Skip to main content
An AI assistant with access to your CRM can delete records, spend money and mint shareable links. Ringee’s MCP server treats those three categories differently from ordinary reads and writes.

​
Sensitivity classes

​
MCP annotations

Every tool carries the standard MCP trust hints, so a client can surface the right warning without knowing anything about Ringee: schedule_meeting, search_leads and reveal_lead are the open-world tools: they sync calendars, send invites, or query Apollo/Prospeo.

​
Hard guards in the server

Some protections do not depend on the client behaving well.
Two conditions must both hold:
  1. confirm is the literal boolean true;
  2. confirmPhoneNumber exactly matches the contact’s stored E.164 number.
A mismatch returns an error telling the assistant to re-fetch the contact and ask the user again. This makes it very hard to delete the wrong record from a fuzzy instruction like “delete that lead”.
update_contact and delete_contact re-read the contact and check it belongs to the active workspace before writing. Passing an id from another workspace fails.
delete_call_session marks the session revoked and invalidates every active token at once. Call history is preserved — the revoke is not a data deletion.
update_call_session can replace the contact queue only before the first call. Once dialing starts, the queue is frozen so progress and attribution stay coherent.

​
Credits

MCP tools never debit Ringee calling credits. Lead search and reveal spend your connected enrichment provider’s own allowance instead. The equivalent flows in the web app do charge Ringee credits — this difference is deliberate.
reveal_lead is explicitly flagged non-idempotent: repeating it spends the provider’s credits again. Assistants should not retry it automatically after an ambiguous failure.

​
What an assistant should do

The server-side rules exist as a backstop. Well-behaved assistants also follow these:
1

Resolve before acting

Use search_contacts or get_contact to resolve a real id before any write. Never act on an id the user did not approve.
2

Read the target back

Before a destructive action, state what will happen and to which record — name and phone number — and wait for an explicit yes.
3

Confirm spend

Before reveal_lead, say that provider credits will be spent and for which lead.
4

Treat links as secrets

Share a joinUrl only with the person who asked for it. Never post it into a shared channel unprompted.
5

Never auto-confirm

confirm: true must reflect a human decision, not the assistant’s own inference.
These rules ship as machine-readable guardrails in @ringee-io/agent, which is what the ringee CLI, the Claude skills and the ChatGPT app all build on.

​
CLI equivalents

The CLI enforces the same classes with explicit flags, so an autonomous agent cannot spend or delete by accident: See CLI commands.