MCP compliance catalog

Every MCP tool in the SCOPE compliance index, grouped by server — risk posture, regulatory exposure, and the tools that warrant tighter governance.
387MCP servers
5470tools
Reset 387 of 387 servers
Upwork
19 tools · footprint 41
1 critical 5 high 9 med 4 low COSOSOX
Vercel
20 tools · footprint 41
2 critical 3 high 2 med 13 low COSOSOX
Cloudinary
23 tools · footprint 40
1 critical 4 high 15 med 3 low
Freshdesk
24 tools · footprint 40
6 high 14 med 4 low
Netlify
23 tools · footprint 40
2 critical 4 high 4 med 13 low
Zapier
14 tools · footprint 39
1 critical 3 high 3 med 7 low COSOPCI+1 more
Freshservice
23 tools · footprint 38
6 high 15 med 2 low
GitHub
83 tools · footprint 38
1 high 20 med 62 low COSOSOX
Bright Data
25 tools · footprint 37
5 high 17 med 3 low
Snowflake
6 tools · footprint 37
2 critical 3 high 1 med COSOSOX
Brex
25 tools · footprint 36
3 high 17 med 5 low COSOGLBA+2 more
Microsoft Dataverse
15 tools · footprint 35
1 critical 3 high 8 med 3 low
Calendly
35 tools · footprint 34
2 high 13 med 20 low
Lovable
25 tools · footprint 34
1 critical 2 high 9 med 13 low
Smartsheet
42 tools · footprint 34
2 high 9 med 31 low COSOSOX
Freshservice
23 tools · footprint 33
5 high 12 med 6 low
‹ PrevPage 4 of 25Next ›
Phoenix by HG InsightsDocs ↗
3 high 5 med 17 low · 25 tools · 0 SoD-flagged
regimes APPICCPAGDPRISO_27001ISO_42001LGPDNIST_AI_RMFPIPEDAPIPLPOPIASOC2UK_GDPR

Tools needing tighter control (8 of 25)

phoenix.contact_enrich high conf mediumOBO
Reveals a named individual's work email, social profiles and employment history from broker data, with phone reveal on by default in v2 — personal data obtained without the subject's direct consent.
phoenix.contact_search high conf mediumOBO
Returns lists of identifiable individuals filtered by title, seniority and location — bulk discovery of people who never interacted with the caller's organisation.
phoenix.hg_data_query high conf mediumOBO
Runs caller-shaped queries against HG's data warehouse billed per row returned, so one broad query can extract large volumes of licensed market data and burn unbounded credits.
phoenix.customer_data_query medium conf lowaudit
Queries the customer's own datasets uploaded into Phoenix, which commonly carry account and contact records from the caller's CRM.
phoenix.phoenix_invoke_agent medium conf lowaudit
Starts a server-side Phoenix agent run that pulls data and writes artifacts on its own; the agent's intermediate data access is not itemised to the caller.
phoenix.market_data_agent medium conf lowaudit
Runs the market-data agent, metered separately and billed at cost through the underlying run — an unbounded-cost path with no per-call credit ceiling.
phoenix.phoenix_get_artifact medium conf lowaudit
Retrieves a stored artifact from a prior agent run, which may contain contact or account data another operator in the workspace already enriched.
phoenix.customer_data_explore low conf lowallow
Lists the customer-uploaded datasets and fields available in the workspace, showing what internal data has been loaded into Phoenix.
All other tools (17)
phoenix.company_ai_spend low conf mediumallow
Returns estimated annual AI spend across software, services and hardware for a target company — modelled, not reported, figures.
phoenix.company_cloud_spend low conf mediumallow
Lists the cloud, CDN and hosting vendors a company uses with adoption dates; despite the name it returns no dollar figures, so reading it as spend data is wrong.
phoenix.company_contracts low conf mediumallow
Returns a company's ICT outsourcing contracts and optionally federal awards and SAM.gov registration — public procurement records, not product-level renewal dates.
phoenix.company_fai low conf mediumallow
Reveals which departments inside a target company use which products, a department-level view of a third party's internal tooling.
phoenix.company_firmographic low conf mediumallow
Returns industry, headcount, revenue and HQ for a named company — licensed third-party market data with no personal data attached.
phoenix.company_intent low conf mediumallow
Returns scored buying-intent topics and TrustRadius activity events for a company — behavioural signals inferred from third-party research activity rather than facts the company disclosed.
phoenix.company_operating_signals low conf mediumallow
Summarises a company's operating posture and AI-maturity signals rolled up from HG mentions, used to rank and prioritise target accounts.
phoenix.company_research medium conf mediumaudit
Aggregates every company signal into a single profile at roughly ten credits per call — the most expensive tool in the catalog and trivially loopable by an agent.
phoenix.company_spend low conf mediumallow
Returns modelled annual IT spend by category and country for a target company — an estimate, so quoting it as an audited figure misstates the source.
phoenix.company_technographic low conf mediumallow
Discloses a target company's currently installed technology stack — competitive intelligence about a third party's estate, not the caller's own.
phoenix.hg_catalog low conf mediumallow
Exposes the warehouse schema — tables, columns and join keys — mapping out every dataset reachable through the query tools.
phoenix.phoenix_get_run_status low conf mediumallow
Returns execution state and progress for an agent run; no market or contact data is disclosed.
phoenix.phoenix_list_agents low conf mediumallow
Enumerates the agents provisioned to the workspace, showing which automated research capabilities the account can run.
phoenix.phoenix_list_artifacts low conf mediumallow
Lists stored artifacts from prior agent runs, revealing which accounts and topics other operators in the workspace have researched.
phoenix.search_companies low conf mediumallow
Returns companies matching firmographic and technographic filters; loose filters produce large result sets that consume search credits.
phoenix.sec_full_text_search low conf mediumallow
Full-text searches SEC filings for a company; the text is public record but each call consumes credits.
phoenix.web_search low conf mediumallow
Issues outbound web searches billed per query, sending the agent's search terms to an external provider outside Phoenix's data boundary.