Skip to content

Multiservicios services

ai.multiservicios/servicesmultiservicios.aistreamable-httpv1.7.0Scanned

Lists Multiservicios services and leaves a request to be contacted. Does not quote, sell or issue.

7 tools: 1 do something that can't be undone, 5 change things and 1 only read.

Tools: 0 delete, 1 irreversible, 5 write, 1 read.
  • Reads private data · 0
  • Reads text others write · 7
  • Can send data out · 3
  • 2 findings

Tools listed without sign-in. Remote posture

Anlyon alternative

6 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

7 tools

Can't be undone 1Claude Code: ask
  • my_earningsClicks, referrals and rewards for this affiliate over a date range, per service and in total.Reads text others writeCan send data out1 finding

    Why it is in this group

    • The description's first verb is "click": a word for a change.
    • The input addresses people (input.to): what it sends cannot be taken back.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a destination (input.to): what the tool writes goes there.

    Findings

    • Warn

      The server marks "my_earnings" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":true}; The description's first verb is "click": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Clicks, referrals and rewards for this affiliate over a date range, per service and in total. Approved and in-review rewards are two separate numbers and must stay that way: a reward in review has not been approved and is not owed, because a person reviews every referral and may decide against it. Never add them together.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
Changes things 5Claude Code: ask
  • apply_as_providerFor a BUSINESS that wants to offer its own services through the Multiservicios affiliate network — not for a customer looking for a service (use request_service) and not for someon…Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "apply_as_provider" says "apply": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a destination (input.phone): what the tool writes goes there.
    Description, as the server wrote it
    For a BUSINESS that wants to offer its own services through the Multiservicios affiliate network — not for a customer looking for a service (use request_service) and not for someone who wants to refer customers as an affiliate. It sends an application that a person reviews; it does not list the business, promise approval, or create any service. Ask for the business name, a contact name, email, phone, the kind of service, the US states where it is offered and a short description. Ask for consent in the person's own words — "is it alright if Multiservicios contacts you about this?" — and send `consent: true` only once they have said so. No document, ID number or immigration status is asked for or accepted. A successful call comes back with `status: "received"`. Do not send it again.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • my_accountThe affiliate's own profile: the referral code their links carry, the state of their account, and their public affiliate page.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    The affiliate's own profile: the referral code their links carry, the state of their account, and their public affiliate page. Needs the affiliate's own token; it answers for nobody else, and it holds nothing about a customer.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • my_referralsThe referrals credited to this affiliate, with the milestone each one reached and where its review stands.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    The referrals credited to this affiliate, with the milestone each one reached and where its review stands. Every referral is reviewed by a person, so a pending one is not an earned reward. Nothing identifies the customer: the connector cannot show who was referred, because that data is not on this surface.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • request_serviceLeaves the customer's name and phone number with Multiservicios so an affiliate calls them about one service.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "request_service" says "request": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a destination (input.phone): what the tool writes goes there.
    Description, as the server wrote it
    Leaves the customer's name and phone number with Multiservicios so an affiliate calls them about one service. It does not quote, price, sell, take payment or bind anything, and it confirms no coverage. Ask for consent in the customer's own words before calling this — "is it alright if an affiliate calls you about this?" — and send `consent: true` only once they have said so. Without it nothing is recorded. The intake asks for the service, a name, a phone number, consent and a language, and nothing else. An address, a document or ID number, an immigration status or a date of birth is refused rather than dropped, because nothing here has anywhere to put it. A successful call is final: it comes back with `status: "received"` and a `reference`, and there is nothing more to send. Do not call it again for the same customer and service — a repeat inside the same conversation returns the same reference rather than a second call to the customer, but a request that genuinely failed says so, with `delivery_failed` and `isError`, and that one is worth retrying.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
Only reads 1Show 1 read-only tool
  • list_servicesThe services that are live right now, with the `slug` to pass to request_service.Reads text others writeNo findings

    Why it is in this group

    • The name "list_services" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    The services that are live right now, with the `slug` to pass to request_service. Call it before asking the customer anything: a service that is not in this list cannot be requested, and offering one that is not there costs the customer a wait for a call that never comes. No price, fee or coverage is returned, and there is none to look up: Multiservicios puts an affiliate on the phone, and the affiliate goes through it with the customer. Sigo Seguros is a licensed insurance agency, not an insurance carrier.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data.

Reads private data0
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write7
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out3
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Tools listed without sign-in

Looked at Oct 22, 2026, 14:20 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable
yes
HTTP status of an anonymous initialize
200
tools/list served without credentials
yes
Tools that change things, listed without credentials
6
Protocol version
2025-06-18
WWW-Authenticate on 401
not observed
resource_metadata in WWW-Authenticate
not observed
RFC 9728 protected resource metadata
https://mcp.multiservicios.ai/.well-known/oauth-protected-resource/mcp
Authorization servers
https://api.multiservicios.ai
Legacy HTTP+SSE transport
no
Dynamic client registration
yes
Client ID metadata documents
yes
  • HighThe whole server

    The endpoint served tools/list without credentials, and the list has 6 tools that change things (1 irreversible, 5 write). Whether a call also works without credentials was not tested: tools are never called.

    Matched text

    https://mcp.multiservicios.ai/mcp: tools/list returned 7 tools to an anonymous client, including my_earnings (irreversible), request_service (write), apply_as_provider (write), my_account (write), my_service_links (write) and 1 more

    What this check looks for

Findings

Matches of fixed checks, with the text they matched.

2 warn
  • The server marks "my_service_links" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":true}; The name "my_service_links" says "link": a word for a change.

    What this check looks for
  • The server marks "my_earnings" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":true}; The description's first verb is "click": a word for a change.

    What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

Install

Pinned to version 1.7.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http services https://mcp.multiservicios.ai/mcp
claude mcp add --transport http services https://mcp.multiservicios.ai/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__services__list_services"
    ],
    "ask": [
      "mcp__services__request_service",
      "mcp__services__apply_as_provider",
      "mcp__services__my_account",
      "mcp__services__my_service_links",
      "mcp__services__my_referrals",
      "mcp__services__my_earnings"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as services. Review it before you use it.

Capability tags behind 7 rules
  • mcp__services__list_services untrusted-input
  • mcp__services__request_service untrusted-input, outbound
  • mcp__services__apply_as_provider untrusted-input, outbound
  • mcp__services__my_account untrusted-input
  • mcp__services__my_service_links untrusted-input
  • mcp__services__my_referrals untrusted-input
  • mcp__services__my_earnings untrusted-input, outbound

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/ai.multiservicios/services/verify?hash=840966f33f1ea9ae32d11a851795011184a83c42103731680a2e08173258efed" | jq -e '.changed == false'

Pinned hash 840966f33f1e, from Oct 21, 2026, 18:40 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/ai.multiservicios/services/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for ai.multiservicios/services
[![anlyon.dev](https://anlyon.dev/badge/ai.multiservicios/services.svg)](https://anlyon.dev/servers/ai.multiservicios/services)

Source: MCP Registry. Synced Oct 21, 2026, 17:42 UTC.