Every MCP tool in the SCOPE compliance index, grouped by server — risk posture, regulatory exposure, and the tools that warrant tighter governance.
2 critical 11 high 8 med 4 low · 25 tools · 6 SoD-flagged
regimes APPICCPACOSOGDPRISO_27001LGPDNIST_CSFPIPEDAPIPLPOPIASOC2SOXUK_GDPR
Tools needing tighter control (15 of 25)
port-io.update_action_permissions critical conf mediumhuman approval
Rewrites who may execute and who must approve a self-service action, so a single call can remove the approval gate on a production provisioning or teardown workflow.
port-io.delete_blueprint critical conf mediumhuman approval
Destroys an entire catalog entity type together with the entities, relations, scorecards, and dashboards built on it — an irreversible loss of the ownership graph.
port-io.upsert_action high conf highhuman approval
Defines or rewrites a self-service action's backend invocation, so new automation reaches production infrastructure without passing a code-review or change-approval gate.
port-io.delete_action high conf mediumOBO
Removes a self-service action along with its approval configuration and run history linkage, breaking the governed path developers use for a privileged operation.
port-io.upsert_workflow high conf mediumhuman approval
Creates or rewrites a workflow that orchestrates production changes, letting one principal alter automated delivery behaviour with no second reviewer.
port-io.delete_workflow high conf mediumOBO
Destroys a workflow definition, silently stopping every automated process that depended on it until someone notices the missing runs.
port-io.run_action high conf highOBO
Executes a self-service action whose backend may provision cloud resources, deploy code, rotate infrastructure, or tear down an environment.
port-io.trigger_run high conf mediumOBO
Starts a workflow or action run against real infrastructure, with the blast radius set by whatever backend the target workflow invokes.
port-io.upsert_blueprint high conf highOBO
Changes the schema every entity of that type conforms to; dropping or retyping a property propagates across the whole catalog and any scorecard or permission rule reading it.
port-io.delete_entity high conf mediumOBO
Removes a catalog record for a service or resource, breaking its ownership mapping, dependency links, and any on-call routing that resolves through it.
port-io.install_library_plugin high conf mediumOBO
Installs third-party plugin code from the public library into the organization, where it renders in the portal for every user.
port-io.upsert_plugin high conf mediumhuman approval
Publishes or replaces custom plugin code that executes in the portal UI for all users, an admin-only change that ships without any review step.
port-io.delete_scorecard high conf mediumhuman approval
Deletes a scorecard, erasing the production-readiness and compliance rules teams are measured against and any gate that depended on its level.
port-io.test_integration_mapping medium conf lowaudit
Evaluates a mapping against live provider payloads and returns the result, which can surface raw third-party data before it is filtered into the catalog.
port-io.get_integration_event_logs medium conf lowaudit
Exposes integration sync logs, which routinely quote provider payload fragments and failure details about connected production systems.
All other tools (10)
port-io.delete_sidebar_folder medium conf mediumaudit
Cascades a delete through the folder and every page and nested folder inside it, wiping dashboards other teams rely on in one call.
port-io.describe_user_details low conf mediumallow
Returns the calling user's identity, organization, and team memberships — personal data that ties a named individual to an internal org structure.
port-io.get_action_permissions low conf mediumallow
Reveals which teams can run each action and where manual approval is required, mapping the weakest approval paths in the portal.
port-io.list_entities medium conf highaudit
Bulk-queries every entity of a blueprint, returning the full inventory of services, infrastructure, owners, and cost or vulnerability properties attached to them.
port-io.search_audit_logs medium conf mediumaudit
Searches the catalog audit trail, disclosing which named actors changed which entities and when across the whole organization.
port-io.simulate_blueprint_permissions low conf mediumallow
Evaluates what a named user could read or write on a blueprint's entities without changing anything, useful for access review and equally useful for probing gaps.
port-io.trigger_auto_discovery medium conf mediumaudit
Kicks off a discovery sweep across connected providers, pulling fresh resource inventory into the catalog and consuming provider API quota while it runs.
port-io.upsert_dashboard_page low conf mediumallow
Creates or replaces a dashboard page and its widget layout, changing what catalog, cost, and security data is surfaced to portal users by default.
port-io.upsert_entity medium conf highaudit
Writes catalog data for a service or resource, including its declared owner and team, which downstream scorecards and incident routing treat as authoritative.
port-io.upsert_scorecard medium conf highaudit
Rewrites the rules and thresholds that decide whether a service is judged production-ready, so a weakened rule makes failing services report as compliant.