The Bot Forum
by forum.bot · remote · no sign-in to list tools · v0.3.0 · published by bot.forum
Data feeds for AI agents: list products, sign up, check balance, get a top-up link, fetch data.
6 tools: 2 change things and 4 only read.
Scanned Oct 21, 2026
- Deletes or cancels0Claude Code: deny
- Can't be undone0Claude Code: ask
- Changes things2Claude Code: ask: see these tools
- Only reads4Claude Code: allow: see these tools
No check matched anything in the tool definitions. No finding is not a safety guarantee. How the checks work.
claude mcp add --transport http forum https://mcp.forum.bot/mcpTools
Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.
6 tools
Changes things 2Claude Code: ask
get_topup_linkOpens a top-up for the account and returns the payment intent with hosted_url, the payment provider's short-lived page where a human completes the payment — no tool pays, and card …Reads private dataReads text others writeNo findings
Why it is in this group
- The name "get_topup_link" says "get": a word for reading.
- The description's first verb is "open": a word for a change.
What it can reach
- private-dataThe input names a secret (input.secret), and the tool reads: it reads secrets.
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe description's first sentence says "open" and "url": it reads web pages, which anyone can write.
Description, as the server wrote it Opens a top-up for the account and returns the payment intent with hosted_url, the payment provider's short-lived page where a human completes the payment — no tool pays, and card details never touch the Forum. amount_minor is in cents; the platform accepts USD only and a minimum of 1000 (= $10). Pass the secret sign_up returned as the secret argument; the data key cannot open a payment. Asking again while a page is open returns the same page. Bought credits appear in account_status once the payment completes.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: false
sign_upCreates a Forum account for an email address under the Terms version currently served, and returns the account, its secret — the one string that runs the account, shown exactly onc…No findings
Why it is in this group
- The description's first verb is "create": a word for a change.
Description, as the server wrote it Creates a Forum account for an email address under the Terms version currently served, and returns the account, its secret — the one string that runs the account, shown exactly once — and its first data key, shown exactly once. It grants the account no credits of its own: a new account's free calls are the daily credit account of each product that gives one, spendable on that product alone and replaced every night, and list_products states which products give one and how much. The result's configure block is the client configuration entry that sends the data key from then on; until the client reconnects, pass data_key.key as data_key on fetch_data. Keep the secret with the owner and pass it as secret on account_status and get_topup_link. An address that already has an account answers 409 email_exists with next_action login_to_link.
Annotations the server declares
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: false
Only reads 4Claude Code: allow
account_statusReads the account behind the secret: tier, accepted Terms version, the products it may call, the balance in credits the account bought minus the spend those credits funded, the las…Reads private dataNo findings
Why it is in this group
- The name "account_status" says "status": a word for reading.
What it can reach
- private-dataThe description's first sentence says "read" and "secret": it reads secrets.
- private-dataThe input names a secret (input.secret), and the tool reads: it reads secrets.
Description, as the server wrote it Reads the account behind the secret: tier, accepted Terms version, the products it may call, the balance in credits the account bought minus the spend those credits funded, the last 30 days of usage per day, product and key, and the 50 latest balance movements. A product's own daily credits are spent before that balance and are no part of it, so a call can be served while it reads zero; list_products carries each product's credit account. Pass the secret sign_up returned as the secret argument; the data key your client configuration sends cannot read the account and answers 403 wrong_credential. Charges nothing; without a string the platform answers 401 invalid_key.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
fetch_dataFetches one data response: GET data.forum.bot/{product}/{route} with the query parameters you pass, using the data key from your client configuration's Authorization header or the …Reads private dataReads text others writeNo findings
Why it is in this group
- The name "fetch_data" says "fetch": a word for reading.
What it can reach
- private-dataThe description's first sentence says "fetch" and "secret": it reads secrets.
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Fetches one data response: GET data.forum.bot/{product}/{route} with the query parameters you pass, using the data key from your client configuration's Authorization header or the data_key argument — never the secret, which fetches nothing. A successful call is billed the product's price per call; a refused call costs nothing. The result carries the payload with the platform's meta block (licence and attribution) and the rate-limit headers; the balance is read with account_status, never from a data response. Every refusal is the platform's error envelope unchanged — a code from https://api.forum.bot/errors.json; 402 payment_required means the key is known but cannot pay for this product now, and 401 invalid_key means it is authorized for no product at all, most often because every credit is spent. Both carry an action_url: a human tops up there (get_topup_link returns the page) and the same key serves again within the engine's build interval plus the region's poll interval.
Annotations the server declares
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
- readOnlyHint: true
get_productReturns one product by slug: its live catalogue entry (price, licence, lifecycle state, the specification address) together with the routes fetch_data can call and the parameters e…No findings
Why it is in this group
- The name "get_product" says "get": a word for reading.
Description, as the server wrote it Returns one product by slug: its live catalogue entry (price, licence, lifecycle state, the specification address) together with the routes fetch_data can call and the parameters each route requires, taken from the platform's published product record. Needs no key and charges nothing. Use it before fetch_data — the route names come from here; an unknown slug answers with the slugs the catalogue serves.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
list_productsLists every data product the Forum serves, as the platform's own catalogue answer: slug, title, lifecycle state, price in credits per call (1 credit = $0.001; the quoted price is t…No findings
Why it is in this group
- The name "list_products" says "list": a word for reading.
Description, as the server wrote it Lists every data product the Forum serves, as the platform's own catalogue answer: slug, title, lifecycle state, price in credits per call (1 credit = $0.001; the quoted price is the charged price), licence and attribution text, and the address of the product's route specification. Needs no key and charges nothing. Call get_product next for a product's routes and required parameters.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Exfil surface
Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.
No private-data, untrusted-input, outbound path in this server alone: no tool is tagged outbound.
- Reads private data3
- Reads files, mail, messages, databases, secrets, calendars or repositories.
- Reads text others write2
- Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
- Can send data out0
- Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.
Install
Pinned to version 0.3.0. Values in angle brackets are yours to fill in.
claude mcp add --transport http forum https://mcp.forum.bot/mcpRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__forum__list_products",
"mcp__forum__get_product",
"mcp__forum__account_status",
"mcp__forum__fetch_data"
],
"ask": [
"mcp__forum__sign_up",
"mcp__forum__get_topup_link"
],
"deny": []
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as forum. Review it before you use it.
Capability tags behind 3 rules
- mcp__forum__account_status private-data
- mcp__forum__get_topup_link private-data, untrusted-input
- mcp__forum__fetch_data private-data, untrusted-input