agent-cronjob

ai.agentasy/cronjobagentasy.aistreamable-httpv0.0.1Scanned 1 hour ago

Scheduled, HMAC-signed, retried webhook triggers for AI agents. No account: self-register via tools.

15 tools: 3 can delete or cancel things, 8 change things and 4 only read.

Reads private data · 1
Reads text others write · 2
Can send data out · 1
6 findings

Anlyon alternative

11 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

15 tools

Deletes or cancels 3Removes, cancels or revokes something.Claude Code: deny

delete_jobStop the job forever and revoke all its credentials.1 finding
Why it is in this group
- The name "delete_job" says "delete": a word for removing or ending something.
- The description says "Cannot be undone".
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The description mentions "credentials".
  Matched text
  description: "Stop the job forever and revoke all its credentials. Cannot be undone. (REST: DELETE /v1/jo..."
  What this check looks for
Description, as the server wrote it
Stop the job forever and revoke all its credentials. Cannot be undone. (REST: DELETE /v1/jobs/{id})
Annotations the server declares
- title: Delete a job
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
rotate_secretNew hmac_secret (SHOWN ONCE, store it now).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
New hmac_secret (SHOWN ONCE, store it now). Until previous.expires_at (grace_sec, default 24 h) triggers carry two v1= signatures, new first. (REST: POST /v1/jobs/{id}/rotate-secret)
Annotations the server declares
- title: Rotate the HMAC signing secret
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: false
- openWorldHint: false
rotate_tokenNew management_token (SHOWN ONCE, store it now).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
New management_token (SHOWN ONCE, store it now). The old one stops working after grace_sec (default 0 = immediately). (REST: POST /v1/jobs/{id}/rotate-token)
Annotations the server declares
- title: Rotate the management token
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: false
- openWorldHint: false

Changes things 8Creates or changes something that can be changed back.Claude Code: ask

claim_credentialsStep 3.3 findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Findings
- Info
  The title mentions "credentials".
  Matched text
  title: "Poll verification / collect credentials"
  What this check looks for
- Info
  The annotations title mentions "credentials".
  Matched text
  annotations.title: "Poll verification / collect credentials"
  What this check looks for
- Info
  The description mentions "credentials".
  Matched text
  description: "...N ONCE, store them now; later calls say credentials: "already_issued". (REST: GET /v1/jobs/..."
  What this check looks for
Description, as the server wrote it
Step 3. Poll verification state with the setup_token. The first call after the webhook is verified returns hmac_secret (signs triggers) and management_token (manages the job) — SHOWN ONCE, store them now; later calls say credentials: "already_issued". (REST: GET /v1/jobs/{id}/verification)
Annotations the server declares
- title: Poll verification / collect credentials
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
create_jobStep 1.Reads text others writeCan send data outNo findings
Why it is in this group
- The name "create_job" says "create": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a URL (input.webhook_url): a request to a URL can carry data to whoever runs it.
Description, as the server wrote it
Step 1. Register your webhook and schedule (no account, no API key). Returns job_id and a one-time setup_token, and POSTs a url_verification challenge to webhook_url. Your webhook must answer it (echo: reply 2xx {"challenge":"<same>"}) — then call claim_credentials. Or reply 2xx and call verify_challenge with the value (callback). Nothing triggers before verification. (REST: POST /v1/jobs)
Annotations the server declares
- title: Create a job (start registration)
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
get_deliveriesTrigger log, newest first: scheduled_at, first attempt time, delay, attempts, status and last response code of each run.1 finding
Why it is in this group
- The name "get_deliveries" says "get": a word for reading.
- The description's first verb is "trigger": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
  The server marks "get_deliveries" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
  Matched text
  annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "get_deliveries" says "get": a word for reading.
  What this check looks for
Description, as the server wrote it
Trigger log, newest first: scheduled_at, first attempt time, delay, attempts, status and last response code of each run. since/until (ISO 8601) filter scheduled_at; page with next_cursor. (REST: GET /v1/jobs/{id}/runs)
Annotations the server declares
- title: Run history
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
pause_jobStop triggering (idempotent).No findings
Why it is in this group
- The description's first verb is "stop": a word for a change.
Description, as the server wrote it
Stop triggering (idempotent). Schedule points while paused are not made up later. (REST: POST /v1/jobs/{id}/pause)
Annotations the server declares
- title: Pause a job
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
resume_jobResume a paused or disabled job from its next schedule point; resets consecutive_failures.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Resume a paused or disabled job from its next schedule point; resets consecutive_failures. (REST: POST /v1/jobs/{id}/resume)
Annotations the server declares
- title: Resume a job
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
retry_challengeRe-send a fresh url_verification challenge to your webhook (at most 5 re-sends (6 challenges in total), at least 60 s apart).Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Re-send a fresh url_verification challenge to your webhook (at most 5 re-sends (6 challenges in total), at least 60 s apart). The previous challenge stops working. (REST: POST /v1/jobs/{id}/verification/retry)
Annotations the server declares
- title: Re-send the challenge
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
update_jobChange a job in place.No findings
Why it is in this group
- The name "update_job" says "update": a word for a change.
Description, as the server wrote it
Change a job in place. Currently only signature_in_body (true = triggers also carry cronjob_signature in the JSON body, for platforms that drop the X-Cronjob-* headers). Applies from the next attempt sent; returns the updated job. (REST: PATCH /v1/jobs/{id})
Annotations the server declares
- title: Change job settings
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
verify_challengeStep 2 (callback mode).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Step 2 (callback mode). Send back the challenge value your webhook received. On success the result holds hmac_secret and management_token — SHOWN ONCE, store them now. (REST: POST /v1/jobs/{id}/verify)
Annotations the server declares
- title: Verify the challenge (callback mode)
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false

Only reads 4Looks things up and changes nothing.Show 4 read-only tools

get_jobSettings, status, next_run_at, run_count and credential prefixes of one job (webhook path masked).Reads private data1 finding
Why it is in this group
- The name "get_job" says "get": a word for reading.
What it can reach
- private-dataThe description's first sentence says "credential": it reads secrets.
Findings
- Info
  The description mentions "credential".
  Matched text
  description: "...ngs, status, next_run_at, run_count and credential prefixes of one job (webhook path maske..."
  What this check looks for
Description, as the server wrote it
Settings, status, next_run_at, run_count and credential prefixes of one job (webhook path masked). (REST: GET /v1/jobs/{id})
Annotations the server declares
- title: Get a job
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_runOne run and each delivery attempt: sent_at, response status, duration, error and next retry.No findings
Why it is in this group
- The name "get_run" says "get": a word for reading.
Description, as the server wrote it
One run and each delivery attempt: sent_at, response status, duration, error and next retry. (REST: GET /v1/jobs/{id}/runs/{run_id})
Annotations the server declares
- title: One run with every delivery attempt
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_statsOn-time rate, p50/p95 first-attempt delay and success rate over a window (default 24h).No findings
Why it is in this group
- The name "get_stats" says "get": a word for reading.
Description, as the server wrote it
On-time rate, p50/p95 first-attempt delay and success rate over a window (default 24h). (REST: GET /v1/jobs/{id}/stats)
Annotations the server declares
- title: Punctuality stats
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
list_jobsStatus of every job you hold a management token for.No findings
Why it is in this group
- The name "list_jobs" says "list": a word for reading.
Description, as the server wrote it
Status of every job you hold a management token for. There are no accounts, so pass each {job_id, management_token} pair (up to 20); a pair without management_token uses the Authorization header. (REST: GET /v1/jobs/{id} (once per job))
Annotations the server declares
- title: List your jobs
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

2 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 1 outbound tool breaks every one.

Reads private data1: Reads files, mail, messages, databases, secrets, calendars or repositories.; get_job
Reads text others write2: Brings in text someone else can write: web pages, inbound email, messages, issues and comments.; create_job
retry_challenge
Can send data out1: Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.; create_job

deny to break every path

{
  "permissions": {
    "deny": [
      "mcp__cronjob__create_job"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

1 warn5 info

Warnget_deliveries
The server marks "get_deliveries" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
Matched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "get_deliveries" says "get": a word for reading.
What this check looks for
Infoclaim_credentials
The title mentions "credentials".
Matched text
title: "Poll verification / collect credentials"
What this check looks for
Infoclaim_credentials
The annotations title mentions "credentials".
Matched text
annotations.title: "Poll verification / collect credentials"
What this check looks for
Infoclaim_credentials
The description mentions "credentials".
Matched text
description: "...N ONCE, store them now; later calls say credentials: "already_issued". (REST: GET /v1/jobs/..."
What this check looks for
Infoget_job
The description mentions "credential".
Matched text
description: "...ngs, status, next_run_at, run_count and credential prefixes of one job (webhook path maske..."
What this check looks for
Infodelete_job
The description mentions "credentials".
Matched text
description: "Stop the job forever and revoke all its credentials. Cannot be undone. (REST: DELETE /v1/jo..."
What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 0.0.1. Values in angle brackets are yours to fill in.

claude mcp add --transport http cronjob https://cronjob.agentasy.ai/mcp

claude mcp add --transport http cronjob https://cronjob.agentasy.ai/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__cronjob__list_jobs",
      "mcp__cronjob__get_job",
      "mcp__cronjob__get_run",
      "mcp__cronjob__get_stats"
    ],
    "ask": [
      "mcp__cronjob__create_job",
      "mcp__cronjob__verify_challenge",
      "mcp__cronjob__claim_credentials",
      "mcp__cronjob__retry_challenge",
      "mcp__cronjob__update_job",
      "mcp__cronjob__pause_job",
      "mcp__cronjob__resume_job",
      "mcp__cronjob__get_deliveries"
    ],
    "deny": [
      "mcp__cronjob__delete_job",
      "mcp__cronjob__rotate_secret",
      "mcp__cronjob__rotate_token"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as cronjob. Review it before you use it.

Capability tags behind 3 rules

mcp__cronjob__create_job untrusted-input, outbound
mcp__cronjob__retry_challenge untrusted-input
mcp__cronjob__get_job private-data

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/ai.agentasy/cronjob/verify?hash=95cf33206bcd1637f6243bcb21a098c60e8715549500147c9d341a8a39a6d5fa" | jq -e '.changed == false'

Pinned hash 95cf33206bcd, from Nov 4, 2026, 00:17 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/ai.agentasy/cronjob/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

[![anlyon.dev](https://anlyon.dev/badge/ai.agentasy/cronjob.svg)](https://anlyon.dev/servers/ai.agentasy/cronjob)

Source: MCP Registry. Synced Nov 4, 2026, 00:17 UTC.