Deskhand
REMOTE · DESKHAND.GRAIN64.COM
CRM and email desk for AI agents: key per agent, undo a run. Start with one POST, no account.
Available components
Last scanned (12 hours ago)
Scores higher than 66% of remote servers
Reachable. Last reached 4 Nov 2026.
Category CRM and Sales
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security89
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation is enforced on tool calls, but the challenge carries no valid RFC 9728 metadata, so a client cannot discover where to get a token. See how to fix → View diagnostics → Fail
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability64
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 4771 tokens (~159/item across 30 items; 30 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management17
- Stability observed for 5 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage98
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 93% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 31 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities60
- Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28. See how to fix → Fail
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 4 Nov 26 +1
- Tool “draft_email” rewrote its description, which is the text the model reads security
- Schema quality: 4143 → 4771 ▼ functional
- Destructive annotations: pass → 100 functional
- New tool “get_outbox” functional
- New tool “report_send” functional
- “create_campaign” added an optional parameter “footer” cosmetic
- “create_campaign” added an optional parameter “opt_out_line” cosmetic
- “draft_email” added an optional parameter “note” cosmetic
- “enroll_contacts” added an optional parameter “claim_check” cosmetic
- “enroll_contacts” added an optional parameter “evidence_url” cosmetic
- “enroll_contacts” added an optional parameter “per_contact” cosmetic
- “update_campaign” added an optional parameter “footer” cosmetic
- “update_campaign” added an optional parameter “opt_out_line” cosmetic
- 2 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes.
- 31 Oct 26 +3
- HSTS header: fail → pass ▲ security
- Stability: unverified → 0.03 ▲ functional
- 30 Oct 26 +38
- Transport: unverified → pass ▲ security
- Injection markers: unverified → pass ▲ security
- First check of Judged manipulation: pass security
- Authorization: Authorisation is enforced on tool calls, but the challenge carries no valid RFC 9728 metadata, so a client cannot discover where to get a token. security
- MCP protocol: unverified → fail ▼ functional
- Tool coverage: unverified → 100 ▲ functional
- First check of Schema quality: fail functional
- First check of Destructive annotations: pass functional
- First check of Tool coverage: 92 functional
- First check of Schema quality: fail functional
- First check of Schema quality: good functional
- 12 Oct 26 33
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 4 Nov 2026 · Probed https://deskhand.grain64.com/api/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=deskhand.grain64.com | CN=WE1,O=Google Trust Services,C=US | 11 Oct 2026 | 9 Jan 2027 | ECDSA 256 | ECDSA-SHA256 | 58d036dd97f863af1356bcac6f369b8e |
| SANs: deskhand.grain64.com | ||||||
| CN=WE1,O=Google Trust Services,C=US (CA) | CN=GTS Root R4,O=Google Trust Services LLC,C=US | 13 Dec 2023 | 20 Feb 2029 | ECDSA 256 | ECDSA-SHA384 | 7ff31977972c224a76155d13b6d685e3 |
| CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) | CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE | 15 Nov 2023 | 28 Jan 2028 | ECDSA 384 | SHA256-RSA | 7fe530bf331343bedd821610493d8a1b |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of deskhand.grain64.com. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| com. | present | 19718 | 13 | Verified |
| grain64.com. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication Challenged, unverified
The endpoint asked for a token, but we could not retrieve and validate the RFC 9728 metadata that tells a client how to obtain one.
| Result | Challenged, unverified |
|---|---|
| Enforced | On tool calls |
| HTTP status | 200 |
WWW-Authenticate challenge Bearer realm="deskhand"
Bearer realm="deskhand" | Header | Value |
|---|---|
| strict-transport-security | max-age=31536000; includeSubDomains |
| x-content-type-options | nosniff |
| referrer-policy | no-referrer |
Protected resource metadata
| Retrieved | No |
|---|---|
| Problem | no_resource_metadata |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://deskhand.grain64.com/api/mcp | Verified | 200 | |
| http (plaintext) | http://deskhand.grain64.com/api/mcp | HTTPS enforced | 301 | https://deskhand.grain64.com/api/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
add_note Add a note ~108
Attach a note to a contact (by id or email) or to a deal. Requires the write_crm scope.
| Name | Type | Req | Description |
|---|---|---|---|
| body | string | yes | Note text. |
| contact_email | string | – | Contact email. |
| contact_id | string | – | Contact id. |
| deal_id | string | – | Deal id. |
| idempotency_key | string | – | Optional. Repeating a call with the same key and the same arguments returns the first result instead of writing again, so retries are safe. |
No output schema declared.
No examples provided.
add_suppression Add to the suppression list ~113
Never email this address or domain again, in any campaign. Open enrollments of matching contacts stop. Removing an entry needs the operator. Requires the manage_campaigns scope.
| Name | Type | Req | Description |
|---|---|---|---|
| idempotency_key | string | – | Optional. Repeating a call with the same key and the same arguments returns the first result instead of writing again, so retries are safe. |
| reason | string | – | manual (default), complaint, unsubscribed, bounced or imported. |
| value | string | yes | An email address or a domain. |
No output schema declared.
No examples provided.
campaign_report Campaign report ~77
Counts per campaign, per step and per variant: enrolled, active, completed, stopped (by reason), sent, sent_dry (dry-run records, nothing delivered), skipped (by reason), replied, bounced, unsubscribed, meetings, deals_created. Rates say which count they divide by.
| Name | Type | Req | Description |
|---|---|---|---|
| campaign_id | string | yes | Campaign id. |
No output schema declared.
No examples provided.
create_campaign Create a campaign ~575
Create a campaign: an ordered sequence of email, wait and task steps run per contact, with follow-ups, stop rules (reply, bounce, unsubscribe and deal stage change stop a contact's sequence), a send window, caps and A/B variants. Pass steps inline, and optionally `enroll` to select contacts in the same call. It starts as a draft; call simulate_campaign, then launch_campaign. Delivery is a dry run (nothing leaves the system) until the operator switches sending on. Requires the manage_campaigns scope.
| Name | Type | Req | Description |
|---|---|---|---|
| daily_cap | integer | – | – |
| description | string | – | Short description. |
| enroll | object | – | Same selectors as enroll_contacts, applied right after creation. |
| footer | string | – | Relay identities only: full (default, your text plus the sender, postal address and unsubscribe link) or own (your step body is the whole message; set opt_out_line). |
| idempotency_key | string | – | Optional. Repeating a call with the same key and the same arguments returns the first result instead of writing again, so retries are safe. |
| identity_id | string | – | Sending identity id, default dry_run. |
| name | string | yes | Campaign name. |
| opt_out_line | string | – | With footer own: the exact words your body uses to let a reader opt out, for example reply "no". Every email body must contain it. |
| send_days | array | – | mon..sun, default weekdays. |
| skip_dates | array | – | Dates like 2026-12-25 with no sending. |
| steps | array | – | Ordered steps. email: {type:"email", variants:[{subject, body, weight?}] or subject+body, condition?, reply_in_thread?}. wait: {type:"wait", days, business_days?}. task: {type:"task", title, due_in_d… |
| stop_on | array | – | reply, bounce, unsubscribe, deal_stage_change, contact_status_change. |
| strategy | string | – | Your stated plan: who you are targeting and why. The operator reads it before approving. |
| timezone | string | – | IANA zone for fixed mode. |
| timezone_mode | string | – | contact (default: each contact's own zone) or fixed. |
| track_opens | boolean | – | Default false. Opens are unreliable. |
| window | object | – | Local send window, default {"start":"09:00","end":"17:00"}. |
No output schema declared.
No examples provided.
create_deal Create a deal ~240
Open a deal, optionally linked to a contact (by id or email) and a company. Stages: lead, contacted, qualified, proposal, won, lost. The deal takes its contact's company unless company_id is given. Unknown arguments are rejected with unknown_field. Requires the write_crm scope.
| Name | Type | Req | Description |
|---|---|---|---|
| company_id | string | – | Company id. |
| contact_email | string | – | Link the contact with this email. |
| contact_id | string | – | Contact id. |
| currency | string | – | 3-letter code, default EUR. |
| fields | object | – | Free-form custom columns, for example {"stack":"Next.js","funding":"seed"}. Values are strings or numbers. |
| idempotency_key | string | – | Optional. Repeating a call with the same key and the same arguments returns the first result instead of writing again, so retries are safe. |
| source | string | – | Where it came from. |
| stage | string | – | lead (default), contacted, qualified, proposal, won or lost. |
| title | string | yes | Deal title. |
| value_cents | integer | – | Deal value in cents. |
No output schema declared.
No examples provided.
create_task Create a task ~139
Create a follow-up task or reminder with an optional due date, on a contact or a deal. Requires the manage_tasks scope.
| Name | Type | Req | Description |
|---|---|---|---|
| contact_id | string | – | Contact id. |
| deal_id | string | – | Deal id. |
| due_at | string | – | ISO date or date-time, for example 2026-10-14 or 2026-10-14T09:00:00Z. |
| idempotency_key | string | – | Optional. Repeating a call with the same key and the same arguments returns the first result instead of writing again, so retries are safe. |
| title | string | yes | What to do. |
No output schema declared.
No examples provided.
draft_email Draft an email ~330
Draft one email to a contact. Drafts are auto-approved by default (the operator can switch approval on for the workspace or for you; then the draft waits in their Approvals inbox). Approved mail that cannot be sent to the recipient yet waits in the operator's To send list and the response says so. Refuses with contact_suppressed when the contact replied, unsubscribed or bounced. One recipient per message, plain text, no attachments. Accepts only contact_id (or to), subject, body and an optional note (your one-line reason for writing it, up to 500 characters, shown to the operator on the approval card): any other argument is rejected with unknown_field. The response carries warnings (codes: open_draft_exists when another unsent draft to the same contact exists, emailed_N_days_ago when mail went out in the last 3 days, contact_status_<status>) and prior_emails; check them before drafting a second message to the same person. Requires the draft_email scope.
| Name | Type | Req | Description |
|---|---|---|---|
| body | string | yes | Plain-text body. The platform adds the sender identity and unsubscribe footer. |
| contact_id | string | – | Contact id. |
| idempotency_key | string | – | Optional. Repeating a call with the same key and the same arguments returns the first result instead of writing again, so retries are safe. |
| note | string | – | Optional: why you wrote this draft, in one sentence. The operator sees it next to the draft. |
| subject | string | yes | Single-line subject. |
| to | string | – | Or the contact's email address. |
No output schema declared.
No examples provided.
enroll_contacts Enroll contacts in a campaign ~319
Enroll contacts by ids, tag, source/list, status, text or custom fields. Suppressed, replied, unsubscribed, bounced, address-less and blocked-domain contacts are skipped with a reason, and a contact in another running campaign is skipped (or moved with on_conflict=move). dry_run=true returns who would be enrolled and who skipped. Requires the manage_campaigns scope.
| Name | Type | Req | Description |
|---|---|---|---|
| campaign_id | string | yes | Campaign id. |
| claim_check | string | – | Relay campaigns: pass, fail or held for every enrolled contact. |
| contact_ids | array | – | Contact ids (up to 1000). |
| dry_run | boolean | – | – |
| evidence_url | string | – | Relay campaigns: the public link that backs the message, for every enrolled contact. |
| fields | object | – | Exact-match filter on custom fields. |
| idempotency_key | string | – | Optional. Repeating a call with the same key and the same arguments returns the first result instead of writing again, so retries are safe. |
| list | string | – | Alias of source. |
| on_conflict | string | – | skip (default) or move. |
| per_contact | object | – | Relay campaigns: contact id -> { claim_check, evidence_url }, overrides the two fields above for that contact. |
| q | string | – | Text in name, email or title. |
| source | string | – | Every contact from this source or list. |
| status | string | – | Every contact with this status. |
| tag | string | – | Every contact with this tag. |
No output schema declared.
No examples provided.
get_campaign Read a campaign ~37
One campaign with its steps, status, delivery mode (dry run or live) and counters.
| Name | Type | Req | Description |
|---|---|---|---|
| campaign_id | string | yes | Campaign id. |
No output schema declared.
No examples provided.
get_outbox Read the signed messages to send ~122
For a campaign that sends through your own sender (relay identity): the operator-approved messages you may send now, each with its exact text, recipient, step and evidence link, plus batch_id and batch_hash. Send the text byte for byte, then call report_send for every message. 409 batch_not_approved until the operator signs the batch; 409 batch_changed if anything changed after sign-off. Requires the manage_campaigns scope.
| Name | Type | Req | Description |
|---|---|---|---|
| campaign_id | string | yes | Campaign id. |
| limit | integer | – | Most messages to return (default 10). |
No output schema declared.
No examples provided.
get_policy Read the sending policy ~88
What the operator allows this agent: the workspace approval setting and, in plain words, what happens to your CRM writes and email drafts (apply or auto-approve at once, or wait for approval), this agent's mode (direct or propose), daily send caps and how many were used today, blocked domains, and the contact statuses that are never mailed. Read it before planning a batch of drafts.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_thread Read a contact's thread ~68
Sent mail and replies for one contact in time order. Requires the read_crm scope.
| Name | Type | Req | Description |
|---|---|---|---|
| contact_id | string | – | Or the contact id. |
| string | – | Or the contact email. | |
| thread_id | string | – | Thread id from an email or reply (thr_...). |
No output schema declared.
No examples provided.
launch_campaign Launch a campaign ~115
Start a draft campaign. Refused with launch_blockers (postal address, sender name, an email step, enrolled contacts, a verified identity) until they are fixed. With approval on, it returns 202 and waits for the operator to approve the launch once. Requires the manage_campaigns scope.
| Name | Type | Req | Description |
|---|---|---|---|
| campaign_id | string | yes | Campaign id. |
| idempotency_key | string | – | Optional. Repeating a call with the same key and the same arguments returns the first result instead of writing again, so retries are safe. |
No output schema declared.
No examples provided.
list_campaigns List campaigns ~53
Campaigns in this workspace with status, delivery mode and enrolled/sent/replied counters. Archived ones are hidden unless status=archived.
| Name | Type | Req | Description |
|---|---|---|---|
| status | string | – | draft, active, paused, completed or archived. |
No output schema declared.
No examples provided.
list_due_tasks List tasks that are due ~59
What is due now: overdue and due-today tasks first, then the next 7 days. Tasks on contacts who replied, unsubscribed or bounced are flagged follow_up_blocked: do not chase those. Requires manage_tasks or read_crm.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_email_status Check email drafts and sends ~149
Status of this agent's emails: pending_approval (only when approval is on), approved (with a note when it waits in the manual To send hand-off), rejected (with reject_reason to learn from), sent, failed, cancelled. Each email carries warnings (open_draft_exists, emailed_N_days_ago) and prior_emails. Filter by status (comma separated), run_id or contact_id.
| Name | Type | Req | Description |
|---|---|---|---|
| contact_id | string | – | Contact id. |
| cursor | string | – | next_cursor from a previous response. |
| limit | integer | – | Page size (default 50). |
| run_id | string | – | Run id. |
| status | string | – | For example rejected,failed. |
No output schema declared.
No examples provided.
list_replies List replies ~69
Replies captured from contacts, newest first. Requires the read_crm scope.
| Name | Type | Req | Description |
|---|---|---|---|
| contact_id | string | – | Only this contact. |
| cursor | string | – | next_cursor from a previous response. |
| limit | integer | – | – |
| since | string | – | ISO timestamp: only replies after it. |
No output schema declared.
No examples provided.
list_sending_identities List sending identities ~42
The identities a campaign can send through: the built-in dry_run identity and any the operator connected (their keys are never shown), with their delivery state.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_suppressions List the suppression list ~55
Addresses and domains that are never emailed.
| Name | Type | Req | Description |
|---|---|---|---|
| cursor | string | – | next_cursor from a previous response. |
| limit | integer | – | Page size (default 50). |
| q | string | – | Text to look for. |
No output schema declared.
No examples provided.
mark_replied Mark a contact as replied ~135
Record that a contact replied (optionally with the reply text). Sets the contact to replied, cancels their pending drafts and open follow-up tasks, and stops further drafts to them. Requires the write_crm scope.
| Name | Type | Req | Description |
|---|---|---|---|
| contact_id | string | – | Contact id. |
| string | – | Or the contact email. | |
| idempotency_key | string | – | Optional. Repeating a call with the same key and the same arguments returns the first result instead of writing again, so retries are safe. |
| subject | string | – | Reply subject. |
| text | string | – | The reply text, if you have it. |
No output schema declared.
No examples provided.
move_deal Move a deal to a stage ~90
Set a deal's stage (lead, contacted, qualified, proposal, won, lost). Requires the write_crm scope.
| Name | Type | Req | Description |
|---|---|---|---|
| deal_id | string | yes | Deal id. |
| idempotency_key | string | – | Optional. Repeating a call with the same key and the same arguments returns the first result instead of writing again, so retries are safe. |
| stage | string | yes | Target stage. |
No output schema declared.
No examples provided.
pause_campaign Pause a campaign ~84
Freeze a running campaign. Nothing is lost: resuming shifts every pending step by the length of the pause. Requires the manage_campaigns scope.
| Name | Type | Req | Description |
|---|---|---|---|
| campaign_id | string | yes | Campaign id. |
| idempotency_key | string | – | Optional. Repeating a call with the same key and the same arguments returns the first result instead of writing again, so retries are safe. |
No output schema declared.
No examples provided.
report_send Report what happened to a message ~220
Report one outbox message: sent (final: the person moves to the next step; reporting sent twice is fine, a different second report is 409 already_reported), refused_cap, refused_unsigned or failed_transient (the message stays in To send and gives its cap unit back), refused_suppressed (the person is suppressed and leaves the campaign). A later bounce is not a report: use add_suppression with reason bounced. Requires the manage_campaigns scope.
| Name | Type | Req | Description |
|---|---|---|---|
| campaign_id | string | yes | Campaign id. |
| email_id | string | yes | The email_id from get_outbox. |
| idempotency_key | string | – | Optional. Repeating a call with the same key and the same arguments returns the first result instead of writing again, so retries are safe. |
| outcome | string | yes | sent, refused_cap, refused_unsigned, failed_transient or refused_suppressed. |
| provider_id | string | – | The sender's own message id, when it has one. |
| reason | string | – | Short reason for a refusal. |
No output schema declared.
No examples provided.
resume_campaign Resume a campaign ~67
Resume a paused campaign. Requires the manage_campaigns scope.
| Name | Type | Req | Description |
|---|---|---|---|
| campaign_id | string | yes | Campaign id. |
| idempotency_key | string | – | Optional. Repeating a call with the same key and the same arguments returns the first result instead of writing again, so retries are safe. |
No output schema declared.
No examples provided.
search_contacts Search contacts ~163
Find contacts by text (name, email, title), status, source, company or a custom field. Returns up to `limit` contacts and a next_cursor. Requires the read_crm scope.
| Name | Type | Req | Description |
|---|---|---|---|
| company_id | string | – | Company id. |
| cursor | string | – | next_cursor from a previous response. |
| fields | object | – | Exact-match filter on custom fields, for example {"stack":"Next.js"}. |
| limit | integer | – | Page size (default 50). |
| q | string | – | Text to look for in name, email or title. |
| source | string | – | The list or prospecting run the contact came from. |
| status | string | – | One of new, contacted, replied, qualified, unsubscribed, bounced, closed. |
No output schema declared.
No examples provided.
simulate_campaign Simulate what goes out ~143
What would go out over the next N days: per contact and step, the send time (UTC and local), the fully rendered subject and body, and the status (will_send, skipped_missing_variable, skipped_condition, blocked_by_cap, task_created), plus problems and launch_blockers. Nothing is written or sent. It uses the same planner as the real scheduler, so this is what the scheduler will do.
| Name | Type | Req | Description |
|---|---|---|---|
| as_of | string | – | ISO date-time to simulate from, default now. |
| campaign_id | string | yes | Campaign id. |
| contacts | integer | – | How many contacts to render (default 1000). |
| horizon_days | integer | – | – |
No output schema declared.
No examples provided.
stop_enrollment Stop one contact's sequence ~81
Stop a single enrollment (reason manual). Requires the manage_campaigns scope.
| Name | Type | Req | Description |
|---|---|---|---|
| campaign_id | string | yes | Campaign id. |
| enrollment_id | string | yes | Enrollment id. |
| idempotency_key | string | – | Optional. Repeating a call with the same key and the same arguments returns the first result instead of writing again, so retries are safe. |
No output schema declared.
No examples provided.
update_campaign Edit a campaign ~412
Change a campaign's settings and/or replace its ordered steps. Editing the steps of a running campaign needs the operator's approval when approval is on. Requires the manage_campaigns scope.
| Name | Type | Req | Description |
|---|---|---|---|
| campaign_id | string | yes | Campaign id. |
| daily_cap | integer | – | – |
| description | string | – | New description. |
| footer | string | – | Relay identities only: full (default, your text plus the sender, postal address and unsubscribe link) or own (your step body is the whole message; set opt_out_line). |
| idempotency_key | string | – | Optional. Repeating a call with the same key and the same arguments returns the first result instead of writing again, so retries are safe. |
| identity_id | string | – | Sending identity id. |
| name | string | – | New name. |
| opt_out_line | string | – | With footer own: the exact words your body uses to let a reader opt out, for example reply "no". Every email body must contain it. |
| send_days | array | – | – |
| skip_dates | array | – | – |
| steps | array | – | Ordered steps. email: {type:"email", variants:[{subject, body, weight?}] or subject+body, condition?, reply_in_thread?}. wait: {type:"wait", days, business_days?}. task: {type:"task", title, due_in_d… |
| stop_on | array | – | – |
| strategy | string | – | New strategy text. |
| timezone | string | – | IANA zone. |
| timezone_mode | string | – | contact or fixed. |
| track_opens | boolean | – | – |
| window | object | – | – |
No output schema declared.
No examples provided.
update_contact Update a contact ~201
Change fields of an existing contact, found by id or email. Custom `fields` are merged with the existing ones. Requires the write_crm scope.
| Name | Type | Req | Description |
|---|---|---|---|
| company_id | string | – | Company id. |
| string | – | Find the contact by this email instead of the id. | |
| fields | object | – | Free-form custom columns, for example {"stack":"Next.js","funding":"seed"}. Values are strings or numbers. |
| id | string | – | Contact id. |
| idempotency_key | string | – | Optional. Repeating a call with the same key and the same arguments returns the first result instead of writing again, so retries are safe. |
| name | string | – | New name. |
| source | string | – | New source. |
| status | string | – | New status. |
| tags | array | – | – |
| timezone | string | – | IANA zone such as Europe/Paris. |
| title | string | – | New title. |
No output schema declared.
No examples provided.
upsert_contact Create or update a contact ~269
Create a contact, or update the one that already has this email (matched case-insensitively). Custom `fields` and `tags` are merged into what is stored. A company is created or reused from company_domain or company_name. Requires the write_crm scope.
| Name | Type | Req | Description |
|---|---|---|---|
| company_domain | string | – | Company domain, for example acme.com. |
| company_name | string | – | Company name. |
| string | yes | Contact email, the dedupe key. | |
| fields | object | – | Free-form custom columns, for example {"stack":"Next.js","funding":"seed"}. Values are strings or numbers. |
| idempotency_key | string | – | Optional. Repeating a call with the same key and the same arguments returns the first result instead of writing again, so retries are safe. |
| name | string | – | Full name. |
| source | string | – | The list or run this contact came from. |
| status | string | – | new, contacted, qualified or closed. replied, unsubscribed and bounced are set by the system or the operator. |
| tags | array | – | Short labels. |
| timezone | string | – | IANA zone such as Europe/Paris. Campaigns send inside the window in this zone. |
| title | string | – | Job title. |
No output schema declared.
No examples provided.
How do I install the Deskhand MCP server?
Deskhand is a hosted endpoint at https://deskhand.grain64.com/api/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · deskhand.grain64.com
claude mcp add --transport http com-grain64-deskhand-deskhand 'https://deskhand.grain64.com/api/mcp'
What is the Deskhand MCP server?
Deskhand is an MCP server listed in the public MCP registry as com.grain64.deskhand/deskhand. CRM and email desk for AI agents: key per agent, undo a run. Start with one POST, no account. This page covers its hosted endpoint (https://deskhand.grain64.com/api/mcp).
Is the Deskhand MCP server safe to use?
Deskhand scores 76 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Deskhand MCP server expose?
Deskhand exposes 30 tools: search_contacts, upsert_contact, update_contact, create_deal, move_deal, and 25 more. Their descriptions and schemas cost roughly 4,623 tokens of context every time the server is loaded.
Does the Deskhand MCP server require authentication?
Yes. Deskhand asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.
Is the Deskhand MCP server still maintained?
Deskhand is still listed as active in the MCP registry. We last reached this channel on 4 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.