Verified

Controld MCP Server

Control D API operations exposed for AI agents through auto-generated tool definitions.

Data last scanned today · Reviewed today

45 1 dangerous tool2 tools★ 0TypeScriptMIT

Overview

This MCP server provides comprehensive access to the Control D API, covering profiles, rules, billing, and organizational settings. It leverages an OpenAPI specification derived from official documentation to automatically generate approximately 46 distinct tools, ensuring that its interface stays synchronized with the upstream API capabilities.

Our verdict

With a security score of 35/100, this server is currently classified as high-risk. This rating stems from the fact that it is a community-maintained project rather than an official offering, and its safety properties—including authentication methods and read-only implementation details—have not yet been editorially reviewed. It is suitable for experimental use by developers familiar with Control D API constraints, but should be handled with caution in sensitive environments.

Supports least-privilege via separate read and write tokens
Uses spec-driven tool generation for reliable API coverage
Physically disables mutating tools if write tokens are omitted
Includes helpful read-only and destructive operation annotations

Lacks official vendor maintenance and support
Security architecture has not yet undergone editorial review
Current zero-star repository status suggests limited community vetting

Setup

Claude Desktop

{
  "mcpServers": {
    "controld-mcp": {
      "args": [
        "-y",
        "controld-mcp"
      ],
      "command": "npx"
    }
  }
}

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows), then restart Claude Desktop. Some servers require API keys or tokens as environment variables — check the project's README and add an "env" object if needed.

No read-only mode — running this grants full read/write access.
No built-in authentication — anyone with access to this config can invoke every tool it exposes.

Tools

Tool	Description	Risk
controld_request_read	Performs a GET request to any Control D API path.	low
controld_request_write	Performs a POST, PUT, PATCH, or DELETE request to any Control D API path.	high

Compatibility

Client	Local	Docker	Remote	Read-only
ChatGPT
Claude Desktop
Cursor
VS Code
Windsurf

Frequently asked questions

›How do I ensure the server runs in read-only mode?

You can ensure the server is read-only by omitting the CONTROLD_API_TOKEN_WRITE environment variable during configuration. When this token is not provided, all mutating tools are automatically disabled.

›What happens if a tool I need is not explicitly modeled?

The server provides two generic escape hatch tools, controld_request_read and controld_request_write, which allow you to perform GET or mutation operations on any API path.

›Are there specific configuration requirements for organization accounts?

If you are using an organization account, you can provide the CONTROLD_ORG_ID environment variable, which the server will send as the X-Force-Org-Id header.

›How are the available tools determined?

The server uses approximately 46 typed tools generated from an OpenAPI specification that is built from Control D's official documentation. You can run tools/list against the server at any time to see the current set of available operations.

›What are the environment requirements for this MCP server?

The server requires Node.js version 18 or higher and a valid Control D API token generated from the Control D API dashboard.