Skip to content

Ahel

ai.ahel/ahelahel.aistreamable-httpv1.0.1Scanned

Data and tools for your AI agent: company, people, SEO, social and EU register data. Pay per call.

12 tools: 1 can delete or cancel things, 6 change things and 5 only read.

Tools: 1 delete, 0 irreversible, 6 write, 5 read.
  • Reads private data · 0
  • Reads text others write · 3
  • Can send data out · 0
  • 2 findings

Sign-in required, OAuth metadata published. Remote posture

Anlyon alternative

7 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

12 tools

Deletes or cancels 1Claude Code: deny
  • my_toolsThis team's own tools: the APIs and MCP servers the team added on ahel.ai under Your own tools.Reads text others write1 finding

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Info

      The description mentions "credentials".

      Matched text

      description: "...guments, calls it with the team's saved credentials, which never enter the chat. NOT for: A..."

      What this check looks for
    Description, as the server wrote it
    This team's own tools: the APIs and MCP servers the team added on ahel.ai under Your own tools. Without tool, lists each one with its tools, their inputs and the exact call. With tool ("<key>/<tool name>" from that list) and arguments, calls it with the team's saved credentials, which never enter the chat. NOT for: Ahel's catalog of data tasks and provider tools, which is capability_search. If the transport times out, do not resubmit the work: call again with the same ids and poll.

    Annotations the server declares

    • title: List or call the team's own tools
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
Changes things 6Claude Code: ask
  • balanceThe workspace's prepaid balance in USD, what runs in flight hold, what settled runs used today and this month (shown to the Owner), any daily spend cap on the team API key this con…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    The workspace's prepaid balance in USD, what runs in flight hold, what settled runs used today and this month (shown to the Owner), any daily spend cap on the team API key this connection uses, and where to top up. Check it when a run is refused for funds, or before a job that will make many runs. Free; changes nothing. NOT for: the price of one run, which is capability_inspect.

    Annotations the server declares

    • title: Read the prepaid balance
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • capability_run_statusWithout execution_id: the paid data capabilities this workspace can run, each with its providers and exact prices.1 finding

    Why it is in this group

    • The name "capability_run_status" says "run": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "capability_run_status" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "capability_run_status" says "run": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Without execution_id: the paid data capabilities this workspace can run, each with its providers and exact prices. With execution_id: that run's state, attempts and exact cost, settled once in the ledger when final; with results true, its rows and provenance (include_raw true adds the provider's own answer). Generated images and audio come as a signed link (media_url, valid for days) with their type and size; a small one is also attached as an image or audio block. A long result answers as many rows as fit and says the offset that reads the rest. NOT for: finding a task or tool to run, which is capability_search.

    Annotations the server declares

    • title: Read a run's status and results
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • catalog_requestAsk Ahel to add a data task or provider tool the catalog does not have yet: call it when capability_search answers verdict none and none of its nearest items fits.No findings

    Why it is in this group

    • The name "catalog_request" says "request": a word for a change.
    Description, as the server wrote it
    Ask Ahel to add a data task or provider tool the catalog does not have yet: call it when capability_search answers verdict none and none of its nearest items fits. Give what you need in plain words, an example input, and the most you would pay for one call. Answers a request id; asking again for the same thing adds to that request instead of making a new one. Free; runs nothing and charges nothing. NOT for: finding what already exists, which is capability_search.

    Annotations the server declares

    • title: Request a missing task or tool
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • feedbackRate one run or one catalog request of this workspace good or bad, with an optional note on what was right or wrong (missing rows, wrong data, too slow).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Rate one run or one catalog request of this workspace good or bad, with an optional note on what was right or wrong (missing rows, wrong data, too slow). Ahel reads every rating to fix providers and the catalog. Free; changes nothing else. NOT for: reading a run's state or rows, which is capability_run_status.

    Annotations the server declares

    • title: Rate a run or request
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • reviewRate how useful one finished run of this workspace was, after you have used its result: useful, partly, not_useful, or not_sure when you cannot tell, with an optional reason about …No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Rate how useful one finished run of this workspace was, after you have used its result: useful, partly, not_useful, or not_sure when you cannot tell, with an optional reason about the result (missing rows, wrong data, stale). One review per run; reviewing it again replaces the earlier one. Ahel reads every review to rank and fix providers. Leave out private information, keys and raw rows. Free; changes nothing else. NOT for: a catalog request, or reporting something confusing or broken, which is feedback.

    Annotations the server declares

    • title: Review a run's usefulness
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • run_capabilityRun one paid data capability (company data, people and contact data and the like) through Ahel's provider execution: it is quoted, the exact price is reserved from the workspace ba…Reads text others writeNo findings

    Why it is in this group

    • The name "run_capability" says "run": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Run one paid data capability (company data, people and contact data and the like) through Ahel's provider execution: it is quoted, the exact price is reserved from the workspace balance, and the run starts. Give id, a task id or tool id from capability_search: it runs only through the v2 capability Ahel's task map binds to it, and an item that is not ready is refused with its exact reason before anything is quoted. It then waits up to wait_seconds (default 20, at most 50; 0 answers at once): when the run finishes in that time, this same answer has its state, exact cost and rows, and generated images and audio as links; otherwise it answers the execution id, and capability_run_status reads the run. Data collection only: a capability that writes or has a side effect is refused. Ahel picks the provider unless endpoint_ids pins one; exclude_endpoint_ids leaves providers out. Give idempotency_key so a retry after a lost answer is safe: the same key answers the same run, with no new charge. NOT for: the team's own tools, which is my_tools.

    Annotations the server declares

    • title: Run a paid data task
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
Only reads 5Show 5 read-only tools
  • capability_inspectRead one task or provider tool from Ahel's catalog by its id: its exact inputs (Ahel's own contract, or the published reference input when Ahel has none), its status and exact reas…No findings

    Why it is in this group

    • The name "capability_inspect" says "inspect": a word for reading.
    Description, as the server wrote it
    Read one task or provider tool from Ahel's catalog by its id: its exact inputs (Ahel's own contract, or the published reference input when Ahel has none), its status and exact reason, Ahel's price per provider (Unknown when Ahel has no rate), for a temporarily unavailable item the market prices seen elsewhere, for comparison, and the exact run_capability call when it can run. With arguments it also prices that exact run before anything runs: Ahel's quote, the most it may cost, the amount a run would reserve and whether the balance covers it; nothing is reserved, charged or started. Free; changes nothing. NOT for: finding ids, which is capability_search, or running it, which is run_capability.

    Annotations the server declares

    • title: Inspect and price a task or tool
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • fetchRead one task or provider tool in full by the id search returned: what it does, its status and exact reason, its inputs, Ahel's price (and, for a temporarily unavailable item, mark…No findings

    Why it is in this group

    • The name "fetch" says "fetch": a word for reading.
    Description, as the server wrote it
    Read one task or provider tool in full by the id search returned: what it does, its status and exact reason, its inputs, Ahel's price (and, for a temporarily unavailable item, market prices seen elsewhere, for comparison), and the exact run_capability call when it can run. The same record as capability_inspect, in the document shape ChatGPT connectors require. NOT for: finding that id in the first place, which is search.

    Annotations the server declares

    • title: Read a catalog item
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_startedHow to start with Ahel: call this when the person asks what Ahel is, what it can do or how to begin.No findings

    Why it is in this group

    • The name "get_started" says "get": a word for reading.
    Description, as the server wrote it
    How to start with Ahel: call this when the person asks what Ahel is, what it can do or how to begin. Returns what Ahel is, how the prepaid balance works, the three steps to find, price and run any data task or provider tool, and ready example prompts. Reads only; changes nothing. NOT for: finding a data task or provider tool for a specific ask, which is capability_search.

    Annotations the server declares

    • title: Get started with Ahel
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data or outbound.

Reads private data0
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write3
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out0
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Sign-in required, OAuth metadata published

Looked at Oct 31, 2026, 23:18 UTC, unchanged since Oct 31, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable
yes
HTTP status of an anonymous initialize
401
tools/list served without credentials
no
Tools that change things, listed without credentials
0
Protocol version
not observed
WWW-Authenticate on 401
yes
resource_metadata in WWW-Authenticate
https://mcp.ahel.ai/.well-known/oauth-protected-resource
RFC 9728 protected resource metadata
https://mcp.ahel.ai/.well-known/oauth-protected-resource
Authorization servers
https://glorious-elephant-19.authkit.app
Legacy HTTP+SSE transport
no
Dynamic client registration
yes
Client ID metadata documents
yes

Findings

Matches of fixed checks, with the text they matched.

1 warn1 info
  • The server marks "capability_run_status" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "capability_run_status" says "run": a word for a change.

    What this check looks for
  • The description mentions "credentials".

    Matched text

    description: "...guments, calls it with the team's saved credentials, which never enter the chat. NOT for: A..."

    What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

Install

Pinned to version 1.0.1. Values in angle brackets are yours to fill in.

claude mcp add --transport http ahel https://mcp.ahel.ai
claude mcp add --transport http ahel https://mcp.ahel.ai

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__ahel__search",
      "mcp__ahel__fetch",
      "mcp__ahel__capability_search",
      "mcp__ahel__capability_inspect",
      "mcp__ahel__get_started"
    ],
    "ask": [
      "mcp__ahel__run_capability",
      "mcp__ahel__capability_run_status",
      "mcp__ahel__catalog_request",
      "mcp__ahel__feedback",
      "mcp__ahel__balance",
      "mcp__ahel__review"
    ],
    "deny": [
      "mcp__ahel__my_tools"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as ahel. Review it before you use it.

Capability tags behind 3 rules
  • mcp__ahel__my_tools untrusted-input
  • mcp__ahel__capability_search untrusted-input
  • mcp__ahel__run_capability untrusted-input

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/ai.ahel/ahel/verify?hash=5dfa6a705fba10bb6795f5798082389d23fd422d230aaf24fd9a3343d2272cbb" | jq -e '.changed == false'

Pinned hash 5dfa6a705fba, from Nov 2, 2026, 13:17 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/ai.ahel/ahel/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for ai.ahel/ahel
[![anlyon.dev](https://anlyon.dev/badge/ai.ahel/ahel.svg)](https://anlyon.dev/servers/ai.ahel/ahel)

Source: MCP Registry · repository. Synced Nov 2, 2026, 13:17 UTC.