MCP compliance catalog

Every MCP tool in the SCOPE compliance index, grouped by server — risk posture, regulatory exposure, and the tools that warrant tighter governance.
303MCP servers
4476tools
Reset 303 of 303 servers
Microsoft 365
23 tools · footprint 41
8 high 14 med 1 low
Paytm for Business
24 tools · footprint 41
2 critical 7 high 5 med 10 low COSOPCI+1 more
Vercel
20 tools · footprint 41
2 critical 3 high 2 med 13 low COSOSOX
Cloudinary
23 tools · footprint 40
1 critical 4 high 15 med 3 low
Freshdesk
24 tools · footprint 40
6 high 14 med 4 low
Netlify
23 tools · footprint 40
2 critical 4 high 4 med 13 low
Zapier
14 tools · footprint 39
1 critical 3 high 3 med 7 low COSOPCI+1 more
Freshservice
23 tools · footprint 38
6 high 15 med 2 low
GitHub
83 tools · footprint 38
1 high 20 med 62 low COSOSOX
Bright Data
25 tools · footprint 37
5 high 17 med 3 low
Snowflake
6 tools · footprint 37
2 critical 3 high 1 med COSOSOX
Brex
25 tools · footprint 36
3 high 17 med 5 low COSOGLBA+2 more
Microsoft Dataverse
15 tools · footprint 35
1 critical 3 high 8 med 3 low
Calendly
35 tools · footprint 34
2 high 13 med 20 low
Lovable
25 tools · footprint 34
1 critical 2 high 9 med 13 low
Smartsheet
42 tools · footprint 34
2 high 9 med 31 low COSOSOX
‹ PrevPage 3 of 19Next ›
GitHubDocs ↗
5 high 12 med 7 low · 24 tools · 4 SoD-flagged
regimes APPICCPACOSOGDPRISO_27001LGPDNIST_CSFPIPEDAPIPLPOPIASOC2SOXUK_GDPR

Tools needing tighter control (5 of 24)

github-api.list_secret_scanning_alerts high conf mediumhuman approval
Enumerates every secret-scanning alert in a repository, revealing the locations of leaked credentials, tokens, and keys at scale.
github-api.actions_run_trigger high conf mediumhuman approval
Triggers a GitHub Actions workflow run, executing CI/CD pipeline code that can build, test, or deploy without a review gate.
github-api.merge_pull_request high conf mediumhuman approval
Merges a pull request into its base branch, landing code changes; self-merging bypasses the review control on the codebase.
github-api.pull_request_review_write high conf mediumhuman approval
Creates, submits, or deletes pull-request reviews; approving one's own PR or deleting a review erases the change-approval trail.
github-api.delete_file high conf mediumOBO
Removes a file from a branch in a commit; destructive to the working tree though recoverable through the repository's history.
All other tools (19)
github-api.create_branch low conf mediumallow
Creates a new branch from an existing ref; isolated from other branches and trivially reversible.
github-api.create_gist medium conf mediumaudit
Creates a gist that can be public, providing a path to expose proprietary code or embedded secrets outside the organization.
github-api.create_or_update_file medium conf mediumaudit
Creates or overwrites a single file on a branch via commit, changing source code directly in the repository.
github-api.create_pull_request low conf mediumallow
Opens a new pull request proposing changes; reviewable and reversible before any merge occurs.
github-api.create_pull_request_with_copilot medium conf mediumaudit
Delegates a coding task to the autonomous Copilot agent, which writes code and opens a pull request with minimal human authorship.
github-api.create_repository medium conf mediumaudit
Provisions a new repository under the account or organization, expanding the managed code surface and its default access grants.
github-api.fork_repository low conf mediumallow
Forks a repository into a new namespace; a copy operation with no effect on the source repository.
github-api.get_job_logs medium conf mediumaudit
Retrieves raw Actions job logs, which frequently contain leaked environment variables, tokens, and internal endpoint details.
github-api.get_secret_scanning_alert medium conf mediumaudit
Returns the details of a single secret-scanning alert, exposing which credential leaked and where it was committed.
github-api.get_team_members medium conf mediumaudit
Lists the members of an organization team, exposing developer identities and the access-boundary of that team.
github-api.issue_write low conf mediumallow
Creates or updates an issue or pull request; reversible tracker content with no direct effect on code or access.
github-api.label_write low conf mediumallow
Creates, updates, or deletes repository labels used to categorize issues and pull requests; low-impact metadata.
github-api.list_code_scanning_alerts medium conf mediumaudit
Enumerates code-scanning alerts, surfacing exploitable security weaknesses across a repository's source before they are remediated.
github-api.list_dependabot_alerts medium conf mediumaudit
Lists Dependabot vulnerability alerts, disclosing which dependencies carry known exploitable flaws across the repository.
github-api.list_repository_collaborators medium conf mediumaudit
Reveals every principal with access to a repository and their permission level, mapping the codebase's access-control surface.
github-api.projects_write low conf mediumallow
Manages GitHub Projects boards, fields, and items; planning-layer changes that are reviewable and reversible.
github-api.push_files medium conf mediumaudit
Pushes multiple files to a branch in a single commit, writing source directly to the repository without a pull request.
github-api.search_code medium conf mediumaudit
Searches code across every repository the token can read, which can surface hardcoded secrets or proprietary snippets at scale.
github-api.update_pull_request low conf mediumallow
Edits a pull request's title, body, state, or base branch; metadata-level and reversible.