Obriym CRM
REMOTE · OBRIYM-CRM.COM
Operate Obriym CRM from your AI assistant: leads, deals, orders, catalog, stock, marketplaces.
Available components
Last scanned (18 hours ago)
Scores higher than 98% of remote servers
Reachable. Last reached 5 Nov 2026.
Category CRM and Sales
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security94
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation is enforced on tool calls, advertised via RFC 9728 protected-resource metadata. Discovery is public, which costs nothing: no tool can be invoked without a token. View diagnostics → Pass
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
- The authorisation server offers only Dynamic Client Registration (RFC 7591), which MCP 2026-07-28 deprecated in favour of Client ID Metadata Documents. View diagnostics → Partial
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability79
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 26080 tokens (~230/item across 113 items; 113 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management99
- Stability check failed: schema churn in the 30 days we've observed: 0 tool removals, 1 breaking changes, 0 auth/transport breaks, 38 additions. See how to fix → Fail
Tool Coverage97
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 91% of tool parameters carry a description.Partial
Tool Safety50
- Injection-marker check failed: the description of tool "publish_ebay_drafts" contains an instruction to conceal the call from the user, the text "Never tell the user", at byte 411 of that field. See how to fix → Fail
- All 12 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 114 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
Checks we ran (13)
- TLS certificate
- Authorization
- HTTPS
- HSTS header
- DNSSEC
- Transport
- Schema quality
- Stability
- Tool coverage
- Injection markers
- Destructive annotations
- Judged manipulation
- MCP protocol
Does not apply to this hosted endpoint (2)
- Supply Chain SecurityScored on package channels only. This is a hosted endpoint, so there is nothing to install or inspect.
- Provenance & TransparencyScored on package channels only. This is a hosted endpoint, so there is nothing to install or inspect.
The score does not measure everything. What the score does not measure →
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 26 Oct 26 0
- Tool “get_customer” rewrote its description, which is the text the model reads security
- Tool “list_customers” rewrote its description, which is the text the model reads security
- Tool “list_people_customers” rewrote its description, which is the text the model reads security
- Tool “publish_ebay_variation_listing” rewrote its description, which is the text the model reads security
- Tool “save_ebay_variation_listing” rewrote its description, which is the text the model reads security
- Server version: 1.20.0 → 1.21.0 functional
- “list_orders” reworded the description of “status” cosmetic
- “search_products” reworded the description of “sort” cosmetic
- “update_order_status” reworded the description of “status” cosmetic
- 20 Oct 26 0
- New tool “push_google_merchant_catalog”, which the server declares destructive security
- Tool “get_marketplace” rewrote its description, which is the text the model reads security
- Tool “list_marketplaces” rewrote its description, which is the text the model reads security
- Tool “get_product” rewrote its description, which is the text the model reads security
- Tool “search_products” rewrote its description, which is the text the model reads security
- Tool “get_customer” rewrote its description, which is the text the model reads security
- Tool “list_customers” rewrote its description, which is the text the model reads security
- Server version: 1.19.0 → 1.20.0 functional
- Server version: 1.18.1 → 1.19.0 functional
- Server version: 1.18.0 → 1.18.1 functional
- New tool “get_person_customer” functional
- New tool “list_people_customers” functional
- “search_products” added an optional parameter “supplierId” cosmetic
- “search_products” added an optional parameter “supplierStock” cosmetic
- “check_channel_readiness” reworded the description of “platform” cosmetic
- “get_marketplace” reworded the description of “platform” cosmetic
- “list_channel_products” reworded the description of “platform” cosmetic
- “list_customers” reworded the description of “wonDealsMin” cosmetic
- 18 Oct 26 0
- Tool “list_content_channels” rewrote its description, which is the text the model reads security
- Tool “list_published_posts” rewrote its description, which is the text the model reads security
- Server version: 1.17.0 → 1.18.0 functional
- “list_published_posts” reworded the description of “channel” cosmetic
- 17 Oct 26 −1
- Stability: pass → fail ▼ security
- Tool “add_order_item” rewrote its description, which is the text the model reads security
- Tool “create_order” rewrote its description, which is the text the model reads security
- Tool “update_order_item” rewrote its description, which is the text the model reads security
- “create_order” made “currency” required, so existing callers break ▼ functional
- Server version: 1.16.2 → 1.17.0 functional
- New tool “quote_order_promotion” functional
- “create_order” added an optional parameter “promotion” cosmetic
- “create_order” reworded the description of “currency” cosmetic
- “create_order” dropped the optional parameter “discountAmount” cosmetic
- “create_order” dropped the optional parameter “promoCode” cosmetic
- 15 Oct 26 0
- Tool “create_company” rewrote its description, which is the text the model reads security
- Tool “update_company” rewrote its description, which is the text the model reads security
- Server version: 1.16.0 → 1.16.2 functional
- “create_company” added an optional parameter “bankName” cosmetic
- “create_company” added an optional parameter “counterpartyType” cosmetic
- “create_company” added an optional parameter “creditLimit” cosmetic
- “create_company” added an optional parameter “creditLimitCurrency” cosmetic
- “create_company” added an optional parameter “deliveryAddress” cosmetic
- “create_company” added an optional parameter “edrpou” cosmetic
- “create_company” added an optional parameter “email” cosmetic
- “create_company” added an optional parameter “iban” cosmetic
- “create_company” added an optional parameter “legalAddress” cosmetic
- “create_company” added an optional parameter “paymentTermsDays” cosmetic
- “create_company” added an optional parameter “phone” cosmetic
- “create_company” added an optional parameter “representationState” cosmetic
- “create_company” added an optional parameter “tags” cosmetic
- “create_company” added an optional parameter “taxGroup” cosmetic
- “create_company” added an optional parameter “taxSystem” cosmetic
- “create_company” added an optional parameter “vatNumber” cosmetic
- “create_company” added an optional parameter “vatPayer” cosmetic
- “create_contact” added an optional parameter “documentRole” cosmetic
- 14 Oct 26 0
- The server rewrote its instructions, which are the text every model session reads security
- Server version: 1.14.0 → 1.16.0 functional
- New tool “get_obriym_product_facts” functional
- 12 Oct 26 0
- New tool “delete_category”, which the server declares destructive security
- Tool “list_categories” rewrote its description, which is the text the model reads security
- Tool “create_category” rewrote its description, which is the text the model reads security
- Tool “list_content_channels” rewrote its description, which is the text the model reads security
- Tool “update_category” rewrote its description, which is the text the model reads security
- Server version: 1.13.0 → 1.14.0 functional
- New tool “get_category” functional
- New tool “get_lead_conversation” functional
- New tool “list_conversations” functional
- New tool “list_published_posts” functional
- New tool “search_marketplace_categories” functional
- “create_category” added an optional parameter “marketplaceCategories” cosmetic
- “create_category” reworded the description of “googleProductCategory” cosmetic
- 10 Oct 26 0
- Schema quality: 14432 → 21409 ▼ functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Probed https://obriym-crm.com/api/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=obriym-crm.com | CN=YR2,O=Let's Encrypt,C=US | 6 Oct 2026 | 4 Jan 2027 | RSA 2048 | SHA256-RSA | 63c2523d33c945df82b3ebfe0bf75ed1153 |
| SANs: obriym-crm.com | ||||||
| CN=YR2,O=Let's Encrypt,C=US (CA) | CN=Root YR,O=ISRG,C=US | 3 Sept 2025 | 2 Sept 2028 | RSA 2048 | SHA256-RSA | 4ebd24947e24d394802d84a52fd5b319 |
| CN=Root YR,O=ISRG,C=US (CA) | CN=ISRG Root X1,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | RSA 4096 | SHA256-RSA | f24b6d17f9d9ad7cb1c9fea78782699f |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of obriym-crm.com. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | Trust anchor | 20326, 38696 | 8, 8 | Verified |
| com. | DS published | 19718 | 13 | Verified |
| obriym-crm.com. | No DS | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication Enforced and verified
The endpoint asked for a token and published valid RFC 9728 metadata describing how to get one.
| Result | Enforced and verified |
|---|---|
| Enforced | On tool calls |
| HTTP status | 200 |
WWW-Authenticate challenge Bearer error="invalid_token", error_description="Authentication required for this tool", resource_metadata="https://obriym-crm.com/.well-known/oauth-protected-resource"
Bearer error="invalid_token", error_description="Authentication required for this tool", resource_metadata="https://obriym-crm.com/.well-known/oauth-protected-resource" | Header | Value |
|---|---|
| strict-transport-security | max-age=63072000; includeSubDomains; preload |
| x-content-type-options | nosniff |
| x-frame-options | SAMEORIGIN |
| referrer-policy | strict-origin-when-cross-origin |
| permissions-policy | camera=(), microphone=(), geolocation=(), browsing-topics=() |
Protected resource metadata
| Document | https://obriym-crm.com/.well-known/oauth-protected-resource |
|---|---|
| Retrieved | Yes |
| Resource | https://obriym-crm.com/api/mcp |
| Authorisation server | https://obriym-crm.com/api/auth |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://obriym-crm.com/api/mcp | Verified | 200 | |
| http (plaintext) | http://obriym-crm.com/api/mcp | HTTPS enforced | 308 | https://obriym-crm.com/api/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
update_content_post Update post ~249
Change a draft or scheduled post: working title, main text, hashtags, format, or its channels and their own texts (sending channels replaces the whole set). Fields you omit stay as they are; images cannot be changed here. Refused for a published post — a post already live on a network cannot be changed from Obriym; create a new one instead. Refused while the post is being published. Repeating the same call changes nothing further. Echoes the workspace.
| Name | Type | Req | Description |
|---|---|---|---|
| channels | array | – | Replaces the post's channels and their texts. Omit to keep them as they are. |
| format | string | – | post = a regular feed post; story = an Instagram/Facebook story, which needs an image. Defaults to post. |
| hashtags | array | – | Replaces the hashtags, without the "#" sign. Omit to keep them; [] removes them. |
| id | string | yes | The publication id returned by create_content_post or list_content_posts. |
| text | string | – | Replaces the main text. |
| title | string | – | An internal working title shown in Obriym's Publications list, e.g. "Monday — new arrivals". Never published. |
No output schema declared.
No examples provided.
update_lead Update lead ~79
Update fields on an existing lead by id. Provide a patch with at least one field. Use search_leads first to find the lead id. The result echoes the operating workspace.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | The lead id returned by search_leads. |
| patch | object | yes | The lead fields to update; include at least one changed field. |
No output schema declared.
No examples provided.
update_order_item Update order item ~181
Update a line item on an order (quantity, unit price, discount, name, or SKU). Recomputes the order total. Only allowed while the order is pending or confirmed; otherwise it fails with 409 CONFLICT "Order lines can only be changed while the order is pending or confirmed" (stock is committed from processing on). Use get_order to find the order's externalId and the item's itemId. The CRM recalculates shipping eligibility from the saved priced lines; a separate whole-order discount may require source-confirmed amount correction. The result echoes the operating workspace.
| Name | Type | Req | Description |
|---|---|---|---|
| externalId | string | yes | The order externalId returned by list_orders or create_order. |
| itemId | string | yes | The order item id returned by get_order. |
| patch | object | yes | The order item fields to update; include at least one changed field. |
No output schema declared.
No examples provided.
update_order_status Update order status ~115
Move an order to a new status by externalId. Only valid transitions from the current status are allowed. Use list_orders to find the externalId and get_order to see the current status. The result echoes the operating workspace.
| Name | Type | Req | Description |
|---|---|---|---|
| externalId | string | yes | The order externalId returned by list_orders or create_order. |
| status | string | yes | The new order status. Only valid transitions from the current status are accepted. Allowed values: pending, confirmed, processing, ready_to_ship, shipped, delivered, cancelled, refunded. |
No output schema declared.
No examples provided.
update_product Update product ~279
Update fields on an existing catalog product by id — including status, to publish a draft or archive a product. Provide a patch with at least one field; use get_product first to see the current values. A changed stock number is applied as a relative movement and recorded in the product stock history; prefer adjust_stock when the intent is a correction with a reason. A bundle's stock is derived from its components, so a stock sent for a bundle is refused; sending bundleItems replaces its composition. A product's type (simple or bundle) cannot change after creation — create a new product instead — and a product that is a component of a bundle that is not archived cannot be archived. A change to price, stock, tracking or status is pushed to every connected sales channel. For a product that belongs to a model, a changed shared field (name, description, category, brand, unit, keywords, videos, material, pattern, gender, age group, size type, condition) is applied to the whole model and every article of it; productGroupId null detaches the product from its model, and the code of another model moves it there. The result echoes the operating workspace.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | The product id returned by search_products. |
| patch | object | yes | The product fields to update; include at least one changed field. |
No output schema declared.
No examples provided.
update_product_images Reorder, caption or remove product images ~277
Reorder, caption or REMOVE the photos a product already has. Send the photos as they should be afterwards: the order given is the display order (the first is the main photo), each alt replaces the stored caption (empty clears it), and a current photo you leave out is removed from the product (the stored file is kept, exactly as when a person removes a photo in the product form). Returns the new list and how many were removed. It never adds photos: every url must already belong to the product, otherwise the call is refused and nothing changes — use add_product_images to add. Idempotent: the same call twice leaves the same result. Saves through the product form's own operation. Call get_product first and copy the urls exactly. The result echoes the workspace.
| Name | Type | Req | Description |
|---|---|---|---|
| images | array | yes | The product's photos as they should be AFTER the change: the order given becomes the display order (the first is the main photo) and each alt replaces the stored caption (empty clears it). A current… |
| productId | string | yes | The product id from search_products or get_product. |
No output schema declared.
No examples provided.
upsert_brand_translation Set a brand translation ~210
Set a brand's DESCRIPTION in ONE language, leaving every other language as it is; null or an empty description removes that language. Translate the text yourself — Obriym does not translate for MCP clients. Never translate a brand NAME: marketplaces match it verbatim. Call list_content_locales first; the workspace's base language is refused (use update_brand for it). update_brand's translations field REPLACES the whole set, so use this tool to change a single language. Idempotent. Returns a warning when the CRM does not show that language yet. Echoes the workspace.
| Name | Type | Req | Description |
|---|---|---|---|
| brandId | string | yes | The brand id returned by list_brands. |
| description | – | yes | The brand description in this language. null or an empty string clears that language. The brand NAME is never translated. |
| locale | string | yes | The language to write, as an ISO 639-1 code. Call list_content_locales for the codes this workspace uses; never the workspace's base language. |
No output schema declared.
No examples provided.
upsert_category_translation Set a category translation ~242
Set a category's name and/or description in ONE language, leaving every other language as it is. Translate the text yourself — Obriym does not translate for MCP clients. Call list_content_locales first; the workspace's base language is refused (use update_category for it). A language needs a translated name before it can hold a description; description null clears it. Idempotent: repeating the same call changes nothing. update_category's translations field REPLACES the whole set, so use this tool to change a single language. Returns a warning when the CRM does not show that language yet. Echoes the workspace.
| Name | Type | Req | Description |
|---|---|---|---|
| categoryId | string | yes | The category id returned by list_categories. |
| description | – | – | The category description in this language. null or an empty string clears it. Cannot be stored for a language that has no translated name. |
| locale | string | yes | The language to write, as an ISO 639-1 code. Call list_content_locales for the codes this workspace uses; never the workspace's base language. |
| name | string | – | The category name in this language. Required the first time a language is written. |
No output schema declared.
No examples provided.
upsert_product_attributes Set product characteristics ~260
Add or update characteristics (name, value, unit) on ONE product without removing the ones not named. Names match case-insensitively; a new name is appended. For eBay, use the item-specific names exactly as inspect_ebay_listings reported them (details.aspects), in the eBay site's own language — 'Marca' on ebay.it, not 'Brand'. Never invent a value: ask the user. Saves through the same product-card operation as the CRM form, with a version check (on CONFLICT re-read and retry). On a product that belongs to a model: when it is the model's only article, the characteristics are the model's and change for the model; when the model has other articles, a value set here applies to this article only — a characteristic shared by every article is changed on the model card. Idempotent. The result echoes the workspace.
| Name | Type | Req | Description |
|---|---|---|---|
| attributes | array | yes | Characteristics to add or update. Match is case-insensitive by name; every existing characteristic not named here is preserved. Use name/value/unit objects, for example {name:'Stile',value:'Casual',u… |
| id | string | yes | The product id returned by search_products or get_product. |
No output schema declared.
No examples provided.
upsert_product_prices Set product prices in other currencies ~371
Add, update or REMOVE the price-list rows of ONE product — the price it sells at in another currency, for example EUR for an eBay site — keeping its other currencies and its own workspace-currency price. Send only an amount the user stated: never a converted or estimated price; to drop a currency send its code in remove. The product's own currency is refused; change that with update_product's price. A price for one channel only is set_product_channel_price; see all of a product's prices with get_product_pricing. Saves through the same product-card operation as the CRM form, with a version check (on CONFLICT re-read the product and retry), and the new price reaches connected channels like a manual edit. Idempotent. The result echoes the workspace.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | The product id returned by search_products or get_product. |
| prices | array | – | Price-list rows to add or update, one per currency (uppercase 3-letter ISO code, e.g. EUR), an amount greater than 0 — the price the product sells at in that currency on every channel that trades in… |
| remove | array | – | Currencies whose price-list row to REMOVE (uppercase 3-letter ISO code). The product stops being sold in that currency on channels that trade in it. The product's own workspace currency cannot be rem… |
No output schema declared.
No examples provided.
upsert_product_translation Set a product translation ~448
Write ONE language of ONE product's translation — title, description, keywords, colour, material, pattern and its characteristics (attributes: keyed by the characteristic's name exactly as get_product returns it, each with a translated name and/or value) in that language — keeping the other languages and every field not named. A characteristic name the product does not have is refused with the list of its names. Call list_content_locales first and write only an offered language, never the base one. Use it when a marketplace publishes in another language (ebay.it reads Italian, Prom and Rozetka read uk and ru) or inspect_ebay_listings reports a title over 80 characters in the site's language. Translate the product's OWN text from get_product and add no fact it does not state; show the user the text before writing. For a product that belongs to a model the translation is the model's, so every article of it changes. Saves through the CRM's own Переклади tab operation with its version check (on CONFLICT re-read the product and retry). Idempotent. The result echoes the workspace.
| Name | Type | Req | Description |
|---|---|---|---|
| attributes | object | – | Translated characteristics, keyed by the characteristic's BASE name exactly as the product shows it (see get_product). Each key is merged into what is stored; other characteristics and languages stay… |
| color | string | – | Colour name. |
| description | string | – | The description in this language. An empty string clears it. |
| id | string | yes | The product id returned by search_products or get_product. |
| keywords | array | – | Search keywords in this language; replaces the list. |
| locale | string | yes | The language to write, as an ISO 639-1 code — for a marketplace, the site's own language (it on ebay.it, de on ebay.de, uk or ru for Prom and Rozetka). |
| material | string | – | Material. |
| name | string | – | The product title in this language. eBay shows at most 80 characters. An empty string clears it, so the base name publishes. |
| pattern | string | – | Pattern. |
No output schema declared.
No examples provided.
withdraw_ebay_listings Withdraw eBay listings ~120
End the LIVE eBay listing of up to 25 products: they stop being buyer-visible and their offers return to drafts — nothing is deleted, and publish_ebay_drafts can put them back. Needs the owner's AI publishing switch. Returns done, failed and notAttempted. The result echoes the workspace.
| Name | Type | Req | Description |
|---|---|---|---|
| productIds | array | yes | End each product's LIVE eBay listing, at most 25 ids fetched with search_products. The listing stops being buyer-visible and its offer returns to a draft — it is NOT deleted. |
No output schema declared.
No examples provided.
withdraw_ebay_variation_listing End a model's eBay variation listing ~143
End a model's LIVE eBay multi-variation listing: every variation leaves sale at once. The group and its offers stay on eBay as a draft, so publish_ebay_variation_listing restores the same listing. Works while listing creation is disarmed (a way off eBay is never locked), but is refused until the workspace owner switches on AI publishing. Returns withdrawn. The result echoes the workspace.
| Name | Type | Req | Description |
|---|---|---|---|
| model | string | yes | The product model: its code — the productGroupId get_product and search_products return for every article of it — or its id. Its active articles on the eBay channel become the listing's variations. |
No output schema declared.
No examples provided.
How do I install the Obriym CRM MCP server?
Obriym CRM is a hosted endpoint at https://obriym-crm.com/api/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · obriym-crm.com
claude mcp add --transport http com-obriym-crm-mcp 'https://obriym-crm.com/api/mcp'
What is the Obriym CRM MCP server?
Obriym CRM is an MCP server listed in the public MCP registry as com.obriym-crm/mcp. Operate Obriym CRM from your AI assistant: leads, deals, orders, catalog, stock, marketplaces. This page covers its hosted endpoint (https://obriym-crm.com/api/mcp).
Is the Obriym CRM MCP server safe to use?
Obriym CRM scores 90 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Obriym CRM MCP server expose?
Obriym CRM exposes 113 tools: search_leads, get_lead, list_conversations, get_lead_conversation, search_deals, and 108 more. Their descriptions and schemas cost roughly 25,704 tokens of context every time the server is loaded.
Does the Obriym CRM MCP server require authentication?
Yes. Obriym CRM asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.
Is the Obriym CRM MCP server still maintained?
Obriym CRM is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What did VerifyMCP test on the Obriym CRM MCP server?
VerifyMCP ran 13 checks on Obriym CRM, covering TLS certificate, Authorization, HTTPS, HSTS header and 9 more. Supply Chain Security and Provenance & Transparency do not apply to a hosted endpoint, so they were not tested. The score does not measure everything, and the scoring documentation lists what it leaves out.