# CRM Lifecycle Ops (npm · crm-lifecycle-ops)

AI copilot for lifecycle and CRM ops on Braze, Klaviyo and Iterable. Read-only.

- Trust score: 68/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

## Components

- npm · `crm-lifecycle-ops`: 68/100 (this document), [markdown](https://verifymcp.io/servers/har5h98-crm-lifecycle-ops/crm-lifecycle-ops.md), [page](https://verifymcp.io/servers/har5h98-crm-lifecycle-ops/crm-lifecycle-ops)

## Channel facts

- Registry: `npm`
- Package: `crm-lifecycle-ops`
- Version: `0.5.1`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Supply Chain Security**: 100/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - No install/post-install scripts declared.
  - No production dependencies, so there is no dependency health to assess.
- **Provenance & Transparency**: 48/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 1 days ago).
  - Publishes a security disclosure policy (SECURITY.md).
- **Schema Quality & AI Usability**: 65/100
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 2321 tokens (~116/item across 20 items; 20 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 86/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 57% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 20 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 20 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### How do I install the CRM Lifecycle Ops MCP server?

CRM Lifecycle Ops runs locally as an npm package, launched with npx -y crm-lifecycle-ops. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add har5h98-crm-lifecycle-ops -- npx -y crm-lifecycle-ops
```

### Cursor

```json
{
  "mcpServers": {
    "har5h98-crm-lifecycle-ops": {
      "command": "npx",
      "args": [
        "-y",
        "crm-lifecycle-ops"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "har5h98-crm-lifecycle-ops": {
      "command": "npx",
      "args": [
        "-y",
        "crm-lifecycle-ops"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add har5h98-crm-lifecycle-ops -- npx -y crm-lifecycle-ops
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "har5h98-crm-lifecycle-ops": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "crm-lifecycle-ops"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add har5h98-crm-lifecycle-ops --command npx --arg -y --arg crm-lifecycle-ops
```

### Hermes

```yaml
mcp_servers:
  har5h98-crm-lifecycle-ops:
    command: "npx"
    args: ["-y", "crm-lifecycle-ops"]
```

### Netclaw

```json
{
  "McpServers": {
    "har5h98-crm-lifecycle-ops": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "crm-lifecycle-ops"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add har5h98-crm-lifecycle-ops -t stdio -c npx -a -y crm-lifecycle-ops
```

### Other

```json
{
  "mcpServers": {
    "har5h98-crm-lifecycle-ops": {
      "command": "npx",
      "args": [
        "-y",
        "crm-lifecycle-ops"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-04 (score 68, +26)

- [security improvement] Malware scan: unverified → pass
- [security improvement] Known CVEs: unverified → pass
- [functional improvement] Dependency health: unverified → pass

### 2026-11-03 (score 42)

First indexed and scored.

## MCP tools (20)

### `check_email` (~240 tokens)

Check an email

QA one email before it sends, using the team's house rules: HTML structure, Outlook conditionals, Gmail clipping, alt text, links (non-production hosts, unsubscribe, UTMs, approved domains), personalization rendered for several synthetic personas, subject line, sender, brand terms, spelling variant and required footer text. Pass HTML or a local file path. Read-only; sends nothing.

Input parameters:

- `check_links_live` (boolean): Also check each link over the network (HEAD requests only; unsubscribe and click-tracking links are never requested).
- `file` (string): Absolute path to a local .html file, used when html is not given.
- `from` (string): Sender email address.
- `html` (string): The email HTML, including template tags.
- `name` (string)
- `personas` (array): Synthetic test profiles. Leave empty to use the team's personas or auto-generated ones.
- `platform` (string, required): Which platform's template language the email uses.
- `preheader` (string)
- `subject` (string)
- `transactional` (boolean): Receipts, password resets and other transactional mail: skips the unsubscribe requirement.

### `check_message` (~243 tokens)

Check a push, SMS, in-app, content card or webhook

QA one push notification, SMS/MMS, in-app message, content card or webhook using the team's house rules: renders personalization for several synthetic personas, then checks length against lock-screen / segment / in-app / card limits, SMS encoding and billed segments, opt-out wording and sender name, deep links and other links (non-production hosts, malformed URIs), buttons, webhook URL, secrets in URLs and JSON bodies that break on quotes, brand terms and spelling. Read-only; sends nothing.

Input parameters:

- `body` (string, required): Push body/alert, SMS text, or in-app message body (text or HTML).
- `buttons` (array): In-app buttons.
- `channel` (string, required)
- `deep_link` (string): Tap-through destination: deep link or URL.
- `image_url` (string)
- `name` (string)
- `personas` (array)
- `platform` (string, required): Which platform's template language the message uses.
- `title` (string): Push title or in-app header.
- `webhook_method` (string): Webhook HTTP method (POST, GET…).
- `webhook_url` (string): Webhook destination URL.

### `check_campaign` (~96 tokens)

Check a campaign or journey

QA every message in a campaign or journey (Canvas/flow): emails with content blocks expanded, push, SMS and in-app, plus its settings: audience, conversion events, naming and journey structure (dead ends, unreachable steps).

Input parameters:

- `name_or_id` (string, required)
- `platform` (string, required): Which platform.
- `workspace` (string): Workspace label. Defaults to the connected one, or "demo" when nothing is connected.

### `list_checks` (~45 tokens)

List all checks

Every check, with its id, default severity and what it catches, plus which ones are locked (can't be turned off). Use to explain a finding or fill in a problem report.

### `get_house_rules` (~34 tokens)

Show house rules

The team's rulebook (what counts as right for them) and where it's stored. Returns defaults if /setup hasn't run.

### `save_house_rules` (~79 tokens)

Save house rules

Replace the team's rulebook. Always show the person the changes and get a yes first. Locked checks can't be overridden. Schema: locale, brand, links, compliance, senders, personalization, style, naming, severity, exceptions.

Input parameters:

- `rules` (object, required): The full rulebook object (get it with get_house_rules, edit, save).

### `add_exception` (~84 tokens)

Mark a finding as fine for us

Record that a finding is acceptable for this team (not a tool bug), with a reason. Optionally scoped by `match` text. Locked checks can't be waived. For tool bugs use /report-problem instead.

Input parameters:

- `check_id` (string, required)
- `match` (string): Only waive findings whose message/evidence contains this text.
- `reason` (string, required)

### `learn_from_email` (~89 tokens)

Learn conventions from a good email

Read an email the team considers correct and propose house rules from it: link domains, UTM params and values, sender, name fallback, US/GB spelling, subject style, footer and postal address. Proposals only; confirm with the person before saving.

Input parameters:

- `file` (string)
- `from` (string)
- `html` (string)
- `subject` (string)

### `connection_status` (~49 tokens)

Connection status

Which platforms have keys set (keys themselves are never shown), test each connection, and list the environment variables each platform needs.

Input parameters:

- `test` (boolean): Also make one read-only call per connected platform.

### `refresh_account` (~71 tokens)

Refresh account snapshot

Pull the latest campaigns, journeys, segments, templates and content blocks into a local snapshot (read-only API calls), then report what changed since the previous one. Set demo: true to load the fictional Fernbrook Market demo account instead.

Input parameters:

- `demo` (boolean)
- `platform` (string, required): Which platform.

### `list_items` (~101 tokens)

Find campaigns, journeys, segments or blocks

Search the latest snapshot by name. Use it to resolve what the person means before checking, mapping or analysing impact.

Input parameters:

- `active_only` (boolean)
- `kind` (string)
- `limit` (integer): Max results per kind (default 50).
- `platform` (string, required): Which platform.
- `query` (string)
- `workspace` (string): Workspace label. Defaults to the connected one, or "demo" when nothing is connected.

### `record_audience` (~121 tokens)

Record an audience seen on screen

Fill an API gap: record which segment/list a campaign or journey targets, as read from the platform's dashboard (e.g. via Claude in Chrome). Stored as 'seen-on-screen' with today's date on the latest snapshot.

Input parameters:

- `item` (string, required): Campaign or journey name or id.
- `mode` (string)
- `platform` (string, required): Which platform.
- `segment` (string, required): Segment or list name or id.
- `workspace` (string): Workspace label. Defaults to the connected one, or "demo" when nothing is connected.

### `what_breaks` (~137 tokens)

What breaks if I change this

Everything that depends on an attribute, segment/list, content block, event, message or piece of text, live items first, each with how we know (api-verified, parsed from template, seen on screen…) and a list of live items we can't rule out.

Input parameters:

- `kind` (string, required)
- `platform` (string, required): Which platform.
- `value` (string, required): Name or id, e.g. loyalty_tier, VIP members, footer_v2, Order Placed, or a phrase/URL.
- `workspace` (string): Workspace label. Defaults to the connected one, or "demo" when nothing is connected.

### `what_changed` (~99 tokens)

What changed in the account

Differences between the latest snapshot and the previous one (or the newest one taken before `since`): added, removed, status changes, content, audience and structure edits. Live items first.

Input parameters:

- `platform` (string, required): Which platform.
- `since` (string): ISO date, e.g. 2026-11-01
- `workspace` (string): Workspace label. Defaults to the connected one, or "demo" when nothing is connected.

### `show_journey` (~81 tokens)

Show a journey

A Mermaid diagram of a live journey (Canvas/flow) with subject lines, plus structural problems (dead ends, unreachable steps, empty message steps).

Input parameters:

- `name_or_id` (string, required)
- `platform` (string, required): Which platform.
- `workspace` (string): Workspace label. Defaults to the connected one, or "demo" when nothing is connected.

### `find_overlaps` (~112 tokens)

Find overlaps with live programs

For a planned journey or campaign: which live campaigns/journeys already target the same segments or lists, trigger on the same events, or use the same attributes, and which live items can't be ruled out.

Input parameters:

- `attributes` (array)
- `events` (array)
- `lists` (array)
- `platform` (string, required): Which platform.
- `segments` (array)
- `workspace` (string): Workspace label. Defaults to the connected one, or "demo" when nothing is connected.

### `bulk_edit_preview` (~105 tokens)

Preview a bulk edit

Find text (or a regex) across every subject, preheader, body and content block and preview the replacement, live items first. Preview only; nothing is written.

Input parameters:

- `active_only` (boolean)
- `find` (string, required)
- `platform` (string, required): Which platform.
- `regex` (boolean)
- `replace` (string, required)
- `workspace` (string): Workspace label. Defaults to the connected one, or "demo" when nothing is connected.

### `how_to` (~374 tokens)

Platform-specific build or edit instructions

Step-by-step instructions for a build or edit task in Braze, Klaviyo or Iterable, in that platform's own terms, from a procedure library verified against the vendors' docs (with links). Filled in with the team's house rules (naming, sender, UTMs, fallback syntax, footer, channel limits) and, when a snapshot exists, the account: segments and blocks to reuse, whether the target is live, and shared content that would change other live programs. The plugin never edits the account; a person follows the steps. Tasks: create-campaign (Create a one-off or scheduled campaign); create-journey (Create a multi-step journey); edit-live-journey (Change a journey that's already live); edit-live-message (Change the copy of a live or scheduled message); edit-shared-content (Change a shared content block / snippet used in live messages); change-audience (Change who a campaign or journey targets, or add exclusions); link-tracking (Add UTM parameters and click tracking); frequency-and-quiet-hours (Set frequency caps, rate limits and quiet hours); conversion-tracking (Set the conversion event / metric); ab-test (Run an A/B or multivariate test); test-and-preview (Preview as a user and send tests); pause-stop-duplicate (Pause, stop or duplicate).

Input parameters:

- `attributes` (array): Personalization attributes the copy will use.
- `audience` (string): Who it's for, in plain words, to find segments to reuse.
- `channels` (array)
- `platform` (string, required): Which platform.
- `target` (string): Existing campaign or journey being changed (edit tasks).
- `task` (string, required)
- `workspace` (string): Workspace label. Defaults to the connected one, or "demo" when nothing is connected.

### `launch_health` (~63 tokens)

Launch health

Recent delivery numbers for a campaign or journey (sent, delivered, bounces, unsubscribes, spam complaints, opens, clicks) judged against stated thresholds. Needs a connected account.

Input parameters:

- `name_or_id` (string, required)
- `platform` (string, required): Which platform.

### `ops_report` (~98 tokens)

Ops report

From the usage log: messages and campaigns checked, blocking problems caught, most common findings, weekly trend and estimated hours saved (assumption stated). With team: true, totals every operator's log in the shared team folder and breaks it down per operator.

Input parameters:

- `days` (integer)
- `minutes_per_manual_check` (number)
- `team` (boolean): Report across the whole team (needs the team report folder set in plugin settings).

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/har5h98-crm-lifecycle-ops/crm-lifecycle-ops#diagnostics

## Score history

- 2026-11-05: 68
- 2026-11-04: 68
- 2026-11-03: 42

## Common questions

### What is the CRM Lifecycle Ops MCP server?

CRM Lifecycle Ops is an MCP server listed in the public MCP registry as io.github.har5h98/crm-lifecycle-ops. AI copilot for lifecycle and CRM ops on Braze, Klaviyo and Iterable. Read-only. This page covers its npm package (crm-lifecycle-ops).

### Is the CRM Lifecycle Ops MCP server safe to use?

CRM Lifecycle Ops scores 68 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the CRM Lifecycle Ops MCP server expose?

CRM Lifecycle Ops exposes 20 tools: check_email, check_message, check_campaign, list_checks, get_house_rules, and 15 more. Their descriptions and schemas cost roughly 2,321 tokens of context every time the server is loaded.

### Is the CRM Lifecycle Ops MCP server still maintained?

CRM Lifecycle Ops is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the CRM Lifecycle Ops MCP server under?

CRM Lifecycle Ops declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- npm package: https://www.npmjs.com/package/crm-lifecycle-ops
- Socket report: https://socket.dev/npm/package/crm-lifecycle-ops
- Repository: https://github.com/har5h98/crm-lifecycle-ops
- Changelog RSS feed: https://verifymcp.io/servers/har5h98-crm-lifecycle-ops/crm-lifecycle-ops.xml
- Changelog JSON feed: https://verifymcp.io/servers/har5h98-crm-lifecycle-ops/crm-lifecycle-ops.json
- HTML version of this page: https://verifymcp.io/servers/har5h98-crm-lifecycle-ops/crm-lifecycle-ops