Surfing Dog Inbox
by surfingdog.ai · remote · no sign-in to list tools · v0.1.0 · published by ai.surfingdog
Message, ask for a quote or book a call with Surfing Dog, through its open-source inbox.
19 tools: 3 can delete or cancel things, 2 do something that can't be undone, 10 change things and 4 only read.
Scanned Oct 21, 2026
- Deletes or cancels3Claude Code: deny: see these tools
- Can't be undone2Claude Code: ask: see these tools
- Changes things10Claude Code: ask: see these tools
- Only reads4Claude Code: allow: see these tools
1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.
claude mcp add --transport http inbox https://inbox.surfingdog.ai/mcpFindings
Matches of fixed checks, with the text they matched.
The server marks "check_availability" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true}; The input addresses people (input.to): what it sends cannot be taken back.
Tools
Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.
19 tools
Deletes or cancels 3Claude Code: deny
cancel_itemCancel an item you created.No findings
Why it is in this group
- The name "cancel_item" says "cancel": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Cancel an item you created. After the business's cancellation window, a confirmed booking is cancelled late where the business records late cancellations (it may count against the customer), and refused where it does not.
Annotations the server declares
- readOnlyHint: false
- idempotentHint: true
- destructiveHint: true
decline_offerSay no to another time or to changes the business proposed (the booking request or the order is closed) or to its quote.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Say no to another time or to changes the business proposed (the booking request or the order is closed) or to its quote. To a change it asks for to a confirmed booking or an accepted order, no keeps what was agreed; on a change your person asked for (requested_change), it takes that back. Add reason (and reason_code) for anything your person wants the business to know.
Annotations the server declares
- readOnlyHint: false
- idempotentHint: true
- destructiveHint: true
withdraw_from_contractYour person withdraws from their booking (one they paid for) or order, within the period the business states (withdrawal on get_item_status).No findings
Why it is in this group
- The name "withdraw_from_contract" says "withdraw": a word that usually means money moves, which cannot be taken back.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Your person withdraws from their booking (one they paid for) or order, within the period the business states (withdrawal on get_item_status). Two steps: without confirm_withdrawal nothing is sent and you get the statement to show them (confirm.statement); send confirm_withdrawal: true on their yes. Before the goods went out the order ends and what was paid is refunded; once they reached your person, the goods come back (lines: only some of them) and are refunded. The business emails a copy. Never refused: past the period, or for something that cannot be returned, it goes to a person there instead (passed_on), or becomes a return under the business's own policy.
Annotations the server declares
- readOnlyHint: false
- idempotentHint: true
- destructiveHint: true
Can't be undone 2Claude Code: ask
check_availabilityFree start times for a service between two instants (at most 14 days).1 finding
Why it is in this group
- The input addresses people (input.to): what it sends cannot be taken back.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "check_availability" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"idempotentHint":true}; The input addresses people (input.to): what it sends cannot be taken back.
Description, as the server wrote it Free start times for a service between two instants (at most 14 days). A time that has started, or that starts within the business's minimum notice, is not offered.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
send_messageStart a conversation, or reply on an item you own.No findings
Why it is in this group
- The name "send_message" says "send": a word for sending, and what is sent cannot be taken back.
Description, as the server wrote it Start a conversation, or reply on an item you own.
Annotations the server declares
- readOnlyHint: false
- idempotentHint: true
- destructiveHint: false
Changes things 10Claude Code: ask
accept_offerAccept another time the business proposed for a booking, its quote, its changes to an order, or a change it asks for to a confirmed booking or an accepted order (offer.kind change:…No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Accept another time the business proposed for a booking, its quote, its changes to an order, or a change it asks for to a confirmed booking or an accepted order (offer.kind change: the promise moves). This binds your person, so send terms_sha — offer.terms_sha from get_item_status — only after they said yes to offer.human, and offer_id (offer.id) so an answer to an offer since replaced does nothing. Without terms_sha nothing is booked: you get the terms to show them. An accepted quote becomes a confirmed booking or order (linked). A yes to a change that can no longer be made online goes to a person there instead (passed_on), and what was agreed stands.
Annotations the server declares
- readOnlyHint: false
- idempotentHint: true
- destructiveHint: false
acknowledge_receiptCounter-sign a receipt this item earned, so both sides hold it: a promise, a change both sides agreed to it (kind amended), how it ended, or a refund's.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Counter-sign a receipt this item earned, so both sides hold it: a promise, a change both sides agreed to it (kind amended), how it ended, or a refund's. Read the item to find its receipts; then send a compact JWS signed with your own Ed25519 key — header {alg:'EdDSA', typ:'sdi-receipt-ack+jws', jwk:<your public jwk>}, payload {rcp:<receipt id>, sha:<base64url(SHA-256(receipt jws))>, iat:<unix seconds>}. The instance verifies it against the key you carry and keeps it. Acknowledging twice is harmless.
Annotations the server declares
- readOnlyHint: false
- idempotentHint: true
- destructiveHint: false
create_bookingRequest a service at a time.No findings
Why it is in this group
- The name "create_booking" says "create": a word for a change.
Description, as the server wrote it Request a service at a time. Check availability first. A fixed-price service costs the business's price from list_services; a different totalPrice you send is only noted for the business. A priced booking binds your person only once they confirmed it: without terms_sha nothing is sent, and you get the summary to show them (confirm.summary, confirm.terms_sha); call again with that terms_sha on their clear yes. Returns the item and, if you have no account, an access_token.
Annotations the server declares
- readOnlyHint: false
- idempotentHint: true
- destructiveHint: false
create_orderOrder products.No findings
Why it is in this group
- The name "create_order" says "create": a word for a change.
Description, as the server wrote it Order products. Prices are in minor units. A line naming a product (productId or sku) costs the business's price from list_products, and the total follows; a different price you send is only noted for the business. A line naming no product waits for the business to price it. A priced order binds your person only once they confirmed it: without terms_sha nothing is sent, and you get the summary to show them (confirm.summary, confirm.terms_sha); call again with that terms_sha on their clear yes.
Annotations the server declares
- readOnlyHint: false
- idempotentHint: true
- destructiveHint: false
make_offerAnswer what the business proposed with only what your person would change: another start_time (a booking: one of the free times check_availability lists; a quote request: the time …No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Answer what the business proposed with only what your person would change: another start_time (a booking: one of the free times check_availability lists; a quote request: the time it is for), other quantities for the lines of changes it suggested to an order (by index in offer.terms.lines; 0 drops one), another delivery_when, or how many (quantity) for a quote request. It goes back to the business as their request. On a confirmed booking or an accepted order it asks for a change to what was agreed (lines by index in the order's orderedItem), which stands until the business says yes. A price of their own is their answer only where get_business_profile says price_negotiable: total_price for a time it proposed (start_time optional), unit_price on lines of changes to an order; it goes back to the business, which takes it or answers. Otherwise — a price where the business sets its prices, on a quote, on something it does not haggle, or asked too often — it goes to a person there as their message, as do a note alone and a suggestion after a few rounds (passed_on): never refused, and what the business proposed, or what was agreed, still stands.
Annotations the server declares
- readOnlyHint: false
- idempotentHint: true
- destructiveHint: false
provide_detailsAnswer what the business asked about an item (get_item_status says it needs a detail).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Answer what the business asked about an item (get_item_status says it needs a detail). The item moves on; on any other item your details are kept as a message for the business.
Annotations the server declares
- readOnlyHint: false
- idempotentHint: true
- destructiveHint: false
request_quoteAsk for a price on something custom.No findings
Why it is in this group
- The name "request_quote" says "request": a word for a change.
Description, as the server wrote it Ask for a price on something custom. Creates a quote_request item.
Annotations the server declares
- readOnlyHint: false
- idempotentHint: true
- destructiveHint: false
request_returnOnce an order's goods reached your person: ask to send them back.No findings
Why it is in this group
- The name "request_return" says "request": a word for a change.
Description, as the server wrote it Once an order's goods reached your person: ask to send them back. reason faulty, not_as_described or wrong_item (the legal guarantee: it costs them nothing), or changed_mind (a withdrawal while the period runs, agreed at once; after it, a return the business answers under its own policy). lines: which, by index in orderedItem, and how many; all when left out. The return comes back as linked; get_item_status lists it under refunds.
Annotations the server declares
- readOnlyHint: false
- idempotentHint: true
- destructiveHint: false
suggest_timeInstead of the time the business proposed, ask for another: start_time must be one of the free times check_availability lists (the end follows the service's length).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Instead of the time the business proposed, ask for another: start_time must be one of the free times check_availability lists (the end follows the service's length). The business confirms it or proposes again. On a confirmed booking it asks the business to move it (the end keeps the booking's length), and the booking stays as agreed until the business says yes. After a few rounds, or past the changes a booking may have, a person there answers it instead (passed_on).
Annotations the server declares
- readOnlyHint: false
- idempotentHint: true
- destructiveHint: false
verify_customerWhen a result says identity.recognised is weak, the person gave the email of a customer the business knows.No findings
Why it is in this group
- The input takes a statement or command to run (input.code), which can change anything it can reach.
Description, as the server wrote it When a result says identity.recognised is weak, the person gave the email of a customer the business knows. Call this with item_id and access_token to email them six digits; ask the person for the code and call it again with code. Then the business recognises them.
Annotations the server declares
- readOnlyHint: false
- idempotentHint: false
- destructiveHint: false
Only reads 4Claude Code: allow
get_business_profileName, time zone, currency, languages and the item types this business accepts, and where it takes any other kind instead (doors_elsewhere).No findings
Why it is in this group
- The name "get_business_profile" says "get": a word for reading.
Description, as the server wrote it Name, time zone, currency, languages and the item types this business accepts, and where it takes any other kind instead (doors_elsewhere).
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
get_item_statusThe current state of an item you created, in the business's words: what it proposed and waits for your person to answer (offer, with its terms_sha), who it waits on, what they can …No findings
Why it is in this group
- The name "get_item_status" says "get": a word for reading.
Description, as the server wrote it The current state of an item you created, in the business's words: what it proposed and waits for your person to answer (offer, with its terms_sha), who it waits on, what they can do next, and the conversation so far (thread: the business's replies and your person's messages).
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
list_productsOrderable products with prices in minor units.No findings
Why it is in this group
- The name "list_products" says "list": a word for reading.
Description, as the server wrote it Orderable products with prices in minor units.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
list_servicesBookable services with duration and price.No findings
Why it is in this group
- The name "list_services" says "list": a word for reading.
Description, as the server wrote it Bookable services with duration and price. A price per person (price.per = person) is for each person in the booking: send partySize, and the total is the price times it.
Annotations the server declares
- readOnlyHint: true
- idempotentHint: true
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Install
Pinned to version 0.1.0. Values in angle brackets are yours to fill in.
claude mcp add --transport http inbox https://inbox.surfingdog.ai/mcpRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__inbox__get_business_profile",
"mcp__inbox__list_services",
"mcp__inbox__list_products",
"mcp__inbox__get_item_status"
],
"ask": [
"mcp__inbox__check_availability",
"mcp__inbox__request_quote",
"mcp__inbox__create_booking",
"mcp__inbox__create_order",
"mcp__inbox__accept_offer",
"mcp__inbox__suggest_time",
"mcp__inbox__make_offer",
"mcp__inbox__provide_details",
"mcp__inbox__request_return",
"mcp__inbox__send_message",
"mcp__inbox__acknowledge_receipt",
"mcp__inbox__verify_customer"
],
"deny": [
"mcp__inbox__decline_offer",
"mcp__inbox__withdraw_from_contract",
"mcp__inbox__cancel_item"
]
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as inbox. Review it before you use it.