Refcat

app.refcat/refcatrefcat.appstreamable-httpv1.0.0Scanned 52 minutes ago

Search 1M real UI flows and 3.3M screens from shipped apps, sites, emails and games.

18 tools: 2 change things and 16 only read.

Reads private data · 2
Reads text others write · 3
Can send data out · 0
No findings

Anlyon alternative

2 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

18 tools

Changes things 2Creates or changes something that can be changed back.Claude Code: ask

similar_appsApps like this one, ranked from the app's own flow themes.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Apps like this one, ranked from the app's own flow themes. Accepts an appId or slug.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
similar_screensScreens that look like a given screen.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Screens that look like a given screen. Visual, not keyword — no quota. includeImages returns the top matches as images (max 4).
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false

Only reads 16Looks things up and changes nothing.Show 16 read-only tools

get_appMetadata for one app in the catalog.No findings
Why it is in this group
- The name "get_app" says "get": a word for reading.
Description, as the server wrote it
Metadata for one app in the catalog. Accepts an appId or a slug like 'spotify'. get_app_flows lists its flows.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_app_flowsThe flows of one app (onboarding, checkout, settings…) in order, with capture date.No findings
Why it is in this group
- The name "get_app_flows" says "get": a word for reading.
Description, as the server wrote it
The flows of one app (onboarding, checkout, settings…) in order, with capture date. Accepts an appId or slug. Big apps have hundreds of flows: page with offset. Then get_flow for the steps of one.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_email_htmlThe original HTML of one email from search_emails (tables, font fallbacks, dark mode included).Reads private dataReads text others writeNo findings
Why it is in this group
- The name "get_email_html" says "get": a word for reading.
What it can reach
- private-dataThe name "get_email_html" says "get" and "email": it reads mail.
- private-dataThe description's first sentence says "email": it reads mail.
- untrusted-inputThe name "get_email_html" says "get" and "email": it reads inbound email, which other people can write.
- untrusted-inputThe description's first sentence says "html": it reads web pages, which anyone can write.
Description, as the server wrote it
The original HTML of one email from search_emails (tables, font fallbacks, dark mode included). Adapt it to the user's brand instead of writing email HTML from scratch. Pro, or this week's free flows.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_flowOne flow with every step in order.No findings
Why it is in this group
- The name "get_flow" says "get": a word for reading.
Description, as the server wrote it
One flow with every step in order. Compact by default: each step has screenDocId (for get_screen), pageType, patterns, components and keyTexts. include 'elements' adds OCR/hotspot boxes per step (large: tens of thousands of tokens for a long flow); 'connections' adds step links.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_flow_historyEarlier captures of the same flow (how it changed over time): capture date, screen count and up to 3 preview images each.No findings
Why it is in this group
- The name "get_flow_history" says "get": a word for reading.
Description, as the server wrote it
Earlier captures of the same flow (how it changed over time): capture date, screen count and up to 3 preview images each.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_projectOne project with its screens, positions and connections.No findings
Why it is in this group
- The name "get_project" says "get": a word for reading.
Description, as the server wrote it
One project with its screens, positions and connections.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_screenOne catalog screen with its image and structure.No findings
Why it is in this group
- The name "get_screen" says "get": a word for reading.
Description, as the server wrote it
One catalog screen with its image and structure. Returns an image block (look at it for color, typography and spacing) and JSON with app, flow, platform, pageType, screenPatterns, uiComponents, keyTexts, dimensions, capturedAt and `elements` (OCR text and hotspots with normalized bbox [x0,y0,x1,y1], sorted top to bottom: use them to reproduce hierarchy, order and positions). image 'small' is ~800px wide (~1-2k tokens), 'full' 1800px. Cite the app, flow and capture date when you build from it.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
list_appsApps in the catalog, optionally filtered by category key (from list_categories) or platform.No findings
Why it is in this group
- The name "list_apps" says "list": a word for reading.
Description, as the server wrote it
Apps in the catalog, optionally filtered by category key (from list_categories) or platform. Platform `email` lists brands with email galleries.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
list_categoriesThe catalog's category rail for a platform, with the key list_apps filters by.No findings
Why it is in this group
- The name "list_categories" says "list": a word for reading.
Description, as the server wrote it
The catalog's category rail for a platform, with the key list_apps filters by. Emails, games, store listings and ads have their own rails.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
list_facetsThe filter vocabulary with real counts (number of flows): platform, flowIntents, uiComponents, pageType and screenPatterns.No findings
Why it is in this group
- The name "list_facets" says "list": a word for reading.
Description, as the server wrote it
The filter vocabulary with real counts (number of flows): platform, flowIntents, uiComponents, pageType and screenPatterns. Call this before filtering search_screens or search_flows so filters are real values, not guesses. Optional query/filters narrow every count, flowIntents included.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
list_projectsThe caller's projects, newest first.No findings
Why it is in this group
- The name "list_projects" says "list": a word for reading.
Description, as the server wrote it
The caller's projects, newest first.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
search_appsFind apps in the catalog by name, website or theme ('nubank', 'linear.app', 'meditation').Reads text others writeNo findings
Why it is in this group
- The name "search_apps" says "search": a word for reading.
What it can reach
- untrusted-inputThe description's first sentence says "find" and "website": it reads web pages, which anyone can write.
Description, as the server wrote it
Find apps in the catalog by name, website or theme ('nubank', 'linear.app', 'meditation').
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
search_emailsSearch real product emails (welcome, receipts, onboarding, re-engagement…) by description or brand.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "search_emails" says "search": a word for reading.
What it can reach
- private-dataThe name "search_emails" says "search" and "email": it reads mail.
- private-dataThe description's first sentence says "search" and "email": it reads mail.
- untrusted-inputThe name "search_emails" says "search" and "email": it reads inbound email, which other people can write.
- untrusted-inputThe description's first sentence says "search" and "email": it reads inbound email, which other people can write.
Description, as the server wrote it
Search real product emails (welcome, receipts, onboarding, re-engagement…) by description or brand. Each result is one email with its desktop and/or mobile image; when hasHtml is true, get_email_html returns the original HTML to adapt. Needs Pro.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
search_flowsSearch whole flows (ordered screen sequences) by intent, app or description.No findings
Why it is in this group
- The name "search_flows" says "search": a word for reading.
Description, as the server wrote it
Search whole flows (ordered screen sequences) by intent, app or description. Then get_flow for the steps.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
search_screensSearch individual UI screens by description, app name or site ('paywall with annual plan first', 'Spotify', 'linear.app').No findings
Why it is in this group
- The name "search_screens" says "search": a word for reading.
Description, as the server wrote it
Search individual UI screens by description, app name or site ('paywall with annual plan first', 'Spotify', 'linear.app'). Returns metadata per screen; set includeImages to also get the top screens as images (max 4, ~1-2k tokens each). Call get_screen for the full structure of one.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
search_screens_by_imageFind catalog screens that look like your images (base64, e.g.No findings
Why it is in this group
- The name "search_screens_by_image" says "search": a word for reading.
Description, as the server wrote it
Find catalog screens that look like your images (base64, e.g. a screenshot of the app you are building). Then call get_screen on the matches to compare. Free plans: up to 2 images and 12 results.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged outbound.

Reads private data2: Reads files, mail, messages, databases, secrets, calendars or repositories.; get_email_html
search_emails
Reads text others write3: Brings in text someone else can write: web pages, inbound email, messages, issues and comments.; get_email_html
search_apps
search_emails
Can send data out0: Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

No check matched anything in these tool definitions. That is not a safety guarantee.

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http refcat https://mcp.refcat.app/mcp --header 'Authorization: <your-authorization>'

claude mcp add --transport http refcat https://mcp.refcat.app/mcp --header 'Authorization: <your-authorization>'

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__refcat__list_facets",
      "mcp__refcat__get_screen",
      "mcp__refcat__search_screens_by_image",
      "mcp__refcat__search_screens",
      "mcp__refcat__search_flows",
      "mcp__refcat__search_emails",
      "mcp__refcat__get_email_html",
      "mcp__refcat__search_apps",
      "mcp__refcat__get_app",
      "mcp__refcat__get_app_flows",
      "mcp__refcat__get_flow",
      "mcp__refcat__get_flow_history",
      "mcp__refcat__list_categories",
      "mcp__refcat__list_apps",
      "mcp__refcat__list_projects",
      "mcp__refcat__get_project"
    ],
    "ask": [
      "mcp__refcat__similar_apps",
      "mcp__refcat__similar_screens"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as refcat. Review it before you use it.

Capability tags behind 3 rules

mcp__refcat__search_emails private-data, untrusted-input
mcp__refcat__get_email_html private-data, untrusted-input
mcp__refcat__search_apps untrusted-input

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/app.refcat/refcat/verify?hash=92129d68ab3c2d97fe83a5faada2537a1cd3a3e7be93594ab8b564a74da83a99" | jq -e '.changed == false'

Pinned hash 92129d68ab3c, from Nov 1, 2026, 17:18 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/app.refcat/refcat/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

[![anlyon.dev](https://anlyon.dev/badge/app.refcat/refcat.svg)](https://anlyon.dev/servers/app.refcat/refcat)

Source: MCP Registry. Synced Nov 1, 2026, 17:17 UTC.