Ephemeral
al.ephemer/ephemeralephemer.alstreamable-httpv1.0.0Scanned
Run AI agent tasks in isolated sandboxes with a cost cap, saved workflows and scoped connections.
19 tools: 3 can delete or cancel things, 5 change things and 11 only read.
- Reads private data · 2
- Reads text others write · 2
- Can send data out · 0
- 2 findings
Anlyon alternative
8 of these tools change something. Run those as governed actions.
Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.
Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.
Import an OpenAPI spec →Tools
Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.
19 tools
Deletes or cancels 3Claude Code: deny
cancel_runCancel a run that has not finished.No findings
Why it is in this group
- The name "cancel_run" says "cancel": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Cancel a run that has not finished. Work already done is billed. Cancelling a finished run changes nothing.
Annotations the server declares
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: false
delete_schedulePermanently delete a schedule.No findings
Why it is in this group
- The name "delete_schedule" says "delete": a word for removing or ending something.
- The description says "Permanently delete".
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Permanently delete a schedule. Needs an administrator key. Runs it already started are not affected. To stop it for a while, pause it with update_schedule instead.
Annotations the server declares
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: false
delete_workflowPermanently delete a saved workflow.No findings
Why it is in this group
- The name "delete_workflow" says "delete": a word for removing or ending something.
- The description says "Permanently delete".
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Permanently delete a saved workflow. Runs already started are not affected; schedules that use it stop being able to start runs until it is saved again.
Annotations the server declares
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: false
Changes things 5Claude Code: ask
create_runStart an AI agent run in an isolated sandbox and return the run (status queued) at once.Reads text others writeNo findings
Why it is in this group
- The name "create_run" says "create": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Start an AI agent run in an isolated sandbox and return the run (status queued) at once. Give a prompt, or the name of a saved workflow. Poll with get_run or block with wait_for_run for the result. Every run has a cost cap (max_cost_micros) and a timeout, and is billed to the organization of the API key. Connections must already be saved in the organization; reference them by name. Use idempotency_key to make a retry safe. A run's cost_micros is provisional (usually above the final cost) until cost_final is true; see get_run. On the hosted service a run costs a run fee once its worker starts, compute per second, model calls at the provider's price plus a percentage, and web requests and searches at flat prices; `GET /v1/me` reports the rates.
Annotations the server declares
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
- readOnlyHint: false
create_scheduleStart a saved workflow on a timetable.No findings
Why it is in this group
- The name "create_schedule" says "create": a word for a change.
Description, as the server wrote it Start a saved workflow on a timetable. Needs an administrator key. Each start is a run billed to the organization, with the cost cap given here (or the default). Use preview_schedule first to check the timetable. A schedule pauses itself after repeated failed starts. An organization can have 50 schedules.
Annotations the server declares
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: false
run_scheduleStart the schedule's workflow now, outside its timetable, with the schedule's input and cost cap.Reads text others writeNo findings
Why it is in this group
- The name "run_schedule" says "run": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Start the schedule's workflow now, outside its timetable, with the schedule's input and cost cap. Returns the queued run (follow it with wait_for_run); each call starts another run and is billed like any run.
Annotations the server declares
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
- readOnlyHint: false
save_workflowCreate a workflow, or replace the one with this name (saving the same definition again changes nothing more).1 finding
Why it is in this group
- The name "save_workflow" says "save": a word for a change.
Findings
- Info
The description mentions "credential".
What this check looks forMatched text
description: "...nce them by name, never with a URL or a credential. Read the current definition with get_w..."
Description, as the server wrote it Create a workflow, or replace the one with this name (saving the same definition again changes nothing more). A workflow is a reusable run definition: start it with create_run and its name, or on a timetable with create_schedule. Connections must already be saved in the organization; reference them by name, never with a URL or a credential. Read the current definition with get_workflow first when you change part of it, because saving replaces the whole definition. Give it a description, and an input_schema and output_schema (JSON Schemas) so that agents can discover and call it: a run's input is checked against input_schema before it starts, and its output must be JSON matching output_schema or the run fails.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: false
update_scheduleChange a schedule; only the fields you give change.No findings
Why it is in this group
- The name "update_schedule" says "update": a word for a change.
Description, as the server wrote it Change a schedule; only the fields you give change. Needs an administrator key. Set enabled to false to pause it and to true to resume it (resuming clears the failures that paused it). A new timetable counts from now.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: false
Only reads 11Show 11 read-only tools
get_runRead a run: status, output, error, cost and billing_pending.No findings
Why it is in this group
- The name "get_run" says "get": a word for reading.
Description, as the server wrote it Read a run: status, output, error, cost and billing_pending. COST: while billing_pending is true (or the run is still going), cost_micros is PROVISIONAL and usually higher than the final cost; the result then has cost_final:false and a cost_note. Quote a cost only when cost_final is true (the run is finished and billing_pending is false); otherwise call get_run again in a few seconds. For a zero-data-retention run the first read of a finished run returns the output and then deletes it. On the hosted service a run costs a run fee once its worker starts, compute per second, model calls at the provider's price plus a percentage, and web requests and searches at flat prices; `GET /v1/me` reports the rates.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
get_scheduleRead a schedule: timetable, time zone, input, cost cap, whether it is enabled, its next start and the outcome of its last start.No findings
Why it is in this group
- The name "get_schedule" says "get": a word for reading.
Description, as the server wrote it Read a schedule: timetable, time zone, input, cost cap, whether it is enabled, its next start and the outcome of its last start.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
get_workflowRead a saved workflow's definition: description, prompt, model, files, connections, limits and its input_schema and output_schema.Reads private data1 finding
Why it is in this group
- The name "get_workflow" says "get": a word for reading.
What it can reach
- private-dataThe description's first sentence says "read" and "file": it reads files.
Findings
- Info
The description mentions "Credentials".
What this check looks forMatched text
description: "...and its input_schema and output_schema. Credentials are never included."
Description, as the server wrote it Read a saved workflow's definition: description, prompt, model, files, connections, limits and its input_schema and output_schema. Credentials are never included.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
list_connectionsThe organization's saved connections that a run may use, with type, allowed methods and tools.No findings
Why it is in this group
- The name "list_connections" says "list": a word for reading.
Description, as the server wrote it The organization's saved connections that a run may use, with type, allowed methods and tools. No URLs or secrets are returned. Reference one in create_run by name.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
list_filesList the files saved in the organization: id, name, size, content type and creation time.Reads private dataNo findings
Why it is in this group
- The name "list_files" says "list": a word for reading.
What it can reach
- private-dataThe name "list_files" says "list" and "file": it reads files.
- private-dataThe description's first sentence says "list" and "file": it reads files.
Description, as the server wrote it List the files saved in the organization: id, name, size, content type and creation time. Reference a file by id in a run's or workflow's files. Read-only; upload and delete files through the REST API.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
list_modelsFind models.No findings
Why it is in this group
- The name "list_models" says "list": a word for reading.
Description, as the server wrote it Find models. Returns a compact list (id, name, context_length, input and output USD per million tokens, zero_data_retention where known), the total count and the default model. There are hundreds of models, so filter with query (case-insensitive part of the id or name, e.g. "claude", "gpt") and read the hint when the list is truncated (default 25, at most 100). Pass model for one model's full details. Use an id from it as create_run's model.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
list_runsList the organization's runs, newest first, with a cursor for the next page.No findings
Why it is in this group
- The name "list_runs" says "list": a word for reading.
Description, as the server wrote it List the organization's runs, newest first, with a cursor for the next page. Each run has cost_final: when false, cost_micros is provisional (usually above the final cost) and billing is still settling.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
list_schedulesList the organization's schedules: each starts a saved workflow on a cron timetable.No findings
Why it is in this group
- The name "list_schedules" says "list": a word for reading.
Description, as the server wrote it List the organization's schedules: each starts a saved workflow on a cron timetable. Includes the next start, the last run and the last error.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
list_workflowsList the organization's saved workflows (reusable run definitions).No findings
Why it is in this group
- The name "list_workflows" says "list": a word for reading.
Description, as the server wrote it List the organization's saved workflows (reusable run definitions). Each entry has the workflow's name and, when set, its description, input_schema (the shape of the input create_run expects) and output_schema (the shape of the JSON it returns), so you can call a workflow without reading its prompt. Run one with create_run and its name.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
preview_scheduleCheck a cron expression and time zone and return the next five start times (UTC), without saving anything.No findings
Why it is in this group
- The name "preview_schedule" says "preview": a word for reading.
Description, as the server wrote it Check a cron expression and time zone and return the next five start times (UTC), without saving anything.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
wait_for_runWait until a run finishes (succeeded, failed, cancelled, interrupted or timed_out) or the wait ends, then return the run.No findings
Why it is in this group
- The name "wait_for_run" says "wait": a word for reading.
Description, as the server wrote it Wait until a run finishes (succeeded, failed, cancelled, interrupted or timed_out) or the wait ends, then return the run. After the run finishes it keeps waiting, within the same time, until billing has settled (billing_pending false, normally a few seconds to about 20), so the cost is final. Waits at most 60 seconds; if the run is still going, the returned status says so and you can call it again. COST: if the result has cost_final:false, cost_micros is PROVISIONAL and usually higher than the final cost; do not quote it, call get_run again shortly. Quote the cost only when cost_final is true.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Exfil surface
Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.
No private-data, untrusted-input, outbound path in this server alone: no tool is tagged outbound.
- Reads private data2
- Reads files, mail, messages, databases, secrets, calendars or repositories.
- Reads text others write2
- Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
- Can send data out0
- Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.
Findings
Matches of fixed checks, with the text they matched.
- Infoget_workflow
The description mentions "Credentials".
What this check looks forMatched text
description: "...and its input_schema and output_schema. Credentials are never included."
- Infosave_workflow
The description mentions "credential".
What this check looks forMatched text
description: "...nce them by name, never with a URL or a credential. Read the current definition with get_w..."
History
Changes to its tool definitions and to its remote endpoint, newest first.
No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.
Install
Pinned to version 1.0.0. Values in angle brackets are yours to fill in.
claude mcp add --transport http ephemeral https://app.ephemer.al/mcpclaude mcp add --transport http ephemeral https://app.ephemer.al/mcpRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__ephemeral__get_run",
"mcp__ephemeral__wait_for_run",
"mcp__ephemeral__list_runs",
"mcp__ephemeral__list_workflows",
"mcp__ephemeral__get_workflow",
"mcp__ephemeral__list_models",
"mcp__ephemeral__list_connections",
"mcp__ephemeral__list_schedules",
"mcp__ephemeral__get_schedule",
"mcp__ephemeral__preview_schedule",
"mcp__ephemeral__list_files"
],
"ask": [
"mcp__ephemeral__create_run",
"mcp__ephemeral__save_workflow",
"mcp__ephemeral__create_schedule",
"mcp__ephemeral__update_schedule",
"mcp__ephemeral__run_schedule"
],
"deny": [
"mcp__ephemeral__cancel_run",
"mcp__ephemeral__delete_workflow",
"mcp__ephemeral__delete_schedule"
]
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as ephemeral. Review it before you use it.
Capability tags behind 4 rules
- mcp__ephemeral__create_run untrusted-input
- mcp__ephemeral__get_workflow private-data
- mcp__ephemeral__run_schedule untrusted-input
- mcp__ephemeral__list_files private-data
Pin
Keep the decision: fail CI when the tools change, follow every change, or show a badge.
Pin in CI
Fail a build when the tools you reviewed are not the tools the server serves today.
curl -s "https://anlyon.dev/api/v1/servers/al.ephemer/ephemeral/verify?hash=ff141302431b038fc8d36ed822e56306f1b4bf7cf5b54853f38005ee18d636a0" | jq -e '.changed == false'Pinned hash ff141302431b, from Oct 26, 2026, 01:17 UTC.
Watch
Get told when its tools change: a new tool, a new description, a new class.
https://anlyon.dev/servers/al.ephemer/ephemeral/changes.xmlAn Atom feed. Works in any feed reader or Slack's RSS app.
Badge
[](https://anlyon.dev/servers/al.ephemer/ephemeral)Source: MCP Registry. Synced Oct 26, 2026, 01:17 UTC.