Skip to content
anlyon.devby Anlyon

Clannit MCP by Nova (CIVAI)

co.civai.nova/mcp-bgpt-clannitnova.civai.costreamable-httpv1.0.0Scanned

Create estate guest visit invites and read your Clannit notifications (including past invite codes…

11 tools: 9 change things and 2 only read.

Tools: 0 delete, 0 irreversible, 9 write, 2 read.
  • Reads private data · 1
  • Reads text others write · 1
  • Can send data out · 0
  • No findings

Anlyon alternative

9 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →
Compare with similar serversMarkdownJSONReport this listing

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

11 tools

Changes things 9Claude Code: ask
  • create_guest_inviteCreate a guest visit invite.No findings

    Why it is in this group

    • The name "create_guest_invite" says "create": a word for a change.
    Description, as the server wrote it
    Create a guest visit invite. Visit times are built in Lagos (WAT) by a CLI step — do not pass step_18_body_from_* hour fields. Collect guest first AND last name before preview. Always emit_display preview before Confirm. After success, display_data.invite_code MUST be the exact numeric data.code / guest_invite_code — never redact or hide for privacy.
  • fetch_external_resource_fileRun the fetch_external_resource_file pipeline.Reads private dataNo findings

    Why it is in this group

    • The name "fetch_external_resource_file" says "fetch": a word for reading.
    • The description's first verb is "run": a word for a change.

    What it can reach

    • private-dataThe name "fetch_external_resource_file" says "fetch" and "file": it reads files.
    • private-dataThe description's first sentence says "file": it reads files.
    Description, as the server wrote it
    Run the fetch_external_resource_file pipeline.
  • fetch_forum_announcementsRun the fetch_forum_announcements pipeline.No findings

    Why it is in this group

    • The name "fetch_forum_announcements" says "fetch": a word for reading.
    • The description's first verb is "run": a word for a change.
    Description, as the server wrote it
    Run the fetch_forum_announcements pipeline.
  • fetch_forum_profile_photoRun the fetch_forum_profile_photo pipeline.No findings

    Why it is in this group

    • The name "fetch_forum_profile_photo" says "fetch": a word for reading.
    • The description's first verb is "run": a word for a change.
    Description, as the server wrote it
    Run the fetch_forum_profile_photo pipeline.
  • fetch_resourceRun the fetch_resource pipeline.No findings

    Why it is in this group

    • The name "fetch_resource" says "fetch": a word for reading.
    • The description's first verb is "run": a word for a change.
    Description, as the server wrote it
    Run the fetch_resource pipeline.
  • fetch_user_profile_pictureRun the fetch_user_profile_picture pipeline.No findings

    Why it is in this group

    • The name "fetch_user_profile_picture" says "fetch": a word for reading.
    • The description's first verb is "run": a word for a change.
    Description, as the server wrote it
    Run the fetch_user_profile_picture pipeline.
  • fetch_user_schoolRun the fetch_user_school pipeline.No findings

    Why it is in this group

    • The name "fetch_user_school" says "fetch": a word for reading.
    • The description's first verb is "run": a word for a change.
    Description, as the server wrote it
    Run the fetch_user_school pipeline.
  • list_forum_postsRun the list_forum_posts pipeline.Reads text others writeNo findings

    Why it is in this group

    • The name "list_forum_posts" says "list": a word for reading.
    • The description's first verb is "run": a word for a change.

    What it can reach

    • untrusted-inputThe name "list_forum_posts" says "list" and "post": it reads posts, which other people can write.
    • untrusted-inputThe description's first sentence says "run" and "post": it reads posts, which other people can write.
    Description, as the server wrote it
    Run the list_forum_posts pipeline.
  • login_and_register_push_notificationsClannit auth login (email + password).No findings

    Why it is in this group

    • The name "login_and_register_push_notifications" says "push": a word for a change.
    Description, as the server wrote it
    Clannit auth login (email + password). Returns JWT in step_1_body_data_token. Requires step_1_body_email and step_1_body_password — collect via collect_user_input or emit_display input BEFORE calling this pipeline. Chat/Android sessions do not register push tokens.
Only reads 2Show 2 read-only tools
  • fetch_guest_invite_advertisementsMarketing/promo advertisement cards for guest invites on the estate (image + open ad link).No findings

    Why it is in this group

    • The name "fetch_guest_invite_advertisements" says "fetch": a word for reading.
    Description, as the server wrote it
    Marketing/promo advertisement cards for guest invites on the estate (image + open ad link). Do NOT use for invite history, sent invite links, or visitor list — use fetch_notifications instead. GET .../guest-invite/advert (steps 1, 16, 17). Agent-only; hidden from chat suggestion buttons.
  • fetch_notificationsNotifications feed for the logged-in resident, including past guest invites created (names, codes, times).No findings

    Why it is in this group

    • The name "fetch_notifications" says "fetch": a word for reading.
    Description, as the server wrote it
    Notifications feed for the logged-in resident, including past guest invites created (names, codes, times). Use for: notifications, invite history, guest-invite activity, check my history. Auth probe before create_guest_invite. GET /notification (steps 1, 2, 15).

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged outbound.

Reads private data1
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write1
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out0
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

No check matched anything in these tool definitions. That is not a safety guarantee.

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http bgpt-clannit https://nova.civai.co/mcp/agents/mcp-bgpt-clannit
claude mcp add --transport http bgpt-clannit https://nova.civai.co/mcp/agents/mcp-bgpt-clannit

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__bgpt-clannit__fetch_notifications",
      "mcp__bgpt-clannit__fetch_guest_invite_advertisements"
    ],
    "ask": [
      "mcp__bgpt-clannit__login_and_register_push_notifications",
      "mcp__bgpt-clannit__list_forum_posts",
      "mcp__bgpt-clannit__fetch_forum_announcements",
      "mcp__bgpt-clannit__fetch_user_school",
      "mcp__bgpt-clannit__fetch_resource",
      "mcp__bgpt-clannit__fetch_user_profile_picture",
      "mcp__bgpt-clannit__fetch_forum_profile_photo",
      "mcp__bgpt-clannit__fetch_external_resource_file",
      "mcp__bgpt-clannit__create_guest_invite"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as bgpt-clannit. Review it before you use it.

Capability tags behind 2 rules
  • mcp__bgpt-clannit__list_forum_posts untrusted-input
  • mcp__bgpt-clannit__fetch_external_resource_file private-data

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/co.civai.nova/mcp-bgpt-clannit/verify?hash=4f5212a6bf3adebd11f102d7846fdd7d2a06aa2fd99b0a6661aff347377c9b9d" | jq -e '.changed == false'

Pinned hash 4f5212a6bf3a, from Nov 2, 2026, 09:18 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/co.civai.nova/mcp-bgpt-clannit/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for co.civai.nova/mcp-bgpt-clannit
[![anlyon.dev](https://anlyon.dev/badge/co.civai.nova/mcp-bgpt-clannit.svg)](https://anlyon.dev/servers/co.civai.nova/mcp-bgpt-clannit)

Source: MCP Registry. Synced Nov 2, 2026, 09:17 UTC.