Skip to content
anlyon.devby Anlyon

AgentMart core tools

ai.ciphyr.agentmart/coreagentmart.ciphyr.aistreamable-httpv1.0.0Scanned

The AgentMart shop with a shorter tool list: the same sign-in, balance and items as /mcp.

33 tools: 23 can delete or cancel things, 6 change things and 4 only read.

Tools: 23 delete, 0 irreversible, 6 write, 4 read.
  • Reads private data · 3
  • Reads text others write · 10
  • Can send data out · 0
  • 3 findings

Anlyon alternative

29 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →
Compare with similar serversMarkdownJSONReport this listing

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

33 tools

Deletes or cancels 23Claude Code: deny
  • blueprint_put_stageSave one stage of your blueprint, in order: concept, features, pages, database, tech_spec, tasks.No findings

    Why it is in this group

    • The name "blueprint_put_stage" says "put": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Save one stage of your blueprint, in order: concept, features, pages, database, tech_spec, tasks. We check it against its schema and your earlier stages (the database DDL really runs on PostgreSQL). Problems come back with their path and nothing is saved; fix them all and call again. For tasks, send {"tasks": []} to let us build the list.

    Annotations the server declares

    • title: Save a blueprint stage
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • blueprint_update_taskSet a blueprint task to doing when you start it and done when its tests pass (todo undoes).No findings

    Why it is in this group

    • The name "blueprint_update_task" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Set a blueprint task to doing when you start it and done when its tests pass (todo undoes). Your human sees the progress on the plan page.

    Annotations the server declares

    • title: Update a blueprint task
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • buyBuy an item from your balance.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Buy an item from your balance. Utilities start immediately; kits return a single-use download link. Pass instance_id to renew a utility you own. Above what is left of today's spending limit, the order waits (status pending_approval, HTTP 202, nothing taken) and your owner gets one email to approve it within 24 hours; get_order then shows paid, declined, expired, cancelled or approval_failed. Retry with the same idempotency_key: never a second order. Human services (shelf human, done by our own team): quote_human_service first (free), then pass brief (get_item: details.brief_schema), max_price_cents, and any login only as secret; then get_job with delivery.job_id. A website test first waits for your proof that each site is yours (verify_job_sites). More: /llms/human-services.md. A kit your owner already bought is a free update in every later version with the same main version number (1.0.2 to 1.2.0 costs 0, no balance, limit or approval); a new main version (2.0.0) is a new purchase.

    Annotations the server declares

    • title: Buy with the balance
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • buy_site_badgeSpends the balance: $5 for 30 days; renew with buy and the badge's instance_id ($3 per 30 days).Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Spends the balance: $5 for 30 days; renew with buy and the badge's instance_id ($3 per 30 days). Needs the domain proved with prove_domain in the last 7 days. We check the site daily and publish the result on a public page with a badge image and a signed copy; get_utility shows the first one within about 10 minutes. Above the daily limit it waits for your owner's approval. One idempotency_key, one order. Not a security audit.

    Annotations the server declares

    • title: Buy a site check badge
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • cancel_jobCancel a website test still waiting for its sites' proof (status needs_verification): the whole price comes back to your owner's balance as store credit at once, the job closes (cl…No findings

    Why it is in this group

    • The name "cancel_job" says "cancel": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Cancel a website test still waiting for its sites' proof (status needs_verification): the whole price comes back to your owner's balance as store credit at once, the job closes (closed_reason cancelled_unproved), and cancel_jws is our signed statement of it. Safe to repeat. Any other status: 409 job_not_cancellable.

    Annotations the server declares

    • title: Cancel a job still waiting for its sites' proof
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • check_emailsCheck up to 1000 of your owner's own email addresses before sending ($1 for up to 100 addresses, $4 for up to 1,000, counted by different entries; a list where no address needs the…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Check up to 1000 of your owner's own email addresses before sending ($1 for up to 100 addresses, $4 for up to 1,000, counted by different entries; a list where no address needs the mail server costs $1, the rest credited). Each comes back valid, invalid, risky or unknown with a reason; nothing is ever sent to the addresses. consent "own_opt_in_contacts" is required, only when it is true: These addresses are my owner's own contacts, who agreed to hear from my owner (opt-in). The list was not bought, rented, scraped, harvested or guessed, and it will not be used for spam. We check a list your owner already has. We never supply, find, guess, enrich or sell addresses, and we never send anything to them. Then call get_email_check about once a minute until completed. A bigger order waits for your owner's approval by email (status pending_approval). Limits: 2 lists open at once per owner and 10 lists per 24 hours. Retries, refusals and credits: /llms/email-check.md.

    Annotations the server declares

    • title: Check a list of my owner's email addresses
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • check_senderCheck how the domain your owner sends email from is set up ($1 per domain, from the balance): MX, SPF, DKIM, DMARC, MTA-STS, TLS-RPT, BIMI, reverse DNS and a blocklist.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Check how the domain your owner sends email from is set up ($1 per domain, from the balance): MX, SPF, DKIM, DMARC, MTA-STS, TLS-RPT, BIMI, reverse DNS and a blocklist. The answer usually holds the whole report: a score, pass, warn or fail per check, a plain summary and the exact DNS records to add. provider ADDS that provider's DKIM selectors and return path to the search (the common selectors are always tried too); for Amazon SES send the three Easy DKIM tokens in dkim_selectors. A bigger order waits for your owner's approval (pending_approval). Limits: 30 checks per owner per 24 hours, one domain at most 5 times an hour per owner. Public DNS only; nothing is sent. This report checks your DNS setup only. Passing every check does not guarantee that mail reaches the inbox: receivers also judge your sending reputation, your content and how people react to your mail. More: /llms/sender-health-check.md.

    Annotations the server declares

    • title: Check my owner's sending domain setup
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • claim_refundClaim store credit for a purchase that did not work.No findings

    Why it is in this group

    • The name "claim_refund" says "refund": a word that usually means money moves, which cannot be taken back.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Claim store credit for a purchase that did not work. Within 24 hours. We verify on our side (our own test run or our service logs) before crediting. Our guarantee pays store credit, not card refunds; your owner's legal rights are not limited by it.

    Annotations the server declares

    • title: Claim store credit for a purchase
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • close_shop_windowClose a pick link you made with show_shop_to_owner before it expires, for example when your human already told you what they want or you shared it by mistake.No findings

    Why it is in this group

    • The name "close_shop_window" says "close": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Close a pick link you made with show_shop_to_owner before it expires, for example when your human already told you what they want or you shared it by mistake. The link then shows a closed page and takes no more picks (also in the in-chat cards); the picks made so far stay readable with get_owner_picks (status closed). Closing again changes nothing. Only the passport that made it.

    Annotations the server declares

    • title: Close a pick link
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • heartbeat_removeStop watching a job.No findings

    Why it is in this group

    • The name "heartbeat_remove" says "remove": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Stop watching a job. Its ping address stops answering.

    Annotations the server declares

    • title: Stop watching a job
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • inbox_pro_setSet your webhook inbox pro plan: inbox_instance_id (the inbox to upgrade, same address), forward ({url} or null), verify ({preset: github|stripe|slack|zoom|hmac, secret, ...} or nu…Reads text others writeNo findings

    Why it is in this group

    • The name "inbox_pro_set" says "set": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Set your webhook inbox pro plan: inbox_instance_id (the inbox to upgrade, same address), forward ({url} or null), verify ({preset: github|stripe|slack|zoom|hmac, secret, ...} or null), handshakes ({slack, zoom, meta_verify_token}). Fields left out stay. The forwarding key comes back once, as forward_secret: keep it to check our forwards.

    Annotations the server declares

    • title: Set webhook inbox pro forwarding, signature checks and handshakes
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
  • locker_deleteDelete a key from your memory locker.No findings

    Why it is in this group

    • The name "locker_delete" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Delete a key from your memory locker.

    Annotations the server declares

    • title: Delete from my memory locker
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • locker_putStore a value in your memory locker under a key (survives between sessions).No findings

    Why it is in this group

    • The name "locker_put" says "put": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Store a value in your memory locker under a key (survives between sessions). Send exactly one of value (text) or value_base64 (bytes). The answer holds the value's etag: pass it as if_match next time so that a run that overlaps yours cannot be overwritten without notice.

    Annotations the server declares

    • title: Store in my memory locker
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • queue_ackDone: the messages of these leases are deleted.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Done: the messages of these leases are deleted. A lease that ran out and was claimed again is listed in lost.

    Annotations the server declares

    • title: Acknowledge queue messages (deletes them)
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • queue_extendMore time for long work: each lease that has not run out ends visibility_timeout_seconds from now (a shorter time than is left shortens it).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    More time for long work: each lease that has not run out ends visibility_timeout_seconds from now (a shorter time than is left shortens it).

    Annotations the server declares

    • title: Extend queue leases
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • reminder_deleteDelete a reminder to your human.No findings

    Why it is in this group

    • The name "reminder_delete" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Delete a reminder to your human.

    Annotations the server declares

    • title: Delete a reminder to my human
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • revoke_passportEnd your passport for good: its token, sessions and app sign-ins stop working at once and cannot be restored.No findings

    Why it is in this group

    • The name "revoke_passport" says "revoke": a word for removing or ending something.
    • The description says "cannot be restored".
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    End your passport for good: its token, sessions and app sign-ins stop working at once and cannot be restored. Your owner's balance and utilities stay with your owner. Safe to repeat. Your MCP app's own sign-in may do this. A passport made over MCP (no key) may do this with its own token, a kill switch if the token leaked; a passport with a key must send a signed request (a token gets signature_required).

    Annotations the server declares

    • title: End this passport
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • schedule_deleteDelete a repeating wake-up and its runs.No findings

    Why it is in this group

    • The name "schedule_delete" says "schedule": a word for a change.
    • The description's first verb is "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Delete a repeating wake-up and its runs.

    Annotations the server declares

    • title: Delete a repeating wake-up
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • set_form_digestChange your form inbox's settings: the daily digest email to your owner (digest on or off: at most one email a day for all their forms, only while new entries arrive) and the site …Reads text others writeNo findings

    Why it is in this group

    • The name "set_form_digest" says "set": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Change your form inbox's settings: the daily digest email to your owner (digest on or off: at most one email a day for all their forms, only while new entries arrive) and the site name its thank-you page shows visitors (site_name, 1 to 60 characters, null clears it). Send either or both. The answer says whether email can reach your owner right now (email: ready, unconfirmed, no_address, not_configured or owner_opted_out; unconfirmed means your owner gets one confirmation email, only once until they confirm, and digests start after they confirm) and when digests go out (digest_schedule).

    Annotations the server declares

    • title: Set the form digest email and the site name
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
  • share_setPublish content on your share link so a human can see it (HTML, plain text, Markdown, PNG, JPEG or PDF, up to 4 MB).Reads text others writeNo findings

    Why it is in this group

    • The name "share_set" says "set": a word for a change.
    • The description's first verb is "publish": a word for a change that another call does not undo.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Publish content on your share link so a human can see it (HTML, plain text, Markdown, PNG, JPEG or PDF, up to 4 MB). Use content for text or content_base64 for images and PDFs. With content_base64 the file can be about 3 MB at most: base64 adds a third and requests are limited to 4.5 MB.

    Annotations the server declares

    • title: Publish on my share link
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
  • uptime_removeStop watching a URL.No findings

    Why it is in this group

    • The name "uptime_remove" says "remove": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Stop watching a URL. Its results and incidents are deleted.

    Annotations the server declares

    • title: Stop watching a URL
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • wakeup_cancelCancel a wake-up call that has not fired yet (scheduled or retrying).No findings

    Why it is in this group

    • The name "wakeup_cancel" says "cancel": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Cancel a wake-up call that has not fired yet (scheduled or retrying).

    Annotations the server declares

    • title: Cancel a wake-up call
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • withdraw_askWithdraw a question to your owner that is still waiting for an answer, because you no longer need it.No findings

    Why it is in this group

    • The name "withdraw_ask" says "withdraw": a word that usually means money moves, which cannot be taken back.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Withdraw a question to your owner that is still waiting for an answer, because you no longer need it. Its answer links then tell your owner you withdrew it, and record nothing. It counts as done (status withdrawn) but keeps its place in your ask limits until its expires_at, so withdrawing never lets you ask more. Withdrawing again changes nothing; an answered question cannot be withdrawn.

    Annotations the server declares

    • title: Withdraw a question to my human
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
Changes things 6Claude Code: ask
  • agentmart_readRun one AgentMart tool that only reads: tool, ack, arguments.1 finding

    Why it is in this group

    • The name "agentmart_read" says "read": a word for reading.
    • The description's first verb is "run": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "agentmart_read" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":false}; The name "agentmart_read" says "read": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Run one AgentMart tool that only reads: tool, ack, arguments. At /mcp/core, reads and changes that destroy nothing run through agentmart_read and agentmart_write, so a block on one of those single tools does not apply there; block the run tool, or connect to /mcp, where every tool is its own tool.

    Annotations the server declares

    • title: Run an AgentMart tool that only reads
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
  • agentmart_writeRun one AgentMart tool that changes, never destroys or spends.Reads text others writeNo findings

    Why it is in this group

    • The name "agentmart_write" says "write": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Run one AgentMart tool that changes, never destroys or spends. At /mcp/core, reads and changes that destroy nothing run through agentmart_read and agentmart_write, so a block on one of those single tools does not apply there; block the run tool, or connect to /mcp, where every tool is its own tool.

    Annotations the server declares

    • title: Run an AgentMart tool that changes something without destroying anything and without spending
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • create_passportOnly for MCP apps that cannot sign in to AgentMart: create your passport (your identity here).No findings

    Why it is in this group

    • The name "create_passport" says "create": a word for a change.
    Description, as the server wrote it
    Only for MCP apps that cannot sign in to AgentMart: create your passport (your identity here). Call once and KEEP the returned token: it is shown only once. No email, no password. When your app signed in (whoami works without a token), you already have a passport: do not call this.

    Annotations the server declares

    • title: Create a passport
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • save_owner_picksOnly for the AgentMart shop window view (the in-chat cards call it when your human presses Send to my agent).No findings

    Why it is in this group

    • The name "save_owner_picks" says "save": a word for a change.
    Description, as the server wrote it
    Only for the AgentMart shop window view (the in-chat cards call it when your human presses Send to my agent). Agents: never call it yourself; read the picks with get_owner_picks.

    Annotations the server declares

    • title: Record my human's picks
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • show_shop_to_ownerShow your human what AgentMart sells, as cards in plain words with prices, and let them pick.Reads private data1 finding

    Why it is in this group

    • The name "show_shop_to_owner" says "show": a word for reading.
    • The server marks it as not read-only (readOnlyHint: false).

    What it can reach

    • private-dataThe input names an inbox (input.inbox_instance_id), and the tool reads: it reads mail.

    Findings

    • Warn

      The server marks "show_shop_to_owner" as not read-only (readOnlyHint: false), and its words say it reads.

      Matched text

      annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":false}; The name "show_shop_to_owner" says "show": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Show your human what AgentMart sells, as cards in plain words with prices, and let them pick. Makes a pick link, your human's own page for it (7 days; your human presses Open my page, ticks items and presses Send to my agent). Send pick_url to your human only, in a private message. It opens in the first browser where they press Open my page, and then only there. Never open pick_url yourself or press Open in your own browser. For another device, reopen it (reopen_shop_window (at /mcp only)). In chats that show MCP Apps, the cards appear right here and the picks come back as a chat message. Put up to 12 items you recommend first, with a short note (plain words, no links). Picking never buys anything: read the picks with get_owner_picks (find it with agentmart_tools), and confirm with your human before you buy (on the link, only the first browser that presses Open my page can pick, and that may not be your human if the link was passed on; the in-chat cards pick too). 20 links per day.

    Annotations the server declares

    • title: Show the shop to my human
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • top_upCreate a payment link to fund your balance.Reads text others writeNo findings

    Why it is in this group

    • The description's first verb is "create": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Create a payment link to fund your balance. Give pay_link to your human owner: it works for 7 days; they tick a box to agree to the waiver, then pay on Stripe's page (USD). Humans always use pay_link. Only for a machine payment by your own agent wallet set for_agent_wallet: true to also get url, the direct Stripe page (about 30 minutes). Then poll top_up_status.

    Annotations the server declares

    • title: Make a top-up pay link for my owner
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
Only reads 4Show 4 read-only tools
  • agentmart_toolsFind AgentMart tools not in your list: memory, webhook inbox, wake-ups, uptime and heartbeat watch, queues, forms, share links, asking your human, orders, jobs, feedback.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The description's first verb is "find": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "find" and "inbox": it reads mail.
    • untrusted-inputThe description's first sentence says "find" and "inbox": it reads inbound email, which other people can write.
    Description, as the server wrote it
    Find AgentMart tools not in your list: memory, webhook inbox, wake-ups, uptime and heartbeat watch, queues, forms, share links, asking your human, orders, jobs, feedback. Pass words or a group, or a tool's name for its description, arguments, ack and the run tool that runs it.

    Annotations the server declares

    • title: Find an AgentMart tool
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
  • get_itemFull details of one item by slug.No findings

    Why it is in this group

    • The name "get_item" says "get": a word for reading.
    Description, as the server wrote it
    Full details of one item by slug. With your passport (your app's sign-in, the Authorization header or passport_token), a kit your owner bought also shows update_available: the newer version with the same main version number that is free for your owner, and the one buy call that gets it (null when nothing newer is free). The project blueprint read with your passport shows your owner's promo: used true once your owner had the free one (search_catalog always shows the general offer).

    Annotations the server declares

    • title: Show a catalog item
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
  • search_catalogSearch the shelves.No findings

    Why it is in this group

    • The name "search_catalog" says "search": a word for reading.
    Description, as the server wrote it
    Search the shelves. Each item shows its price and verified agent reviews; every digital product also shows what building it took our own agents (counted by our published method), and every kit its test results.

    Annotations the server declares

    • title: Search the catalog
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
  • whoamiYour passport, how strong this sign-in is (credential), balance (owner.balance_expires_at: when it expires without a top-up or purchase; tell your human in time), spend limit, noti…Reads private dataReads text others write1 finding

    Why it is in this group

    • The name "whoami" says "whoami": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "credential": it reads secrets.
    • untrusted-inputThe description's first sentence says "review": it reads comments, which other people can write.

    Findings

    • Info

      The description mentions "credential".

      Matched text

      description: "...r passport, how strong this sign-in is (credential), balance (owner.balance_expires_at: wh..."

      What this check looks for
    Description, as the server wrote it
    Your passport, how strong this sign-in is (credential), balance (owner.balance_expires_at: when it expires without a top-up or purchase; tell your human in time), spend limit, notices, pending reviews, and at most one optional question from us (answer it once with send_feedback and its prompt_id). owner.email_hint (who paid, masked) and owner.passport_count show who is behind your balance: if they are not your human's, tell your human (as your owner's only agent you may also call leave_owner). owner.notices lists agents that joined (also with a code from your owner's email), tokens that spent from a new network, and lockdowns.

    Annotations the server declares

    • title: Show my passport and balance
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged outbound.

Reads private data3
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write10
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out0
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

2 warn1 info
  • Warnshow_shop_to_owner

    The server marks "show_shop_to_owner" as not read-only (readOnlyHint: false), and its words say it reads.

    Matched text

    annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":false}; The name "show_shop_to_owner" says "show": a word for reading.

    What this check looks for
  • Warnagentmart_read

    The server marks "agentmart_read" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":false}; The name "agentmart_read" says "read": a word for reading.

    What this check looks for
  • Infowhoami

    The description mentions "credential".

    Matched text

    description: "...r passport, how strong this sign-in is (credential), balance (owner.balance_expires_at: wh..."

    What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http core https://agentmart.ciphyr.ai/mcp/core
claude mcp add --transport http core https://agentmart.ciphyr.ai/mcp/core

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__core__whoami",
      "mcp__core__search_catalog",
      "mcp__core__get_item",
      "mcp__core__agentmart_tools"
    ],
    "ask": [
      "mcp__core__create_passport",
      "mcp__core__top_up",
      "mcp__core__show_shop_to_owner",
      "mcp__core__save_owner_picks",
      "mcp__core__agentmart_read",
      "mcp__core__agentmart_write"
    ],
    "deny": [
      "mcp__core__revoke_passport",
      "mcp__core__buy",
      "mcp__core__cancel_job",
      "mcp__core__check_emails",
      "mcp__core__locker_put",
      "mcp__core__locker_delete",
      "mcp__core__wakeup_cancel",
      "mcp__core__withdraw_ask",
      "mcp__core__uptime_remove",
      "mcp__core__schedule_delete",
      "mcp__core__heartbeat_remove",
      "mcp__core__reminder_delete",
      "mcp__core__inbox_pro_set",
      "mcp__core__queue_ack",
      "mcp__core__queue_extend",
      "mcp__core__check_sender",
      "mcp__core__share_set",
      "mcp__core__set_form_digest",
      "mcp__core__claim_refund",
      "mcp__core__blueprint_put_stage",
      "mcp__core__blueprint_update_task",
      "mcp__core__buy_site_badge",
      "mcp__core__close_shop_window"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as core. Review it before you use it.

Capability tags behind 11 rules
  • mcp__core__whoami private-data, untrusted-input
  • mcp__core__top_up untrusted-input
  • mcp__core__check_emails untrusted-input
  • mcp__core__inbox_pro_set untrusted-input
  • mcp__core__check_sender untrusted-input
  • mcp__core__share_set untrusted-input
  • mcp__core__set_form_digest untrusted-input
  • mcp__core__buy_site_badge untrusted-input
  • mcp__core__show_shop_to_owner private-data
  • mcp__core__agentmart_tools private-data, untrusted-input
  • mcp__core__agentmart_write untrusted-input

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/ai.ciphyr.agentmart/core/verify?hash=515af59e1a0a2484ba8d0890b5ada2169f47dcbd41e952eebd9221c4dd6c4d58" | jq -e '.changed == false'

Pinned hash 515af59e1a0a, from Oct 24, 2026, 11:17 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/ai.ciphyr.agentmart/core/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for ai.ciphyr.agentmart/core
[![anlyon.dev](https://anlyon.dev/badge/ai.ciphyr.agentmart/core.svg)](https://anlyon.dev/servers/ai.ciphyr.agentmart/core)

Source: MCP Registry · repository. Synced Oct 24, 2026, 12:17 UTC.