mumo
by mumo.chat · remote · no sign-in to list tools · v1.1.0 · published by chat.mumo
Multi-model deliberation over MCP: full responses plus typed cross-model reactions from other labs.
8 tools: 3 change things and 5 only read.
Scanned Oct 21, 2026
- Deletes or cancels0Claude Code: deny
- Can't be undone0Claude Code: ask
- Changes things3Claude Code: ask: see these tools
- Only reads5Claude Code: allow: see these tools
1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.
claude mcp add --transport http mumo https://mumo.chat/api/mcp --header 'Authorization: <your-authorization>'Findings
Matches of fixed checks, with the text they matched.
- Infowait_for_round
The description is 2,016 characters long, over the 2,000 this check looks for.
What this check looks forMatched text
description ends: "...HTTP 200 with explicit semantic state — failed rounds don't crash the tool call."
Tools
Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.
8 tools
Changes things 3Claude Code: ask
append_roundAdd a follow-up round to an existing deliberation session.Reads text others writeNo findings
Why it is in this group
- The description's first verb is "add": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Add a follow-up round to an existing deliberation session. Use after reading the previous round's claim_map and responses to steer the conversation. The `snippets` array lets you forward specific quotes from the prior round's responses with a typed reaction: - KEEP: this point is strong, preserve it - EXPLORE: dig deeper on this thread - CHALLENGE: push back on this claim - CORE: this is load-bearing, build on it - SHIFT: this reframes the question Models see the snippets as curated forwards and respond with full context. Use this to resolve disagreements, test claims, or direct attention to specific passages. Forwarding is the moderator's privileged promotion of ledger content into the record — you have seen notes the panel has not. Elevate what the discussion needs now rather than waiting to see whether its author carries it. **Returns immediately (async).** Response is a compact ack — model execution runs in background. Call `wait_for_round` with this `session_id` and `round_id` from the ack to read the finished round; its `structuredContent` carries `round_status` (4-way), `is_usable`, and `recommended_client_action` so you can decide whether to read the result, retry, or abandon without parsing prose. Only works on sessions that don't have an in-flight round. If `get_session` shows the latest round is `pending`, wait. If a prior round failed catastrophically and was refunded, you can append a new round — the refund restored your budget. Idempotency is automatic per-tool-args, so retrying after a transport failure is safe — a second call with identical args within 24 hours replays the first round's ack without creating a duplicate (no second round, no second charge).
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
create_deliberationStart a multi-model AI deliberation on a question or decision.Reads text others writeNo findings
Why it is in this group
- The name "create_deliberation" says "create": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Start a multi-model AI deliberation on a question or decision. Runs the prompt through multiple frontier AI models in parallel and extracts typed reactions (KEEP/EXPLORE/CHALLENGE/CORE/SHIFT) into a claim map of where they agree and diverge. **Returns immediately (async).** The response is a compact ack — `{ session_id, round_id, round_index, status: 'processing', progress_url, ... }` — NOT the finished deliberation. Model execution runs in the background. Call `wait_for_round` to block on cheap progress polling and read the actual responses and claim_map once the round completes (typically 15–120s depending on model choice). `wait_for_round` returns protocol-native `structuredContent` so you can branch on `round_status` / `recommended_client_action` without parsing prose. MCP deliberations are agent-moderated: one round runs, then you decide whether to stop or call `append_round` with follow-up steering. There is no fixed round cap and no autonomous moderator on this surface. Use when you need structured disagreement from independent models, not a single synthesized answer. Ideal for spec review, architectural decisions, or any question where model diversity is a signal. Idempotency is automatic — the adapter derives a stable key from tool arguments, so repeat tool calls with identical args resolve to the same session for 24 hours (no second session, no second charge). A catastrophically-failed round (all providers errored) auto-refunds your budget within 60s; the round won't count against your daily cap.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
Only reads 5Claude Code: allow
get_creditFetch the caller's current credit wallet balance.No findings
Why it is in this group
- The name "get_credit" says "get": a word for reading.
Description, as the server wrote it Fetch the caller's current credit wallet balance. Returns `effective_balance_usd` (markup-included, what's left to spend). At or below zero, every new round is refused until top-up or the monthly free-credit reset. Above zero, a round is admitted when the balance also covers that round's minimum (each model's reserved output plus input and the post-round reactions/takeaway) — a per-request check, so a low positive balance can still refuse a large panel with `credit_exhausted`, whose `required_usd` names the minimum and `affordable_alternatives` the rosters that fit (from `create_deliberation` only; always empty from `append_round`). `per_model_minimum_usd_default` is also returned, and `pricing.minimum_usd` on `list_models` carries per-model values. Both are reported for reference — they no longer gate admission.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
get_sessionFetch the full state of a deliberation session including all rounds, responses, snippets, and claim maps.No findings
Why it is in this group
- The name "get_session" says "get": a word for reading.
Description, as the server wrote it Fetch the full state of a deliberation session including all rounds, responses, snippets, and claim maps. Use to re-read completed session state. While a round is running, prefer `wait_for_round` so you do not repeatedly fetch the full transcript. The claim_map on each round is the highest-signal representation: shows which claims multiple models reacted to, who originated them, and what each reacting model said (KEEP/CHALLENGE/etc + their comment). Use claim_map to identify unresolved disagreements before sending a follow-up. Reactions are the panel's private ledger — participants never see each other's reactions, and as moderator you read them FIRST: the claim map is an advance view of what each model is privately weighing before any of it reaches prose. Use that privileged preview to steer the next round — forward a reaction as a snippet when it deserves the record immediately, or shape your prompt around a collision you can see coming. Authors weave their own strongest notes into their next responses; in later rounds you can compare a prior round's ledger against the prose that followed to spot what was dropped.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
list_modelsList the full model catalog.No findings
Why it is in this group
- The name "list_models" says "list": a word for reading.
Description, as the server wrote it List the full model catalog. Returns id, provider, display name, context window, max output tokens, pricing, and a per-model `available` verdict for your account (with `unavailable_reason` when false). Nothing is filtered out — `available` is what varies by caller. Call before `create_deliberation` if the user wants specific models. Model IDs from this endpoint are what `create_deliberation`'s `models` parameter expects.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
list_sessionsList the caller's deliberation sessions, optionally filtered by status.No findings
Why it is in this group
- The name "list_sessions" says "list": a word for reading.
Description, as the server wrote it List the caller's deliberation sessions, optionally filtered by status. Most useful for agents managing multiple concurrent sessions — use `status: 'ready'` to find sessions awaiting your next round. Returns a lightweight list (no response bodies); call `get_session` for full content.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
wait_for_roundWait for a deliberation round to finish, then return the full session.1 finding
Why it is in this group
- The name "wait_for_round" says "wait": a word for reading.
Findings
- Info
The description is 2,016 characters long, over the 2,000 this check looks for.
What this check looks forMatched text
description ends: "...HTTP 200 with explicit semantic state — failed rounds don't crash the tool call."
Description, as the server wrote it Wait for a deliberation round to finish, then return the full session. This is the agent-friendly follow-up to `create_deliberation` and `append_round`: those tools return a fast ack; this tool polls the lightweight progress endpoint internally and fetches the full transcript only once terminal state is reached. Use this instead of repeatedly calling `get_session` while models are running. The returned claim_map is your advance look at the panel's private notes — nothing in it has reached the other participants yet. Steer with it. **Web-created rounds** (started from the mumo web UI rather than this API) resolve when all model responses have settled — round artifacts (claim map, takeaway) may still be generating at that moment. `claim_map_url` is always present and does not imply the map is ready; if it matters, re-check via `get_session` shortly after. **Structured output.** The response carries both `content[0].text` (human-readable — full session markdown on terminal, short prose summary on timeout) and `structuredContent` matching the tool's `outputSchema`. Branch on `structuredContent.round_status` (`complete` | `partial_failure` | `in_progress` | `failed`) and `recommended_client_action` (`proceed_with_complete_result` | `proceed_with_partial_result` | `poll_again` | `retry` | `abandon`) rather than parsing prose. The schema also exposes per-model `completed_models[]` (with `tokens_in` / `tokens_out` / `finish_reason` / `is_partial` / `output_cap`), `in_progress_models[]` (with `partial_text_length` / `last_chunk_at` / `since_last_chunk_ms` / `expired_at_read`), and `failed_models[]` (with canonical `error_code`, `output_cap` and any preserved `partial_text`). `output_cap` is null unless a platform cap bound the call: `{ tokens, reason }` with reason `guest` (guest output limit) or `balance` (the remaining credit bounded the output — top up or wait for the reset rather than retrying). Always HTTP 200 with explicit semantic state — failed rounds don't crash the tool call.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Exfil surface
Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.
No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data or outbound.
- Reads private data0
- Reads files, mail, messages, databases, secrets, calendars or repositories.
- Reads text others write2
- Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
- Can send data out0
- Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.
Remote posture
What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.
Looked at Oct 22, 2026, 14:25 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.
- Reachable
- yes
- HTTP status of an anonymous initialize
- 200
- tools/list served without credentials
- yes
- Tools that change things, listed without credentials
- 3
- Protocol version
- 2025-06-18
- WWW-Authenticate on 401
- not observed
- resource_metadata in WWW-Authenticate
- none
- RFC 9728 protected resource metadata
- none
- Authorization servers
- none
- Legacy HTTP+SSE transport
- no
- Dynamic client registration
- not observed
- Client ID metadata documents
- not observed
- WarnThe whole server
The endpoint served tools/list without credentials, and the list has 3 tools that change things (3 write). Whether a call also works without credentials was not tested: tools are never called.
What this check looks forMatched text
https://mumo.chat/api/mcp: tools/list returned 8 tools to an anonymous client, including create_deliberation (write), append_round (write), share_session (write)
Install
Pinned to version 1.1.0. Values in angle brackets are yours to fill in.
claude mcp add --transport http mumo https://mumo.chat/api/mcp --header 'Authorization: <your-authorization>'Run in a terminal.
Claude Code permissions
Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__mumo__wait_for_round",
"mcp__mumo__get_session",
"mcp__mumo__list_sessions",
"mcp__mumo__list_models",
"mcp__mumo__get_credit"
],
"ask": [
"mcp__mumo__create_deliberation",
"mcp__mumo__append_round",
"mcp__mumo__share_session"
],
"deny": []
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as mumo. Review it before you use it.
Capability tags behind 2 rules
- mcp__mumo__create_deliberation untrusted-input
- mcp__mumo__append_round untrusted-input