uetr.ai - UETR and SWIFT Payment Tracking
ai.uetr/uetr.aiuetr.aistreamable-httpv1.0.1-registry.1Scanned
UETR tracking and SWIFT payment tracking for AI apps. Read transfer status and manage monitoring.
33 tools: 15 can delete or cancel things, 3 do something that can't be undone, 2 change things and 13 only read.
- Reads private data · 1
- Reads text others write · 12
- Can send data out · 5
- 1 finding
Anlyon alternative
20 of these tools change something. Run those as governed actions.
Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.
Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.
Import an OpenAPI spec →Tools
Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.
33 tools
Deletes or cancels 15Claude Code: deny
archive_transferArchive a transfer: its checks stop, and it and its timeline stay in the account.No findings
Why it is in this group
- The name "archive_transfer" says "archive": a word for removing or ending something.
- The description says "cannot be restored".
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Archive a transfer: its checks stop, and it and its timeline stay in the account. Archived transfers use no active transfer place. Restoring needs an active subscription and a free active transfer place, so on a free or lapsed account archiving ends the transfer's checks: it cannot be restored unless the account subscribes. Archiving an archived transfer changes nothing. Returns the transfer.
Annotations the server declares
- title: Archive a transfer
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
change_webhook_endpoint_urlSend a webhook endpoint's events to a new HTTPS address, for example after the receiver moved.Reads text others writeCan send data outNo findings
Why it is in this group
- The description's first verb is "send": a word for sending, and what is sent cannot be taken back.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe description's first verb is "send": it sends or publishes something to other people.
Description, as the server wrote it Send a webhook endpoint's events to a new HTTPS address, for example after the receiver moved. The endpoint keeps its id, events and signing secret, and returns to pending: until the account owner confirms the new address on the website it receives only test events, and the owner is normally notified by email. Deliveries still waiting for the old address are dropped, and a request still waiting on the old address is closed as withdrawn. If the owner declines, or nobody confirms within 7 days, the endpoint is removed. Sending the address an endpoint is already waiting on answers with its waiting request again. A change counts toward the hourly limit on adding endpoints. Only the account owner's API keys and connected apps can change webhooks.
Annotations the server declares
- title: Change a webhook endpoint's address
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: true
decline_team_invitationDecline an invitation addressed to the user behind this key or connection, using the token from their invitation link.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Decline an invitation addressed to the user behind this key or connection, using the token from their invitation link. Releases that pending seat without joining the team. It cannot decline another person's invitation or remove an active membership. Available on every plan.
Annotations the server declares
- title: Decline a team invitation
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
delete_transferPermanently delete a transfer from the account, archived or not, with its timeline.No findings
Why it is in this group
- The name "delete_transfer" says "delete": a word for removing or ending something.
- The description says "Permanently delete".
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Permanently delete a transfer from the account, archived or not, with its timeline. It cannot be undone; archiving keeps the transfer instead. Adding the UETR again later starts a new transfer.
Annotations the server declares
- title: Delete a transfer
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
delete_webhook_endpointDelete a webhook endpoint.No findings
Why it is in this group
- The name "delete_webhook_endpoint" says "delete": a word for removing or ending something.
- The description says "cannot be undone".
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Delete a webhook endpoint. Nothing more is sent to it, its delivery log is removed, and a confirmation still waiting for the account owner is closed as withdrawn. This cannot be undone. Only the account owner's API keys and connected apps can delete webhooks.
Annotations the server declares
- title: Delete a webhook endpoint
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
remove_team_memberRemove a teammate from the account, or cancel a pending invitation, and free the seat.No findings
Why it is in this group
- The name "remove_team_member" says "remove": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Remove a teammate from the account, or cancel a pending invitation, and free the seat. A removed teammate loses access to the account at once, and the API keys and connected apps they set up for it stop working. Transfers they added stay in the account. Only the account owner's API keys and connected apps can remove, while the plan includes team seats.
Annotations the server declares
- title: Remove a teammate
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
rename_transferSet or clear a transfer's label, at most 64 characters; an empty label clears it, as does one of only spaces or invisible characters.No findings
Why it is in this group
- The name "rename_transfer" says "rename": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Set or clear a transfer's label, at most 64 characters; an empty label clears it, as does one of only spaces or invisible characters. A label cannot contain tabs, line breaks or other control characters, or characters that override the direction of the text (U+202A to U+202E, U+2066 to U+2069). The direction marks U+200E, U+200F and U+061C are accepted, as right-to-left text uses them. A label can be set once the transfer has been found. Only the account owner's API keys and connected apps can rename a transfer. Returns the transfer.
Annotations the server declares
- title: Rename a transfer
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
resend_team_invitationSend a pending team invitation again when its delivery was not confirmed.Reads text others writeCan send data outNo findings
Why it is in this group
- The name "resend_team_invitation" says "resend": a word for sending, and what is sent cannot be taken back.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe name "resend_team_invitation" says "resend": it sends or publishes something to other people.
Description, as the server wrote it Send a pending team invitation again when its delivery was not confirmed. An invitation already queued for delivery is refused, and invitations to one address are limited each hour. No seat changes. Only the account owner's API keys and connected apps can resend, while the plan includes team seats.
Annotations the server declares
- title: Resend a team invitation
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: false
- openWorldHint: true
restore_transferRestore an archived transfer so its monitoring resumes.No findings
Why it is in this group
- The name "restore_transfer" says "transfer": a word for a change that another call does not undo.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Restore an archived transfer so its monitoring resumes. Restoring needs an active subscription and a free active transfer place. A restored transfer is monitored until the plan's current period ends: the end of the subscription's billing period, the end date of a courtesy grant, or 30 days from the restore for a courtesy grant with no end date. Its checks run every 5 minutes, which set_check_frequency can change. Restoring an active transfer changes nothing. Returns the transfer.
Annotations the server declares
- title: Restore an archived transfer
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
rotate_webhook_secretReplace a webhook endpoint's signing secret, for example after it was exposed.No findings
Why it is in this group
- The description's first verb is "replace": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Replace a webhook endpoint's signing secret, for example after it was exposed. The new secret is returned once, here. For the next 24 hours every delivery carries two signatures, one with the new secret and one with the previous secret, so the receiver keeps accepting requests while it is updated; after that only the new secret signs. Rotating again within those 24 hours ends the oldest secret at once: only the secret in use at that moment keeps signing beside the new one. The address, events and status do not change. Only the account owner's API keys and connected apps can rotate a secret.
Annotations the server declares
- title: Rotate a webhook signing secret
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: false
- openWorldHint: false
send_webhook_testQueue one test event to a webhook endpoint, about a sample transfer and never one of the account's own.Reads text others writeCan send data outNo findings
Why it is in this group
- The name "send_webhook_test" says "send": a word for sending, and what is sent cannot be taken back.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe name "send_webhook_test" says "send": it sends or publishes something to other people.
Description, as the server wrote it Queue one test event to a webhook endpoint, about a sample transfer and never one of the account's own. It is sent within about a minute; read the endpoint's deliveries to see the receiver's answer. Pending endpoints can receive test events. Only the account owner's API keys and connected apps can send tests.
Annotations the server declares
- title: Send a test event
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: false
- openWorldHint: true
set_check_frequencySet how often this transfer's own checks run, in minutes: one of 5, 15, 30, 60, 180, 360, 720, 1440.No findings
Why it is in this group
- The name "set_check_frequency" says "set": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Set how often this transfer's own checks run, in minutes: one of 5, 15, 30, 60, 180, 360, 720, 1440. Only a paid transfer whose monitoring runs and whose checks have not ended has a frequency to set; a free, finished or lapsed transfer keeps its schedule. Only the account owner's API keys and connected apps can change it. Returns the transfer.
Annotations the server declares
- title: Set a transfer's check frequency
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
update_transferCorrects the amount, currency or payment date entered for a transfer.No findings
Why it is in this group
- The name "update_transfer" says "update": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Corrects the amount, currency or payment date entered for a transfer. Bank-reported figures never change. After a bank has reported, the owner can make up to 3 corrections. The owner's corrections on the website count toward the same limit. Give all three details as they should stand; a correction replaces them together, as the website's form does. After a bank has reported, sending the details every copy of this transfer in the account already holds changes nothing and uses no correction; if an older copy holds other details, the save aligns it and counts as one correction. Before a report, every save checks the transfer again. The UETR cannot be changed: it identifies the payment. A correction is refused once the transfer is archived, or when its checks ended before any bank reported on it. Only the account owner's API keys and connected apps can correct details. Returns the transfer, the outcome and the corrections left.
Annotations the server declares
- title: Correct a transfer's details
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
update_webhook_endpointChoose which events a webhook endpoint receives.No findings
Why it is in this group
- The name "update_webhook_endpoint" says "update": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Choose which events a webhook endpoint receives. The address is changed with change_webhook_endpoint_url instead, and the account owner confirms the new one. Only the account owner's API keys and connected apps can change webhooks.
Annotations the server declares
- title: Change a webhook endpoint's events
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
Can't be undone 3Claude Code: ask
export_transfersExport every transfer in the account, archived ones included, with the bank reports its records hold: the same records the account's export download contains, named the API's way.1 finding
Why it is in this group
- The name "export_transfers" says "transfer": a word for a change that another call does not undo.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "export_transfers" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "export_transfers" says "transfer": a word for a change that another call does not undo.
Description, as the server wrote it Export every transfer in the account, archived ones included, with the bank reports its records hold: the same records the account's export download contains, named the API's way. A page holds up to 50 UETRs in UETR order, each exported once as one transfer however many times the account added it; pass next_cursor as cursor for the next page. Reading changes nothing.
Annotations the server declares
- title: Export the account's transfers
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
invite_team_memberAsk to invite someone to the team.Reads text others writeCan send data outNo findings
Why it is in this group
- The name "invite_team_member" says "invite": a word for sending, and what is sent cannot be taken back.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe name "invite_team_member" says "invite": it sends or publishes something to other people.
Description, as the server wrote it Ask to invite someone to the team. The account owner must confirm the invitation on the website before anything happens: until then no invitation is sent and no seat is used. The owner sees the request on the website and is normally notified by email. Asking again for the same address returns the open request. Only the account owner's API keys and connected apps can ask, while the plan includes team seats.
Annotations the server declares
- title: Invite a teammate
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
recheck_transferCheck the banks' trackers for this transfer now, then return it with any new reports.Reads text others writeNo findings
Why it is in this group
- The name "recheck_transfer" says "transfer": a word for a change that another call does not undo.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Check the banks' trackers for this transfer now, then return it with any new reports. Available for transfers in the full view while monitoring runs and checks have not ended. A transfer can be re-checked once a minute and 20 times a day, and an account 20 times a minute and 500 times a day, counted together for the website and the API. Only the account owner's API keys and connected apps can re-check.
Annotations the server declares
- title: Re-check a transfer now
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
Changes things 2Claude Code: ask
add_transferAdd a transfer to the account by its UETR, with the amount, currency and date it was sent.Reads text others writeNo findings
Why it is in this group
- The name "add_transfer" says "add": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Add a transfer to the account by its UETR, with the amount, currency and date it was sent. The account's plan decides how it is monitored, as for an add on the website. Adding a UETR the account already holds returns that transfer and uses no more of the plan; an archived one is returned archived. Returns the transfer and the outcome.
Annotations the server declares
- title: Add a transfer
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
create_webhook_endpointAsk to send the account's transfer events to an HTTPS address: your own receiver, or a Slack or Microsoft Teams incoming webhook, which gets a readable message.Reads text others writeCan send data outNo findings
Why it is in this group
- The name "create_webhook_endpoint" says "create": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
Description, as the server wrote it Ask to send the account's transfer events to an HTTPS address: your own receiver, or a Slack or Microsoft Teams incoming webhook, which gets a readable message. The endpoint starts pending: it receives only test events, on a sample transfer, until the account owner confirms it on the website, and the owner is normally notified by email. The signing secret is returned once, here; deliveries carry Standard Webhooks headers signed with it. Only the account owner's API keys and connected apps can add endpoints.
Annotations the server declares
- title: Add a webhook endpoint
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
Only reads 13Show 13 read-only tools
get_accountGet the account this API key or connected app acts on: its id, this user's role, the plan, and any scheduled deletion date.No findings
Why it is in this group
- The name "get_account" says "get": a word for reading.
Description, as the server wrote it Get the account this API key or connected app acts on: its id, this user's role, the plan, and any scheduled deletion date. Check it to notice when that account changes or is ending. Reading changes nothing.
Annotations the server declares
- title: Get the account
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_billing_linkGet the address of the account's billing page on the website, where the account owner, signed in, manages the plan, payment details and invoices.Reads text others writeNo findings
Why it is in this group
- The name "get_billing_link" says "get": a word for reading.
What it can reach
- untrusted-inputThe description's first sentence says "get" and "website": it reads web pages, which anyone can write.
Description, as the server wrote it Get the address of the account's billing page on the website, where the account owner, signed in, manages the plan, payment details and invoices. Only the account owner can open it, so a teammate's key is refused. Reading changes nothing.
Annotations the server declares
- title: Get the billing page link
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_payment_recordRead a payment record from its link: the bank reports on a paid transfer, shared by its owner with whoever holds the link.No findings
Why it is in this group
- The name "get_payment_record" says "get": a word for reading.
Description, as the server wrote it Read a payment record from its link: the bank reports on a paid transfer, shared by its owner with whoever holds the link. Any key can read a record it has the link to, from any account. A link the owner replaced, or one that never existed, is not found. Reading changes nothing and is not counted as a visit to the record.
Annotations the server declares
- title: Get a payment record
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_plan_usageGet the account's plan and how many of its active transfers are in use.No findings
Why it is in this group
- The name "get_plan_usage" says "get": a word for reading.
Description, as the server wrote it Get the account's plan and how many of its active transfers are in use. Free accounts have no active-transfer cap; lookup and request rate limits still apply. On a paid plan, a finished transfer keeps its place until it archives itself a week after its last check, and can be archived sooner to free the place. Archived transfers stay in the account and never count. On a custom package, also how many transfers were added in the current billing period against the package's volume, and when it resets. Reading changes nothing.
Annotations the server declares
- title: Get plan usage
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_transferGet one transfer in this account by its UETR, with every bank report in the full view, or the free tracker's view for a free transfer.No findings
Why it is in this group
- The name "get_transfer" says "get": a word for reading.
Description, as the server wrote it Get one transfer in this account by its UETR, with every bank report in the full view, or the free tracker's view for a free transfer. When a bank last reported: in the free view, free.last_report_at is the newest bank report time, a time a bank gave (null when no report gives one), while free.last_update_at is only when the newest report was first received; in the full view, each event's reported_at is the bank's own time. free.amount_bank_number and free.value_date_bank_number name which numbered bank (as in free.reports) reported the amount and the value date: they are bank numbers, not counts, and free.reporting_banks is the count. The number of people who follow the transfer's updates comes from get_watcher_count. The demo transfer 00000000-0000-4000-8000-000000000000 works for every key. Each hour (UTC) it is searching, with no bank reports, for its first 10 minutes, then gains a bank report every 10 minutes until it is credited at 50 minutes past the hour. Reading changes nothing.
Annotations the server declares
- title: Get a transfer
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_watcher_countCount how many people follow a transfer's updates by email: those who receive its email alerts through its share link or payment record link, from sign-ups they confirmed and have …Reads private dataReads text others writeNo findings
Why it is in this group
- The name "get_watcher_count" says "get": a word for reading.
What it can reach
- private-dataThe description's first sentence says "count" and "email": it reads mail.
- untrusted-inputThe description's first sentence says "count" and "email": it reads inbound email, which other people can write.
Description, as the server wrote it Count how many people follow a transfer's updates by email: those who receive its email alerts through its share link or payment record link, from sign-ups they confirmed and have not stopped, each address once. An archived transfer sends no alerts, so it counts none. It never returns their addresses, and alert sign-ups are made and stopped only by each person. Reading changes nothing.
Annotations the server declares
- title: Count the people following a transfer
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_webhook_endpointRead one webhook endpoint: its masked address, status and events.No findings
Why it is in this group
- The name "get_webhook_endpoint" says "get": a word for reading.
Description, as the server wrote it Read one webhook endpoint: its masked address, status and events. The signing secret is never returned. Only the account owner's API keys and connected apps can read webhooks. Reading changes nothing.
Annotations the server declares
- title: Get a webhook endpoint
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
list_pending_accessList the team invitations, payment record shares and webhook endpoints that API keys and connected apps asked for on this account, newest first, with whether the account owner conf…No findings
Why it is in this group
- The name "list_pending_access" says "list": a word for reading.
Description, as the server wrote it List the team invitations, payment record shares and webhook endpoints that API keys and connected apps asked for on this account, newest first, with whether the account owner confirmed, declined or has not answered yet, and whether a request expired or the API key or connected app that asked withdrew it. A confirmed record share carries the record link while it still works. Only the account owner's API keys and connected apps can list them. Reading changes nothing.
Annotations the server declares
- title: List requests waiting for the owner
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
list_team_membersList the people who share this account: the owner, each teammate and each pending invitation, with the seats the plan includes.No findings
Why it is in this group
- The name "list_team_members" says "list": a word for reading.
Description, as the server wrote it List the people who share this account: the owner, each teammate and each pending invitation, with the seats the plan includes. Only the account owner's API keys and connected apps can list the team, while the plan includes team seats. Reading changes nothing.
Annotations the server declares
- title: List the team
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
list_transfersList the transfers in this account with their current status, newest first (the dashboard's default order), one page at a time.No findings
Why it is in this group
- The name "list_transfers" says "list": a word for reading.
Description, as the server wrote it List the transfers in this account with their current status, newest first (the dashboard's default order), one page at a time. Paid transfers come in the full view and the rest in the free view, as the dashboard shows them. Archived transfers are left out unless asked for. Pass next_cursor as cursor until it is null. The list holds no bank report times: last_checked_at is when the transfer was last checked, not when a bank last reported; get_transfer gives the newest bank report time. Reading changes nothing.
Annotations the server declares
- title: List transfers
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
list_webhook_deliveriesList the most recent deliveries to a webhook endpoint, newest first, with each attempt count and the receiver's last HTTP status code.Reads text others writeNo findings
Why it is in this group
- The name "list_webhook_deliveries" says "list": a word for reading.
What it can reach
- untrusted-inputThe description's first sentence says "list" and "http": it reads web pages, which anyone can write.
Description, as the server wrote it List the most recent deliveries to a webhook endpoint, newest first, with each attempt count and the receiver's last HTTP status code. Deliveries are kept for 30 days and payloads are never returned. Only the account owner's API keys and connected apps can read webhooks. Reading changes nothing.
Annotations the server declares
- title: List a webhook endpoint's deliveries
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
list_webhook_endpointsList the account's webhook endpoints with their status and events, oldest first.No findings
Why it is in this group
- The name "list_webhook_endpoints" says "list": a word for reading.
Description, as the server wrote it List the account's webhook endpoints with their status and events, oldest first. Addresses show only their host and a masked path, and signing secrets are never returned. Only the account owner's API keys and connected apps can read webhooks. Reading changes nothing.
Annotations the server declares
- title: List webhook endpoints
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Exfil surface
Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.
60 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 1 private-data tool breaks every one.
- Reads private data1
- Reads files, mail, messages, databases, secrets, calendars or repositories.
- Reads text others write12
- Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
- Can send data out5
- Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
{
"permissions": {
"deny": [
"mcp__uetr-ai__get_watcher_count"
]
}
}Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.
Findings
Matches of fixed checks, with the text they matched.
- Warnexport_transfers
The server marks "export_transfers" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "export_transfers" says "transfer": a word for a change that another call does not undo.
History
Changes to its tool definitions and to its remote endpoint, newest first.
No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.
Install
Pinned to version 1.0.1-registry.1. Values in angle brackets are yours to fill in.
claude mcp add --transport http uetr-ai https://uetr.ai/mcpclaude mcp add --transport http uetr-ai https://uetr.ai/mcpRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__uetr-ai__get_account",
"mcp__uetr-ai__get_billing_link",
"mcp__uetr-ai__get_payment_record",
"mcp__uetr-ai__get_plan_usage",
"mcp__uetr-ai__get_share_link",
"mcp__uetr-ai__get_transfer",
"mcp__uetr-ai__get_watcher_count",
"mcp__uetr-ai__get_webhook_endpoint",
"mcp__uetr-ai__list_pending_access",
"mcp__uetr-ai__list_team_members",
"mcp__uetr-ai__list_transfers",
"mcp__uetr-ai__list_webhook_deliveries",
"mcp__uetr-ai__list_webhook_endpoints"
],
"ask": [
"mcp__uetr-ai__add_transfer",
"mcp__uetr-ai__create_webhook_endpoint",
"mcp__uetr-ai__export_transfers",
"mcp__uetr-ai__invite_team_member",
"mcp__uetr-ai__recheck_transfer"
],
"deny": [
"mcp__uetr-ai__archive_transfer",
"mcp__uetr-ai__change_webhook_endpoint_url",
"mcp__uetr-ai__decline_team_invitation",
"mcp__uetr-ai__delete_transfer",
"mcp__uetr-ai__delete_webhook_endpoint",
"mcp__uetr-ai__remove_team_member",
"mcp__uetr-ai__rename_transfer",
"mcp__uetr-ai__resend_team_invitation",
"mcp__uetr-ai__restore_transfer",
"mcp__uetr-ai__rotate_webhook_secret",
"mcp__uetr-ai__send_webhook_test",
"mcp__uetr-ai__set_check_frequency",
"mcp__uetr-ai__share_payment_record",
"mcp__uetr-ai__update_transfer",
"mcp__uetr-ai__update_webhook_endpoint"
]
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as uetr-ai. Review it before you use it.
Capability tags behind 12 rules
- mcp__uetr-ai__add_transfer untrusted-input
- mcp__uetr-ai__change_webhook_endpoint_url untrusted-input, outbound
- mcp__uetr-ai__create_webhook_endpoint untrusted-input, outbound
- mcp__uetr-ai__get_billing_link untrusted-input
- mcp__uetr-ai__get_share_link untrusted-input
- mcp__uetr-ai__get_watcher_count private-data, untrusted-input
- mcp__uetr-ai__invite_team_member untrusted-input, outbound
- mcp__uetr-ai__list_webhook_deliveries untrusted-input
- mcp__uetr-ai__recheck_transfer untrusted-input
- mcp__uetr-ai__resend_team_invitation untrusted-input, outbound
- mcp__uetr-ai__send_webhook_test untrusted-input, outbound
- mcp__uetr-ai__share_payment_record untrusted-input
Pin
Keep the decision: fail CI when the tools change, follow every change, or show a badge.
Pin in CI
Fail a build when the tools you reviewed are not the tools the server serves today.
curl -s "https://anlyon.dev/api/v1/servers/ai.uetr/uetr.ai/verify?hash=6af6abb6ad770e643c522786d37e5378790f1e3230946c2d1268a481de3a130f" | jq -e '.changed == false'Pinned hash 6af6abb6ad77, from Nov 5, 2026, 12:17 UTC.
Watch
Get told when its tools change: a new tool, a new description, a new class.
https://anlyon.dev/servers/ai.uetr/uetr.ai/changes.xmlAn Atom feed. Works in any feed reader or Slack's RSS app.
Badge
[](https://anlyon.dev/servers/ai.uetr/uetr.ai)Source: MCP Registry. Synced Nov 5, 2026, 12:17 UTC.