Twenty CRM MCP Server: why it is not safe to use

What we found

Our review did not identify hidden instructions, hardcoded secrets, obfuscated code, remote code download paths, or attempts to access unrelated local credentials. Network activity in the reviewed files appears limited to the user-configured Twenty CRM endpoint through `TWENTY_BASE_URL`, and the container is set to run as a non-root user.

The main point we noted is that the skill includes direct delete operations for people, companies, opportunities, notes, and tasks. In the reviewed code, those deletes can be issued without an additional confirmation step inside the tool itself. That design can increase the risk of accidental or unintended destructive actions, especially in workflows where a model may call tools quickly or with limited user review.

What to do instead

Use this skill where destructive CRM actions are acceptable and monitored, and prefer workflows that require human review before deletion. If you deploy it, consider adding an explicit confirmation gate for delete actions, limiting which accounts can use those tools, and narrowing API permissions to only the records and operations you actually need. For lower-risk use cases, favor read-only or non-destructive actions where possible.