FastAF

co.fastaf/fastaffastaf.costreamable-httpv1.2.0Scanned 2 hours ago

22 web-data tools: search, Bing, images, Reddit without authors, jobs, patents, flights and YouTube.

22 tools: 22 only read.

Reads private data · 1
Reads text others write · 22
Can send data out · 3
No findings

Sign-in required, no OAuth metadata. Remote posture

Anlyon alternative

Run the operations that matter as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

22 tools

Only reads 22Looks things up and changes nothing.Show 22 read-only tools

amazon_productReturn current Amazon products by ASIN or keyword.Reads text others writeNo findings
Why it is in this group
- The description's first verb is "return": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Return current Amazon products by ASIN or keyword. Use for Amazon lookups, not price history or other merchants (use google_shopping_prices). Required: asin or query. For offers/bestsellers use REST amazon with resource.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
bing_searchFind web pages with Bing titles, URLs, snippets and ranks.Reads text others writeNo findings
Why it is in this group
- The name "bing_search" says "search": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe description's first sentence says "find" and "web": it reads web pages, which anyone can write.
Description, as the server wrote it
Find web pages with Bing titles, URLs, snippets and ranks. Use for an alternative search index; for Google results use google_search. Required: query.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
get_linkedin_profileReturn a public LinkedIn person profile with headline and summary.Reads text others writeNo findings
Why it is in this group
- The name "get_linkedin_profile" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Return a public LinkedIn person profile with headline and summary. Not company pages or people search (use google_search). Required: profile_id.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
google_ai_answerReturn a Google AI Mode answer with sources for a question.Reads text others writeNo findings
Why it is in this group
- The description's first verb is "return": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Return a Google AI Mode answer with sources for a question. For organic result lists use google_search. Required: query.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
google_imagesFind Google Images results with thumbnails, source URLs and dimensions.Reads text others writeNo findings
Why it is in this group
- The description's first verb is "find": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Find Google Images results with thumbnails, source URLs and dimensions. Use for image discovery; for web pages use google_search. Required: query. Verify image rights before reuse.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
google_maps_placesFind local businesses with address, rating, reviews and place ID.Reads text others writeNo findings
Why it is in this group
- The description's first verb is "find": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe description's first sentence says "find" and "review": it reads comments, which other people can write.
Description, as the server wrote it
Find local businesses with address, rating, reviews and place ID. Not general web pages (use google_search). Required: query. Optional: location.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
google_searchFind pages with Google organic results: title, URL, snippet and position.Reads text others writeNo findings
Why it is in this group
- The name "google_search" says "search": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe description's first sentence says "find" and "url": it reads web pages, which anyone can write.
Description, as the server wrote it
Find pages with Google organic results: title, URL, snippet and position. Not page contents (use scrape_url). Required: query. Optional: country, language.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
google_shopping_pricesCompare product prices and merchants from Google Shopping.Reads text others writeNo findings
Why it is in this group
- The description's first verb is "compare": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Compare product prices and merchants from Google Shopping. For Amazon-only product details use amazon_product. Required: query.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
read_redditRead a public Reddit subreddit or thread as markdown from its RSS feed.Reads private dataReads text others writeCan send data outNo findings
Why it is in this group
- The name "read_reddit" says "read": a word for reading.
What it can reach
- private-dataThe description's first sentence says "read" and "thread": it reads messages.
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe description's first sentence says "read" and "thread": it reads messages, which other people can write.
- untrusted-inputThe input takes a URL (input.url), and the tool reads it: it reads web pages, which anyone can write.
- outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
Claude Code: ask, because it is tagged outbound.
Description, as the server wrote it
Read a public Reddit subreddit or thread as markdown from its RSS feed. Use for public discussions; for other websites use scrape_url. Required: url. Feed coverage may be partial.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
scrape_urlRead one public URL as markdown.Reads text others writeCan send data outNo findings
Why it is in this group
- The description's first verb is "read": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe name "scrape_url" says "scrape": it reads web pages, which anyone can write.
- untrusted-inputThe description's first sentence says "read" and "url": it reads web pages, which anyone can write.
- untrusted-inputThe input takes a URL (input.url), and the tool reads it: it reads web pages, which anyone can write.
- outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
Claude Code: ask, because it is tagged outbound.
Description, as the server wrote it
Read one public URL as markdown. Use for a known page, not discovery (use google_search) or Amazon/eBay/Zillow data (use their tools). Required: url. For HTML, links or summaries use REST scrape.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
search_ebayFind eBay listings with prices, condition and shipping by keyword.Reads text others writeNo findings
Why it is in this group
- The name "search_ebay" says "search": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Find eBay listings with prices, condition and shipping by keyword. For one item use REST ebay with an item URL. Required: query. REST ebay requires an eBay site URL, not a keyword.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
search_flightsSearch Google Flights for flight itineraries and current fares.Reads text others writeNo findings
Why it is in this group
- The name "search_flights" says "search": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Search Google Flights for flight itineraries and current fares. Required: departure_id, arrival_id, outbound_date.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
search_jobsFind jobs with company, location and apply links.Reads text others writeNo findings
Why it is in this group
- The name "search_jobs" says "search": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Find jobs with company, location and apply links. Not company profiles (use google_search). Required: query.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
search_linkedin_jobsFind public LinkedIn job listings by job title or company, with location and work-model filters.Reads text others writeNo findings
Why it is in this group
- The name "search_linkedin_jobs" says "search": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Find public LinkedIn job listings by job title or company, with location and work-model filters. Use for LinkedIn vacancies; for jobs across sources use search_jobs. Required: field.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
search_newsFind current news articles with titles, links and snippets.Reads text others writeNo findings
Why it is in this group
- The name "search_news" says "search": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Find current news articles with titles, links and snippets. Not general web search (use google_search). Required: query.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
search_patentsSearch Google Patents for inventions, patent titles and publication links.Reads text others writeNo findings
Why it is in this group
- The name "search_patents" says "search": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Search Google Patents for inventions, patent titles and publication links. Required: query.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
search_scholarFind scholarly publications and citation details by topic.Reads text others writeNo findings
Why it is in this group
- The name "search_scholar" says "search": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Find scholarly publications and citation details by topic. Not general pages (use google_search). Required: query.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
search_walmartFind Walmart products with prices and availability by keyword.Reads text others writeNo findings
Why it is in this group
- The name "search_walmart" says "search": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Find Walmart products with prices and availability by keyword. For other merchants use google_shopping_prices. Required: query. REST walmart instead requires a Walmart search URL, not a keyword.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
search_youtubeFind YouTube videos by keyword with titles, URLs, channels and durations.Reads text others writeNo findings
Why it is in this group
- The name "search_youtube" says "search": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Find YouTube videos by keyword with titles, URLs, channels and durations. Not transcripts (use youtube_transcript). Required: query. Costs 5 credits per successful call.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
search_zillowReturn home listings with address, price, beds and baths from a Zillow search URL.Reads text others writeCan send data outNo findings
Why it is in this group
- The name "search_zillow" says "search": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe description's first sentence says "return" and "url": it reads web pages, which anyone can write.
- untrusted-inputThe input takes a URL (input.url), and the tool reads it: it reads web pages, which anyone can write.
- outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
Claude Code: ask, because it is tagged outbound.
Description, as the server wrote it
Return home listings with address, price, beds and baths from a Zillow search URL. Input is a site URL, not a keyword. For general search use google_search. Required: url.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
x_profileReturn a public X profile and follower counts by username.Reads text others writeNo findings
Why it is in this group
- The description's first verb is "return": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Return a public X profile and follower counts by username. Not posts or keyword search (use google_search for indexed pages). Required: username.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
youtube_transcriptReturn timestamped transcript text for a known YouTube video ID.Reads text others writeNo findings
Why it is in this group
- The description's first verb is "return": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Return timestamped transcript text for a known YouTube video ID. Not video discovery (use search_youtube). Required: video_id. Costs 5 credits per successful call.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

66 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 1 private-data tool breaks every one.

Reads private data1: Reads files, mail, messages, databases, secrets, calendars or repositories.; read_reddit
Reads text others write22: Brings in text someone else can write: web pages, inbound email, messages, issues and comments.; amazon_product
bing_search
get_linkedin_profile
google_ai_answer
google_images
google_maps_places
google_search
google_shopping_prices
read_reddit
scrape_url
search_ebay
search_flights
and 10 more
Can send data out3: Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.; read_reddit
scrape_url
search_zillow

deny to break every path

{
  "permissions": {
    "deny": [
      "mcp__fastaf__read_reddit"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Sign-in required, no OAuth metadata

Looked at Oct 22, 2026, 14:25 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable: yes
HTTP status of an anonymous initialize: 401
tools/list served without credentials: no
Tools that change things, listed without credentials: 0
Protocol version: not observed
WWW-Authenticate on 401: yes
resource_metadata in WWW-Authenticate: not observed
RFC 9728 protected resource metadata: not observed
Authorization servers: not observed
Legacy HTTP+SSE transport: no
Dynamic client registration: not observed
Client ID metadata documents: not observed

WarnThe whole server
The endpoint asks for credentials (HTTP 401) but publishes no RFC 9728 protected resource metadata: no resource_metadata in WWW-Authenticate and no document at /.well-known/oauth-protected-resource.
Matched text
https://api.fastaf.co/mcp: initialize answered HTTP 401, with a WWW-Authenticate header
What this check looks for

Findings

Matches of fixed checks, with the text they matched.

No check matched anything in these tool definitions. That is not a safety guarantee.

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 1.2.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http fastaf https://api.fastaf.co/mcp

claude mcp add --transport http fastaf https://api.fastaf.co/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__fastaf__google_search",
      "mcp__fastaf__google_maps_places",
      "mcp__fastaf__amazon_product",
      "mcp__fastaf__search_news",
      "mcp__fastaf__google_shopping_prices",
      "mcp__fastaf__search_scholar",
      "mcp__fastaf__search_jobs",
      "mcp__fastaf__google_ai_answer",
      "mcp__fastaf__search_walmart",
      "mcp__fastaf__search_ebay",
      "mcp__fastaf__x_profile",
      "mcp__fastaf__search_youtube",
      "mcp__fastaf__youtube_transcript",
      "mcp__fastaf__search_linkedin_jobs",
      "mcp__fastaf__search_patents",
      "mcp__fastaf__search_flights",
      "mcp__fastaf__bing_search",
      "mcp__fastaf__google_images",
      "mcp__fastaf__get_linkedin_profile"
    ],
    "ask": [
      "mcp__fastaf__scrape_url",
      "mcp__fastaf__search_zillow",
      "mcp__fastaf__read_reddit"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as fastaf. Review it before you use it.

Capability tags behind 22 rules

mcp__fastaf__scrape_url untrusted-input, outbound
mcp__fastaf__google_search untrusted-input
mcp__fastaf__google_maps_places untrusted-input
mcp__fastaf__amazon_product untrusted-input
mcp__fastaf__search_news untrusted-input
mcp__fastaf__google_shopping_prices untrusted-input
mcp__fastaf__search_scholar untrusted-input
mcp__fastaf__search_jobs untrusted-input
mcp__fastaf__google_ai_answer untrusted-input
mcp__fastaf__search_walmart untrusted-input
mcp__fastaf__search_ebay untrusted-input
mcp__fastaf__search_zillow untrusted-input, outbound
mcp__fastaf__x_profile untrusted-input
mcp__fastaf__search_youtube untrusted-input
mcp__fastaf__youtube_transcript untrusted-input
mcp__fastaf__search_linkedin_jobs untrusted-input
mcp__fastaf__search_patents untrusted-input
mcp__fastaf__search_flights untrusted-input
mcp__fastaf__bing_search untrusted-input
mcp__fastaf__google_images untrusted-input
mcp__fastaf__read_reddit private-data, untrusted-input, outbound
mcp__fastaf__get_linkedin_profile untrusted-input

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/co.fastaf/fastaf/verify?hash=4ca6da7b6732c799947fd51c544e61512f04d042609d74326d1b1ca21c8133e5" | jq -e '.changed == false'

Pinned hash 4ca6da7b6732, from Oct 28, 2026, 14:17 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/co.fastaf/fastaf/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

[![anlyon.dev](https://anlyon.dev/badge/co.fastaf/fastaf.svg)](https://anlyon.dev/servers/co.fastaf/fastaf)

Source: MCP Registry. Synced Oct 28, 2026, 15:17 UTC.