MCP compliance catalog

Every MCP tool in the SCOPE compliance index, grouped by server — risk posture, regulatory exposure, and the tools that warrant tighter governance.
387MCP servers
5470tools
Reset 387 of 387 servers
Intuit QuickBooks
51 tools · footprint 188
15 critical 10 high 17 med 9 low COSOGLBA+3 more
Zoho Books
25 tools · footprint 96
3 critical 14 high 7 med 1 low COSOPCI+1 more
PayPal
33 tools · footprint 86
6 critical 7 high 9 med 11 low COSOGLBA+3 more
Workable
25 tools · footprint 81
13 high 12 med COSOSOX
Vercel
25 tools · footprint 78
6 critical 4 high 7 med 8 low COSOPCI+1 more
Stripe
26 tools · footprint 77
3 critical 7 high 10 med 6 low COSOPCI+2 more
Qonto
25 tools · footprint 76
15 high 9 med 1 low COSOGLBA+3 more
Zoho Books
25 tools · footprint 73
3 critical 11 high 11 med COSOPCI+1 more
Xero
25 tools · footprint 72
3 critical 8 high 14 med COSOSOX
Port
25 tools · footprint 69
2 critical 11 high 8 med 4 low COSOSOX
PostHog
36 tools · footprint 69
6 high 22 med 8 low
Supabase
32 tools · footprint 69
4 critical 4 high 8 med 16 low COSOSOX
Datadog
25 tools · footprint 68
1 critical 12 high 11 med 1 low
Zoho CRM
25 tools · footprint 68
2 critical 10 high 12 med 1 low COSOSOX
Zoom
25 tools · footprint 68
11 high 14 med HIPAA
PostHog
25 tools · footprint 66
3 critical 12 high 10 med
‹ PrevPage 1 of 25Next ›
Phoenix by HG InsightsDocs ↗
3 high 5 med 17 low · 25 tools · 0 SoD-flagged
regimes APPICCPAGDPRISO_27001ISO_42001LGPDNIST_AI_RMFPIPEDAPIPLPOPIASOC2UK_GDPR

Tools needing tighter control (8 of 25)

phoenix.contact_enrich high conf mediumOBO
Reveals a named individual's work email, social profiles and employment history from broker data, with phone reveal on by default in v2 — personal data obtained without the subject's direct consent.
phoenix.contact_search high conf mediumOBO
Returns lists of identifiable individuals filtered by title, seniority and location — bulk discovery of people who never interacted with the caller's organisation.
phoenix.hg_data_query high conf mediumOBO
Runs caller-shaped queries against HG's data warehouse billed per row returned, so one broad query can extract large volumes of licensed market data and burn unbounded credits.
phoenix.customer_data_query medium conf lowaudit
Queries the customer's own datasets uploaded into Phoenix, which commonly carry account and contact records from the caller's CRM.
phoenix.phoenix_invoke_agent medium conf lowaudit
Starts a server-side Phoenix agent run that pulls data and writes artifacts on its own; the agent's intermediate data access is not itemised to the caller.
phoenix.market_data_agent medium conf lowaudit
Runs the market-data agent, metered separately and billed at cost through the underlying run — an unbounded-cost path with no per-call credit ceiling.
phoenix.phoenix_get_artifact medium conf lowaudit
Retrieves a stored artifact from a prior agent run, which may contain contact or account data another operator in the workspace already enriched.
phoenix.customer_data_explore low conf lowallow
Lists the customer-uploaded datasets and fields available in the workspace, showing what internal data has been loaded into Phoenix.
All other tools (17)
phoenix.company_ai_spend low conf mediumallow
Returns estimated annual AI spend across software, services and hardware for a target company — modelled, not reported, figures.
phoenix.company_cloud_spend low conf mediumallow
Lists the cloud, CDN and hosting vendors a company uses with adoption dates; despite the name it returns no dollar figures, so reading it as spend data is wrong.
phoenix.company_contracts low conf mediumallow
Returns a company's ICT outsourcing contracts and optionally federal awards and SAM.gov registration — public procurement records, not product-level renewal dates.
phoenix.company_fai low conf mediumallow
Reveals which departments inside a target company use which products, a department-level view of a third party's internal tooling.
phoenix.company_firmographic low conf mediumallow
Returns industry, headcount, revenue and HQ for a named company — licensed third-party market data with no personal data attached.
phoenix.company_intent low conf mediumallow
Returns scored buying-intent topics and TrustRadius activity events for a company — behavioural signals inferred from third-party research activity rather than facts the company disclosed.
phoenix.company_operating_signals low conf mediumallow
Summarises a company's operating posture and AI-maturity signals rolled up from HG mentions, used to rank and prioritise target accounts.
phoenix.company_research medium conf mediumaudit
Aggregates every company signal into a single profile at roughly ten credits per call — the most expensive tool in the catalog and trivially loopable by an agent.
phoenix.company_spend low conf mediumallow
Returns modelled annual IT spend by category and country for a target company — an estimate, so quoting it as an audited figure misstates the source.
phoenix.company_technographic low conf mediumallow
Discloses a target company's currently installed technology stack — competitive intelligence about a third party's estate, not the caller's own.
phoenix.hg_catalog low conf mediumallow
Exposes the warehouse schema — tables, columns and join keys — mapping out every dataset reachable through the query tools.
phoenix.phoenix_get_run_status low conf mediumallow
Returns execution state and progress for an agent run; no market or contact data is disclosed.
phoenix.phoenix_list_agents low conf mediumallow
Enumerates the agents provisioned to the workspace, showing which automated research capabilities the account can run.
phoenix.phoenix_list_artifacts low conf mediumallow
Lists stored artifacts from prior agent runs, revealing which accounts and topics other operators in the workspace have researched.
phoenix.search_companies low conf mediumallow
Returns companies matching firmographic and technographic filters; loose filters produce large result sets that consume search credits.
phoenix.sec_full_text_search low conf mediumallow
Full-text searches SEC filings for a company; the text is public record but each call consumes credits.
phoenix.web_search low conf mediumallow
Issues outbound web searches billed per query, sending the agent's search terms to an external provider outside Phoenix's data boundary.