Skip to content

Anchor Terminal

com.anchorterminal/anchor-terminalanchorterminal.comstreamable-httpv2026.10.31Scanned

Independent graded directory of AI agent tools: search, compare, prices, MCP server checks.

11 tools: 2 do something that can't be undone, 2 change things and 7 only read.

Tools: 0 delete, 2 irreversible, 2 write, 7 read.
  • Reads private data · 3
  • Reads text others write · 3
  • Can send data out · 3
  • 4 findings

Anlyon alternative

4 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

11 tools

Can't be undone 2Claude Code: ask
  • contactSends a message to the Anchor Terminal team, the same one the site's forms send, and a person replies to email.Can send data outNo findings

    Why it is in this group

    • The description's first verb is "send": a word for sending, and what is sent cannot be taken back.

    What it can reach

    • outboundThe description's first verb is "send": it sends or publishes something to other people.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Sends a message to the Anchor Terminal team, the same one the site's forms send, and a person replies to email. Use it only when your user asks you to get in touch. Kinds are listing (a tool to add, with its url), claim or dispute (a listing), general (anything else), enterprise, partner, compliance, audit (the tools in scope in message) and waitlist (product letme, only email needed). One call; three an hour and ten a day per address. The reply carries a reference id.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
    • readOnlyHint: false
    • title: Send a request to Anchor Terminal
  • submit_reviewPublish a review of a listing you used.No findings

    Why it is in this group

    • The name "submit_review" says "submit": a word for a change.
    • The description's first verb is "publish": a word for a change that another call does not undo.
    Description, as the server wrote it
    Publish a review of a listing you used. The easy way: write the review as JSON text, {"tool": "<slug>", "rating": 1-5, "outcome": "success|partial|failure", "text": "what worked and what didn't"} plus any of task, title, pros, cons, findings, agent {harness, model}, sign those exact bytes with your Ed25519 key (keep the key and reuse it), and pass body (the text), key (the 32-byte public key, base64url) and signature (base64url). Or pass a signed anchor-review envelope. account and proof in the body (the account you use the tool under, a receipt) are kept private for checking. A signed review is published at once and counts for little until evidence of use backs it (a signed response or a vendor token, checked against the tool's key directory; an x402 payment is kept and counts once we check it by hand); the reply says what would raise it. Details at /agents/#reviews.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: false
    • title: Submit a signed review
Changes things 2Claude Code: ask
  • file_issueFiles an issue on Anchor Terminal's public issue tracker (/issues/), where anyone can read it with our replies and its status.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Files an issue on Anchor Terminal's public issue tracker (/issues/), where anyone can read it with our replies and its status. For a bug on the site, letme.dev, the API or this MCP server, or a wrong score or fact on a listing. Write it as JSON text, {"kind": "bug|listing-correction|api-mcp|other", "about": "letme|directory|api|mcp|listing|site", "listing": "<slug, when about is listing>", "title": "at most 120 characters", "text": "what happened, at most 1,200", "called": "the address you called, optional", "calledAt": "when, optional"}, sign those exact bytes with your Ed25519 key (the one you sign reviews with) and pass body, key and signature. Plain text: no links in the text, no keys, tokens or personal data, which are refused. Never a security problem: report those privately to the contact in /.well-known/security.txt, and a filing that reads like one is refused. Ten an hour and forty a day per address.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: false
    • title: File an issue on the public tracker
  • verify_listingFor a tool's vendor: proves a listing is theirs by finding the Anchor badge (/badges/{slug}.svg) or a plain link to the listing (/tools/{slug}) on a page on the listing's own domai…Reads text others writeCan send data out1 finding

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.

    Findings

    • Info

      The description mentions "credentials".

      Matched text

      description: "...es that page once (public addresses, no credentials, redirects only within the domain) and..."

      What this check looks for
    Description, as the server wrote it
    For a tool's vendor: proves a listing is theirs by finding the Anchor badge (/badges/{slug}.svg) or a plain link to the listing (/tools/{slug}) on a page on the listing's own domain, or in the README of its repository on GitHub. Fetches that page once (public addresses, no credentials, redirects only within the domain) and keeps the result; it's re-checked weekly. Use it only when your user runs the product and has put the link there. It never changes a grade, rank or review. Ten an hour per address and twenty a day per listing.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: false
    • title: Verify a listing as its vendor
Only reads 7Show 7 read-only tools
  • check_serverRead another MCP server's tool list the way you'd meet it and report what should change how you use it: text aimed at the model (tool poisoning), missing or contradictory safety hi…Reads text others writeCan send data out2 findings

    Why it is in this group

    • The description's first verb is "read": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe input takes a URL (input.url), and the tool reads it: it reads web pages, which anyone can write.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.

    Claude Code: ask, because it is tagged outbound.

    Findings

    • Info

      The description mentions "credentials".

      Matched text

      description: "...ow. HTTPS and public addresses only, no credentials, never calls the server's tools; a few..."

      What this check looks for
    • Warn

      The description contains "another MCP server", wording about other tools or servers.

      Matched text

      description: "Read another MCP server's tool list the way you'd meet it and r..."

      What this check looks for
    Description, as the server wrote it
    Read another MCP server's tool list the way you'd meet it and report what should change how you use it: text aimed at the model (tool poisoning), missing or contradictory safety hints, undocumented parameters, names model APIs reject, and what the list costs in tokens. Use it before adding a server you don't know. HTTPS and public addresses only, no credentials, never calls the server's tools; a few checks per ten minutes. For local servers or ones that need a key, run anchor check on your own machine. What each check looks for: https://www.anchorterminal.com/check

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: true
    • title: Check an MCP server before connecting
  • compare_toolsTwo listings head to head, as on /compare/: what each is good for, the categories each leads, the score per category with the edge, the facts side by side (transport, auth, pricing…Reads private dataNo findings

    Why it is in this group

    • The name "compare_tools" says "compare": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "note": it reads notes.
    Description, as the server wrote it
    Two listings head to head, as on /compare/: what each is good for, the categories each leads, the score per category with the edge, the facts side by side (transport, auth, pricing, x402, tools exposed, latest release), the verdicts and the notes for agents. Pairs that don't do the same job get a short answer saying why. format markdown (default), slim (fewest tokens) or json.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
    • title: Compare two listings
  • get_pricesModel token prices per million (input, output, blended 3:1, context, what each model supports, rate-limit docs), cheapest first, or with unit set (see units in the result) per-call…Reads private dataNo findings

    Why it is in this group

    • The name "get_prices" says "get": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "doc": it reads documents.
    Description, as the server wrote it
    Model token prices per million (input, output, blended 3:1, context, what each model supports, rate-limit docs), cheapest first, or with unit set (see units in the result) per-call prices for tools in the same unit, e.g. 1k-requests.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
    • title: Compare prices
  • get_toolOne listing in full by its slug (from search_tools): connection snippets (Claude Code command, MCP client config, x402 example), auth, prices, provenance checks, the tools its host…No findings

    Why it is in this group

    • The name "get_tool" says "get": a word for reading.
    Description, as the server wrote it
    One listing in full by its slug (from search_tools): connection snippets (Claude Code command, MCP client config, x402 example), auth, prices, provenance checks, the tools its hosted MCP endpoint lists, dated changes. format json (default), markdown or slim (fewest tokens). It also takes a package name, GitHub owner/repo or MCP registry name the listing goes by and says which slug that resolved to; a registry server the directory doesn't list returns the registry entry.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
    • title: Get one listing
  • list_capabilitiesEvery capability the directory tracks (inference.llm, web.search, web.scrape, data.company, payments.x402, …) with the listings that provide it, best first.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "list_capabilities" says "list": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "directory": it reads files.
    • untrusted-inputThe description's first sentence says "scrape": it reads web pages, which anyone can write.
    Description, as the server wrote it
    Every capability the directory tracks (inference.llm, web.search, web.scrape, data.company, payments.x402, …) with the listings that provide it, best first. prefix narrows it, e.g. 'web.'.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
    • title: Capabilities and the listings for each
  • read_pageAny page of anchorterminal.com as Markdown, the same text a person reads there: the top list (/top/), a category (/categories/search/), the benchmark's method (/benchmark/), prices…No findings

    Why it is in this group

    • The name "read_page" says "read": a word for reading.
    Description, as the server wrote it
    Any page of anchorterminal.com as Markdown, the same text a person reads there: the top list (/top/), a category (/categories/search/), the benchmark's method (/benchmark/), prices (/prices/), sunsets (/sunsets/), the for-agents guide (/agents/) and so on. path is the page's path; format markdown (default), slim or json. The site's guide for agents: https://www.anchorterminal.com/agents/

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
    • title: Read any page of the site
  • search_toolsFind tools, APIs, MCP servers, models and data providers for a job.1 finding

    Why it is in this group

    • The name "search_tools" says "search": a word for reading.

    Findings

    • Warn

      The description contains "other servers", wording about other tools or servers.

      Matched text

      description: "...and our own checks but no score), then other servers from the official MCP registry. Filters..."

      What this check looks for
    Description, as the server wrote it
    Find tools, APIs, MCP servers, models and data providers for a job. Every word in q has to match the name, vendor, summary, tags or capabilities. Returns graded listings first (grade, score, x402, agent-ready; grades from public evidence, see /benchmark/), then indexed listings (MCP servers from the official registry that clear the index's bar, APIs from APIs.guru, x402 Bazaar hosts and OpenRouter model families, with facts and our own checks but no score), then other servers from the official MCP registry. Filters apply to graded listings; kind, category and where also apply to indexed ones.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
    • title: Search the directory

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

27 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 3 outbound tools breaks every one.

Reads private data3
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write3
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out3
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
deny to break every path
{
  "permissions": {
    "deny": [
      "mcp__anchor-terminal__check_server",
      "mcp__anchor-terminal__contact",
      "mcp__anchor-terminal__verify_listing"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

2 warn2 info
  • The description contains "other servers", wording about other tools or servers.

    Matched text

    description: "...and our own checks but no score), then other servers from the official MCP registry. Filters..."

    What this check looks for
  • The description contains "another MCP server", wording about other tools or servers.

    Matched text

    description: "Read another MCP server's tool list the way you'd meet it and r..."

    What this check looks for
  • The description mentions "credentials".

    Matched text

    description: "...ow. HTTPS and public addresses only, no credentials, never calls the server's tools; a few..."

    What this check looks for
  • The description mentions "credentials".

    Matched text

    description: "...es that page once (public addresses, no credentials, redirects only within the domain) and..."

    What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

Install

Pinned to version 2026.10.31. Values in angle brackets are yours to fill in.

claude mcp add --transport http anchor-terminal https://www.anchorterminal.com/mcp
claude mcp add --transport http anchor-terminal https://www.anchorterminal.com/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__anchor-terminal__search_tools",
      "mcp__anchor-terminal__get_tool",
      "mcp__anchor-terminal__compare_tools",
      "mcp__anchor-terminal__read_page",
      "mcp__anchor-terminal__list_capabilities",
      "mcp__anchor-terminal__get_prices"
    ],
    "ask": [
      "mcp__anchor-terminal__check_server",
      "mcp__anchor-terminal__submit_review",
      "mcp__anchor-terminal__file_issue",
      "mcp__anchor-terminal__contact",
      "mcp__anchor-terminal__verify_listing"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as anchor-terminal. Review it before you use it.

Capability tags behind 6 rules
  • mcp__anchor-terminal__compare_tools private-data
  • mcp__anchor-terminal__list_capabilities private-data, untrusted-input
  • mcp__anchor-terminal__get_prices private-data
  • mcp__anchor-terminal__check_server untrusted-input, outbound
  • mcp__anchor-terminal__contact outbound
  • mcp__anchor-terminal__verify_listing untrusted-input, outbound

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/com.anchorterminal/anchor-terminal/verify?hash=4f7980f7970dfca6f7eb733790be128ee434958cde4ecb3c57b72f023c21ba3f" | jq -e '.changed == false'

Pinned hash 4f7980f7970d, from Oct 31, 2026, 21:18 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/com.anchorterminal/anchor-terminal/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for com.anchorterminal/anchor-terminal
[![anlyon.dev](https://anlyon.dev/badge/com.anchorterminal/anchor-terminal.svg)](https://anlyon.dev/servers/com.anchorterminal/anchor-terminal)

Source: MCP Registry. Synced Oct 31, 2026, 21:17 UTC.