Hecher Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Hecher Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
The official Model Context Protocol (MCP) server for Hecher — the multi-tenant CRM for Chabad shluchim by Grow Gelt.
Connect Claude Desktop, ChatGPT, Cursor, or any other MCP‑compatible AI assistant to your Hecher account and let it search donors, record donations, run reports, and manage tasks for you — across all of your organizations (mosads).
Heads up: This repository is the public listing and documentation for the Hecher MCP server. The server itself runs as a managed remote service at https://api.hecher.app/mcp — there is nothing to install or self-host. https://api.hecher.app/mcpYou can review and revoke connected assistants anytime under Settings → AI Connections inside Hecher.
The server exposes 20 tools that wrap the Hecher API. Every call runs as you, in whichever Mosad you've selected as active — RLS, billing gates, and audit logging all apply exactly as in the web app.
list_tenants — list the Mosads you have access toset_active_tenant — choose which Mosad subsequent calls operate onget_active_tenant — show the currently active Mosadsearch_donors — search by name, email, phone, tag, or statusget_donor — full profile with stats and contact infocreate_donor / update_donor / delete_donoradd_donor_tag / remove_donor_tag / bulk_tag_donorslist_donations — optionally filtered by donor or datecreate_donation / update_donation / delete_donationlist_activities — optionally filtered by donor, status, or assigneecreate_activity — task, call, meeting, or notecomplete_activityget_dashboard_stats — KPIs for the active Mosadrun_report — execute a saved reportThe server speaks OAuth 2.1 with dynamic client registration, so any compliant MCP client can connect with no manual API keys.
| Endpoint | URL |
|---|---|
| Discovery | https://api.hecher.app/.well-known/oauth-authorization-server |
| Authorization | https://api.hecher.app/oauth/authorize |
| Token | https://api.hecher.app/oauth/token |
| Dynamic registration | https://api.hecher.app/oauth/register |
Each authorization issues an access token bound to your user account and the Mosad you pick during the consent flow. Tokens can be revoked at any time from Settings → AI Connections.
bulk_tag_donors) flow through Hecher's background operation queue, the same as in the web UI.Any MCP client that supports remote servers over Streamable HTTP with OAuth 2.1, including:
MIT © Grow Gelt Solutions
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.