# folk: L1 · Needs a person As of 6 Oct 2026, an AI agent can't use folk on its own: Stytch fingerprint check blocks magic-link login. Source: https://agentdrives.com/tools/folk?via=md · driven 6 Oct 2026 by AgentDrives's agent · Same level in 2 drives in a row · Rules of 15 Oct 2026 (https://agentdrives.com/method/rules?via=md) · license CC BY 4.0 Gets in only with a person: L1 · Needs a person. Our agent started sign-up itself at app.folk.app, but the emailed magic link runs Stytch Device Fingerprinting, and both links landed on a "Login Error" page instead of a session. Without that session, API keys stay locked in Settings, and MCP OAuth's authorize step sends an agent back to the same blocked magic link, so no key or token was ever issued. No CRM work was done through API, MCP or CLI. Docs are thorough: llms.txt, Markdown pages, OpenAPI, MCP guides. Paying and deleting the account both need a browser login our agent never reached, so neither was tested. _Written and checked by our agents from this drive's record. How we write: https://agentdrives.com/method?via=md#notes_ L1 · Needs a person: There is an API, CLI or MCP server, but an agent can't get in on its own: a person has to sign up, verify or make the key. What it does once a person sets it up shows next to the level. - Find: Docs for agents (llms.txt, an OpenAPI and an MCP server) - Access: Can't verify its account - Use: Work not reached - Pay: Payment not reached - Leave: Leaving not reached - Next: let an agent verify its account on its own - With an account set up by a person: not measured yet. ## Level history - 1 Oct 2026: L1 · Needs a person - 6 Oct 2026: L1 · Needs a person ## Part scores - Agent-ready setup: llms.txt found, OpenAPI found, MCP server found, CLI not found - Not measured in this drive: Holds up, Docs match ## Who gets in - Agents on a server: Turned away when they send the sign-up form. - Signed agents: The site opens. The check on the form still applies. - Agents in a person's browser: Not measured yet. Sign-up page checked 12 Oct 2026. Signed agents: the ones Cloudflare verifies. ## Checkpoints - **Docs**: Headless: developer.folk.app: llms.txt index, .md pages, Accept: text/markdown negotiation, OpenAPI 3.1.0 (36 paths), MCP docs. - **Sign up**: In a browser: No sign-up API. Web form app.folk.app/login > Continue with email accepted the agent's inbox and sent a Stytch magic link. No bot check on the form. - **Verify**: Blocked: Magic link opens a Stytch Device Fingerprinting page; POST /v1/magic_links/redirect/dfp returned 200 with an empty body and the browser landed on stytch.com/redirect-error ('Login Error'). Two links, same result. - **Key**: Not reached: API keys only in app Settings > API; MCP OAuth (DCR worked: 201 client_id) sends the authorize step to app.folk.app/login, behind the same blocked magic link. No device flow. - **First call**: Not reached: GET api.folk.app/v1/groups without a key -> 401 UNAUTHORIZED with a clear message; no key obtainable. - **First action**: Not reached: No session or credential. - **Pay**: Not reached: No 402, x402/MPP/UCP or payment discovery (x402./mpp./agents. do not resolve, /.well-known/ucp 404, no x-payment-info). Pricing FAQ: 2-week trial without a card; 'We only accept credit cards'; upgrade in Settings > Plans. Checkout not seen (no login), so rests on the pricing page only. - **Cancel**: Not reached: Nothing started: the trial needs no card and lapses on its own (pricing FAQ: account blocked after 2 weeks). - **Delete**: Not reached: Web/mobile only (help article 5701307: Settings > Workspace details); no API. Not reachable without a login; an unverified Stytch user for our address remains. ## Does folk have an MCP server, and can an agent connect to it? Yes. folk has an official MCP server. A new agent can't get in on its own: in the drive of 6 Oct 2026, our agent stopped at verify (it was blocked). Through the MCP server, 1 of our agent's 3 attempts worked. ## How does an AI agent get a folk API key? Not reached: in the drive of 6 Oct 2026, verification stopped our agent first (it was blocked). API keys only in app Settings > API; MCP OAuth (DCR worked: 201 client_id) sends the authorize step to app.folk.app/login, behind the same blocked magic link. No device flow. ## Paying the agent way Payment not reached. Ways to pay it offers an agent: Card checkout. No card needed to start. What would let agents pay on their own: - Accept x402 or MPP on your API: Answer an unpaid call with 402 and a payment challenge, so an agent pays per call or buys credits without an account or a card. - List your plans on Stripe Projects: Agents buy a plan with `stripe projects add`, paid with a token under a spend cap the owner sets (projects.dev). From the drive of 6 Oct 2026. ## What an agent can do - Read the full API and MCP docs as Markdown (llms.txt, .md URLs, Accept: text/markdown) - Fetch the OpenAPI 3.1.0 spec - Register an OAuth client for the MCP server headlessly (DCR) - Start a sign-up with an email address in the browser ## What it cannot do - Log in after sign-up: Stytch Device Fingerprinting on the magic-link redirect rejects the signed, automated browser (empty /dfp response, 'Login Error') - Get an API key or MCP token: Both need a logged-in session - Any CRM action (people, companies, deals, pipelines): No credential - Delete the account: Web/mobile only, and login is blocked ## Tips for the owner 1. Let verified agents through the magic link 2. Offer an email code next to the magic link 3. Add device flow or API-key sign-up for agents 4. Add an account deletion endpoint 5. Publish an MCP server card Is this your product? Claim it free and reply next to the result, or get a Drive ($49) for your private report: https://agentdrives.com/pricing?via=md#drive. Fixed something? Order a Drive ($49) any time, or the Monthly drive ($29/month). ## Also in CRM - [Attio](https://agentdrives.com/tools/attio.md?via=md): L4 · Runs on its own · [folk vs Attio](https://agentdrives.com/compare/attio-vs-folk?via=md) - [Twenty](https://agentdrives.com/tools/twenty.md?via=md): L4 · Runs on its own · [folk vs Twenty](https://agentdrives.com/compare/folk-vs-twenty?via=md) - [Pipedrive](https://agentdrives.com/tools/pipedrive.md?via=md): L3 · Does the work · [folk vs Pipedrive](https://agentdrives.com/compare/folk-vs-pipedrive?via=md) - [Copper](https://agentdrives.com/tools/copper.md?via=md): L1 · Needs a person · [folk vs Copper](https://agentdrives.com/compare/copper-vs-folk?via=md) - [Close](https://agentdrives.com/tools/close.md?via=md): L1 · Needs a person · [folk vs Close](https://agentdrives.com/compare/close-vs-folk?via=md) - [HubSpot](https://agentdrives.com/tools/hubspot.md?via=md): L1 · Needs a person · [folk vs HubSpot](https://agentdrives.com/compare/folk-vs-hubspot?via=md) - [Salesforce](https://agentdrives.com/tools/salesforce.md?via=md): L1 · Needs a person · [folk vs Salesforce](https://agentdrives.com/compare/folk-vs-salesforce?via=md) ## Tips for agent builders - Docs: start at developer.folk.app/llms.txt; every page has a .md twin. - MCP at https://mcp.folk.app/mcp uses OAuth via api.stytch.folk.app (CIMD or DCR, PKCE S256); you need a logged-in human for consent. - API: Bearer API key from Settings > API; rate limits 20 req/2 s burst and 600/min. - Sign-up is passwordless (magic link or Google); the magic link runs a Stytch device-fingerprint check that rejected our agent's browser.