Skip to content

Surfing Dog Inbox

by surfingdog.ai · remote · no sign-in to list tools · v0.1.0 · published by ai.surfingdog

Message, ask for a quote or book a call with Surfing Dog, through its open-source inbox.

Deletes · 3Final · 2Changes · 10

19 tools: 3 can delete or cancel things, 2 do something that can't be undone, 10 change things and 4 only read.

Scanned Oct 21, 2026

1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http inbox https://inbox.surfingdog.ai/mcp

Findings

Matches of fixed checks, with the text they matched.

1 warn
  • The server marks "check_availability" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"idempotentHint":true}; The input addresses people (input.to): what it sends cannot be taken back.

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

19 tools

Deletes or cancels 3Claude Code: deny
  • cancel_itemCancel an item you created.No findings

    Why it is in this group

    • The name "cancel_item" says "cancel": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Cancel an item you created. After the business's cancellation window, a confirmed booking is cancelled late where the business records late cancellations (it may count against the customer), and refused where it does not.

    Annotations the server declares

    • readOnlyHint: false
    • idempotentHint: true
    • destructiveHint: true
  • decline_offerSay no to another time or to changes the business proposed (the booking request or the order is closed) or to its quote.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Say no to another time or to changes the business proposed (the booking request or the order is closed) or to its quote. To a change it asks for to a confirmed booking or an accepted order, no keeps what was agreed; on a change your person asked for (requested_change), it takes that back. Add reason (and reason_code) for anything your person wants the business to know.

    Annotations the server declares

    • readOnlyHint: false
    • idempotentHint: true
    • destructiveHint: true
  • withdraw_from_contractYour person withdraws from their booking (one they paid for) or order, within the period the business states (withdrawal on get_item_status).No findings

    Why it is in this group

    • The name "withdraw_from_contract" says "withdraw": a word that usually means money moves, which cannot be taken back.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Your person withdraws from their booking (one they paid for) or order, within the period the business states (withdrawal on get_item_status). Two steps: without confirm_withdrawal nothing is sent and you get the statement to show them (confirm.statement); send confirm_withdrawal: true on their yes. Before the goods went out the order ends and what was paid is refunded; once they reached your person, the goods come back (lines: only some of them) and are refunded. The business emails a copy. Never refused: past the period, or for something that cannot be returned, it goes to a person there instead (passed_on), or becomes a return under the business's own policy.

    Annotations the server declares

    • readOnlyHint: false
    • idempotentHint: true
    • destructiveHint: true
Can't be undone 2Claude Code: ask
  • check_availabilityFree start times for a service between two instants (at most 14 days).1 finding

    Why it is in this group

    • The input addresses people (input.to): what it sends cannot be taken back.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "check_availability" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"idempotentHint":true}; The input addresses people (input.to): what it sends cannot be taken back.

      What this check looks for
    Description, as the server wrote it
    Free start times for a service between two instants (at most 14 days). A time that has started, or that starts within the business's minimum notice, is not offered.

    Annotations the server declares

    • readOnlyHint: true
    • idempotentHint: true
  • send_messageStart a conversation, or reply on an item you own.No findings

    Why it is in this group

    • The name "send_message" says "send": a word for sending, and what is sent cannot be taken back.
    Description, as the server wrote it
    Start a conversation, or reply on an item you own.

    Annotations the server declares

    • readOnlyHint: false
    • idempotentHint: true
    • destructiveHint: false
Changes things 10Claude Code: ask
  • accept_offerAccept another time the business proposed for a booking, its quote, its changes to an order, or a change it asks for to a confirmed booking or an accepted order (offer.kind change:…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Accept another time the business proposed for a booking, its quote, its changes to an order, or a change it asks for to a confirmed booking or an accepted order (offer.kind change: the promise moves). This binds your person, so send terms_sha — offer.terms_sha from get_item_status — only after they said yes to offer.human, and offer_id (offer.id) so an answer to an offer since replaced does nothing. Without terms_sha nothing is booked: you get the terms to show them. An accepted quote becomes a confirmed booking or order (linked). A yes to a change that can no longer be made online goes to a person there instead (passed_on), and what was agreed stands.

    Annotations the server declares

    • readOnlyHint: false
    • idempotentHint: true
    • destructiveHint: false
  • acknowledge_receiptCounter-sign a receipt this item earned, so both sides hold it: a promise, a change both sides agreed to it (kind amended), how it ended, or a refund's.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Counter-sign a receipt this item earned, so both sides hold it: a promise, a change both sides agreed to it (kind amended), how it ended, or a refund's. Read the item to find its receipts; then send a compact JWS signed with your own Ed25519 key — header {alg:'EdDSA', typ:'sdi-receipt-ack+jws', jwk:<your public jwk>}, payload {rcp:<receipt id>, sha:<base64url(SHA-256(receipt jws))>, iat:<unix seconds>}. The instance verifies it against the key you carry and keeps it. Acknowledging twice is harmless.

    Annotations the server declares

    • readOnlyHint: false
    • idempotentHint: true
    • destructiveHint: false
  • create_bookingRequest a service at a time.No findings

    Why it is in this group

    • The name "create_booking" says "create": a word for a change.
    Description, as the server wrote it
    Request a service at a time. Check availability first. A fixed-price service costs the business's price from list_services; a different totalPrice you send is only noted for the business. A priced booking binds your person only once they confirmed it: without terms_sha nothing is sent, and you get the summary to show them (confirm.summary, confirm.terms_sha); call again with that terms_sha on their clear yes. Returns the item and, if you have no account, an access_token.

    Annotations the server declares

    • readOnlyHint: false
    • idempotentHint: true
    • destructiveHint: false
  • create_orderOrder products.No findings

    Why it is in this group

    • The name "create_order" says "create": a word for a change.
    Description, as the server wrote it
    Order products. Prices are in minor units. A line naming a product (productId or sku) costs the business's price from list_products, and the total follows; a different price you send is only noted for the business. A line naming no product waits for the business to price it. A priced order binds your person only once they confirmed it: without terms_sha nothing is sent, and you get the summary to show them (confirm.summary, confirm.terms_sha); call again with that terms_sha on their clear yes.

    Annotations the server declares

    • readOnlyHint: false
    • idempotentHint: true
    • destructiveHint: false
  • make_offerAnswer what the business proposed with only what your person would change: another start_time (a booking: one of the free times check_availability lists; a quote request: the time …No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Answer what the business proposed with only what your person would change: another start_time (a booking: one of the free times check_availability lists; a quote request: the time it is for), other quantities for the lines of changes it suggested to an order (by index in offer.terms.lines; 0 drops one), another delivery_when, or how many (quantity) for a quote request. It goes back to the business as their request. On a confirmed booking or an accepted order it asks for a change to what was agreed (lines by index in the order's orderedItem), which stands until the business says yes. A price of their own is their answer only where get_business_profile says price_negotiable: total_price for a time it proposed (start_time optional), unit_price on lines of changes to an order; it goes back to the business, which takes it or answers. Otherwise — a price where the business sets its prices, on a quote, on something it does not haggle, or asked too often — it goes to a person there as their message, as do a note alone and a suggestion after a few rounds (passed_on): never refused, and what the business proposed, or what was agreed, still stands.

    Annotations the server declares

    • readOnlyHint: false
    • idempotentHint: true
    • destructiveHint: false
  • provide_detailsAnswer what the business asked about an item (get_item_status says it needs a detail).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Answer what the business asked about an item (get_item_status says it needs a detail). The item moves on; on any other item your details are kept as a message for the business.

    Annotations the server declares

    • readOnlyHint: false
    • idempotentHint: true
    • destructiveHint: false
  • request_quoteAsk for a price on something custom.No findings

    Why it is in this group

    • The name "request_quote" says "request": a word for a change.
    Description, as the server wrote it
    Ask for a price on something custom. Creates a quote_request item.

    Annotations the server declares

    • readOnlyHint: false
    • idempotentHint: true
    • destructiveHint: false
  • request_returnOnce an order's goods reached your person: ask to send them back.No findings

    Why it is in this group

    • The name "request_return" says "request": a word for a change.
    Description, as the server wrote it
    Once an order's goods reached your person: ask to send them back. reason faulty, not_as_described or wrong_item (the legal guarantee: it costs them nothing), or changed_mind (a withdrawal while the period runs, agreed at once; after it, a return the business answers under its own policy). lines: which, by index in orderedItem, and how many; all when left out. The return comes back as linked; get_item_status lists it under refunds.

    Annotations the server declares

    • readOnlyHint: false
    • idempotentHint: true
    • destructiveHint: false
  • suggest_timeInstead of the time the business proposed, ask for another: start_time must be one of the free times check_availability lists (the end follows the service's length).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Instead of the time the business proposed, ask for another: start_time must be one of the free times check_availability lists (the end follows the service's length). The business confirms it or proposes again. On a confirmed booking it asks the business to move it (the end keeps the booking's length), and the booking stays as agreed until the business says yes. After a few rounds, or past the changes a booking may have, a person there answers it instead (passed_on).

    Annotations the server declares

    • readOnlyHint: false
    • idempotentHint: true
    • destructiveHint: false
  • verify_customerWhen a result says identity.recognised is weak, the person gave the email of a customer the business knows.No findings

    Why it is in this group

    • The input takes a statement or command to run (input.code), which can change anything it can reach.
    Description, as the server wrote it
    When a result says identity.recognised is weak, the person gave the email of a customer the business knows. Call this with item_id and access_token to email them six digits; ask the person for the code and call it again with code. Then the business recognises them.

    Annotations the server declares

    • readOnlyHint: false
    • idempotentHint: false
    • destructiveHint: false
Only reads 4Claude Code: allow
  • get_business_profileName, time zone, currency, languages and the item types this business accepts, and where it takes any other kind instead (doors_elsewhere).No findings

    Why it is in this group

    • The name "get_business_profile" says "get": a word for reading.
    Description, as the server wrote it
    Name, time zone, currency, languages and the item types this business accepts, and where it takes any other kind instead (doors_elsewhere).

    Annotations the server declares

    • readOnlyHint: true
    • idempotentHint: true
  • get_item_statusThe current state of an item you created, in the business's words: what it proposed and waits for your person to answer (offer, with its terms_sha), who it waits on, what they can …No findings

    Why it is in this group

    • The name "get_item_status" says "get": a word for reading.
    Description, as the server wrote it
    The current state of an item you created, in the business's words: what it proposed and waits for your person to answer (offer, with its terms_sha), who it waits on, what they can do next, and the conversation so far (thread: the business's replies and your person's messages).

    Annotations the server declares

    • readOnlyHint: true
    • idempotentHint: true
  • list_productsOrderable products with prices in minor units.No findings

    Why it is in this group

    • The name "list_products" says "list": a word for reading.
    Description, as the server wrote it
    Orderable products with prices in minor units.

    Annotations the server declares

    • readOnlyHint: true
    • idempotentHint: true
  • list_servicesBookable services with duration and price.No findings

    Why it is in this group

    • The name "list_services" says "list": a word for reading.
    Description, as the server wrote it
    Bookable services with duration and price. A price per person (price.per = person) is for each person in the booking: send partySize, and the total is the price times it.

    Annotations the server declares

    • readOnlyHint: true
    • idempotentHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 0.1.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http inbox https://inbox.surfingdog.ai/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__inbox__get_business_profile",
      "mcp__inbox__list_services",
      "mcp__inbox__list_products",
      "mcp__inbox__get_item_status"
    ],
    "ask": [
      "mcp__inbox__check_availability",
      "mcp__inbox__request_quote",
      "mcp__inbox__create_booking",
      "mcp__inbox__create_order",
      "mcp__inbox__accept_offer",
      "mcp__inbox__suggest_time",
      "mcp__inbox__make_offer",
      "mcp__inbox__provide_details",
      "mcp__inbox__request_return",
      "mcp__inbox__send_message",
      "mcp__inbox__acknowledge_receipt",
      "mcp__inbox__verify_customer"
    ],
    "deny": [
      "mcp__inbox__decline_offer",
      "mcp__inbox__withdraw_from_contract",
      "mcp__inbox__cancel_item"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as inbox. Review it before you use it.