Is it legit? Reviews trust checker

ai.legitreviews/legitreviewslegitreviews.aistreamable-httpv2.0.0Scanned 3 hours ago

Scores whether a business's Google Maps reviews are genuine. Your agent collects them, we judge.

7 tools: 1 do something that can't be undone, 3 change things and 3 only read.

Reads private data · 1
Reads text others write · 3
Can send data out · 3
1 finding

Anlyon alternative

4 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

7 tools

Can't be undone 1Sends, pays, publishes or merges: once done, it cannot be taken back.Claude Code: ask

finalize_submissionFor a submission fed by inline chunks: validates, scores, stores and returns the report.No findings
Why it is in this group
- The name "finalize_submission" says "finalize": a word for a change that another call does not undo.
Description, as the server wrote it
For a submission fed by inline chunks: validates, scores, stores and returns the report. For one already uploaded to its upload_url: returns the stored report. Pending with nothing uploaded yet: says so.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false

Changes things 3Creates or changes something that can be changed back.Claude Code: ask

begin_submissionReserves a submission and returns an upload_url.Can send data outNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
What it can reach
- outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
Description, as the server wrote it
Reserves a submission and returns an upload_url. POST the complete JSON payload (format from describe_review_source) to it from your own environment or the user's browser; the HTTP response is the trust report. The URL is a secret that completes the submission under YOUR identity whoever posts to it, so the POST needs no key. Alternatively feed the same submission_id to submit_reviews in inline chunks. Pending submissions expire after 2 hours (or are closed as superseded when you one-shot the same place instead).
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
check_placeCall first.Can send data out1 finding
Why it is in this group
- The description's first verb is "call": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
Findings
- Warn
  The server marks "check_place" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
  Matched text
  annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "call": a word for a change.
  What this check looks for
Description, as the server wrote it
Call first. Resolves a Google Maps link or place_id and reports whether a trust result is cached, how fresh it is, and a recommendation: use the cached result, or collect and submit the reviews (also when a cached single-source result would benefit from your corroboration). Never contacts Google.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
submit_reviewsSubmit the review feed inside the tool call.No findings
Why it is in this group
- The name "submit_reviews" says "submit": a word for a change.
Description, as the server wrote it
Submit the review feed inside the tool call. Without submission_id this is a one-shot submission of the whole payload (fine up to about 150 reviews). For more, call begin_submission, then send chunks of up to 150 reviews each with the same submission_id and final=false; send final=true with the last chunk (the identity fields may arrive with any chunk). Use this only when you cannot POST to the upload_url yourself (no page fetch, no curl): retyping reviews you already hold in a page or script is slow and error-prone. Returns the trust report when finalized.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false

Only reads 3Looks things up and changes nothing.Show 3 read-only tools

describe_review_sourceRead this BEFORE scraping.Reads text others writeNo findings
Why it is in this group
- The name "describe_review_source" says "describe": a word for reading.
What it can reach
- untrusted-inputThe name "describe_review_source" says "describe" and "review": it reads comments, which other people can write.
Description, as the server wrote it
Read this BEFORE scraping. Returns, per platform, the exact submission format: identity fields for the listing, the per-review fields (required vs optional; everything required is visible on the review card), where each lives on the platform's pages, the sort-by-newest and 500-most-recent rules, an example payload, and how to deliver it. Without a platform it lists the supported platforms. Only Google Maps exists today.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_place_trustThe cached fraud analysis for a place: verdict (looks_legit / not_sure / past_manipulation / inflated / manipulated) with its label and a one-sentence summary, letter grade, 0-100 …Reads text others writeCan send data outNo findings
Why it is in this group
- The name "get_place_trust" says "get": a word for reading.
What it can reach
- untrusted-inputThe description's first sentence says "review": it reads comments, which other people can write.
- untrusted-inputThe input takes a URL (input.url), and the tool reads it: it reads web pages, which anyone can write.
- outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
Claude Code: ask, because it is tagged outbound.
Description, as the server wrote it
The cached fraud analysis for a place: verdict (looks_legit / not_sure / past_manipulation / inflated / manipulated) with its label and a one-sentence summary, letter grade, 0-100 trust score, the adjusted rating credible reviewers actually give (vs the headline average), reviewer-mix tiers, review-injection statistics, cross-business duplicate-review evidence, red flags, and provenance. Cache only: on a miss, collect and submit the reviews (see check_place).
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
list_scored_placesThe ranked directory of places already analyzed for review fraud, best adjusted rating first (what the site's home and city pages show).Reads private dataReads text others writeNo findings
Why it is in this group
- The name "list_scored_places" says "list": a word for reading.
What it can reach
- private-dataThe description's first sentence says "directory": it reads files.
- untrusted-inputThe description's first sentence says "review": it reads comments, which other people can write.
Description, as the server wrote it
The ranked directory of places already analyzed for review fraud, best adjusted rating first (what the site's home and city pages show). 25 per page. Optional city or curated-list filter; the response lists the available cities/lists and their counts.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

9 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 1 private-data tool breaks every one.

Reads private data1: Reads files, mail, messages, databases, secrets, calendars or repositories.; list_scored_places
Reads text others write3: Brings in text someone else can write: web pages, inbound email, messages, issues and comments.; describe_review_source
get_place_trust
list_scored_places
Can send data out3: Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.; begin_submission
check_place
get_place_trust

deny to break every path

{
  "permissions": {
    "deny": [
      "mcp__legitreviews__list_scored_places"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

1 warn

Warncheck_place
The server marks "check_place" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
Matched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "call": a word for a change.
What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 2.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http legitreviews https://legitreviews.ai/mcp

claude mcp add --transport http legitreviews https://legitreviews.ai/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__legitreviews__describe_review_source",
      "mcp__legitreviews__list_scored_places"
    ],
    "ask": [
      "mcp__legitreviews__check_place",
      "mcp__legitreviews__begin_submission",
      "mcp__legitreviews__submit_reviews",
      "mcp__legitreviews__finalize_submission",
      "mcp__legitreviews__get_place_trust"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as legitreviews. Review it before you use it.

Capability tags behind 5 rules

mcp__legitreviews__describe_review_source untrusted-input
mcp__legitreviews__check_place outbound
mcp__legitreviews__begin_submission outbound
mcp__legitreviews__get_place_trust untrusted-input, outbound
mcp__legitreviews__list_scored_places private-data, untrusted-input

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/ai.legitreviews/legitreviews/verify?hash=85eb752f73a8e041c6b19b1625f01c796b204011393ba04637e45570c8794d35" | jq -e '.changed == false'

Pinned hash 85eb752f73a8, from Nov 3, 2026, 08:17 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/ai.legitreviews/legitreviews/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

[![anlyon.dev](https://anlyon.dev/badge/ai.legitreviews/legitreviews.svg)](https://anlyon.dev/servers/ai.legitreviews/legitreviews)

Source: MCP Registry. Synced Nov 3, 2026, 09:17 UTC.