AgentDrives
Free check
folkfolk.app

Can an AI agent use folk?

As of 6 Oct 2026, an AI agent can't use folk on its own: Stytch fingerprint check blocks magic-link login.

Level 1 · Needs a personAgents can't get in on their own.

To reach L2 · Gets in: let an agent verify its account on its own.

With an account set up by a person: not measured yet.

What the levels mean
Visit folk Follow changes

Driven 6 Oct 2026Same level in 2 drives in a rowRules of 15 Oct 2026Claim this page

Written and checked by our agents from this drive's record. How we write.

Who gets in

  • Agents on a serverTurned away when they send the sign-up form.
  • Signed agentsThe site opens. The check on the form still applies.
  • Agents in a person's browserNot measured yet.

Sign-up page checked 12 Oct 2026. Signed agents: the ones Cloudflare verifies. Where agents come from

What an agent can do in folk.

On its own

  • Read all the product's technical documentation automatically
  • Fetch the full list of API capabilities
  • Register itself as an app allowed to connect later
1 more
  • Start creating an account by submitting an email address

What it can't, and why

  • Finish logging inAn invisible fraud check on the email link rejected the automated browser
  • Get a key to use the API or AI integrationBoth require being logged in first
  • Create or manage any contacts, companies, or dealsNo account access was ever obtained
1 more
  • Delete the accountDeletion is only in the web app, which needs the blocked login
On its own, in a browser

Can an AI agent sign up for folk on its own?

It signs up on its own (in a browser), but can't get in on its own: verifying its account stopped it. No sign-up API. Web form app.folk.app/login > Continue with email accepted the agent's inbox and sent a Stytch magic link. No bot check on the form.

Official server · 1 of 3 calls worked

Does folk have an MCP server, and can an agent connect to it?

Yes. folk has an official MCP server.

A new agent can't get in on its own: in the drive of 6 Oct 2026, our agent stopped at verify (it was blocked). Through the MCP server, 1 of our agent's 3 attempts worked.

What the drive found

APIOpenAPIMCP · official–CLI–SDKllms.txtWebhooks–Sandbox

Not reached in this drive: the API key, deleting the account and paying. Every checkpoint, in detail

For the team behind folk.

Where agents stop in folk today, and the fixes that get them further, highest impact first.

Stops at verify

The fixes, highest impact first

  1. Let verified agents through the magic linkStep-by-step guide
  2. Offer an email code next to the magic link
  3. Add device flow or API-key sign-up for agentsStep-by-step guide
2 more fixes
  1. Add an account deletion endpoint
  2. Publish an MCP server card Step-by-step guide
  • Claim it free and reply next to the result.
  • A Drive, $49: your private report, with where agents stop, the evidence and the fixes that move your level.
  • Fixed something? Order a Drive ($49) any time, or the Monthly drive ($29/month).
Get a DriveClaim it free
See the example report
Details

Your API, MCP server or CLI is the product? An Audit ($299) also checks every documented route, MCP tool and CLI command against your docs. Compare plans.

Already claimed it? Open it in your dashboard.

Rather not be driven? Block AgentDrivesAgent in robots.txt or write to us. We stop driving it ourselves; this page stays, with its date.

Embed the badge on your site

Driven · L1 · Needs a person badge

Behind the level.

Our agent couldn't get into folk, so the work, its reliability and the crash test aren't measured. The part scores are what it could judge from the outside.

Part scores · level history

Part scores

Agent-ready setup

  • llms.txt
  • OpenAPI
  • MCP server
  • CLI

Not measured in this drive: Holds up, Docs match (part of an Audit).

Level history

  1. 1 Oct 2026L1Needs a person
  2. 6 Oct 2026L1Needs a person

For agents and builders.

The drive as data, every checkpoint and all 26 attempts.

How an agent connects · 4 tips

/api/tools/folk.json/tools/folk.mdMCP get_tool {"slug":"folk"}

  • Docs: start at developer.folk.app/llms.txt; every page has a .md twin.
  • MCP at https://mcp.folk.app/mcp uses OAuth via api.stytch.folk.app (CIMD or DCR, PKCE S256); you need a logged-in human for consent.
  • API: Bearer API key from Settings > API; rate limits 20 req/2 s burst and 600/min.
  • Sign-up is passwordless (magic link or Google); the magic link runs a Stytch device-fingerprint check that rejected our agent's browser.
Every checkpoint, in detail · 9 checkpoints
  1. DocsHeadlessdeveloper.folk.app: llms.txt index, .md pages, Accept: text/markdown negotiation, OpenAPI 3.1.0 (36 paths), MCP docs.
  2. Sign upIn a browserNo sign-up API. Web form app.folk.app/login > Continue with email accepted the agent's inbox and sent a Stytch magic link. No bot check on the form.
  3. VerifyBlockedMagic link opens a Stytch Device Fingerprinting page; POST /v1/magic_links/redirect/dfp returned 200 with an empty body and the browser landed on stytch.com/redirect-error ('Login Error'). Two links, same result.
  4. KeyNot reachedAPI keys only in app Settings > API; MCP OAuth (DCR worked: 201 client_id) sends the authorize step to app.folk.app/login, behind the same blocked magic link. No device flow.
  5. First callNot reachedGET api.folk.app/v1/groups without a key -> 401 UNAUTHORIZED with a clear message; no key obtainable.
  6. First actionNot reachedNo session or credential.
  7. PayNot reachedNo 402, x402/MPP/UCP or payment discovery (x402./mpp./agents. do not resolve, /.well-known/ucp 404, no x-payment-info). Pricing FAQ: 2-week trial without a card; 'We only accept credit cards'; upgrade in Settings > Plans. Checkout not seen (no login), so rests on the pricing page only.
  8. CancelNot reachedNothing started: the trial needs no card and lapses on its own (pricing FAQ: account blocked after 2 weeks).
  9. DeleteNot reachedWeb/mobile only (help article 5701307: Settings > Workspace details); no API. Not reachable without a login; an unverified Stytch user for our address remains.
The attempt log · 26 attempts
CapabilityRouteResultEvidence
agent discovery: robots.txt + Content-Usagenonedone ✓www.folk.app/robots.txt 200: User-agent * Allow /, explicit Allow for GPTBot/ClaudeBot etc; Disallow only for SEO bots. No Content-Usage or Content-signal lines; no Content-Usage response header.
agent discovery: llms.txtnonedone ✓https://www.folk.app/llms.txt (marketing) and https://developer.folk.app/llms.txt (full API+MCP index, links .md pages and OpenAPI /schemas/2025-06-09.json)
agent discovery: markdown docsnonedone ✓developer.folk.app/guides/quick-start with Accept: text/markdown -> content-type text/markdown, vary includes Accept; .md URLs also work
agent discovery: OpenAPInonedone ✓https://developer.folk.app/schemas/2025-06-09.json openapi 3.1.0, 36 paths, server https://api.folk.app; no x-payment-info
agent discovery: MCP server/discover 2026-07-28mcpfailed ✓POST https://mcp.folk.app/mcp server/discover unauthenticated -> 401 WWW-Authenticate Bearer resource_metadata=https://mcp.folk.app/.well-known/oauth-protected-resource/mcp; body JSON-RPC -32001 Unauthorized
agent discovery: PRM + AS metadatamcpdone ✓PRM 200 JSON: resource https://mcp.folk.app/mcp, authorization_servers [https://api.stytch.folk.app]. AS metadata 200: client_id_metadata_document_supported true, registration_endpoint (DCR) present, S256 PKCE, iss param supported, authorization_endpoint https://app.folk.app/oauth/authorize; no device_authorization_endpoint, no agent_auth block
agent discovery: server card / ai-catalog / A2A cardsnonefailed ✓mcp.folk.app/mcp/server-card 404 (-32601); www.folk.app and developer.folk.app /.well-known/ai-catalog.json 404; /.well-known/agent-card.json and agent.json 404
pay step probes: 402 / agent payment discoverynonedone ✓x402./mpp./agents.folk.app do not resolve; /.well-known/ucp 404; /auth.md, /SKILL.md 404; api.folk.app unauth -> 401 JSON not 402; OpenAPI has no x-payment-info. Pricing page: 2-week trial, no card; 'We only accept credit cards'; upgrade via Settings > Plans
sign up: find headless sign-upnonefailed ✓Docs quick-start: 'Create a folk account ... Sign up here (https://app.folk.app/login)'; no sign-up API, no auth.md, AS has no agent_auth/device flow. Only web form (Google or email).
sign up: sign up via web formbrowserdone ✓app.folk.app/login > Continue with email > entered the agent's inbox > 'Check your email'. Passwordless (Stytch magic link); no bot check seen
verify email / first login: open magic link from inbox in drive browserbrowserblocked ✓Two magic links (mails 07:27:28 and 07:28:14). stytch.com/v1/magic_links/redirect serves a Stytch Device Fingerprinting page: telemetry.js loads, POST eml.stytch.com/submit 200, then POST stytch.com/v1/magic_links/redirect/dfp returns 200 with an empty body; the page's JSON parse fails and it navigates to stytch.com/redirect-error 'Login Error. There was an error logging you in.' No visible challenge.
API key / OAuth token: get API key (Settings > API) or MCP OAuth tokenbrowserblocked ✓API keys only in app settings (developer.folk.app/api-reference/authentication). MCP OAuth: DCR POST api.stytch.folk.app/v1/oauth2/register -> 201 client_id; authorize URL https://app.folk.app/oauth/authorize redirects to /login, which needs the blocked magic link. No device flow.
first API call: GET https://api.folk.app/v1/groupsapiblocked ✓Without key -> 401 application/json {error:{code:UNAUTHORIZED,message:'No authorization header found...',documentationUrl,requestId}} (clear, not problem+json)
agent discovery: MCP tools/listmcpblocked ✓mcp.folk.app/mcp requires OAuth token; server/discover answered 401 before any version negotiation
Create, update, and delete a contact (person): Create, update, and delete a contact (person) in our trial workspacenoneblockedno session or credential
Create, update, and delete a company: Create, update, and delete a company in our trial workspacenoneblockedno session or credential
Create, update, and close a deal with a value: Create, update, and close a deal with a value in our trial workspacenoneblockedno session or credential
Organize records into a pipeline with stages/views: Organize records into a pipeline with stages/views in our trial workspacenoneblockedno session or credential
Send an email campaign to a list: Send an email campaign to a list in our trial workspacenoneblockedno session or credential
Send a multi-step automated email sequence: Send a multi-step automated email sequence in our trial workspacenoneblockedno session or credential
Enrich a contact to find a missing email: Enrich a contact to find a missing email in our trial workspacenoneblockedno session or credential
Auto-fill a custom field with AI (Magic field): Auto-fill a custom field with AI (Magic field) in our trial workspacenoneblockedno session or credential
Sync email, calendar, and WhatsApp accounts to auto-log interactions: Sync email, calendar, and WhatsApp accounts to auto-log interactions in our trial workspacenoneblockedno session or credential
Capture a contact from LinkedIn/web via the folkX Chrome extension: Capture a contact from LinkedIn/web via the folkX Chrome extension in our trial workspacenoneblockedno session or credential
delete account: delete account and datanoneblockedNo account deletion endpoint in OpenAPI (36 paths: people, companies, groups, deals, objects, notes, tasks, reminders, interactions, webhooks, users read-only). Could not log in to try the web UI.
delete account: find documented delete routenoneblocked ✓help.folk.app/en/articles/5701307: 'To delete your account, go to Settings > Workspace details where you can delete your workspace and all associated data' (web/desktop) or mobile Settings > Delete account. Web-only; not reachable without a login.

Also in CRM.

All of CRM, by level