcp-eu.customer.io", "url": "https://mcp-eu.customer.io/mcp", "region": "eu", "write_capable": true} ], "identity_tool": "cio_auth_status", "read_only_layer": "only the default read scope approved at consent, with the admin toggles for live data and sensitive data off", "checked": "2026-11-01", "source": "https://docs.customer.io/ai/mcp/get-started/" }, { "id": "search_console", "name": "Google Search Console", "category": "seo", "keywords": ["search-console", "searchconsole", "google-search-console", "gsc"], "official": [], "community_known": [ { "match_package": "open-gsc-mcp", "note": "unofficial, MIT; log in with --read-only", "read_only_checks": [ { "type": "env", "key": "GSC_ENABLE_WRITES", "value": "0", "severity": "FAIL", "why": "the server defaults to 1, which lists submit_sitemap, delete_sitemap, add_site and delete_site; also log in with --read-only and revoke any older full-scope grant" } ] } ], "identity_tool": "list_sites", "read_only_layer": "the bulk export to BigQuery; a community server only with a --read-only login and GSC_ENABLE_WRITES=0", "checked": "2026-11-01", "source": "https://github.com/onlymoein/google-search-console-mcp" }, { "id": "bigquery", "name": "BigQuery", "category": "warehouse", "keywords": ["bigquery"], "official": [ { "kind": "remote", "match_host": "bigquery.googleapis.com", "match_path_contains": "/mcp", "url": "https://bigquery.googleapis.com/mcp", "write_capable": true } ], "identity_tool": "list_dataset_ids", "read_only_layer": "an IAM deny policy on tools not marked read-only and Data Viewer on approved datasets only", "checked": "2026-11-01", "source": "https://docs.cloud.google.com/bigquery/docs/use-bigquery-mcp" }, { "id": "snowflake", "name": "Snowflake", "category": "warehouse", "keywords": ["snowflake"], "vendor_scopes": ["github.com/snowflakedb/"], "official": [ { "kind": "remote", "match_host": "*.snowflakecomputing.com", "match_path_contains": "/mcp-servers/", "url": "https:///api/v2/databases/{database}/schemas/{schema}/mcp-servers/{name}", "write_capable": true } ], "deprecated": [ {"match_package": "snowflake-labs-mcp", "replacement": "the Snowflake-managed MCP server"}, {"match_package": "snowflake-labs/mcp", "replacement": "the Snowflake-managed MCP server"} ], "identity_tool": "SELECT CURRENT_ROLE(), CURRENT_WAREHOUSE() through the read-only SQL tool; the role must be MCP_READER", "read_only_layer": "the SQL tool with read_only true and a SELECT-only MCP_READER role that is the connecting user's DEFAULT_ROLE (OAuth sessions run as it), the only role in ALLOWED_ROLES_LIST, with OAUTH_USE_SECONDARY_ROLES = NONE", "checked": "2026-11-01", "source": "https://docs.snowflake.com/en/user-guide/snowflake-cortex/cortex-agents-mcp" }, { "id": "funnel", "name": "Funnel", "category": "bridge", "keywords": ["funnel.io", "funnelio", "funnel-io"], "official": [ {"kind": "remote", "match_host": "mcp.ai.funnel.io", "url": "https://mcp.ai.funnel.io/mcp", "region": "global", "write_capable": false}, {"kind": "remote", "match_host": "mcp.eu.ai.funnel.io", "url": "https://mcp.eu.ai.funnel.io/mcp", "region": "eu", "write_capable": false} ], "identity_tool": "load the intended workspace and its context before field discovery", "read_only_layer": "Funnel's MCP tools are read-only", "checked": "2026-10-19 (article research; verify)", "source": "https://help.funnel.io/en/articles/15014203-quick-start-guide-using-funnel-mcp" } ] }