MCP compliance catalog

Every MCP tool in the SCOPE compliance index, grouped by server — risk posture, regulatory exposure, and the tools that warrant tighter governance.
387MCP servers
5470tools
Reset 387 of 387 servers
Intuit QuickBooks
51 tools · footprint 188
15 critical 10 high 17 med 9 low COSOGLBA+3 more
Zoho Books
25 tools · footprint 96
3 critical 14 high 7 med 1 low COSOPCI+1 more
PayPal
33 tools · footprint 86
6 critical 7 high 9 med 11 low COSOGLBA+3 more
Workable
25 tools · footprint 81
13 high 12 med COSOSOX
Vercel
25 tools · footprint 78
6 critical 4 high 7 med 8 low COSOPCI+1 more
Stripe
26 tools · footprint 77
3 critical 7 high 10 med 6 low COSOPCI+2 more
Qonto
25 tools · footprint 76
15 high 9 med 1 low COSOGLBA+3 more
Zoho Books
25 tools · footprint 73
3 critical 11 high 11 med COSOPCI+1 more
Xero
25 tools · footprint 72
3 critical 8 high 14 med COSOSOX
Port
25 tools · footprint 69
2 critical 11 high 8 med 4 low COSOSOX
PostHog
36 tools · footprint 69
6 high 22 med 8 low
Supabase
32 tools · footprint 69
4 critical 4 high 8 med 16 low COSOSOX
Datadog
25 tools · footprint 68
1 critical 12 high 11 med 1 low
Zoho CRM
25 tools · footprint 68
2 critical 10 high 12 med 1 low COSOSOX
Zoom
25 tools · footprint 68
11 high 14 med HIPAA
PostHog
25 tools · footprint 66
3 critical 12 high 10 med
‹ PrevPage 1 of 25Next ›
ReplitDocs ↗
1 high 3 med 5 low · 9 tools · 1 SoD-flagged
regimes ISO_27001SOC2

Tools needing tighter control (2 of 9)

replit.publish_app high conf mediumhuman approval
Pushes an app live on a public URL, exposing whatever code, data and credentials it currently carries to anyone on the internet with no separate review step.
replit.import-claude-design-from-url medium conf lowaudit
Pulls content from an external URL into an app's source, so the fetched material becomes part of what the app builds and serves.
All other tools (7)
replit.ask_question low conf mediumallow
Surfaces details about an app's code and configuration through the Agent, so project internals can be read out without opening the workspace.
replit.create_app_from_prompt medium conf highaudit
Provisions a new app with its own database, auth and hosting inside the workspace, consuming plan entitlements and adding a system nobody has reviewed.
replit.get_publish_status low conf mediumallow
Reveals deployment state and the live URL of an app, which tells a caller which internal projects are already exposed publicly.
replit.list_apps low conf mediumallow
Returns every app the credential can edit, giving a caller the full inventory of writable projects in the workspace.
replit.resolve_app_by_name low conf highallow
Looks up one app by exact title and returns its identifiers, the handle other write tools need to act on that project.
replit.search_apps low conf mediumallow
Enumerates workspace apps matching a keyword or URL, mapping out which projects exist and when each was last touched.
replit.update_app_using_prompt medium conf highaudit
Rewrites the source of an existing app through an Agent run, so a single prompt can change application behaviour, dependencies or schema without a code review.