Rentalot MCP Server (Rentalot-ai/rentalot-mcp) is an MCP server listed on the M8ven Trust Index. It scores 60 out of 100, grade C. It declares 65 tools. No publisher has claimed this listing.
MCP server for the Rentalot API. Manage rental properties, contacts, showings, conversations, and more from any AI assistant.
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
Rentalot-ai
Source: Glama
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
bulk_create_propertiesUse to bulk-import up to 500 properties at once. Accepts flexible field names (Zillow/AppFolio aliases are auto-normalized). Returns a job ID for tracking progress. Supports Idempotency-Key header to prevent duplicates. Write operation — requires Pro tier or higher.
get_bulk_import_jobUse to check the status of a bulk property import job. Returns progress (total, created, failed), created property IDs, unmapped fields, and any errors.
list_contactsUse to list contacts (prospects, tenants, etc.). Supports filtering by lifecycle status, role, channel, and free-text search across name/email/phone. Each contact includes `appliedAt` (ISO 8601, nullable) auto-set when status → applicant, and `language` (ISO 639-1, default "en").
get_contactUse to get full details for a specific contact by ID. Response includes `appliedAt` (ISO 8601 timestamp, nullable) — auto-set when status transitions to applicant, cleared on other transitions.
update_contactUse to update a contact's details or status. Only include fields you want to change. Write operation — requires Pro tier or higher.
create_contactUse to create a new contact (prospect, tenant, etc.). Write operation — requires Pro tier or higher.
delete_contactUse to soft-delete a contact. The contact can be restored later. Write operation — requires Pro tier or higher.
list_conversationsUse to list messaging conversations. Supports filtering by contact and status. Read-only.
get_conversationUse to get details for a specific conversation by ID. Read-only.
search_conversationsUse to search conversations by keyword. Returns conversations matching the query across message content. Response includes full pagination object (page, limit, total, totalPages). Read-only.
list_conversation_messagesUse to list messages in a conversation. Returns paginated messages with direction (inbound/outbound), content, channel, and timestamp. Response includes full pagination object (page, limit, total, totalPages). Read-only.
list_draftsUse to list draft messages. Supports filtering by contact, status, and channel. Drafts auto-expire 24 hours after creation.
get_draftUse to get a specific draft message by ID.
create_draftUse to create a draft message for review before sending. Drafts auto-expire after 24 hours. Use send_draft to deliver it. Write operation — requires Pro tier or higher.
update_draftUse to edit an existing draft message. Only 'pending' drafts can be updated. Write operation — requires Pro tier or higher.
send_draftUse to send a pending draft message. The draft will be delivered via its specified channel. Once sent, the draft status changes to 'sent' and cannot be modified. Write operation — requires Pro tier or higher.
delete_draftUse to delete a draft message. Only 'pending' drafts can be deleted. Write operation — requires Pro tier or higher.
list_eventsUse to list all calendar events (showings, calls, inspections, meetings). Supports filtering by date range and event type. Read-only.
list_followupsUse to list scheduled follow-up messages. Supports filtering by contact and status.
get_followupUse to get details for a specific follow-up by ID.
create_followupUse to schedule a follow-up message for a contact. The follow-up will be automatically sent at the scheduled time. Write operation — requires Pro tier or higher.
delete_followupUse to cancel and delete a pending follow-up. Only 'pending' follow-ups can be deleted. Write operation — requires Pro tier or higher.
send_messageUse to send a message to a contact via their preferred channel (or a specified channel). The message is delivered through the connected channel adapter (WhatsApp, Telegram, SMS, or Gmail). Write operation — requires Pro tier or higher.
list_propertiesUse to list rental properties. Supports filtering by rent range, bedrooms, bathrooms, availability date, pet policy, parking, and city. Returns paginated results.
get_propertyUse to get full details for a specific rental property by ID.
create_propertyUse to create a new rental property listing. Requires address, monthly rent, bedrooms, and bathrooms at minimum. Write operation — requires Pro tier or higher.
update_propertyUse to update an existing property. Only include fields you want to change. Write operation — requires Pro tier or higher.
delete_propertyUse to permanently delete a property listing. This cannot be undone. Write operation — requires Pro tier or higher.
list_property_imagesUse to list all images for a property. Returns image metadata including URLs, alt text, and display order.
presign_image_uploadUse to get a presigned URL for uploading a property image to R2 storage. Returns an upload URL and R2 key. Write operation — requires Pro tier or higher.
confirm_image_uploadUse to confirm a property image upload after the file has been uploaded to the presigned URL. Creates the image record. Write operation — requires Pro tier or higher.
delete_property_imagesUse to delete one or more images from a property. Write operation — requires Pro tier or higher.
reorder_property_imagesUse to reorder images for a property. Pass the image IDs in the desired display order. Write operation — requires Pro tier or higher.
presign_image_batchUse to get presigned URLs for uploading up to 20 property images at once. Returns an upload URL and R2 key for each image. Write operation — requires Pro tier or higher.
confirm_image_batchUse to confirm multiple property image uploads after files have been uploaded to their presigned URLs. Creates image records for all confirmed uploads. Supports Idempotency-Key header. Write operation — requires Pro tier or higher.
import_property_imagesUse to import property images from external URLs. The server downloads from the URLs (SSRF-protected) and uploads to R2 asynchronously. Returns a job ID to track progress. Supports Idempotency-Key header. Write operation — requires Pro tier or higher.
get_image_import_jobUse to check the status of an image import job. Returns progress including how many images have been imported, failed, total bytes, and any errors.
list_sessionsUse to list workflow sessions. Supports filtering by contact, workflow template, status, and review status.
get_sessionUse to get full details for a specific workflow session by ID.
review_sessionUse to approve or deny a workflow session. Write operation — requires Pro tier or higher.
get_followup_settingsUse to get the current follow-up automation settings (enabled state, idle hours before trigger, max sequence steps).
update_followup_settingsUse to update follow-up automation settings. Only include fields you want to change. Write operation — requires Pro tier or higher.
get_settingsUse to get all account settings including agent preferences, working hours, voice settings, prescreening config, follow-up settings, and email notification preferences.
update_settingsUse to update account settings including agent preferences and email notifications. Only include fields you want to change. Write operation — requires Pro tier or higher.
list_showingsUse to list property showings. Supports filtering by property, contact, status, and date range.
get_showingUse to get full details for a specific showing by ID.
create_showingUse to schedule a new property showing. Requires property ID, contact ID, title, and start/end times. Write operation — requires Pro tier or higher.
update_showingUse to update a showing's details or status. Only include fields you want to change. To cancel a showing, set status to 'cancelled'. Write operation — requires Pro tier or higher.
check_showing_availabilityUse to check available time slots for scheduling a property showing. Returns open slots for the given property and date range.
delete_showingUse to permanently delete a showing. Prefer updating status to 'cancelled' instead. Write operation — requires Pro tier or higher.
list_webhooksUse to list webhook subscriptions. Webhooks deliver real-time event notifications to your HTTPS endpoint.
create_webhookUse to create a webhook subscription. Specify an HTTPS URL and one or more event types to subscribe to. Payloads are signed with HMAC-SHA256. Write operation — requires Pro tier or higher.
get_webhookUse to get details for a specific webhook subscription by ID.
update_webhookUse to update a webhook subscription. Only include fields you want to change. Write operation — requires Pro tier or higher.
delete_webhookUse to delete a webhook subscription. Events will no longer be delivered to the endpoint. Write operation — requires Pro tier or higher.
test_webhookUse to send a test event to a webhook endpoint. Useful for verifying your webhook handler is working correctly. Write operation — requires Pro tier or higher.
rotate_webhook_secretUse to rotate the HMAC signing secret for a webhook subscription. The new secret is returned once and must be stored immediately — it cannot be retrieved again. Write operation — requires Pro tier or higher.
list_workflowsUse to list workflow templates. Workflows are automated multi-step sequences (e.g. pre-screening, lead qualification, follow-up sequences). Response includes full template detail: steps, triggerConfig, exitConditions, questionConfig, completionConfig, introMessage, voiceConfig, currentVersion, and u…
get_workflowUse to get a specific workflow template by ID. Returns full template detail including steps, triggerConfig, exitConditions, questionConfig, completionConfig, introMessage, voiceConfig, currentVersion, and updatedAt. Read-only.
create_workflowUse to create a new workflow template. Slug is auto-generated from name. Write operation — requires Pro tier or higher.
update_workflowUse to update a workflow template. Only include fields you want to change. Changes to execution fields (steps, triggerConfig, exitConditions, questionConfig, completionConfig) auto-create a version snapshot. Write operation — requires Pro tier or higher.
delete_workflowUse to delete a workflow template. Fails with 409 if active runs exist — cancel or wait for them to finish first. Write operation — requires Pro tier or higher.
trigger_workflow_runUse to trigger a new run of a workflow for a specific contact. Optionally scope it to a property. The workflow will execute its steps asynchronously. Write operation — requires Pro tier or higher.
list_workflow_runsUse to list workflow runs. Supports filtering by workflow, contact, and execution status.
get_workflow_runUse to get details and current progress of a specific workflow run by ID.
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse
Anthropic's MCP TypeScript SDK has a ReDoS vulnerability
Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default
RENTALOT_API_KEYclaude mcp add rentalot -e =ra_your_key -- npx -y @rentalot/mcp-serverRENTALOT_BASE_URLXDG_CONFIG_HOMERespects $ — if set, looks for $XDG_CONFIG_HOME/rentalot/config.yaml instead.Tool annotations
No tools have read-only/destructive annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
65/65 tools missing one or more hints — bulk_create_properties (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_bulk_import_job (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); list_contacts (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +62 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
Tool inputs are validated
62/65 tool handlers declare input schemas (95%)
Declare an inputSchema with zod/joi/yup on every tool definition.
Tool handlers catch errors
Only 0/65 tool handlers wrap calls in try/catch (0%)
Wrap each tool handler body in try/catch and return a structured error response.
Production dependencies are patched
0 critical, 3 high severity in production deps — @modelcontextprotocol/sdk@1.12.0 (high), @modelcontextprotocol/sdk@1.12.0 (high)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/rentalot-ai/rentalot-mcp)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check