Skip to content

For AI agents

Everything on anlyon.dev is also available to agents: as Markdown, as JSON and as a read-only MCP server. An agent can check a server before it uses one and get the same answer a person sees.

On this pageShow
  1. Add the MCP server
  2. The tools
  3. Read it over HTTP
  4. Built to be read safely

Add the MCP serverLink to this section

Streamable HTTP, no sign-in, twelve read-only tools.

claude mcp add --transport http anlyon-dev https://anlyon.dev/mcp

The toolsLink to this section

What each tool answers. Every one declares readOnlyHint.

search_servers
Find scanned servers, with how many tools fall in each group.
get_server
One server's tools, groups, reasons, findings and permissions block.
check_tools_list
Classify a tools/list your agent already holds. Nothing is fetched or stored.
get_config_audit
Everything an agent can do across a whole MCP config, with one permissions block and a lockfile.
get_lockfile_status
Has any server in a lockfile changed its tools?
get_pin_status
Has this server changed its tools since the hash you reviewed?
recent_changes
Recent tool changes across the index, or for one server.
compare_servers
Up to four servers side by side.
get_methodology
What a check looks for.
search_skills
Find Agent Skills by what they let an agent do.
get_skill
One skill's labels, the lines that set them, and its findings.
check_skill
Label a SKILL.md your agent already holds. Nothing is fetched or run.

Or read it over HTTPLink to this section

Any page answers Accept: text/markdown, and each server page has a .md twin. The JSON API is open, read-only and CORS-enabled.

Search
curl "https://anlyon.dev/api/v1/servers?q=github&destructive=1"
One server
curl "https://anlyon.dev/api/v1/servers/<name>"
Check a tools/list you have
curl -X POST "https://anlyon.dev/api/v1/scan?install_as=myserver" \
  --data-binary @tools-list.json
Fail CI when a pinned server changes
curl -s "https://anlyon.dev/api/v1/servers/<name>/verify?hash=<pinned>" \
  | jq -e '.changed == false'
Audit a whole config
curl -X POST "https://anlyon.dev/api/v1/audit" --data-binary @.mcp.json
Fail CI when any locked server changes
curl -s -X POST "https://anlyon.dev/api/v1/audit/verify" \
  --data-binary @mcp-lock.json | jq -e '.ok'
Recent tool changes
curl "https://anlyon.dev/api/v1/changes?limit=20"
Search Agent Skills
curl "https://anlyon.dev/api/v1/skills?q=pdf&capability=runs-commands"
Check a SKILL.md you have
curl -X POST "https://anlyon.dev/api/v1/skills/check" \
  --data-binary @SKILL.md
Compare servers
curl "https://anlyon.dev/api/v1/compare?s=<a>&s=<b>"

Also: /index.md, /methodology.md, /changes.xml and /llms.txt.

Built to be read safelyLink to this section

An index of other people's tool descriptions has to be careful about whose words an agent ends up reading.

  • Server text is marked as data

    Tool names, descriptions and the finding messages that quote them only appear inside fenced blocks marked untrusted-server-text, which they cannot close, or under an untrusted key in JSON. Every response says so at the top.

  • Hidden characters are written out

    Zero-width, bidi-control and tag characters come back as [U+XXXX].

  • Read-only, every time

    Every MCP tool declares readOnlyHint. Nothing an agent sends makes anlyon.dev fetch a URL, run code, sign in anywhere or store anything.

  • Rate limited, no keys

    No account and no key. Requests are limited per address.

The groups are the same as on the pages; how a tool is sorted is on the methodology page.