Atlas / MCP servers / yaniv-golan / affinity-sdk

affinity-sdkBLOCK

Name: affinity-sdk
Author: yaniv-golan

mcp/yaniv-golan/affinity-sdk

MCP server by yaniv-golan · affinity · affinity crm · ai agents · Audited 2026-10-10

Unofficial strongly-typed Python SDK for the Affinity CRM API - full read/write coverage, Pydantic v2, MCP server included. For when you need more than Affinity's official MCP

Verdict

BLOCK

Grade

Trust score

69 /100

Exposed tools

—

Transport

stdio

License

MIT

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://github.com/yaniv-golan/affinity-sdk/actions/workflows/ci.yml) [](https://codecov.io/gh/yaniv-golan/affinity-sdk) [](https://pypi.org/project/affinity-sdk/) [](https://pypi.org/project/affinity-sdk/) [](https://opensource.org/licenses/MIT) [](https://mypy-lang.org/) [](https://docs.pydantic.dev/) [](https://yaniv-golan.github.io/affinity-sdk/latest/) [](https://yaniv-golan.github.io/affinity-sdk/latest/mcp/) [](https://github.com/yaniv-golan/mcp-bash-framework) [](https://yaniv-golan.github.io/affinity-sdk/latest/guides/claude-code-plugins/) [](https://github.com/yaniv-golan/skill-creator-plus)

A modern, strongly-typed Python wrapper for the Affinity CRM API.

Disclaimer: This is an unofficial community project and is not affiliated with, endorsed by, or sponsored by Affinity. “Affinity” and related marks are trademarks of their respective owners. Use of the Affinity API is subject to Affinity’s Terms of Service.

Maintainer: GitHub: yaniv-golan

Documentati

Read from source at commit 4b00ae256703OBSERVED · 2026-10-10

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add affinity-sdk --env AFFINITY_API_KEY=${AFFINITY_API_KEY} --env AFFINITY_API_KEY_COMMAND=${AFFINITY_API_KEY_COMMAND} --env AFFINITY_API_KEY_COMMAND_TIMEOUT=${AFFINITY_API_KEY_COMMAND_TIMEOUT} --env AFFINITY_API_KEY_FILE=${AFFINITY_API_KEY_FILE} -- uvx affinity-sdk

claude-desktop

{
  "mcpServers": {
    "affinity-sdk": {
      "command": "uvx",
      "args": [
        "affinity-sdk"
      ],
      "env": {
        "AFFINITY_API_KEY": "${AFFINITY_API_KEY}",
        "AFFINITY_API_KEY_COMMAND": "${AFFINITY_API_KEY_COMMAND}",
        "AFFINITY_API_KEY_COMMAND_TIMEOUT": "${AFFINITY_API_KEY_COMMAND_TIMEOUT}",
        "AFFINITY_API_KEY_FILE": "${AFFINITY_API_KEY_FILE}"
      }
    }
  }
}

Trust audit

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	FAIL
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (2 observation(s))
Network: declared (7 observation(s))
Shell: declared (2 observation(s))
Dependencies: pinned
Secrets in source: found

Findings (18)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

affinity/cli/commands/completion_cmd.py:24

script = "eval (env _XAFFINITY_COMPLETE=fish_source xaffinity)\n"

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHNetwork egress · net.env_exfil · CWE-200, CWE-319

affinity/cli/commands/config_cmds.py:316

".env" ... httpx.

Why it matters. reads secrets in the same file that sends data out

HIGHPrompt injection · prompt.hide_from_user · CWE-94, CWE-1427

plugins/xaffinity-cli/skills/xaffinity-cli-usage/SKILL.md:57

skipped and the flag that fetches it. Never tell the user a record "has no lists" or "empty fields"

Why it matters. asks the agent to act without the user's knowledge

MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321

tests/test_client.py:911

secret = "super-secret-api-key"

LOWInventory / provenance · inv.hidden_file · CWE-1104

.pre-commit-config.yaml

.pre-commit-config.yaml

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInventory / provenance · inv.hidden_file · CWE-1104

mcp/test/.env.test.example

.env.test.example

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338

affinity/cli/session_cache.py:150

key_hash = hashlib.md5(key.encode()).hexdigest()[:8]

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

tests/test_mcp_resource_scripts.py:181

"xaffinity://../../x",

LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427

docs/public/guides/webhooks.md:191

@app.post("/webhooks/affinity/{secret}")

Why it matters. an instruction to move sensitive data to an outside destination

Fix. remove; a skill never needs the user's secrets off the machine

LOWInventory / provenance · mcp.no_tools_extracted · CWE-1104

mcp/server.json

Why it matters. the tool list is enumerated at runtime by tools/list, not declared in source

Fix. the page says so rather than showing an empty table

INFOPrompt injection · prompt.authority_framing · CWE-94, CWE-1427

mcp/.claude-plugin/skills/affinity-mcp-workflows/SKILL.md:76

The CLI Gateway provides full access to the xaffinity CLI:

INFOPrompt injection · prompt.authority_framing · CWE-94, CWE-1427

mcp/README.md:222

The CLI Gateway provides full access to the xaffinity CLI with minimal token overhead: