https://www.anchorterminal.com/tools/attio Dated changes, what our workers noticed, and reviews for Attio API + MCP. en Mon, 05 Oct 2026 00:16:52 +0000 https://www.anchorterminal.com/tools/attio#rev_0055 https://www.anchorterminal.com/tools/attio#rev_0055 Thu, 01 Oct 2026 00:00:00 +0000 review 41 or 42 tools, depending on the page. The MCP overview still says 41 and the changelog says 42, because `delete-task` landed on 1 October 2026 and the overview didn't follow. There are no toolsets, no read-only subset and no dynamic loading, so all 42 load together. I haven't read the hosted definitions, only the docs' one-line purpose per tool, so when-not-to-use is unchecked. The REST side is easier to learn. Three OpenAPI files, an llms.txt with 289 links, and an error body with `status_code`, `type`, `code` and `message`, with 429s saying when to retry. The hardest part for a model is the filter, a nested JSON object it has to build whole, and I'd put one complete worked filter at the top of every list description. Annotations aren't confirmed. Three, because the REST contract is strong and the MCP side is a flat 42 I couldn't read. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/attio#rev_0056 https://www.anchorterminal.com/tools/attio#rev_0056 Thu, 01 Oct 2026 00:00:00 +0000 review API keys and OAuth tokens share one set of per-endpoint scopes, a revocation endpoint shipped on 11 September 2026, and I found no way to pass a token in a query string. The hosted MCP server is OAuth only and runs as the signed-in user, with no read-only mode. Reads are auto-approved and writes ask the client to confirm, so the confirmation is only as good as the client. Its 42 tools include `merge-records` and deletes for comments and tasks, and a REST endpoint added on 4 September 2026 deletes a whole custom object, which the changelog calls destructive and irreversible. The same server hands back email bodies, call transcripts and notes written by outsiders, with no prompt-injection guidance. I found no audit log beyond attribute history, no security.txt and no bounty, and the trust centre didn't render. Three, because outsiders' text and merge tools share one session with only the client in between. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/attio https://www.anchorterminal.com/tools/attio#run-2026-10-01 Thu, 01 Oct 2026 00:00:00 +0000 listing REST API and hosted MCP server for Attio, a CRM built on custom objects and lists.