AgentRoam

by agentroam.ai · remote · no sign-in to list tools · v1.0.0 · published by ai.agentroam

Buy travel eSIMs, gift cards and mobile top-ups with crypto — user confirms before any order.

Deletes · 2Changes · 1

Compare Registry entry

11 tools: 2 can delete or cancel things, 1 change things and 8 only read.

Scanned Oct 21, 2026

Deletes or cancels2Claude Code: deny: see these tools
Can't be undone0Claude Code: ask
Changes things1Claude Code: ask: see these tools
Only reads8Claude Code: allow: see these tools

1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http agentroam https://agentroam.ai/api/mcp

Findings

Matches of fixed checks, with the text they matched.

1 warn

Warnvalidate_order
The server marks "validate_order" as not read-only (readOnlyHint: false), and its words say it reads.
Matched text
annotations: {"readOnlyHint":false,"destructiveHint":false,"openWorldHint":true}; The name "validate_order" says "validate": a word for reading.
What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

11 tools

Deletes or cancels 2Removes, cancels or revokes something.Claude Code: deny

create_orderCreates the real order.Reads text others writeNo findings
Why it is in this group
- The name "create_order" says "create": a word for a change.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Creates the real order. Requires a confirm_token minted by validate_order. Returns the payment wallet address, exact crypto amount, 30-minute expiry, and an order-status URL. The purchased code/QR is emailed by Cryptorefills to the buyer — it is never returned here.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: true
- destructiveHint: true
- title: Place order
purchase_wizardStateful text-only purchase flow for clients without widget support.Reads text others writeNo findings
Why it is in this group
- The name "purchase_wizard" says "purchase": a word that usually means money moves, which cannot be taken back.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Stateful text-only purchase flow for clients without widget support. Called repeatedly with the same session_token, one question at a time, until status is "complete"; the first call takes empty arguments. The final "confirm" answer creates a real order.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: true
- destructiveHint: true
- title: Guided purchase (text)

Changes things 1Creates or changes something that can be changed back.Claude Code: ask

validate_orderDry-run an order and mint a one-time confirm_token (valid 10 minutes).Reads text others writeCan send data out1 finding
Why it is in this group
- The name "validate_order" says "validate": a word for reading.
- The server marks it as not read-only (readOnlyHint: false).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a destination (input.phone): what the tool writes goes there.
Findings
- Warn
  The server marks "validate_order" as not read-only (readOnlyHint: false), and its words say it reads.
  Matched text
  annotations: {"readOnlyHint":false,"destructiveHint":false,"openWorldHint":true}; The name "validate_order" says "validate": a word for reading.
  What this check looks for
Description, as the server wrote it
Dry-run an order and mint a one-time confirm_token (valid 10 minutes). Returns a human-readable purchase summary for the buyer to approve, plus the one-time token that create_order requires. Creates no order and reserves no funds.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: true
- destructiveHint: false
- title: Prepare order for approval

Only reads 8Looks things up and changes nothing.Claude Code: allow

get_currenciesList all supported payment cryptocurrencies (the response carries the current set).No findings
Why it is in this group
- The name "get_currencies" says "get": a word for reading.
Description, as the server wrote it
List all supported payment cryptocurrencies (the response carries the current set).
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: List payment coins
get_order_statusPoll order state (WAITING_FOR_PAYMENT → PARTIAL → COMPLETED, or CANCELED/EXPIRED).Reads text others writeNo findings
Why it is in this group
- The name "get_order_status" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Poll order state (WAITING_FOR_PAYMENT → PARTIAL → COMPLETED, or CANCELED/EXPIRED). Requires the status_token from create_order.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: true
- destructiveHint: false
- title: Check order status
get_payment_methodsFull payment matrix: every supported coin × network combination currently available, with the exact network strings orders require.No findings
Why it is in this group
- The name "get_payment_methods" says "get": a word for reading.
Description, as the server wrote it
Full payment matrix: every supported coin × network combination currently available, with the exact network strings orders require. The response includes live totals for coins, networks and combinations.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
- title: List payment networks
get_priceLive crypto price for one product/denomination.Reads text others writeNo findings
Why it is in this group
- The name "get_price" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Live crypto price for one product/denomination. Payment coins include USDT, USDC, BTC (incl. Lightning), ETH, SOL, DAI, PYUSD, LTC, TRX, TON, DOGE and SUI across many networks; get_payment_methods returns the current set. Creates no order.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: true
- destructiveHint: false
- title: Get crypto price
list_brandsBrowse all available brands/carriers for a country: gift cards (500+ US brands) and mobile top-up carriers (100+ countries).Reads text others writeNo findings
Why it is in this group
- The name "list_brands" says "list": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe description's first sentence says "browse": it reads web pages, which anyone can write.
Description, as the server wrote it
Browse all available brands/carriers for a country: gift cards (500+ US brands) and mobile top-up carriers (100+ countries). Creates no order.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: true
- destructiveHint: false
- title: List brands by country
list_esim_plansLive eSIM data plans for a destination (110+ countries, plus "eu" Europe and "ww" Global multi-country plans) with USD prices and crypto amounts.Reads text others writeNo findings
Why it is in this group
- The name "list_esim_plans" says "list": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Live eSIM data plans for a destination (110+ countries, plus "eu" Europe and "ww" Global multi-country plans) with USD prices and crypto amounts. In clients that support widgets, the response also renders an interactive plan picker. Creates no order by itself.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: true
- destructiveHint: false
- title: List eSIM plans
list_productsList a brand's live products/denominations with prices in the chosen coin — including the exact denomination labels the pricing and order tools expect (eSIM destinations are covere…Reads text others writeNo findings
Why it is in this group
- The name "list_products" says "list": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
List a brand's live products/denominations with prices in the chosen coin — including the exact denomination labels the pricing and order tools expect (eSIM destinations are covered by list_esim_plans). Creates no order.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: true
- destructiveHint: false
- title: List brand products
search_productsSearch the AgentRoam travel-crypto catalog: gift cards (Airbnb, Uber, airlines, 500+ US brands), eSIM data plans (110+ destinations incl.Reads text others writeNo findings
Why it is in this group
- The name "search_products" says "search": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Search the AgentRoam travel-crypto catalog: gift cards (Airbnb, Uber, airlines, 500+ US brands), eSIM data plans (110+ destinations incl. Europe/Global region plans) and mobile top-ups (carriers in 100+ countries). Returns product handles (brandSlug + countryCode) used by the pricing and order tools. Creates no order.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: true
- destructiveHint: false
- title: Search catalog

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data.

Reads private data0: Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write9: Brings in text someone else can write: web pages, inbound email, messages, issues and comments.; create_order
get_order_status
get_price
list_brands
list_esim_plans
list_products
purchase_wizard
search_products
validate_order
Can send data out1: Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.; validate_order

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http agentroam https://agentroam.ai/api/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__agentroam__search_products",
      "mcp__agentroam__get_price",
      "mcp__agentroam__list_esim_plans",
      "mcp__agentroam__get_order_status",
      "mcp__agentroam__list_brands",
      "mcp__agentroam__list_products",
      "mcp__agentroam__get_currencies",
      "mcp__agentroam__get_payment_methods"
    ],
    "ask": [
      "mcp__agentroam__validate_order"
    ],
    "deny": [
      "mcp__agentroam__create_order",
      "mcp__agentroam__purchase_wizard"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as agentroam. Review it before you use it.

Capability tags behind 9 rules

mcp__agentroam__search_products untrusted-input
mcp__agentroam__get_price untrusted-input
mcp__agentroam__validate_order untrusted-input, outbound
mcp__agentroam__create_order untrusted-input
mcp__agentroam__list_esim_plans untrusted-input
mcp__agentroam__get_order_status untrusted-input
mcp__agentroam__list_brands untrusted-input
mcp__agentroam__list_products untrusted-input
mcp__agentroam__purchase_wizard untrusted-input

Keep track

Get told when this server's tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/ai.agentroam/agentroam/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Anlyon alternative

3 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Compare with other servers for the same product.

Source: MCP Registry · repository. Synced Oct 21, 2026, 17:41 UTC.

For agents: Markdown · JSON · report this listing