Vaaya
by vaaya.ai · remote · local (npm) · no sign-in to list tools · v0.6.8 · published by ai.vaaya
Paid APIs and tokenized shares for agents. Prepaid funding, including authorized Instinct checkout.
14 tools: 1 can delete or cancel things, 11 change things and 2 only read.
Scanned Oct 21, 2026
- Deletes or cancels1Claude Code: deny: see these tools
- Can't be undone0Claude Code: ask
- Changes things11Claude Code: ask: see these tools
- Only reads2Claude Code: allow: see these tools
8 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.
claude mcp add --transport http vaaya https://vaaya.ai/mcpFindings
Matches of fixed checks, with the text they matched.
- Warnbuy
The input schema at properties.booking.anyOf[0].properties.segments.items.properties.cabin.$ref contains a 58-character base64 string.
What this check looks forMatched text
inputSchema.properties.booking.anyOf[0].properties.segments.items.properties.cabin.$ref: "#/anyOf/0/properties/segments/items/properties/flightNumber"
- Warnbuy
The input schema at properties.booking.anyOf[0].properties.segments.items.properties.fare.$ref contains a 58-character base64 string.
What this check looks forMatched text
inputSchema.properties.booking.anyOf[0].properties.segments.items.properties.fare.$ref: "#/anyOf/0/properties/segments/items/properties/flightNumber"
- Warnbuy
The input schema at properties.booking.anyOf[0].properties.baggage.$ref contains a 58-character base64 string.
What this check looks forMatched text
inputSchema.properties.booking.anyOf[0].properties.baggage.$ref: "#/anyOf/0/properties/segments/items/properties/flightNumber"
- Infobuy
The input schema at properties.command.enum[8] mentions "credentials".
What this check looks forMatched text
inputSchema.properties.command.enum[8]: "credentials"
- Infobuy
The input schema at properties.merchant.description mentions "credentials".
What this check looks forMatched text
inputSchema.properties.merchant.description: "....g. bombas.com (`purchase`, `propose`, `credentials`)."
- Infobuy
The input schema at properties.username.description mentions "credentials".
What this check looks forMatched text
inputSchema.properties.username.description: "Email/username at the merchant (`credentials`)."
Show 2 more findingsShow fewer
- Infobuy
The input schema at properties.password.description mentions "credentials".
What this check looks forMatched text
inputSchema.properties.password.description: "...nt — stored encrypted, never returned (`credentials`)."
- Infobuy
The description is 4,408 characters long, over the 2,000 this check looks for.
What this check looks forMatched text
description ends: "...al. Never open `browserbase` sessions yourself to buy something — only `buy` can."
Tools
Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.
14 tools
Deletes or cancels 1Claude Code: deny
vaaya_logoutDisconnect this client from the current Vaaya account: revokes this connection's authorization server-side, so every later call fails with 401 until the user reconnects.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Disconnect this client from the current Vaaya account: revokes this connection's authorization server-side, so every later call fails with 401 until the user reconnects. Call it when the user asks to log out, sign out, disconnect, or switch Vaaya accounts — then relay the returned switch steps VERBATIM (the browser sign-out step is what actually enables switching accounts).
Annotations the server declares
- title: Disconnect / Switch Vaaya Account
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
Changes things 11Claude Code: ask
buyFind and buy products, tickets, bookings and subscriptions for the user at supported stores.8 findings
Why it is in this group
- The description's first verb is "find": a word for reading.
- The input takes a statement or command to run (input.command), which can change anything it can reach.
Findings
- Info
The input schema at properties.command.enum[8] mentions "credentials".
What this check looks forMatched text
inputSchema.properties.command.enum[8]: "credentials"
- Info
The input schema at properties.merchant.description mentions "credentials".
What this check looks forMatched text
inputSchema.properties.merchant.description: "....g. bombas.com (`purchase`, `propose`, `credentials`)."
- Info
The input schema at properties.username.description mentions "credentials".
What this check looks forMatched text
inputSchema.properties.username.description: "Email/username at the merchant (`credentials`)."
- Info
The input schema at properties.password.description mentions "credentials".
What this check looks forMatched text
inputSchema.properties.password.description: "...nt — stored encrypted, never returned (`credentials`)."
- Warn
The input schema at properties.booking.anyOf[0].properties.segments.items.properties.cabin.$ref contains a 58-character base64 string.
What this check looks forMatched text
inputSchema.properties.booking.anyOf[0].properties.segments.items.properties.cabin.$ref: "#/anyOf/0/properties/segments/items/properties/flightNumber"
- Warn
The input schema at properties.booking.anyOf[0].properties.segments.items.properties.fare.$ref contains a 58-character base64 string.
What this check looks forMatched text
inputSchema.properties.booking.anyOf[0].properties.segments.items.properties.fare.$ref: "#/anyOf/0/properties/segments/items/properties/flightNumber"
- Warn
The input schema at properties.booking.anyOf[0].properties.baggage.$ref contains a 58-character base64 string.
What this check looks forMatched text
inputSchema.properties.booking.anyOf[0].properties.baggage.$ref: "#/anyOf/0/properties/segments/items/properties/flightNumber"
- Info
The description is 4,408 characters long, over the 2,000 this check looks for.
What this check looks forMatched text
description ends: "...al. Never open `browserbase` sessions yourself to buy something — only `buy` can."
Description, as the server wrote it Find and buy products, tickets, bookings and subscriptions for the user at supported stores. Start with `search` { query } to find the item and merchant page using Vaaya OneSearch (5¢ per search); the user can describe what they need without supplying a link. Before checkout, use `setup` to check payment and shipping readiness; resolve missing setup once. Persistent merchant accounts are managed at /store-connections. Use store_connection_id to select an account. Passwords and verification codes belong only on the merchant page, never in chat. PRODUCT DISCOVERY: if the user describes what to buy but provides no URL, use `search` { query: <product, variant, budget and preferred merchant if specified> } to locate it under the existing tool spending permissions; do not ask them to paste a link or say search for it first. Search is not purchase authorization. Respect search fees and spending limits; if search is unavailable, explain the actual error and then ask for a link. Verify the merchant, item and variant from the result; ask only when matches are ambiguous or details cannot be verified. Never invent a product URL, final total or delivery date from a search snippet. THE SEAMLESS PATH: once the user has told you what to buy and you have the exact item, merchant page URL and total, call `purchase` { item, merchant, url, total_cents, confirmed: true, confirmation: <the user's own words> } — it approves from their message (under the chat limit), starts buying in the user's cloud browser in the background and returns `message` ("Hold on — buying it now."): RELAY IT, then poll `status` { approval_id } every ~10 seconds and relay its `message` when the status is completed ("Done — …"), requires_action (read action_required.reason for the exact blocker) or failed. If `status` says the user's shipping address is missing, ask for it and call `address` { name, line1, line2?, city, state?, postal_code, country, phone? } then `checkout` { approval_id } to resume; if merchant authentication is pending, relay handoff_url and handoff_deadline. The durable worker checks authentication and resumes the same authorized purchase automatically. Do not ask the user to send done or submit codes in chat. If the handoff expires, relay the recovery page; it does not clear order or payment uncertainty. Other sub-commands: `search` { query } (protocol merchants plus a real web search; the web half bills 5¢), `propose` { item, merchant, total_cents, url?, notes?, confirmed?, confirmation? } (creates an approval; without `confirmed` it returns an approval link the user opens — show its `message` VERBATIM), `checkout` { approval_id, params? } (buys an approved purchase; for a browser merchant it runs in the background like `purchase`). Use the user's existing authorization of the exact item and total; do not ask them to confirm twice. Ask only for missing purchase details. Nothing is ever bought without the user's yes: `checkout` refuses anything else. Use `reconcile` { approval_id } after an uncertain submission: it only inspects the existing checkout and never submits payment. For an unavailable checkout or inconclusive reconciliation, relay recovery_url and recovery_instructions from status. The user can resolve the attempt on its approval page only after checking both merchant orders and payment records. A chat statement alone does not clear the lock, and expiration does not clear it. If status or replay says purchase_resolved, never reuse checkout on that approval. When the user requests another attempt, call propose with retry_of set to that resolved ID, current item/price and no confirmed flag, then show the new approval link. Check setup browser_allowance first; a daily_browser_limit requires waiting until resets_at, not reconnecting or changing request text. For a handoff, return action_required.url and the deadline. The user fixes 2FA, CAPTCHA, payment, address or booking issues on that authenticated page and uses Return control to Vaaya; do not call checkout to bypass a pending handoff. Status polling never creates a replacement. Resume only the same approval_id; do not recreate a purchase to bypass an unresolved attempt. `charged_cents` is the Vaaya tool fee, NOT a merchant charge; read merchant_payment separately, and never infer a hold or capture from Link approval. Never open `browserbase` sessions yourself to buy something — only `buy` can.
Annotations the server declares
- title: Buy Something for the User
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
closeClose an E2B sandbox session and stop its billing.No findings
Why it is in this group
- The name "close" says "close": a word for a change.
Description, as the server wrote it Close an E2B sandbox session and stop its billing. Pass the `session_id`. Captures the final metered uptime cost and releases the hold. ALWAYS call this when finished with a session — an open session keeps billing per second of uptime. Safe to call repeatedly (idempotent).
Annotations the server declares
- title: Close a Sandbox Session
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
consultVaaya's consultant.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Vaaya's consultant. Describe ANY external capability you or the user might want — generate an image/video, search or scrape the web, run code in a sandbox, send/receive email, enrich a contact — and it helps figure out the best way, teaching the user what Vaaya can do. It is CONVERSATIONAL and remembers prior turns. It returns: mode='converse' (a reply to RELAY to the user verbatim — questions, options, ideas; get the user's response and call consult again with it, so the conversation continues), mode='call' (an ordered list of calls to run via `use`, with a message explaining the preferred choice + alternatives + why; multi-step results may contain placeholders like '<from step 1: sandbox_id>' — run earlier steps first and substitute), or mode='unsupported'. Every reply includes `suggestions` (2-3 things to do next) — surface these to the user. AFTER you run a `call` result's calls via `use`, call consult ONE more time with a short note on the outcome (what was produced / any failures) — it returns result-aware, Vaaya-grounded next steps to offer the user (the `call` result's `after_running` field reminds you). Call consult whenever you hit a capability gap or the user wants to know what's possible. It does NOT execute or bill — you run returned calls via `use`. ALWAYS show the user consult's `message` and `suggestions` and let them steer.
Annotations the server declares
- title: Consult Vaaya — Plan Any Capability
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
docsVaaya's deep reference, FREE and instant.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Vaaya's deep reference, FREE and instant. Pass `topic` to get the full playbook for a capability area — exact services, actions, params, prices, model lists, and gotchas — the same reference files the vaaya skill ships. Topics: 'setup' (connecting an agent, a chat app, or an unattended process), 'tools' (exact params of every Vaaya tool, GTM suite included), 'media' (image/video/audio models + product-demo videos), 'gtm' (leads, enrichment, outreach, signals, email), 'research' (OneSearch lanes, deep research, company/market research playbooks), 'data' (scraping, people, social platforms, public records, onchain, compliance), 'compute' (sandboxes, browser automation, files, memory, workers, phone calls, llm). Read the matching topic BEFORE non-trivial work in that area — it is cheaper than a wrong call. Never bills; safe to call any time.
Annotations the server declares
- title: Read Vaaya Deep Reference
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
jobsJobs: a marketplace where humans hire humans, and each side's agent handles the steps.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Jobs: a marketplace where humans hire humans, and each side's agent handles the steps. Call with { action, ...params }. Actions: list, get, mine, draft, update_draft, cancel, accept, submit_proof, record_verdict, request_release, dispute. A poster's agent drafts a job (budget_usd, definition_of_done, required_evidence) and gives its human the review_url; the HUMAN publishes, which holds the budget from their wallet. A doer's agent accepts an open job for its human and later submits that human's proof (summary + links). The poster's agent evaluates the proof against the definition of done with record_verdict. Only the poster, in their own browser on the job page, can release payment; no action here moves money to anyone. Never claim the agent did the work.
Annotations the server declares
- title: Jobs: Post Work and Submit Proof
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
llmAsk a DIFFERENT LLM a question and get its answer, billed per token from the Vaaya wallet (model cost + 3%, usually a fraction of a cent).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Ask a DIFFERENT LLM a question and get its answer, billed per token from the Vaaya wallet (model cost + 3%, usually a fraction of a cent). Use it to get a second opinion from a rival model, cross-check an answer, summarize a huge blob cheaply, or query a specific model the user names (Kimi, GPT, Gemini, Claude, DeepSeek, and 300+ more). `model` accepts 'auto' (default: short prompts go cheap, long go mid), 'cheap' | 'mid' | 'best' tiers, or any exact OpenRouter slug like 'moonshotai/kimi-k3'. Typical costs: cheap tier well under 0.1 cents, best tier 1-3 cents per call. Not for the conversation you are already having — it is a one-shot ask to another model.
Annotations the server declares
- title: Ask Another LLM
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
sessionRun a command or code in an open E2B sandbox session (started by `use` with action `create_session`, which returns a `session_id`).No findings
Why it is in this group
- The description's first verb is "run": a word for a change.
- The input takes a statement or command to run (input.command), which can change anything it can reach.
Description, as the server wrote it Run a command or code in an open E2B sandbox session (started by `use` with action `create_session`, which returns a `session_id`). Pass `session_id` plus either `command` (a shell command) or `code` (+ optional `language`: python/javascript/bash). Returns stdout/stderr/exit_code (or the code result). The sandbox stays alive — and billed per second of uptime — until you `close` it; re-running reuses the SAME box, so filesystem + process state persist between calls. ALWAYS `close` when done.
Annotations the server declares
- title: Run Code in a Sandbox Session
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
stocksBuy tokenized stocks on Base using only the user’s prepaid Vaaya balance, never the welcome credit or the GitHub credit line.No findings
Why it is in this group
- The input takes a statement or command to run (input.command), which can change anything it can reach.
Description, as the server wrote it Buy tokenized stocks on Base using only the user’s prepaid Vaaya balance, never the welcome credit or the GitHub credit line. Commands: list (supported token tickers), portfolio (owned stocks and buying power), quote {symbol, amount_cents}, buy {symbol, amount_cents, idempotency_key}, order {order_id}. When the user asks to buy a specified stock and dollar amount, resolve its supported token ticker (Apple = AAPLc) and call buy directly; no activation or additional approval step. amount_cents is the maximum total prepaid spend including provider fees. Use a unique idempotency_key for each intended purchase and reuse it on retries. Query order until confirmed/failed; queued/submitted is not success. Do not increase the user’s spend or retry a failed purchase as a new order without instruction. Ask only for missing or ambiguous purchase details. If prepaid_required or buyingPowerCents is insufficient, offer a $14/$40/$60 prepaid pack: POST /api/v1/topup with pack_cents 1400/4000/6000 and the same account bearer token returns a Stripe Checkout url. With authorization for that pack amount, the user’s Instinct agent can pay the URL in its browser using the card saved in Instinct; otherwise give the URL to the user. Vaaya cannot charge Instinct’s card directly. Do not include card details or tokens in a handoff. Check GET /api/v1/wallet wallet.prepaid_cents, then portfolio buyingPowerCents before resuming the same purchase key. A share purchase alone does not authorize a top-up. Stop on needs_review as well as failed.
Annotations the server declares
- title: Buy Tokenized Stocks
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
useExecute a single external call, and bill on success.No findings
Why it is in this group
- The description's first verb is "execute": a word for a change.
Description, as the server wrote it Execute a single external call, and bill on success. Used for any external capability (image/video/audio generation, web search, scraping, email, document parsing, code sandbox, browser automation, embeddings, etc.). The server validates params against a registered schema and proxies to the upstream — you never pass URLs or API keys. Call it directly when you know the exact (service, action, params, max_cost_cents) — from the vaaya skill's catalog or a call you've made before; when unsure, get the call from `consult` rather than guessing.
Annotations the server declares
- title: Execute a Paid Service Call
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
vaaya_onboardPublic onboarding hint for an agent whose user isn't linked to Vaaya yet.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Public onboarding hint for an agent whose user isn't linked to Vaaya yet. Returns where the human should go to connect (and sign up if new). Call this when vaaya_test_connection reports needs_auth, or any tool returns unauthorized, then relay the instructions to the user. If the user IS already linked it returns `first_call` instead — show `first_call.show_to_user` as written so they know what to try.
Annotations the server declares
- title: Get Onboarding Instructions
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
vaaya_test_connectionRound-trip ping that confirms the agent → Vaaya connection and whether the user is linked.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Round-trip ping that confirms the agent → Vaaya connection and whether the user is linked. Returns { ok:true, userId, scope, version, server_time, first_call } when linked — SHOW `first_call.show_to_user` to the user as written, it is the same set of starter examples the website and installer give them. Returns { ok:false, needs_auth:true, verification_uri, signup_uri, instructions } when not linked yet — relay that to the user so they can connect (and sign up if new).
Annotations the server declares
- title: Test Vaaya Connection
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
Only reads 2Claude Code: allow
resultFetch the status + output of an async job started by `use` (e.g.No findings
Why it is in this group
- The description's first verb is "fetch": a word for reading.
Description, as the server wrote it Fetch the status + output of an async job started by `use` (e.g. a video render). Pass the `job_id` that `use` returned with `{ async: true }`. Returns `{ status, result?, progress?, charged_cents }`: `running` (still working — when the job reports it, `progress` carries `{ phase, percent, rendered_frames, total_frames, eta_sec }` and `hint` is a one-line summary like "rendering 42% (380/900 frames, ~120s left)", so you can tell real progress from a hang; wait a bit and call again), `succeeded` (`result` holds the output, e.g. the video URL; the call is charged now), or `failed`/`cancelled` (no charge; on `failed`, read `error` AND `hint` — `hint` carries the service's usage notes, which usually explain how to fix the call). Safe to call repeatedly — it never starts new work or double-charges. ALWAYS use this to retrieve an async result instead of re-running `use` (re-running starts a new paid job).
Annotations the server declares
- title: Poll an Async Job
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
vaaya_accountShow which Vaaya account this connection is linked to and its money state.No findings
Why it is in this group
- The description's first verb is "show": a word for reading.
Description, as the server wrote it Show which Vaaya account this connection is linked to and its money state. Returns { email, name, user_id, connected_client, scopes, balance_cents, credit_line, available_cents, credits_url, switch_account }. Call it whenever the user asks "which account is connected", "what's my balance", "how much credit is left", or "how do I switch accounts" — and relay the answer. `credit_line` is the credit the account can spend past its prepaid balance (the welcome credit plus any GitHub-score line); `available_cents` = balance + active line, the number calls are gated on.
Annotations the server declares
- title: Show Connected Account & Balance
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Install
Pinned to version 0.6.8. Values in angle brackets are yours to fill in.
claude mcp add --transport http vaaya https://vaaya.ai/mcpRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__vaaya__vaaya_account",
"mcp__vaaya__result"
],
"ask": [
"mcp__vaaya__stocks",
"mcp__vaaya__jobs",
"mcp__vaaya__vaaya_test_connection",
"mcp__vaaya__vaaya_onboard",
"mcp__vaaya__docs",
"mcp__vaaya__consult",
"mcp__vaaya__use",
"mcp__vaaya__buy",
"mcp__vaaya__session",
"mcp__vaaya__close",
"mcp__vaaya__llm"
],
"deny": [
"mcp__vaaya__vaaya_logout"
]
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as vaaya. Review it before you use it.