Rentalot MCP Server (Rentalot-ai/rentalot-mcp) is an MCP server listed on the M8ven Trust Index. It scores 60 out of 100, grade C. It declares 65 tools. No publisher has claimed this listing.

C
Caution
60/100

Rentalot MCP Server

MCP server for the Rentalot API. Manage rental properties, contacts, showings, conversations, and more from any AI assistant.

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

Rentalot-ai

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

Install from

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
⚠️
Known vulnerabilities in dependencies: 3 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 1 credential: RENTALOT_API_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// tools this server exposes65 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

bulk_create_properties

Use to bulk-import up to 500 properties at once. Accepts flexible field names (Zillow/AppFolio aliases are auto-normalized). Returns a job ID for tracking progress. Supports Idempotency-Key header to prevent duplicates. Write operation — requires Pro tier or higher.

get_bulk_import_job

Use to check the status of a bulk property import job. Returns progress (total, created, failed), created property IDs, unmapped fields, and any errors.

list_contacts

Use to list contacts (prospects, tenants, etc.). Supports filtering by lifecycle status, role, channel, and free-text search across name/email/phone. Each contact includes `appliedAt` (ISO 8601, nullable) auto-set when status → applicant, and `language` (ISO 639-1, default "en").

get_contact

Use to get full details for a specific contact by ID. Response includes `appliedAt` (ISO 8601 timestamp, nullable) — auto-set when status transitions to applicant, cleared on other transitions.

update_contact

Use to update a contact's details or status. Only include fields you want to change. Write operation — requires Pro tier or higher.

create_contact

Use to create a new contact (prospect, tenant, etc.). Write operation — requires Pro tier or higher.

delete_contact

Use to soft-delete a contact. The contact can be restored later. Write operation — requires Pro tier or higher.

list_conversations

Use to list messaging conversations. Supports filtering by contact and status. Read-only.

get_conversation

Use to get details for a specific conversation by ID. Read-only.

search_conversations

Use to search conversations by keyword. Returns conversations matching the query across message content. Response includes full pagination object (page, limit, total, totalPages). Read-only.

list_conversation_messages

Use to list messages in a conversation. Returns paginated messages with direction (inbound/outbound), content, channel, and timestamp. Response includes full pagination object (page, limit, total, totalPages). Read-only.

list_drafts

Use to list draft messages. Supports filtering by contact, status, and channel. Drafts auto-expire 24 hours after creation.

get_draft

Use to get a specific draft message by ID.

create_draft

Use to create a draft message for review before sending. Drafts auto-expire after 24 hours. Use send_draft to deliver it. Write operation — requires Pro tier or higher.

update_draft

Use to edit an existing draft message. Only 'pending' drafts can be updated. Write operation — requires Pro tier or higher.

send_draft

Use to send a pending draft message. The draft will be delivered via its specified channel. Once sent, the draft status changes to 'sent' and cannot be modified. Write operation — requires Pro tier or higher.

delete_draft

Use to delete a draft message. Only 'pending' drafts can be deleted. Write operation — requires Pro tier or higher.

list_events

Use to list all calendar events (showings, calls, inspections, meetings). Supports filtering by date range and event type. Read-only.

list_followups

Use to list scheduled follow-up messages. Supports filtering by contact and status.

get_followup

Use to get details for a specific follow-up by ID.

create_followup

Use to schedule a follow-up message for a contact. The follow-up will be automatically sent at the scheduled time. Write operation — requires Pro tier or higher.

delete_followup

Use to cancel and delete a pending follow-up. Only 'pending' follow-ups can be deleted. Write operation — requires Pro tier or higher.

send_message

Use to send a message to a contact via their preferred channel (or a specified channel). The message is delivered through the connected channel adapter (WhatsApp, Telegram, SMS, or Gmail). Write operation — requires Pro tier or higher.

list_properties

Use to list rental properties. Supports filtering by rent range, bedrooms, bathrooms, availability date, pet policy, parking, and city. Returns paginated results.

get_property

Use to get full details for a specific rental property by ID.

create_property

Use to create a new rental property listing. Requires address, monthly rent, bedrooms, and bathrooms at minimum. Write operation — requires Pro tier or higher.

update_property

Use to update an existing property. Only include fields you want to change. Write operation — requires Pro tier or higher.

delete_property

Use to permanently delete a property listing. This cannot be undone. Write operation — requires Pro tier or higher.

list_property_images

Use to list all images for a property. Returns image metadata including URLs, alt text, and display order.

presign_image_upload

Use to get a presigned URL for uploading a property image to R2 storage. Returns an upload URL and R2 key. Write operation — requires Pro tier or higher.

confirm_image_upload

Use to confirm a property image upload after the file has been uploaded to the presigned URL. Creates the image record. Write operation — requires Pro tier or higher.

delete_property_images

Use to delete one or more images from a property. Write operation — requires Pro tier or higher.

reorder_property_images

Use to reorder images for a property. Pass the image IDs in the desired display order. Write operation — requires Pro tier or higher.

presign_image_batch

Use to get presigned URLs for uploading up to 20 property images at once. Returns an upload URL and R2 key for each image. Write operation — requires Pro tier or higher.

confirm_image_batch

Use to confirm multiple property image uploads after files have been uploaded to their presigned URLs. Creates image records for all confirmed uploads. Supports Idempotency-Key header. Write operation — requires Pro tier or higher.

import_property_images

Use to import property images from external URLs. The server downloads from the URLs (SSRF-protected) and uploads to R2 asynchronously. Returns a job ID to track progress. Supports Idempotency-Key header. Write operation — requires Pro tier or higher.

get_image_import_job

Use to check the status of an image import job. Returns progress including how many images have been imported, failed, total bytes, and any errors.

list_sessions

Use to list workflow sessions. Supports filtering by contact, workflow template, status, and review status.

get_session

Use to get full details for a specific workflow session by ID.

review_session

Use to approve or deny a workflow session. Write operation — requires Pro tier or higher.

get_followup_settings

Use to get the current follow-up automation settings (enabled state, idle hours before trigger, max sequence steps).

update_followup_settings

Use to update follow-up automation settings. Only include fields you want to change. Write operation — requires Pro tier or higher.

get_settings

Use to get all account settings including agent preferences, working hours, voice settings, prescreening config, follow-up settings, and email notification preferences.

update_settings

Use to update account settings including agent preferences and email notifications. Only include fields you want to change. Write operation — requires Pro tier or higher.

list_showings

Use to list property showings. Supports filtering by property, contact, status, and date range.

get_showing

Use to get full details for a specific showing by ID.

create_showing

Use to schedule a new property showing. Requires property ID, contact ID, title, and start/end times. Write operation — requires Pro tier or higher.

update_showing

Use to update a showing's details or status. Only include fields you want to change. To cancel a showing, set status to 'cancelled'. Write operation — requires Pro tier or higher.

check_showing_availability

Use to check available time slots for scheduling a property showing. Returns open slots for the given property and date range.

delete_showing

Use to permanently delete a showing. Prefer updating status to 'cancelled' instead. Write operation — requires Pro tier or higher.

list_webhooks

Use to list webhook subscriptions. Webhooks deliver real-time event notifications to your HTTPS endpoint.

create_webhook

Use to create a webhook subscription. Specify an HTTPS URL and one or more event types to subscribe to. Payloads are signed with HMAC-SHA256. Write operation — requires Pro tier or higher.

get_webhook

Use to get details for a specific webhook subscription by ID.

update_webhook

Use to update a webhook subscription. Only include fields you want to change. Write operation — requires Pro tier or higher.

delete_webhook

Use to delete a webhook subscription. Events will no longer be delivered to the endpoint. Write operation — requires Pro tier or higher.

test_webhook

Use to send a test event to a webhook endpoint. Useful for verifying your webhook handler is working correctly. Write operation — requires Pro tier or higher.

rotate_webhook_secret

Use to rotate the HMAC signing secret for a webhook subscription. The new secret is returned once and must be stored immediately — it cannot be retrieved again. Write operation — requires Pro tier or higher.

list_workflows

Use to list workflow templates. Workflows are automated multi-step sequences (e.g. pre-screening, lead qualification, follow-up sequences). Response includes full template detail: steps, triggerConfig, exitConditions, questionConfig, completionConfig, introMessage, voiceConfig, currentVersion, and u

get_workflow

Use to get a specific workflow template by ID. Returns full template detail including steps, triggerConfig, exitConditions, questionConfig, completionConfig, introMessage, voiceConfig, currentVersion, and updatedAt. Read-only.

create_workflow

Use to create a new workflow template. Slug is auto-generated from name. Write operation — requires Pro tier or higher.

update_workflow

Use to update a workflow template. Only include fields you want to change. Changes to execution fields (steps, triggerConfig, exitConditions, questionConfig, completionConfig) auto-create a version snapshot. Write operation — requires Pro tier or higher.

delete_workflow

Use to delete a workflow template. Fails with 409 if active runs exist — cancel or wait for them to finish first. Write operation — requires Pro tier or higher.

trigger_workflow_run

Use to trigger a new run of a workflow for a specific contact. Optionally scope it to a property. The workflow will execute its steps asynchronously. Write operation — requires Pro tier or higher.

list_workflow_runs

Use to list workflow runs. Supports filtering by workflow, contact, and execution status.

get_workflow_run

Use to get details and current progress of a specific workflow run by ID.

// known CVEs in dependencies3 high

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.12.0GHSA-345p-7cg4-v4c7

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

high@modelcontextprotocol/sdk@1.12.0GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.12.0GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
🔐 secretRENTALOT_API_KEYclaude mcp add rentalot -e =ra_your_key -- npx -y @rentalot/mcp-server
configRENTALOT_BASE_URL
configXDG_CONFIG_HOMERespects $ — if set, looks for $XDG_CONFIG_HOME/rentalot/config.yaml instead.
// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

65/65 tools missing one or more hints — bulk_create_properties (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_bulk_import_job (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); list_contacts (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +62 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Tool inputs are validated

62/65 tool handlers declare input schemas (95%)

Declare an inputSchema with zod/joi/yup on every tool definition.

Tool handlers catch errors

Only 0/65 tool handlers wrap calls in try/catch (0%)

Wrap each tool handler body in try/catch and return a structured error response.

Production dependencies are patched

0 critical, 3 high severity in production deps — @modelcontextprotocol/sdk@1.12.0 (high), @modelcontextprotocol/sdk@1.12.0 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 5 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/rentalot-ai/rentalot-mcp?variant=verified)](https://m8ven.ai/mcp/rentalot-ai/rentalot-mcp)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: 48c73fbf89a6ca1d2f43d42330b63f6d8a12d2e7
code hash: b6017dfde39f679727afaff16f1b585a61c623d84dd5d29a3a43d3b4a4f8610c
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client