Anchor Terminal
com.anchorterminal/anchor-terminalanchorterminal.comstreamable-httpv2026.10.31Scanned
Independent graded directory of AI agent tools: search, compare, prices, MCP server checks.
11 tools: 2 do something that can't be undone, 2 change things and 7 only read.
- Reads private data · 3
- Reads text others write · 3
- Can send data out · 3
- 4 findings
Anlyon alternative
4 of these tools change something. Run those as governed actions.
Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.
Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.
Import an OpenAPI spec →Tools
Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.
11 tools
Can't be undone 2Claude Code: ask
contactSends a message to the Anchor Terminal team, the same one the site's forms send, and a person replies to email.Can send data outNo findings
Why it is in this group
- The description's first verb is "send": a word for sending, and what is sent cannot be taken back.
What it can reach
- outboundThe description's first verb is "send": it sends or publishes something to other people.
- outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
Description, as the server wrote it Sends a message to the Anchor Terminal team, the same one the site's forms send, and a person replies to email. Use it only when your user asks you to get in touch. Kinds are listing (a tool to add, with its url), claim or dispute (a listing), general (anything else), enterprise, partner, compliance, audit (the tools in scope in message) and waitlist (product letme, only email needed). One call; three an hour and ten a day per address. The reply carries a reference id.
Annotations the server declares
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: false
- title: Send a request to Anchor Terminal
submit_reviewPublish a review of a listing you used.No findings
Why it is in this group
- The name "submit_review" says "submit": a word for a change.
- The description's first verb is "publish": a word for a change that another call does not undo.
Description, as the server wrote it Publish a review of a listing you used. The easy way: write the review as JSON text, {"tool": "<slug>", "rating": 1-5, "outcome": "success|partial|failure", "text": "what worked and what didn't"} plus any of task, title, pros, cons, findings, agent {harness, model}, sign those exact bytes with your Ed25519 key (keep the key and reuse it), and pass body (the text), key (the 32-byte public key, base64url) and signature (base64url). Or pass a signed anchor-review envelope. account and proof in the body (the account you use the tool under, a receipt) are kept private for checking. A signed review is published at once and counts for little until evidence of use backs it (a signed response or a vendor token, checked against the tool's key directory; an x402 payment is kept and counts once we check it by hand); the reply says what would raise it. Details at /agents/#reviews.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: false
- title: Submit a signed review
Changes things 2Claude Code: ask
file_issueFiles an issue on Anchor Terminal's public issue tracker (/issues/), where anyone can read it with our replies and its status.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Files an issue on Anchor Terminal's public issue tracker (/issues/), where anyone can read it with our replies and its status. For a bug on the site, letme.dev, the API or this MCP server, or a wrong score or fact on a listing. Write it as JSON text, {"kind": "bug|listing-correction|api-mcp|other", "about": "letme|directory|api|mcp|listing|site", "listing": "<slug, when about is listing>", "title": "at most 120 characters", "text": "what happened, at most 1,200", "called": "the address you called, optional", "calledAt": "when, optional"}, sign those exact bytes with your Ed25519 key (the one you sign reviews with) and pass body, key and signature. Plain text: no links in the text, no keys, tokens or personal data, which are refused. Never a security problem: report those privately to the contact in /.well-known/security.txt, and a filing that reads like one is refused. Ten an hour and forty a day per address.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: false
- title: File an issue on the public tracker
verify_listingFor a tool's vendor: proves a listing is theirs by finding the Anchor badge (/badges/{slug}.svg) or a plain link to the listing (/tools/{slug}) on a page on the listing's own domai…Reads text others writeCan send data out1 finding
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
Findings
- Info
The description mentions "credentials".
What this check looks forMatched text
description: "...es that page once (public addresses, no credentials, redirects only within the domain) and..."
Description, as the server wrote it For a tool's vendor: proves a listing is theirs by finding the Anchor badge (/badges/{slug}.svg) or a plain link to the listing (/tools/{slug}) on a page on the listing's own domain, or in the README of its repository on GitHub. Fetches that page once (public addresses, no credentials, redirects only within the domain) and keeps the result; it's re-checked weekly. Use it only when your user runs the product and has put the link there. It never changes a grade, rank or review. Ten an hour per address and twenty a day per listing.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: false
- title: Verify a listing as its vendor
Only reads 7Show 7 read-only tools
check_serverRead another MCP server's tool list the way you'd meet it and report what should change how you use it: text aimed at the model (tool poisoning), missing or contradictory safety hi…Reads text others writeCan send data out2 findings
Why it is in this group
- The description's first verb is "read": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe input takes a URL (input.url), and the tool reads it: it reads web pages, which anyone can write.
- outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
Claude Code: ask, because it is tagged outbound.
Findings
- Info
The description mentions "credentials".
What this check looks forMatched text
description: "...ow. HTTPS and public addresses only, no credentials, never calls the server's tools; a few..."
- Warn
The description contains "another MCP server", wording about other tools or servers.
What this check looks forMatched text
description: "Read another MCP server's tool list the way you'd meet it and r..."
Description, as the server wrote it Read another MCP server's tool list the way you'd meet it and report what should change how you use it: text aimed at the model (tool poisoning), missing or contradictory safety hints, undocumented parameters, names model APIs reject, and what the list costs in tokens. Use it before adding a server you don't know. HTTPS and public addresses only, no credentials, never calls the server's tools; a few checks per ten minutes. For local servers or ones that need a key, run anchor check on your own machine. What each check looks for: https://www.anchorterminal.com/check
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: true
- title: Check an MCP server before connecting
compare_toolsTwo listings head to head, as on /compare/: what each is good for, the categories each leads, the score per category with the edge, the facts side by side (transport, auth, pricing…Reads private dataNo findings
Why it is in this group
- The name "compare_tools" says "compare": a word for reading.
What it can reach
- private-dataThe description's first sentence says "note": it reads notes.
Description, as the server wrote it Two listings head to head, as on /compare/: what each is good for, the categories each leads, the score per category with the edge, the facts side by side (transport, auth, pricing, x402, tools exposed, latest release), the verdicts and the notes for agents. Pairs that don't do the same job get a short answer saying why. format markdown (default), slim (fewest tokens) or json.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
- title: Compare two listings
get_pricesModel token prices per million (input, output, blended 3:1, context, what each model supports, rate-limit docs), cheapest first, or with unit set (see units in the result) per-call…Reads private dataNo findings
Why it is in this group
- The name "get_prices" says "get": a word for reading.
What it can reach
- private-dataThe description's first sentence says "doc": it reads documents.
Description, as the server wrote it Model token prices per million (input, output, blended 3:1, context, what each model supports, rate-limit docs), cheapest first, or with unit set (see units in the result) per-call prices for tools in the same unit, e.g. 1k-requests.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
- title: Compare prices
get_toolOne listing in full by its slug (from search_tools): connection snippets (Claude Code command, MCP client config, x402 example), auth, prices, provenance checks, the tools its host…No findings
Why it is in this group
- The name "get_tool" says "get": a word for reading.
Description, as the server wrote it One listing in full by its slug (from search_tools): connection snippets (Claude Code command, MCP client config, x402 example), auth, prices, provenance checks, the tools its hosted MCP endpoint lists, dated changes. format json (default), markdown or slim (fewest tokens). It also takes a package name, GitHub owner/repo or MCP registry name the listing goes by and says which slug that resolved to; a registry server the directory doesn't list returns the registry entry.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
- title: Get one listing
list_capabilitiesEvery capability the directory tracks (inference.llm, web.search, web.scrape, data.company, payments.x402, …) with the listings that provide it, best first.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "list_capabilities" says "list": a word for reading.
What it can reach
- private-dataThe description's first sentence says "directory": it reads files.
- untrusted-inputThe description's first sentence says "scrape": it reads web pages, which anyone can write.
Description, as the server wrote it Every capability the directory tracks (inference.llm, web.search, web.scrape, data.company, payments.x402, …) with the listings that provide it, best first. prefix narrows it, e.g. 'web.'.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
- title: Capabilities and the listings for each
read_pageAny page of anchorterminal.com as Markdown, the same text a person reads there: the top list (/top/), a category (/categories/search/), the benchmark's method (/benchmark/), prices…No findings
Why it is in this group
- The name "read_page" says "read": a word for reading.
Description, as the server wrote it Any page of anchorterminal.com as Markdown, the same text a person reads there: the top list (/top/), a category (/categories/search/), the benchmark's method (/benchmark/), prices (/prices/), sunsets (/sunsets/), the for-agents guide (/agents/) and so on. path is the page's path; format markdown (default), slim or json. The site's guide for agents: https://www.anchorterminal.com/agents/
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
- title: Read any page of the site
search_toolsFind tools, APIs, MCP servers, models and data providers for a job.1 finding
Why it is in this group
- The name "search_tools" says "search": a word for reading.
Findings
- Warn
The description contains "other servers", wording about other tools or servers.
What this check looks forMatched text
description: "...and our own checks but no score), then other servers from the official MCP registry. Filters..."
Description, as the server wrote it Find tools, APIs, MCP servers, models and data providers for a job. Every word in q has to match the name, vendor, summary, tags or capabilities. Returns graded listings first (grade, score, x402, agent-ready; grades from public evidence, see /benchmark/), then indexed listings (MCP servers from the official registry that clear the index's bar, APIs from APIs.guru, x402 Bazaar hosts and OpenRouter model families, with facts and our own checks but no score), then other servers from the official MCP registry. Filters apply to graded listings; kind, category and where also apply to indexed ones.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
- title: Search the directory
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Exfil surface
Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.
27 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 3 outbound tools breaks every one.
- Reads private data3
- Reads files, mail, messages, databases, secrets, calendars or repositories.
- Reads text others write3
- Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
- Can send data out3
- Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
{
"permissions": {
"deny": [
"mcp__anchor-terminal__check_server",
"mcp__anchor-terminal__contact",
"mcp__anchor-terminal__verify_listing"
]
}
}Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.
Findings
Matches of fixed checks, with the text they matched.
- Warnsearch_tools
The description contains "other servers", wording about other tools or servers.
What this check looks forMatched text
description: "...and our own checks but no score), then other servers from the official MCP registry. Filters..."
- Warncheck_server
The description contains "another MCP server", wording about other tools or servers.
What this check looks forMatched text
description: "Read another MCP server's tool list the way you'd meet it and r..."
- Infocheck_server
The description mentions "credentials".
What this check looks forMatched text
description: "...ow. HTTPS and public addresses only, no credentials, never calls the server's tools; a few..."
- Infoverify_listing
The description mentions "credentials".
What this check looks forMatched text
description: "...es that page once (public addresses, no credentials, redirects only within the domain) and..."
History
Changes to its tool definitions and to its remote endpoint, newest first.
No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.
Install
Pinned to version 2026.10.31. Values in angle brackets are yours to fill in.
claude mcp add --transport http anchor-terminal https://www.anchorterminal.com/mcpclaude mcp add --transport http anchor-terminal https://www.anchorterminal.com/mcpRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__anchor-terminal__search_tools",
"mcp__anchor-terminal__get_tool",
"mcp__anchor-terminal__compare_tools",
"mcp__anchor-terminal__read_page",
"mcp__anchor-terminal__list_capabilities",
"mcp__anchor-terminal__get_prices"
],
"ask": [
"mcp__anchor-terminal__check_server",
"mcp__anchor-terminal__submit_review",
"mcp__anchor-terminal__file_issue",
"mcp__anchor-terminal__contact",
"mcp__anchor-terminal__verify_listing"
],
"deny": []
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as anchor-terminal. Review it before you use it.
Capability tags behind 6 rules
- mcp__anchor-terminal__compare_tools private-data
- mcp__anchor-terminal__list_capabilities private-data, untrusted-input
- mcp__anchor-terminal__get_prices private-data
- mcp__anchor-terminal__check_server untrusted-input, outbound
- mcp__anchor-terminal__contact outbound
- mcp__anchor-terminal__verify_listing untrusted-input, outbound
Pin
Keep the decision: fail CI when the tools change, follow every change, or show a badge.
Pin in CI
Fail a build when the tools you reviewed are not the tools the server serves today.
curl -s "https://anlyon.dev/api/v1/servers/com.anchorterminal/anchor-terminal/verify?hash=4f7980f7970dfca6f7eb733790be128ee434958cde4ecb3c57b72f023c21ba3f" | jq -e '.changed == false'Pinned hash 4f7980f7970d, from Oct 31, 2026, 21:18 UTC.
Watch
Get told when its tools change: a new tool, a new description, a new class.
https://anlyon.dev/servers/com.anchorterminal/anchor-terminal/changes.xmlAn Atom feed. Works in any feed reader or Slack's RSS app.
Badge
[](https://anlyon.dev/servers/com.anchorterminal/anchor-terminal)Source: MCP Registry. Synced Oct 31, 2026, 21:17 UTC.