Skip to content

mumo

by mumo.chat · remote · no sign-in to list tools · v1.1.0 · published by chat.mumo

Multi-model deliberation over MCP: full responses plus typed cross-model reactions from other labs.

Changes · 3

8 tools: 3 change things and 5 only read.

Scanned Oct 21, 2026

1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http mumo https://mumo.chat/api/mcp --header 'Authorization: <your-authorization>'

Findings

Matches of fixed checks, with the text they matched.

1 info
  • The description is 2,016 characters long, over the 2,000 this check looks for.

    Matched text

    description ends: "...HTTP 200 with explicit semantic state — failed rounds don't crash the tool call."

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

8 tools

Changes things 3Claude Code: ask
  • append_roundAdd a follow-up round to an existing deliberation session.Reads text others writeNo findings

    Why it is in this group

    • The description's first verb is "add": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Add a follow-up round to an existing deliberation session. Use after reading the previous round's claim_map and responses to steer the conversation. The `snippets` array lets you forward specific quotes from the prior round's responses with a typed reaction: - KEEP: this point is strong, preserve it - EXPLORE: dig deeper on this thread - CHALLENGE: push back on this claim - CORE: this is load-bearing, build on it - SHIFT: this reframes the question Models see the snippets as curated forwards and respond with full context. Use this to resolve disagreements, test claims, or direct attention to specific passages. Forwarding is the moderator's privileged promotion of ledger content into the record — you have seen notes the panel has not. Elevate what the discussion needs now rather than waiting to see whether its author carries it. **Returns immediately (async).** Response is a compact ack — model execution runs in background. Call `wait_for_round` with this `session_id` and `round_id` from the ack to read the finished round; its `structuredContent` carries `round_status` (4-way), `is_usable`, and `recommended_client_action` so you can decide whether to read the result, retry, or abandon without parsing prose. Only works on sessions that don't have an in-flight round. If `get_session` shows the latest round is `pending`, wait. If a prior round failed catastrophically and was refunded, you can append a new round — the refund restored your budget. Idempotency is automatic per-tool-args, so retrying after a transport failure is safe — a second call with identical args within 24 hours replays the first round's ack without creating a duplicate (no second round, no second charge).

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • create_deliberationStart a multi-model AI deliberation on a question or decision.Reads text others writeNo findings

    Why it is in this group

    • The name "create_deliberation" says "create": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Start a multi-model AI deliberation on a question or decision. Runs the prompt through multiple frontier AI models in parallel and extracts typed reactions (KEEP/EXPLORE/CHALLENGE/CORE/SHIFT) into a claim map of where they agree and diverge. **Returns immediately (async).** The response is a compact ack — `{ session_id, round_id, round_index, status: 'processing', progress_url, ... }` — NOT the finished deliberation. Model execution runs in the background. Call `wait_for_round` to block on cheap progress polling and read the actual responses and claim_map once the round completes (typically 15–120s depending on model choice). `wait_for_round` returns protocol-native `structuredContent` so you can branch on `round_status` / `recommended_client_action` without parsing prose. MCP deliberations are agent-moderated: one round runs, then you decide whether to stop or call `append_round` with follow-up steering. There is no fixed round cap and no autonomous moderator on this surface. Use when you need structured disagreement from independent models, not a single synthesized answer. Ideal for spec review, architectural decisions, or any question where model diversity is a signal. Idempotency is automatic — the adapter derives a stable key from tool arguments, so repeat tool calls with identical args resolve to the same session for 24 hours (no second session, no second charge). A catastrophically-failed round (all providers errored) auto-refunds your budget within 60s; the round won't count against your daily cap.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • share_sessionShare a deliberation session at a public URL — anyone with the link can view it in the read-only reader deck.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Share a deliberation session at a public URL — anyone with the link can view it in the read-only reader deck. Returns the public `share_url` plus two machine-readable twins: `markdown_url` (the full transcript with per-round claim maps — the review/audit surface) and `brief_url` (synthesis-only triage tier, ~1-2k tokens). Hand the markdown twin to a reviewer model, or the share_url to a human — no web UI required. Semantics: idempotent — re-calling returns the same URL. The link is a point-in-time snapshot that auto-refreshes when you've appended rounds since the last share, so after extending a session, call this again to bring the public page current. Sharing never changes the session itself and never lists the page in search engines or the public library (that elevation is a separate platform-curated step). Call when the user wants a shareable link or asks to publish/share results. Requires a registered (non-anonymous) mumo account; sharing generates any missing round takeaways first, so the first share of a long session can take ~15-30s.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
Only reads 5Claude Code: allow
  • get_creditFetch the caller's current credit wallet balance.No findings

    Why it is in this group

    • The name "get_credit" says "get": a word for reading.
    Description, as the server wrote it
    Fetch the caller's current credit wallet balance. Returns `effective_balance_usd` (markup-included, what's left to spend). At or below zero, every new round is refused until top-up or the monthly free-credit reset. Above zero, a round is admitted when the balance also covers that round's minimum (each model's reserved output plus input and the post-round reactions/takeaway) — a per-request check, so a low positive balance can still refuse a large panel with `credit_exhausted`, whose `required_usd` names the minimum and `affordable_alternatives` the rosters that fit (from `create_deliberation` only; always empty from `append_round`). `per_model_minimum_usd_default` is also returned, and `pricing.minimum_usd` on `list_models` carries per-model values. Both are reported for reference — they no longer gate admission.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
  • get_sessionFetch the full state of a deliberation session including all rounds, responses, snippets, and claim maps.No findings

    Why it is in this group

    • The name "get_session" says "get": a word for reading.
    Description, as the server wrote it
    Fetch the full state of a deliberation session including all rounds, responses, snippets, and claim maps. Use to re-read completed session state. While a round is running, prefer `wait_for_round` so you do not repeatedly fetch the full transcript. The claim_map on each round is the highest-signal representation: shows which claims multiple models reacted to, who originated them, and what each reacting model said (KEEP/CHALLENGE/etc + their comment). Use claim_map to identify unresolved disagreements before sending a follow-up. Reactions are the panel's private ledger — participants never see each other's reactions, and as moderator you read them FIRST: the claim map is an advance view of what each model is privately weighing before any of it reaches prose. Use that privileged preview to steer the next round — forward a reaction as a snippet when it deserves the record immediately, or shape your prompt around a collision you can see coming. Authors weave their own strongest notes into their next responses; in later rounds you can compare a prior round's ledger against the prose that followed to spot what was dropped.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
  • list_modelsList the full model catalog.No findings

    Why it is in this group

    • The name "list_models" says "list": a word for reading.
    Description, as the server wrote it
    List the full model catalog. Returns id, provider, display name, context window, max output tokens, pricing, and a per-model `available` verdict for your account (with `unavailable_reason` when false). Nothing is filtered out — `available` is what varies by caller. Call before `create_deliberation` if the user wants specific models. Model IDs from this endpoint are what `create_deliberation`'s `models` parameter expects.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
  • list_sessionsList the caller's deliberation sessions, optionally filtered by status.No findings

    Why it is in this group

    • The name "list_sessions" says "list": a word for reading.
    Description, as the server wrote it
    List the caller's deliberation sessions, optionally filtered by status. Most useful for agents managing multiple concurrent sessions — use `status: 'ready'` to find sessions awaiting your next round. Returns a lightweight list (no response bodies); call `get_session` for full content.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
  • wait_for_roundWait for a deliberation round to finish, then return the full session.1 finding

    Why it is in this group

    • The name "wait_for_round" says "wait": a word for reading.

    Findings

    • Info

      The description is 2,016 characters long, over the 2,000 this check looks for.

      Matched text

      description ends: "...HTTP 200 with explicit semantic state — failed rounds don't crash the tool call."

      What this check looks for
    Description, as the server wrote it
    Wait for a deliberation round to finish, then return the full session. This is the agent-friendly follow-up to `create_deliberation` and `append_round`: those tools return a fast ack; this tool polls the lightweight progress endpoint internally and fetches the full transcript only once terminal state is reached. Use this instead of repeatedly calling `get_session` while models are running. The returned claim_map is your advance look at the panel's private notes — nothing in it has reached the other participants yet. Steer with it. **Web-created rounds** (started from the mumo web UI rather than this API) resolve when all model responses have settled — round artifacts (claim map, takeaway) may still be generating at that moment. `claim_map_url` is always present and does not imply the map is ready; if it matters, re-check via `get_session` shortly after. **Structured output.** The response carries both `content[0].text` (human-readable — full session markdown on terminal, short prose summary on timeout) and `structuredContent` matching the tool's `outputSchema`. Branch on `structuredContent.round_status` (`complete` | `partial_failure` | `in_progress` | `failed`) and `recommended_client_action` (`proceed_with_complete_result` | `proceed_with_partial_result` | `poll_again` | `retry` | `abandon`) rather than parsing prose. The schema also exposes per-model `completed_models[]` (with `tokens_in` / `tokens_out` / `finish_reason` / `is_partial` / `output_cap`), `in_progress_models[]` (with `partial_text_length` / `last_chunk_at` / `since_last_chunk_ms` / `expired_at_read`), and `failed_models[]` (with canonical `error_code`, `output_cap` and any preserved `partial_text`). `output_cap` is null unless a platform cap bound the call: `{ tokens, reason }` with reason `guest` (guest output limit) or `balance` (the remaining credit bounded the output — top up or wait for the reset rather than retrying). Always HTTP 200 with explicit semantic state — failed rounds don't crash the tool call.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data or outbound.

Reads private data0
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write2
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out0
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Looked at Oct 22, 2026, 14:25 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable
yes
HTTP status of an anonymous initialize
200
tools/list served without credentials
yes
Tools that change things, listed without credentials
3
Protocol version
2025-06-18
WWW-Authenticate on 401
not observed
resource_metadata in WWW-Authenticate
none
RFC 9728 protected resource metadata
none
Authorization servers
none
Legacy HTTP+SSE transport
no
Dynamic client registration
not observed
Client ID metadata documents
not observed
  • WarnThe whole server

    The endpoint served tools/list without credentials, and the list has 3 tools that change things (3 write). Whether a call also works without credentials was not tested: tools are never called.

    Matched text

    https://mumo.chat/api/mcp: tools/list returned 8 tools to an anonymous client, including create_deliberation (write), append_round (write), share_session (write)

    What this check looks for

Install

Pinned to version 1.1.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http mumo https://mumo.chat/api/mcp --header 'Authorization: <your-authorization>'

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__mumo__wait_for_round",
      "mcp__mumo__get_session",
      "mcp__mumo__list_sessions",
      "mcp__mumo__list_models",
      "mcp__mumo__get_credit"
    ],
    "ask": [
      "mcp__mumo__create_deliberation",
      "mcp__mumo__append_round",
      "mcp__mumo__share_session"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as mumo. Review it before you use it.

Capability tags behind 2 rules
  • mcp__mumo__create_deliberation untrusted-input
  • mcp__mumo__append_round untrusted-input