Multiservicios services
by multiservicios.ai · remote · no sign-in to list tools · v1.7.0 · published by ai.multiservicios
Lists Multiservicios services and leaves a request to be contacted. Does not quote, sell or issue.
7 tools: 1 do something that can't be undone, 5 change things and 1 only read.
Scanned Oct 21, 2026
- Deletes or cancels0Claude Code: deny
- Can't be undone1Claude Code: ask: see these tools
- Changes things5Claude Code: ask: see these tools
- Only reads1Claude Code: allow: see these tools
2 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.
claude mcp add --transport http services https://mcp.multiservicios.ai/mcpFindings
Matches of fixed checks, with the text they matched.
- Warnmy_service_links
The server marks "my_service_links" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":true}; The name "my_service_links" says "link": a word for a change.
- Warnmy_earnings
The server marks "my_earnings" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":true}; The description's first verb is "click": a word for a change.
Tools
Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.
7 tools
Can't be undone 1Claude Code: ask
my_earningsClicks, referrals and rewards for this affiliate over a date range, per service and in total.Reads text others writeCan send data out1 finding
Why it is in this group
- The description's first verb is "click": a word for a change.
- The input addresses people (input.to): what it sends cannot be taken back.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a destination (input.to): what the tool writes goes there.
Findings
- Warn
The server marks "my_earnings" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":true}; The description's first verb is "click": a word for a change.
Description, as the server wrote it Clicks, referrals and rewards for this affiliate over a date range, per service and in total. Approved and in-review rewards are two separate numbers and must stay that way: a reward in review has not been approved and is not owed, because a person reviews every referral and may decide against it. Never add them together.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
Changes things 5Claude Code: ask
apply_as_providerFor a BUSINESS that wants to offer its own services through the Multiservicios affiliate network — not for a customer looking for a service (use request_service) and not for someon…Reads text others writeCan send data outNo findings
Why it is in this group
- The name "apply_as_provider" says "apply": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a destination (input.phone): what the tool writes goes there.
Description, as the server wrote it For a BUSINESS that wants to offer its own services through the Multiservicios affiliate network — not for a customer looking for a service (use request_service) and not for someone who wants to refer customers as an affiliate. It sends an application that a person reviews; it does not list the business, promise approval, or create any service. Ask for the business name, a contact name, email, phone, the kind of service, the US states where it is offered and a short description. Ask for consent in the person's own words — "is it alright if Multiservicios contacts you about this?" — and send `consent: true` only once they have said so. No document, ID number or immigration status is asked for or accepted. A successful call comes back with `status: "received"`. Do not send it again.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
my_accountThe affiliate's own profile: the referral code their links carry, the state of their account, and their public affiliate page.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it The affiliate's own profile: the referral code their links carry, the state of their account, and their public affiliate page. Needs the affiliate's own token; it answers for nobody else, and it holds nothing about a customer.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
my_referralsThe referrals credited to this affiliate, with the milestone each one reached and where its review stands.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it The referrals credited to this affiliate, with the milestone each one reached and where its review stands. Every referral is reviewed by a person, so a pending one is not an earned reward. Nothing identifies the customer: the connector cannot show who was referred, because that data is not on this surface.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
my_service_linksEach service this affiliate holds, with their own referral link and an HTML snippet to embed it.Reads text others write1 finding
Why it is in this group
- The name "my_service_links" says "link": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Findings
- Warn
The server marks "my_service_links" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":true}; The name "my_service_links" says "link": a word for a change.
Description, as the server wrote it Each service this affiliate holds, with their own referral link and an HTML snippet to embed it. A service the affiliate has switched off is reported as disabled: sharing it credits no referral. No price, fee or coverage is returned, and there is none here to look up.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
request_serviceLeaves the customer's name and phone number with Multiservicios so an affiliate calls them about one service.Reads text others writeCan send data outNo findings
Why it is in this group
- The name "request_service" says "request": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a destination (input.phone): what the tool writes goes there.
Description, as the server wrote it Leaves the customer's name and phone number with Multiservicios so an affiliate calls them about one service. It does not quote, price, sell, take payment or bind anything, and it confirms no coverage. Ask for consent in the customer's own words before calling this — "is it alright if an affiliate calls you about this?" — and send `consent: true` only once they have said so. Without it nothing is recorded. The intake asks for the service, a name, a phone number, consent and a language, and nothing else. An address, a document or ID number, an immigration status or a date of birth is refused rather than dropped, because nothing here has anywhere to put it. A successful call is final: it comes back with `status: "received"` and a `reference`, and there is nothing more to send. Do not call it again for the same customer and service — a repeat inside the same conversation returns the same reference rather than a second call to the customer, but a request that genuinely failed says so, with `delivery_failed` and `isError`, and that one is worth retrying.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
Only reads 1Claude Code: allow
list_servicesThe services that are live right now, with the `slug` to pass to request_service.Reads text others writeNo findings
Why it is in this group
- The name "list_services" says "list": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it The services that are live right now, with the `slug` to pass to request_service. Call it before asking the customer anything: a service that is not in this list cannot be requested, and offering one that is not there costs the customer a wait for a call that never comes. No price, fee or coverage is returned, and there is none to look up: Multiservicios puts an affiliate on the phone, and the affiliate goes through it with the customer. Sigo Seguros is a licensed insurance agency, not an insurance carrier.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: true
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Exfil surface
Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.
No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data.
- Reads private data0
- Reads files, mail, messages, databases, secrets, calendars or repositories.
- Reads text others write7
- Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
- Can send data out3
- Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.
Remote posture
What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.
Looked at Oct 22, 2026, 14:20 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.
- Reachable
- yes
- HTTP status of an anonymous initialize
- 200
- tools/list served without credentials
- yes
- Tools that change things, listed without credentials
- 6
- Protocol version
- 2025-06-18
- WWW-Authenticate on 401
- not observed
- resource_metadata in WWW-Authenticate
- none
- RFC 9728 protected resource metadata
- https://mcp.multiservicios.ai/.well-known/oauth-protected-resource/mcp
- Authorization servers
- https://api.multiservicios.ai
- Legacy HTTP+SSE transport
- no
- Dynamic client registration
- yes
- Client ID metadata documents
- yes
- HighThe whole server
The endpoint served tools/list without credentials, and the list has 6 tools that change things (1 irreversible, 5 write). Whether a call also works without credentials was not tested: tools are never called.
What this check looks forMatched text
https://mcp.multiservicios.ai/mcp: tools/list returned 7 tools to an anonymous client, including my_earnings (irreversible), request_service (write), apply_as_provider (write), my_account (write), my_service_links (write) and 1 more
Install
Pinned to version 1.7.0. Values in angle brackets are yours to fill in.
claude mcp add --transport http services https://mcp.multiservicios.ai/mcpRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__services__list_services"
],
"ask": [
"mcp__services__request_service",
"mcp__services__apply_as_provider",
"mcp__services__my_account",
"mcp__services__my_service_links",
"mcp__services__my_referrals",
"mcp__services__my_earnings"
],
"deny": []
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as services. Review it before you use it.
Capability tags behind 7 rules
- mcp__services__list_services untrusted-input
- mcp__services__request_service untrusted-input, outbound
- mcp__services__apply_as_provider untrusted-input, outbound
- mcp__services__my_account untrusted-input
- mcp__services__my_service_links untrusted-input
- mcp__services__my_referrals untrusted-input
- mcp__services__my_earnings untrusted-input, outbound