Truvon MCP server
ai.truvon/directorytruvon.aistreamable-httpv1.0.0Scanned
Find and check local U.S. businesses: open or closed, sourced phone and hours, and how to act.
11 tools: 8 change things and 3 only read.
- Reads private data · 0
- Reads text others write · 2
- Can send data out · 3
- 1 finding
With Anlyon
8 tools here change things. Govern them.
- Anlyon lists the tools and adopts none.
- Each tool you adopt gets approvals and receipts.
- Your agent never holds the key.
A tool your agent calls directly is not routed through Anlyon and is not governed by it. anlyon.dev only lists and labels, and these labels are the same either way.
What the Truvon MCP server can do
The Truvon MCP server is published by truvon.ai, a domain the MCP Registry verified. It has 11 tools. It can create or change data (8 tools: find_local_businesses, more_results, check_places_results, report_answer and 4 more), but cannot delete data. 3 tools only read.
2 tools bring in text other people can write (get_business_record and report_missing); 3 tools can send data out of your system (check_places_results, report_answer and report_missing).
The fixed checks matched 1 finding (annotation-conflict). Each one comes with the text it matched.
Last scanned Nov 5, 2026, version 1.0.0.
Tools
Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.
11 tools
Changes things 8Claude Code: ask
answer_follow_upDays later, when the outcome is knowable: send your user's answers to the questions report_outcome gave you, by follow_up id.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Days later, when the outcome is knowable: send your user's answers to the questions report_outcome gave you, by follow_up id. Closed options only, never personal details.
Annotations the server declares
- title: Answer a follow-up
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
check_places_resultsCheck up to 10 businesses you found elsewhere (maps, web, a link) before you give your user a phone or send them somewhere: open or closed with dated evidence, the phone its source…Can send data outNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- outboundThe input takes a destination (input.phone): what the tool writes goes there.
Description, as the server wrote it Check up to 10 businesses you found elsewhere (maps, web, a link) before you give your user a phone or send them somewhere: open or closed with dated evidence, the phone its sources agree on, how to act. Send the name plus phone, website or address, and the town. With the need, you also get two listed businesses that fit it that you did not send. One not found is reported as not in Truvon.
Annotations the server declares
- title: Check businesses you found
- readOnlyHint: true
- openWorldHint: false
connect_truvonWhen your app has not signed in to Truvon itself: get a link for your user to open and a connection code for you.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it When your app has not signed in to Truvon itself: get a link for your user to open and a connection code for you. One tap on the link (no account) and the reporting tools accept connection in this conversation. Searching needs none of this.
Annotations the server declares
- title: Connect for reporting
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
find_local_businessesStart here.1 finding
Why it is in this group
- The name "find_local_businesses" says "find": a word for reading.
- The description's first verb is "start": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "find_local_businesses" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"openWorldHint":false}; The name "find_local_businesses" says "find": a word for reading.
Description, as the server wrote it Start here. Find businesses that fit a need near a place. Give the service in a few plain words ("furnace repair", "water heater leak"), not the user's sentence; timing goes in open_at. Each result says why it fits, its hours and whether it is open right now (by its stated hours at its local time; "open:" is whether it is in business), the phone, and how to act, and the response ends with your next step. Five results by default; ask for more with limit, and add max_minutes to stay close.
Annotations the server declares
- title: Search businesses
- readOnlyHint: true
- openWorldHint: false
more_resultsThe next page of a search, with the next_cursor the search returned; kept 24 hours.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it The next page of a search, with the next_cursor the search returned; kept 24 hours. Narrowing the need usually beats paging.
Annotations the server declares
- title: More search results
- readOnlyHint: true
- idempotentHint: false
- openWorldHint: false
report_answerWhen a business told you something its record lacks ("yes, certified kosher"), record the question and its answer in its words, with the business's truvon_id.Can send data outNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
What it can reach
- outboundThe input takes a destination (input.channel): what the tool writes goes there.
Description, as the server wrote it When a business told you something its record lacks ("yes, certified kosher"), record the question and its answer in its words, with the business's truvon_id.
Annotations the server declares
- title: Report what a business said
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
report_missingA business that fits your user's need, that you found elsewhere (the web, a map), and Truvon does not list (check_places_results said so): send its name, its own website, phone, ad…Reads text others writeCan send data outNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a destination (input.phone): what the tool writes goes there.
Description, as the server wrote it A business that fits your user's need, that you found elsewhere (the web, a map), and Truvon does not list (check_places_results said so): send its name, its own website, phone, address and the town, with the need and the search_id. It is read and listed for every agent; the directory grows where agents found it thin.
Annotations the server declares
- title: Report a business Truvon lacks
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
report_outcomeAfter you have acted for your user (booked, ordered, called, got a quote): say what happened, with the search_id and the business's truvon_id.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it After you have acted for your user (booked, ordered, called, got a quote): say what happened, with the search_id and the business's truvon_id. If something was arranged you get the questions to ask your user later and, for a job, a job id. Test traffic (x-truvon-test) is refused: dry-run at https://sandbox.truvon.ai/mcp.
Annotations the server declares
- title: Report how it went
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
Only reads 3Show 3 read-only tools
get_business_recordOne business's full record by website domain: prices, offers, hours, every way to act, each fact with its source and date, and every source's value where they disagree.Reads text others writeNo findings
Why it is in this group
- The name "get_business_record" says "get": a word for reading.
What it can reach
- untrusted-inputThe description's first sentence says "website": it reads web pages, which anyone can write.
Description, as the server wrote it One business's full record by website domain: prices, offers, hours, every way to act, each fact with its source and date, and every source's value where they disagree. Open it for a finalist, and whenever a phone or address matters. A business that is not listed cannot be opened.
Annotations the server declares
- title: Get a business listing
- readOnlyHint: true
- openWorldHint: false
get_field_historyEvery value one fact (phone, hours, address, name) has held, which source said it and when.No findings
Why it is in this group
- The name "get_field_history" says "get": a word for reading.
Description, as the server wrote it Every value one fact (phone, hours, address, name) has held, which source said it and when. Use it when a value matters and you want to judge how settled it is.
Annotations the server declares
- title: History of a fact
- readOnlyHint: true
- openWorldHint: false
get_jobWhen your user returns asking about a job you arranged: its status and the business's updates, by the job id report_outcome gave you.No findings
Why it is in this group
- The name "get_job" says "get": a word for reading.
Description, as the server wrote it When your user returns asking about a job you arranged: its status and the business's updates, by the job id report_outcome gave you.
Annotations the server declares
- title: Get a job
- readOnlyHint: true
- openWorldHint: false
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Exfil surface
Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.
No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data.
- Reads private data0
- Reads files, mail, messages, databases, secrets, calendars or repositories.
- Reads text others write2
- Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
- Can send data out3
- Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.
Findings
Matches of fixed checks, with the text they matched.
The server marks "find_local_businesses" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"openWorldHint":false}; The name "find_local_businesses" says "find": a word for reading.
History
Changes to its tool definitions and to its remote endpoint, newest first.
No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.
Install
Pinned to version 1.0.0. Values in angle brackets are yours to fill in.
claude mcp add --transport http directory https://truvon.ai/mcpclaude mcp add --transport http directory https://truvon.ai/mcpRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__directory__get_business_record",
"mcp__directory__get_field_history",
"mcp__directory__get_job"
],
"ask": [
"mcp__directory__find_local_businesses",
"mcp__directory__more_results",
"mcp__directory__check_places_results",
"mcp__directory__report_answer",
"mcp__directory__report_outcome",
"mcp__directory__report_missing",
"mcp__directory__answer_follow_up",
"mcp__directory__connect_truvon"
],
"deny": []
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as directory. Review it before you use it.
Capability tags behind 4 rules
- mcp__directory__get_business_record untrusted-input
- mcp__directory__check_places_results outbound
- mcp__directory__report_answer outbound
- mcp__directory__report_missing untrusted-input, outbound
Pin
Keep the decision: fail CI when the tools change, follow every change, or show a badge.
Pin in CI
Fail a build when the tools you reviewed are not the tools the server serves today.
curl -s "https://anlyon.dev/api/v1/servers/ai.truvon/directory/verify?hash=dcb38df6e988601651d1be2920ac61d5ed4e0dab59097aacf19a0f42ecbbf77b" | jq -e '.changed == false'Pinned hash dcb38df6e988, from Nov 5, 2026, 18:18 UTC.
Watch
Get told when its tools change: a new tool, a new description, a new class.
https://anlyon.dev/servers/ai.truvon/directory/changes.xmlAn Atom feed. Works in any feed reader or Slack's RSS app.
Badge
[](https://anlyon.dev/servers/ai.truvon/directory)Source: MCP Registry. Synced Nov 5, 2026, 18:17 UTC.
Truvon MCP server: questions and answers
Answered from the scan above, not from the publisher's description.
Is the Truvon MCP server safe?
- No scan can promise that. What its definitions show: 11 tools, 8 of which can change, send or delete something, and 1 finding from fixed checks. Allow the reads, ask before each change, and deny the deletes; the permissions block on this page does that.
Can the Truvon MCP server delete data?
- No tool is classed as destructive: going by their definitions, none of them deletes, cancels or revokes anything.
Can the Truvon MCP server do things that cannot be undone?
- No tool is classed as irreversible: none of them sends, pays, publishes or merges, going by their definitions.
What tools does the Truvon MCP server have?
- 11 tools: 8 write, 3 read. find_local_businesses, more_results, check_places_results, report_answer, report_outcome, report_missing, answer_follow_up, connect_truvon and 3 more.
Does the Truvon MCP server send data to outside services?
- 3 tools can carry data out (it sends, posts or publishes, or takes a recipient, channel or URL): check_places_results, report_answer and report_missing.
Has the Truvon MCP server changed its tools?
- Not since anlyon.dev started tracking it. Last scanned Nov 5, 2026.