Loading…
API-first CRM for AI agents — contacts, companies, deals, and activities.
Do not connect
A critical issue was found. Do not connect this server as-is.
Scanned 8 days ago Due for re-check
A server can change after it's graded. Re-run the automated scan to refresh this report.
This grade is deterministic and reproducible: the same server surface always yields the same grade under a given algorithm version. It is a real automated assessment computed by the MCPGrade engine from what the probe actually observed — not a fabricated or opinion score. It is not a manual human pentest, so it can miss context-specific risks.
Every signal below was measured directly by the automated probe. The grade is derived only from evidence like this — nothing is assumed.
The relm MCP server exposes 41 tools, focused primarily on communication and database capabilities. Its published description reads: "API-first CRM for AI agents — contacts, companies, deals, and activities". It communicates over Streamable HTTP using the 2026-07-28 protocol revision, and does not require authorization to connect. MCPGrade currently rates relm F — a critical issue was found and the server should not be connected as-is. Its most notable findings include "Metadata dictates tool-call ordering" and "Cross-tool shadowing". This report is a deterministic, reproducible automated assessment: the same observed surface always yields the same grade under a given algorithm version, and it is refreshed as new scans arrive and free to read — but it is not a substitute for a manual human security review. Always re-check relm's advertised tools, transport security, and authorization posture before connecting an autonomous agent or sharing sensitive context with it.
Add relm to an MCP client using the endpoint below. Review the grade and findings above before granting an autonomous agent access.
MCP endpoint
https://api.relmcrm.com/mcpStreamable HTTP transport. This is the MCP endpoint, not a website — paste it into your MCP client server list rather than a browser.
Captured passively during the read-only scan. Click any value to find servers that match it.
The tools this server advertises via tools/list — names, purposes, and the parameters each accepts, exactly as enumerated read-only.
Return the live schema: every object, its fields (built-in + custom), and all enum groups with their current values (contact types, activity types, etc). ALWAYS call this before guessing a type, stage
Cross-entity search over contacts, companies and deals by name/email/title.
List records of an object with keyset pagination. Optional filters vary by object (e.g. contact: email/company_id/type; deal: pipeline/stage/company_id; activity: contact_id/deal_id/type).
Sorted worst-first. Each finding shows its severity, what it means, its OWASP MCP Top-10 mapping, and a recommended fix — the check id links to the exact methodology row that produced it.
tool: relm_describe_schema
The text tells the model WHEN to call this tool relative to others ("always call first", "before any other tool", "chain to X tool") — a toxic-flow injection that hijacks the agent’s orchestration rather than describing the tool.
ty types, etc). ALWAYS call this before guessing a type, stage, or field - it is the soRecommendationTool metadata must describe only the tool, never sequence the agent’s calls.
tool: relm_create
A tool description tries to alter the model’s use of another tool.
t's fields (see relm_describe_schema). Custom fields must be registered first (relm_RecommendationDescriptions must describe only their own tool.
tool: relm_delete
A tool description tries to alter the model’s use of another tool.
recoverable via relm_restore). Never hard-destroys data.RecommendationDescriptions must describe only their own tool.
tool: relm_create_enum_value
A tool description tries to alter the model’s use of another tool.
. Use this when relm_create rejects an unknown type with a valid_options liRecommendationDescriptions must describe only their own tool.
tool: relm_connect_channel
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
vider='resend', api_key=<your Resend key>, from='Team <hi@you.com>' (muRecommendationRemove side-channel parameters; constrain tool inputs.
tool: relm_connect_channel
The input schema declares a parameter that asks the caller to hand over a password, key, token, or other secret — a credential-harvest / token-passthrough risk. (Bare pagination `token` params are excluded.)
parameter "api_key"RecommendationNever pass secrets as tool arguments; authenticate out-of-band and remove credential parameters from the schema.
tool: relm_create_automation
A tool description tries to alter the model’s use of another tool.
al won!'}]. See relm_automations_capabilities.RecommendationDescriptions must describe only their own tool.
tool: relm_create_webhook
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: relm_manage_automation
A tool description tries to alter the model’s use of another tool.
o read one, use relm_get_automation. To change a rule's trigger/conditions/actions,RecommendationDescriptions must describe only their own tool.
tool: relm_manage_sequence
A tool description tries to alter the model’s use of another tool.
nrollments, use relm_get_sequence.RecommendationDescriptions must describe only their own tool.
tool: relm_manage_pipeline
A tool description tries to alter the model’s use of another tool.
o read one, use relm_get_pipeline.RecommendationDescriptions must describe only their own tool.
tool: relm_manage_webhook
A tool description tries to alter the model’s use of another tool.
remove it, use relm_delete_webhook.RecommendationDescriptions must describe only their own tool.
tool: (server instructions)
A tool description tries to alter the model’s use of another tool.
gent owns. Call relm_describe_schema first to learn what objects, types and fields eRecommendationDescriptions must describe only their own tool.
The server accepts tool enumeration (and likely invocation) with no authentication.
RecommendationRequire OAuth 2.1 authorization for any server exposing non-public tools.
tool: relm_delete
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: relm_manage_stage
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: relm_batch
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: relm_connect_channel
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: relm_create_automation
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: relm_create_sequence
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: relm_enroll
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: relm_create_webhook
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: relm_delete_webhook
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: relm_manage_automation
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: relm_manage_sequence
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: relm_manage_pipeline
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: relm_manage_webhook
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: relm_delete_connection
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
Vantaj uptime monitoring via MCP — manage monitors, heartbeats, incidents, and status pages.
Unified gateway to Algeria's TKAWEN ecosystem: commerce, certification, and AI tools.
Provides access to the Cohereon Doctrine AI safety framework with governance components, tiered access, and agent onboarding.
Agentic rails for complex workflows with receipts, fees, and MCP tool access.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Fetch one record by id.
Create a record. `data` is the object's fields (see relm_describe_schema). Custom fields must be registered first (relm_create_field). A contact needs at least one of: a name, an identifier (email/pho
Patch a record. Pass if_match (the record's current version) for optimistic concurrency; a 412 means re-fetch and retry.
Soft-delete a record (recoverable via relm_restore). Never hard-destroys data.
Restore a soft-deleted record.
Log an activity (note/call/email/meeting/task) on a contact and/or deal. Convenience wrapper over create activity.
List pipelines with their ordered stages.
Create a pipeline. Optionally provide stages [{key,label}] (defaults to lead/qualified/proposal/won/lost) and is_default.
Add, rename/retype, delete, or reorder stages in a pipeline. action=add: `key` (+optional label, ordinal, type). action=rename: `key` (existing) + any of new_key / label / type - keys are slugified an
Register a new object type in the schema (registry). Idempotent on key; returns the full type set.
Register a new custom field on an object (contact/company/deal/activity). data_type: text|number|boolean|date|select|multiselect|currency|reference|email|url. Must be created before it can be written
Add a value to an enum group (e.g. group 'contact.type' value 'partner'). Idempotent; returns the full value set. Use this when relm_create rejects an unknown type with a valid_options list.
Run up to 100 record writes in ONE call (contact/company/deal/activity) - the fast path for imports/migrations. operations: [{object, method:create|update|delete, data|patch, id?}]. Returns a per-op r
Discover the automation building blocks: valid trigger_events, condition ops, action types, channels/providers, and the shapes of automations/sequences/connections. Call before building a rule or sequ
Connect a BYO messaging channel so automations can send. channel='email', provider='resend', api_key=<your Resend key>, from='Team <hi@you.com>' (must be a verified Resend sender). The key is encrypte
List connected messaging channels (never returns the secret key).
Create a single-step rule: when <trigger_event> [if <conditions>] then <actions>. conditions=[{field,op,value}] (ANDed), actions=[{type,...}]. Example: trigger_event='deal.stage_changed', conditions=[
List reactive rules (automations).
Create a reusable email template. name, html (full HTML, {{field}} placeholders ok), optional subject + text (plaintext alt; auto-derived if omitted). Reference it from a rule/sequence step via {"type
List reusable email templates.
Create a multi-step drip sequence. trigger={event,filter:[{field,op,value}]} auto-enrolls the matching entity's contact; exit_when=[{field,op,value}] stops it (re-checked before every send); steps=[{w
List drip sequences with their steps and enrollment counts.
Dry-run a sequence: how many contacts would enroll now + the send schedule. No side effects.
Manually enroll a contact into a sequence (idempotent per contact+sequence). Optional source={object,id} records what drove the enrollment (e.g. a deal).
Subscribe an https endpoint to CRM events. events=['*'] for all, or a subset of ['contact.created','contact.updated','deal.created','deal.updated','deal.stage_changed']. Returns a `secret` ONCE - the
List webhook subscriptions in this workspace/mode.
Delete a webhook subscription by id.
Read one automation by id, with its trigger, conditions and actions.
Read one drip sequence by id. view=sequence (default) returns it with its steps; view=enrollments lists who is enrolled and their state.
Read one pipeline by key or pl_ id, with its ordered stages and their semantic types (open/won/lost).
Read one webhook by id. view=webhook (default) returns the subscription; view=deliveries returns recent delivery attempts (status, retries, dead-letter) to debug why an endpoint isn't receiving events
Change an existing automation by id. action=disable stops it firing (use this to turn off a misbehaving rule); action=enable resumes it; action=delete removes it. To read one, use relm_get_automation.
Change an existing drip sequence by id. action=disable stops further sends (use this to halt a bad sequence); action=enable resumes; action=delete removes it. To read one or list its enrollments, use
Change an existing pipeline by key or pl_ id. action=rename changes its display `name` and/or its key (pass `new_key`) - deals link by internal id, so they follow a re-key automatically; action=set_de
Pause or resume delivery for an existing webhook by id. action=enable/disable. To read one or inspect its delivery attempts, use relm_get_webhook. To remove it, use relm_delete_webhook.
Delete a connected messaging channel by id (e.g. to remove a rotated/wrong Resend key).
Read this workspace's current billing period: requests used, plan, monthly limit, and any metered overage. Call this to see how close you are to the quota before a big import.
Set (or clear) the hard monthly overage spend cap in USD. overage_cap_usd: a number caps paid overage (requests 429 with spend_cap_reached past it), 0 = never any overage, null = unlimited. This is th