Skip to content

API Acre

by apiacre.com · remote · no sign-in to list tools · v0.1.36 · published by com.apiacre

73 x402-paid Base and Solana APIs with free discovery, samples, workflows, and Pixel Acre.

Deletes · 1Final · 3Changes · 36
CompareRegistry entry

73 tools: 1 can delete or cancel things, 3 do something that can't be undone, 36 change things and 33 only read.

Scanned Oct 21, 2026

17 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http api-acre https://apiacre.com/mcp

Findings

Matches of fixed checks, with the text they matched.

16 warn1 info
  • Warnweb.extract

    The server marks "web.extract" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The description's first verb is "convert": a word for a change.

    What this check looks for
  • Warnweb.links

    The server marks "web.links" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "web.links" says "link": a word for a change.

    What this check looks for
  • Warnweb.full-audit

    The server marks "web.full-audit" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The description's first verb is "run": a word for a change.

    What this check looks for
  • Warndata.convert

    The server marks "data.convert" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "data.convert" says "convert": a word for a change.

    What this check looks for
  • Warndata.schema

    The server marks "data.schema" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "create": a word for a change.

    What this check looks for
  • Warndata.deduplicate

    The server marks "data.deduplicate" read-only (readOnlyHint: true), and its own name, description or input give the class "destructive".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "remove": a word for removing or ending something.

    What this check looks for
Show 11 more findings
  • Warndata.deduplicate

    The server marks "data.deduplicate" not destructive (destructiveHint: false), and its own name, description or input give the class "destructive".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "remove": a word for removing or ending something.

    What this check looks for
  • Warndeveloper.code-metrics

    The server marks "developer.code-metrics" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The input takes a statement or command to run (input.code), which can change anything it can reach.

    What this check looks for
  • Warndeveloper.sql-change-review

    The server marks "developer.sql-change-review" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The input takes a statement or command to run (input.sql), which can change anything it can reach.

    What this check looks for
  • Warnresearch.news-aggregate

    The server marks "research.news-aggregate" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The description's first verb is "merge": a word for a change that another call does not undo.

    What this check looks for
  • Warndeveloper.openapi-test-generate

    The server marks "developer.openapi-test-generate" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "developer.openapi-test-generate" says "generate": a word for a change.

    What this check looks for
  • Warndata.ecb-fx-reference

    The server marks "data.ecb-fx-reference" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The description's first verb is "convert": a word for a change.

    What this check looks for
  • Warndata.timezone-convert

    The server marks "data.timezone-convert" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "data.timezone-convert" says "convert": a word for a change.

    What this check looks for
  • Warncrypto.base-usdc-transfers

    The server marks "crypto.base-usdc-transfers" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "crypto.base-usdc-transfers" says "transfer": a word for a change that another call does not undo.

    What this check looks for
  • Warncrypto.base-gas-estimate

    The server marks "crypto.base-gas-estimate" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The input addresses people (input.to): what it sends cannot be taken back.

    What this check looks for
  • Warncrypto.base-contract-read

    The server marks "crypto.base-contract-read" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "crypto.base-contract-read" says "read": a word for reading.

    What this check looks for
  • Infodeveloper.secret-scan

    The description mentions "credential".

    Matched text

    description: "...tokens, private-key headers, JWTs, and credential assignments in caller-supplied source o..."

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

73 tools

Deletes or cancels 1Claude Code: deny
  • data.deduplicateRemove duplicate CSV, TSV, JSON, JSON Lines, or YAML records using selected identity fields and report the removed count.2 findings

    Why it is in this group

    • The description's first verb is "remove": a word for removing or ending something.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    • The server marks it not destructive (destructiveHint: false), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "data.deduplicate" read-only (readOnlyHint: true), and its own name, description or input give the class "destructive".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "remove": a word for removing or ending something.

      What this check looks for
    • Warn

      The server marks "data.deduplicate" not destructive (destructiveHint: false), and its own name, description or input give the class "destructive".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "remove": a word for removing or ending something.

      What this check looks for
    Description, as the server wrote it
    Remove duplicate CSV, TSV, JSON, JSON Lines, or YAML records using selected identity fields and report the removed count.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
Can't be undone 3Claude Code: ask
  • crypto.base-gas-estimateEstimate gas for one Base mainnet transaction context at a resolved block, add a bounded caller-selected buffer, and preserve RPC rejection evidence without signing or broadcasting…Reads text others writeCan send data out1 finding

    Why it is in this group

    • The input addresses people (input.to): what it sends cannot be taken back.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a destination (input.to): what the tool writes goes there.

    Findings

    • Warn

      The server marks "crypto.base-gas-estimate" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The input addresses people (input.to): what it sends cannot be taken back.

      What this check looks for
    Description, as the server wrote it
    Estimate gas for one Base mainnet transaction context at a resolved block, add a bounded caller-selected buffer, and preserve RPC rejection evidence without signing or broadcasting.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • crypto.base-usdc-transfersRetrieve newest-first incoming and outgoing Circle USDC Transfer events for one address across a validated, bounded Base mainnet block range.Reads text others write1 finding

    Why it is in this group

    • The name "crypto.base-usdc-transfers" says "transfer": a word for a change that another call does not undo.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "crypto.base-usdc-transfers" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "crypto.base-usdc-transfers" says "transfer": a word for a change that another call does not undo.

      What this check looks for
    Description, as the server wrote it
    Retrieve newest-first incoming and outgoing Circle USDC Transfer events for one address across a validated, bounded Base mainnet block range.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • research.news-aggregateMerge two to eight public RSS or Atom feeds into a filtered, deduplicated, time-ordered news stream with bounded partial-failure reporting.Reads text others write1 finding

    Why it is in this group

    • The description's first verb is "merge": a word for a change that another call does not undo.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "research.news-aggregate" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The description's first verb is "merge": a word for a change that another call does not undo.

      What this check looks for
    Description, as the server wrote it
    Merge two to eight public RSS or Atom feeds into a filtered, deduplicated, time-ordered news stream with bounded partial-failure reporting.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
Changes things 36Claude Code: ask
  • commerce.product-pricePaste one public retailer product URL to get its current publisher-supplied structured price, currency, availability, seller, shipping terms, aggregate rating, variant attributes, …Reads text others writeCan send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Paste one public retailer product URL to get its current publisher-supplied structured price, currency, availability, seller, shipping terms, aggregate rating, variant attributes, identifiers, observation time, and evidence hashes from Schema.org JSON-LD, Schema.org microdata, or paired product meta tags; optionally compare the selected offer with a buyer-supplied maximum. Fetching proceeds only when robots.txt permits it, without JavaScript, login, cookies, or anti-bot bypass.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • crypto.base-contract-readExecute one bounded read-only eth_call against a resolved Base mainnet block, retain call and block evidence, and optionally decode caller-specified ABI output types.Reads text others write1 finding

    Why it is in this group

    • The name "crypto.base-contract-read" says "read": a word for reading.
    • The description's first verb is "execute": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "crypto.base-contract-read" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "crypto.base-contract-read" says "read": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Execute one bounded read-only eth_call against a resolved Base mainnet block, retain call and block evidence, and optionally decode caller-specified ABI output types.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • data.cleanClean CSV, TSV, JSON, JSON Lines, or YAML records with collision-safe header normalization, deterministic integrity hashes, and exact transformation counts.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Clean CSV, TSV, JSON, JSON Lines, or YAML records with collision-safe header normalization, deterministic integrity hashes, and exact transformation counts.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • data.contractNormalize caller-supplied CSV, TSV, JSON, JSON Lines, or YAML to deterministic JSON, infer a Draft 2020-12 schema from that normalized value, and validate one future JSON value in …No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Normalize caller-supplied CSV, TSV, JSON, JSON Lines, or YAML to deterministic JSON, infer a Draft 2020-12 schema from that normalized value, and validate one future JSON value in a single x402 call.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • data.convertConvert caller-supplied CSV, TSV, JSON, JSON Lines (NDJSON), or YAML with optional root preservation, deterministic integrity hashes, JSON-encoded nested tabular cells, and explici…1 finding

    Why it is in this group

    • The name "data.convert" says "convert": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "data.convert" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "data.convert" says "convert": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Convert caller-supplied CSV, TSV, JSON, JSON Lines (NDJSON), or YAML with optional root preservation, deterministic integrity hashes, JSON-encoded nested tabular cells, and explicit rejection of ambiguous duplicate keys or non-finite numbers.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • data.ecb-fx-referenceConvert an amount between two supported currencies using one validated ECB daily reference-rate observation.Reads text others write1 finding

    Why it is in this group

    • The description's first verb is "convert": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "data.ecb-fx-reference" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The description's first verb is "convert": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Convert an amount between two supported currencies using one validated ECB daily reference-rate observation. The underlying ECB statistics are available free from the ECB Data Portal; the fee covers bounded retrieval, validation, clearly labelled cross-rate calculation, and x402 delivery.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • data.json-repairRepair caller-supplied malformed JSON by safely removing an outer Markdown fence, comments, single-quoted strings, unquoted identifier keys, Python literals, and trailing commas, w…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Repair caller-supplied malformed JSON by safely removing an outer Markdown fence, comments, single-quoted strings, unquoted identifier keys, Python literals, and trailing commas, with transformation hashes and strict rejection of duplicate keys or non-finite numbers.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • data.profileProfile CSV, TSV, JSON, JSON Lines, or YAML records for field types, nulls, uniqueness, and representative samples.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Profile CSV, TSV, JSON, JSON Lines, or YAML records for field types, nulls, uniqueness, and representative samples.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • data.schemaCreate and generate a nested JSON Schema Draft 2020-12 contract by inferring field types and required fields from representative JSON, CSV, TSV, JSON Lines, or YAML records, with e…1 finding

    Why it is in this group

    • The description's first verb is "create": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "data.schema" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "create": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Create and generate a nested JSON Schema Draft 2020-12 contract by inferring field types and required fields from representative JSON, CSV, TSV, JSON Lines, or YAML records, with equivalent CSV/TSV numeric and null inference, input evidence, and non-enforcing observed bounds.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • data.schemaorg-normalizeNormalize caller-supplied inline Schema.org JSON-LD into deterministic Organization, Product, Service, Article, and Event entities with privacy scrubbing and field-level evidence h…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Normalize caller-supplied inline Schema.org JSON-LD into deterministic Organization, Product, Service, Article, and Event entities with privacy scrubbing and field-level evidence hashes.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • data.timezone-convertConvert an offset-aware ISO 8601 instant or a local wall time between IANA time zones with explicit DST gap and repeated-hour handling, nearby transition evidence, and a pinned loc…1 finding

    Why it is in this group

    • The name "data.timezone-convert" says "convert": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "data.timezone-convert" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "data.timezone-convert" says "convert": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Convert an offset-aware ISO 8601 instant or a local wall time between IANA time zones with explicit DST gap and repeated-hour handling, nearby transition evidence, and a pinned local time-zone database.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • data.us-address-geocodeGeocode one structural address in the United States, Puerto Rico, or U.S.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Geocode one structural address in the United States, Puerto Rico, or U.S. Island Areas with normalized U.S. Census MAF/TIGER coordinates, optional bounded state/county/tract/block/congressional geography, exact source attribution, and explicit range-interpolation limits.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • data.vin-decodeDecode a full 17-character VIN into normalized NHTSA vPIC make, model, year, body, engine, transmission, plant, fuel, and occupancy fields with official source evidence and explici…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Decode a full 17-character VIN into normalized NHTSA vPIC make, model, year, body, engine, transmission, plant, fuel, and occupancy fields with official source evidence and explicit missing-data semantics.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • developer.code-metricsMeasure caller-supplied source code with Python AST analysis or a deterministic lexical fallback, including per-function complexity, a SHA-256 fingerprint, density ratios, syntax s…1 finding

    Why it is in this group

    • The input takes a statement or command to run (input.code), which can change anything it can reach.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "developer.code-metrics" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The input takes a statement or command to run (input.code), which can change anything it can reach.

      What this check looks for
    Description, as the server wrote it
    Measure caller-supplied source code with Python AST analysis or a deterministic lexical fallback, including per-function complexity, a SHA-256 fingerprint, density ratios, syntax status, and actionable maintainability signals without retaining or forwarding the code. One bounded no-wallet trial is available through the separate HTTP endpoint https://apiacre.com/trials/developer.code-metrics; this MCP tools/call operation remains paid.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • developer.dependency-auditAudit exact Python/PyPI, npm, Go, Maven, NuGet, crates.io, or RubyGems dependencies against OSV and return affected packages and vulnerabilities.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Audit exact Python/PyPI, npm, Go, Maven, NuGet, crates.io, or RubyGems dependencies against OSV and return affected packages and vulnerabilities.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • developer.license-auditClassify software dependency licenses and flag packages that need commercial or legal review.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Classify software dependency licenses and flag packages that need commercial or legal review.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • developer.openapi-test-generateGenerate deterministic, syntax-validated pytest and requests smoke tests from a caller-supplied OpenAPI 3 document, with mutating operations disabled by default.1 finding

    Why it is in this group

    • The name "developer.openapi-test-generate" says "generate": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "developer.openapi-test-generate" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "developer.openapi-test-generate" says "generate": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Generate deterministic, syntax-validated pytest and requests smoke tests from a caller-supplied OpenAPI 3 document, with mutating operations disabled by default.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • developer.secret-scanDetect likely leaked API keys, tokens, private-key headers, JWTs, and credential assignments in caller-supplied source or configuration text.1 finding

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Info

      The description mentions "credential".

      Matched text

      description: "...tokens, private-key headers, JWTs, and credential assignments in caller-supplied source o..."

      What this check looks for
    Description, as the server wrote it
    Detect likely leaked API keys, tokens, private-key headers, JWTs, and credential assignments in caller-supplied source or configuration text. Return type, line, fingerprint, and a fully redacted preview with no network access or code execution.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • developer.sql-change-reviewStatically parse caller-supplied SQL without a database connection or execution, inventory statements and tables, and flag destructive DDL, unfiltered writes, and migration atomici…1 finding

    Why it is in this group

    • The input takes a statement or command to run (input.sql), which can change anything it can reach.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "developer.sql-change-review" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The input takes a statement or command to run (input.sql), which can change anything it can reach.

      What this check looks for
    Description, as the server wrote it
    Statically parse caller-supplied SQL without a database connection or execution, inventory statements and tables, and flag destructive DDL, unfiltered writes, and migration atomicity concerns.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • developer.x402-preflightProbe a public endpoint without paying, grade its x402 v2 challenge, check exact-host x402-list presence and traction, and optionally rank licensed market matches with buyer-concen…Reads text others writeCan send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Probe a public endpoint without paying, grade its x402 v2 challenge, check exact-host x402-list presence and traction, and optionally rank licensed market matches with buyer-concentration caveats.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • document.extractExtract clean text and metadata from supplied PDF, DOCX, HTML, Markdown, CSV, JSON, YAML, or plain-text documents.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Extract clean text and metadata from supplied PDF, DOCX, HTML, Markdown, CSV, JSON, YAML, or plain-text documents.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • document.redactDeterministically detect and redact PII and personal data in supplied text with overlap-safe matching for emails, phone numbers, validated IPv4 and IPv6 addresses, Luhn-valid payme…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Deterministically detect and redact PII and personal data in supplied text with overlap-safe matching for emails, phone numbers, validated IPv4 and IPv6 addresses, Luhn-valid payment cards, valid-checksum IBANs, and structurally valid US Social Security numbers.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • document.tablesExtract structured table rows and columns from supplied HTML, DOCX, or CSV documents.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Extract structured table rows and columns from supplied HTML, DOCX, or CSV documents.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • research.sec-filing-signalsLook up a public company by ticker or CIK, normalize recent SEC filings, and flag deterministic events such as late filings, amendments, auditor changes, non-reliance, control chan…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Look up a public company by ticker or CIK, normalize recent SEC filings, and flag deterministic events such as late filings, amendments, auditor changes, non-reliance, control changes, or bankruptcy disclosures.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • web.accessibility-auditCheck a public page for deterministic HTML accessibility problems and return actionable WCAG-oriented findings.Reads text others writeCan send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Check a public page for deterministic HTML accessibility problems and return actionable WCAG-oriented findings.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • web.business-due-diligenceAssess one public business website and domain using site quality, SEO, security, accessibility, performance, DNS, TLS, RDAP, and optional public GLEIF candidates; return technical …Reads text others writeCan send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Assess one public business website and domain using site quality, SEO, security, accessibility, performance, DNS, TLS, RDAP, and optional public GLEIF candidates; return technical evidence and explicit identity, ownership, compliance, and vendor-approval limitations.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • web.domain-intelligenceInvestigate a domain using parallel DNS, TLS certificate, RDAP (the standards-based successor to WHOIS), DNSSEC, SPF, and DMARC signals with factual findings and source provenance.Reads text others writeCan send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Investigate a domain using parallel DNS, TLS certificate, RDAP (the standards-based successor to WHOIS), DNSSEC, SPF, and DMARC signals with factual findings and source provenance.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • web.email-authCheck a public domain's email authentication and anti-spoofing posture using MX, SPF, DMARC, caller-selected DKIM, MTA-STS, TLS-RPT, and BIMI DNS evidence.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Check a public domain's email authentication and anti-spoofing posture using MX, SPF, DMARC, caller-selected DKIM, MTA-STS, TLS-RPT, and BIMI DNS evidence.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • web.extractConvert and extract a public website URL into clean Markdown or readable text plus bounded structured links, canonical and heading signals, Schema.org types, redirect evidence, con…Reads text others writeCan send data out1 finding

    Why it is in this group

    • The description's first verb is "convert": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.

    Findings

    • Warn

      The server marks "web.extract" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The description's first verb is "convert": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Convert and extract a public website URL into clean Markdown or readable text plus bounded structured links, canonical and heading signals, Schema.org types, redirect evidence, content hashes, and response provenance for RAG, research, or agent context.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • web.full-auditRun a comprehensive website audit combining SEO, security, accessibility, and performance scores with prioritized fixes.Reads text others writeCan send data out1 finding

    Why it is in this group

    • The description's first verb is "run": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.

    Findings

    • Warn

      The server marks "web.full-audit" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The description's first verb is "run": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Run a comprehensive website audit combining SEO, security, accessibility, and performance scores with prioritized fixes.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • web.metadataExtract webpage metadata from one public URL: page title, meta description, canonical URL, headings, hreflang, icons, feeds, Open Graph, Twitter Cards, and JSON-LD Schema.org types…Reads text others writeCan send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Extract webpage metadata from one public URL: page title, meta description, canonical URL, headings, hreflang, icons, feeds, Open Graph, Twitter Cards, and JSON-LD Schema.org types, with redirect and response provenance plus privacy-safe, publisher-asserted Organization facts with field evidence.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • web.performance-profileMeasure website response latency, payload size, compression, caching, and performance signals for a public URL.Reads text others writeCan send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Measure website response latency, payload size, compression, caching, and performance signals for a public URL.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • web.security-auditScan a public website for TLS and browser security header weaknesses and return a security score with fixes.Reads text others writeCan send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Scan a public website for TLS and browser security header weaknesses and return a security score with fixes.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • web.seo-auditAudit one public URL for title, meta description, H1 count, image alt text, canonical, robots, language, Open Graph, Twitter cards, headings, hreflang, feeds, and Schema.org data; …Reads text others writeCan send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Audit one public URL for title, meta description, H1 count, image alt text, canonical, robots, language, Open Graph, Twitter cards, headings, hreflang, feeds, and Schema.org data; return a deterministic score and prioritized issue codes.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • web.tech-fingerprintIdentify frameworks, analytics, CDNs, servers, and other website technologies from public response signals.Reads text others writeCan send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Identify frameworks, analytics, CDNs, servers, and other website technologies from public response signals.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
Only reads 33Claude Code: allow, ask for 2 outbound
  • crypto.address-inspectValidate and normalize an Ethereum or EVM wallet address, distinguish valid, absent, or invalid ERC-55 checksum casing, and identify the zero address without a network request.No findings

    Why it is in this group

    • The name "crypto.address-inspect" says "inspect": a word for reading.
    Description, as the server wrote it
    Validate and normalize an Ethereum or EVM wallet address, distinguish valid, absent, or invalid ERC-55 checksum casing, and identify the zero address without a network request.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • crypto.base-account-snapshotRead point-in-time ETH, native USDC, and up to four caller-selected ERC-20 balances plus account nonce and contract-code status at one resolved Base mainnet block.Reads text others writeNo findings

    Why it is in this group

    • The name "crypto.base-account-snapshot" says "snapshot": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Read point-in-time ETH, native USDC, and up to four caller-selected ERC-20 balances plus account nonce and contract-code status at one resolved Base mainnet block.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • crypto.base-account-statusCheck one Base mainnet wallet or contract for ETH and official USDC balances, transaction nonce, and contract-bytecode evidence at a single resolved block.Reads text others writeNo findings

    Why it is in this group

    • The name "crypto.base-account-status" says "status": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Check one Base mainnet wallet or contract for ETH and official USDC balances, transaction nonce, and contract-bytecode evidence at a single resolved block.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • crypto.base-block-inspectGet and inspect one historical Base mainnet block by exact number or a latest, safe, or finalized tag, returning its header timestamp, transaction count, gas use, base and blob fee…Reads text others writeNo findings

    Why it is in this group

    • The name "crypto.base-block-inspect" says "inspect": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Get and inspect one historical Base mainnet block by exact number or a latest, safe, or finalized tag, returning its header timestamp, transaction count, gas use, base and blob fees, state and receipt roots, confirmations, and head-distance evidence.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • crypto.base-contract-inspectInspect Base mainnet contract bytecode, common token metadata, and ERC-165, ERC-721, and ERC-1155 interface signals at one resolved block.Reads text others writeNo findings

    Why it is in this group

    • The name "crypto.base-contract-inspect" says "inspect": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Inspect Base mainnet contract bytecode, common token metadata, and ERC-165, ERC-721, and ERC-1155 interface signals at one resolved block.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • crypto.base-event-logsQuery validated eth_getLogs events from one Base mainnet contract using a required event signature and optional indexed topic filters across a bounded resolved block range.Reads text others writeNo findings

    Why it is in this group

    • The name "crypto.base-event-logs" says "log": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Query validated eth_getLogs events from one Base mainnet contract using a required event signature and optional indexed topic filters across a bounded resolved block range.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • crypto.base-network-statusRead the latest Base mainnet block and a bounded EIP-1559 fee history in one RPC batch, including gas utilization and priority-fee percentile samples.Reads text others writeNo findings

    Why it is in this group

    • The name "crypto.base-network-status" says "status": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Read the latest Base mainnet block and a bounded EIP-1559 fee history in one RPC batch, including gas utilization and priority-fee percentile samples.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • crypto.base-transaction-inspectInspect Base transaction status and receipt evidence in one call, including success, revert, or pending state, confirmations, actual gas fee, recognized calldata, bounded ERC-20-sh…Reads text others writeNo findings

    Why it is in this group

    • The name "crypto.base-transaction-inspect" says "inspect": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Inspect Base transaction status and receipt evidence in one call, including success, revert, or pending state, confirmations, actual gas fee, recognized calldata, bounded ERC-20-shaped transfers, and official Base USDC recognition for payment confirmation.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • crypto.calldata-decodeResolve 29 common ERC-20, ERC-165, ERC-721, ERC-1155, ERC-2612, and ERC-3009 selectors without a network lookup, or strictly decode arbitrary Ethereum or EVM calldata using a suppl…No findings

    Why it is in this group

    • The description's first verb is "resolve": a word for reading.
    Description, as the server wrote it
    Resolve 29 common ERC-20, ERC-165, ERC-721, ERC-1155, ERC-2612, and ERC-3009 selectors without a network lookup, or strictly decode arbitrary Ethereum or EVM calldata using a supplied Solidity signature.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • crypto.typed-data-hashValidate EIP-712 typed structured data and derive its domain separator, message hash, and signing digest.No findings

    Why it is in this group

    • The description's first verb is "validate": a word for reading.
    Description, as the server wrote it
    Validate EIP-712 typed structured data and derive its domain separator, message hash, and signing digest.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • data.current-weatherGet one current weather snapshot for a city/locality name or exact coordinates.Reads text others writeNo findings

    Why it is in this group

    • The description's first verb is "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Get one current weather snapshot for a city/locality name or exact coordinates. Returns the nearest NOAA/NWS station observation where available; otherwise returns the latest MET Norway model point, always labeled explicitly as observation or model with bounded SI fields and source provenance.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • data.place-geocodeResolve one global city or locality name into bounded, population-ranked GeoNames coordinates, country and first-level-region identity, population, timezone, feature code, and sour…No findings

    Why it is in this group

    • The description's first verb is "resolve": a word for reading.
    Description, as the server wrote it
    Resolve one global city or locality name into bounded, population-ranked GeoNames coordinates, country and first-level-region identity, population, timezone, feature code, and source freshness without a request-time network call.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • data.reverse-geocodeResolve one latitude/longitude pair into bounded, great-circle-distance-ranked nearby GeoNames populated places with country, first-level region, population, timezone, feature code…No findings

    Why it is in this group

    • The description's first verb is "resolve": a word for reading.
    Description, as the server wrote it
    Resolve one latitude/longitude pair into bounded, great-circle-distance-ranked nearby GeoNames populated places with country, first-level region, population, timezone, feature code, and source freshness without a request-time network call.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • data.schema-validateValidate JSON data against a bounded JSON Schema Draft 2020-12 contract for nested objects, arrays, required properties, types, enums, formats, lengths, patterns, and numeric bound…No findings

    Why it is in this group

    • The name "data.schema-validate" says "validate": a word for reading.
    Description, as the server wrote it
    Validate JSON data against a bounded JSON Schema Draft 2020-12 contract for nested objects, arrays, required properties, types, enums, formats, lengths, patterns, and numeric bounds; return deterministic instance and schema JSON Pointers, explicit error truncation, input hashes, and no remote reference resolution.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • data.us-weather-forecastGet a global weather forecast for a city/locality name or exact coordinates.Reads text others writeNo findings

    Why it is in this group

    • The description's first verb is "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Get a global weather forecast for a city/locality name or exact coordinates. Returns normalized day/night or hourly periods worldwide: NOAA/NWS is preferred within supported U.S. coverage for optional station conditions and active alerts, while MET Norway provides an attributed open-data fallback globally.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • data.worldbank-snapshotBundle six official World Development Indicators into one normalized country snapshot with latest and previous GDP, growth, population, inflation, unemployment, and life-expectancy…Reads text others writeNo findings

    Why it is in this group

    • The name "data.worldbank-snapshot" says "snapshot": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Bundle six official World Development Indicators into one normalized country snapshot with latest and previous GDP, growth, population, inflation, unemployment, and life-expectancy observations plus source and license evidence.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • developer.code-change-reviewCompare caller-supplied before and after source snapshots without execution or network access, returning source fingerprints, syntax regressions, structural deltas, function-level …Reads text others writeNo findings

    Why it is in this group

    • The description's first verb is "compare": a word for reading.

    What it can reach

    • untrusted-inputThe name "developer.code-change-review" says "review": it reads comments, which other people can write.
    • untrusted-inputThe description's first sentence says "compare" and "review": it reads comments, which other people can write.
    Description, as the server wrote it
    Compare caller-supplied before and after source snapshots without execution or network access, returning source fingerprints, syntax regressions, structural deltas, function-level changes, and bounded review findings.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • developer.openapi-auditValidate and audit an OpenAPI document for missing operation IDs, descriptions, responses, and consistency problems.No findings

    Why it is in this group

    • The description's first verb is "validate": a word for reading.
    Description, as the server wrote it
    Validate and audit an OpenAPI document for missing operation IDs, descriptions, responses, and consistency problems.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • developer.structured-diffCompare JSON or YAML deterministically and return source hashes plus machine-readable additions, removals, and replacements by path with explicit truncation evidence.No findings

    Why it is in this group

    • The name "developer.structured-diff" says "diff": a word for reading.
    Description, as the server wrote it
    Compare JSON or YAML deterministically and return source hashes plus machine-readable additions, removals, and replacements by path with explicit truncation evidence.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • document.diffCompare two texts and return structured line additions, removals, and a unified diff.Reads private dataNo findings

    Why it is in this group

    • The name "document.diff" says "diff": a word for reading.

    What it can reach

    • private-dataThe name "document.diff" says "diff" and "document": it reads documents.
    Description, as the server wrote it
    Compare two texts and return structured line additions, removals, and a unified diff.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • research.crossref-doi-metadataResolve one DOI into normalized open Crossref bibliographic, author, container, citation-count, license, identifier, and correction or retraction-link metadata without abstracts or…Reads text others writeNo findings

    Why it is in this group

    • The description's first verb is "resolve": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Resolve one DOI into normalized open Crossref bibliographic, author, container, citation-count, license, identifier, and correction or retraction-link metadata without abstracts or full text.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • research.feed-normalizeFetch and normalize public RSS or Atom feeds into stable structured JSON entries for agents and research workflows.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The description's first verb is "fetch": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe description's first sentence says "fetch" and "rss": it reads web pages, which anyone can write.
    • untrusted-inputThe input takes a URL (input.url), and the tool reads it: it reads web pages, which anyone can write.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.

    Claude Code: ask, because it is tagged outbound.

    Description, as the server wrote it
    Fetch and normalize public RSS or Atom feeds into stable structured JSON entries for agents and research workflows.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • research.organization-evidenceRetrieve a current supplier and organization evidence report from official GLEIF legal-entity, USAspending prime-contract, SEC filing-activity, and OFAC Entity records, with bounde…Reads text others writeNo findings

    Why it is in this group

    • The description's first verb is "retrieve": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Retrieve a current supplier and organization evidence report from official GLEIF legal-entity, USAspending prime-contract, SEC filing-activity, and OFAC Entity records, with bounded source-specific coverage for procurement research and no identity, linkage, risk, or compliance verdict.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • research.sec-company-evidenceResolve an exact SEC company name, ticker, or CIK, then bundle recent filing signals, normalized issuer-reported XBRL facts, and Form 4 insider transactions into one bounded public…Reads text others writeNo findings

    Why it is in this group

    • The description's first verb is "resolve": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Resolve an exact SEC company name, ticker, or CIK, then bundle recent filing signals, normalized issuer-reported XBRL facts, and Form 4 insider transactions into one bounded public-company evidence report with explicit section coverage and official-source provenance.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • research.sec-financial-factsRetrieve normalized, recent issuer-reported revenue, earnings, balance-sheet, cash-flow, and diluted-EPS facts from official SEC XBRL data.Reads text others writeNo findings

    Why it is in this group

    • The description's first verb is "retrieve": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Retrieve normalized, recent issuer-reported revenue, earnings, balance-sheet, cash-flow, and diluted-EPS facts from official SEC XBRL data.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • research.sec-insider-transactionsRetrieve recent SEC Form 4 officer, director, and 10% beneficial-owner trades for a ticker or CIK, including purchases, sales, awards, exercises, tax withholding, prices, holdings,…Reads text others writeNo findings

    Why it is in this group

    • The description's first verb is "retrieve": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Retrieve recent SEC Form 4 officer, director, and 10% beneficial-owner trades for a ticker or CIK, including purchases, sales, awards, exercises, tax withholding, prices, holdings, 10b5-1 context, derivatives, and filing footnotes.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • web.robots-sitemapInspect a domain's robots.txt crawl rules and XML sitemap health, availability, and URL count.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The description's first verb is "inspect": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe name "web.robots-sitemap" says "web": it reads web pages, which anyone can write.
    • untrusted-inputThe description's first sentence says "crawl": it reads web pages, which anyone can write.
    • untrusted-inputThe input takes a URL (input.url), and the tool reads it: it reads web pages, which anyone can write.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.

    Claude Code: ask, because it is tagged outbound.

    Description, as the server wrote it
    Inspect a domain's robots.txt crawl rules and XML sitemap health, availability, and URL count.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

1504 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 2 private-data tools breaks every one.

Reads private data2
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write47
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out16
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
deny to break every path
{
  "permissions": {
    "deny": [
      "mcp__api-acre__document_diff",
      "mcp__api-acre__research_ofac-entity-search"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Looked at Oct 22, 2026, 14:27 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable
yes
HTTP status of an anonymous initialize
200
tools/list served without credentials
yes
Tools that change things, listed without credentials
40
Protocol version
2025-06-18
WWW-Authenticate on 401
not observed
resource_metadata in WWW-Authenticate
none
RFC 9728 protected resource metadata
none
Authorization servers
none
Legacy HTTP+SSE transport
no
Dynamic client registration
not observed
Client ID metadata documents
not observed
  • HighThe whole server

    The endpoint served tools/list without credentials, and the list has 40 tools that change things (1 destructive, 3 irreversible, 36 write). Whether a call also works without credentials was not tested: tools are never called.

    Matched text

    https://apiacre.com/mcp: tools/list returned 73 tools to an anonymous client, including data.deduplicate (destructive), research.news-aggregate (irreversible), crypto.base-usdc-transfers (irreversible), crypto.base-gas-estimate (irreversible), web.extract (write) and 35 more

    What this check looks for

Install

Pinned to version 0.1.36. Values in angle brackets are yours to fill in.

claude mcp add --transport http api-acre https://apiacre.com/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__api-acre__research_lei-entity-search",
      "mcp__api-acre__document_diff",
      "mcp__api-acre__data_schema-validate",
      "mcp__api-acre__developer_openapi-audit",
      "mcp__api-acre__developer_code-change-review",
      "mcp__api-acre__developer_structured-diff",
      "mcp__api-acre__research_us-contract-search",
      "mcp__api-acre__research_federal-register-search",
      "mcp__api-acre__research_ofac-entity-search",
      "mcp__api-acre__research_organization-evidence",
      "mcp__api-acre__data_worldbank-snapshot",
      "mcp__api-acre__research_sec-insider-transactions",
      "mcp__api-acre__research_sec-financial-facts",
      "mcp__api-acre__research_sec-company-evidence",
      "mcp__api-acre__research_crossref-work-search",
      "mcp__api-acre__research_crossref-doi-metadata",
      "mcp__api-acre__research_wikidata-organization-search",
      "mcp__api-acre__data_place-geocode",
      "mcp__api-acre__data_reverse-geocode",
      "mcp__api-acre__data_current-weather",
      "mcp__api-acre__data_us-weather-forecast",
      "mcp__api-acre__crypto_address-inspect",
      "mcp__api-acre__crypto_base-account-snapshot",
      "mcp__api-acre__crypto_base-account-status",
      "mcp__api-acre__crypto_base-event-logs",
      "mcp__api-acre__crypto_base-network-status",
      "mcp__api-acre__crypto_base-block-inspect",
      "mcp__api-acre__crypto_base-contract-inspect",
      "mcp__api-acre__crypto_base-transaction-inspect",
      "mcp__api-acre__crypto_calldata-decode",
      "mcp__api-acre__crypto_typed-data-hash"
    ],
    "ask": [
      "mcp__api-acre__web_extract",
      "mcp__api-acre__web_metadata",
      "mcp__api-acre__web_seo-audit",
      "mcp__api-acre__web_security-audit",
      "mcp__api-acre__web_accessibility-audit",
      "mcp__api-acre__web_performance-profile",
      "mcp__api-acre__web_links",
      "mcp__api-acre__web_robots-sitemap",
      "mcp__api-acre__web_tech-fingerprint",
      "mcp__api-acre__web_email-auth",
      "mcp__api-acre__web_domain-intelligence",
      "mcp__api-acre__web_full-audit",
      "mcp__api-acre__web_business-due-diligence",
      "mcp__api-acre__commerce_product-price",
      "mcp__api-acre__document_extract",
      "mcp__api-acre__document_tables",
      "mcp__api-acre__document_redact",
      "mcp__api-acre__data_profile",
      "mcp__api-acre__data_clean",
      "mcp__api-acre__data_convert",
      "mcp__api-acre__data_json-repair",
      "mcp__api-acre__data_schema",
      "mcp__api-acre__data_contract",
      "mcp__api-acre__data_schemaorg-normalize",
      "mcp__api-acre__developer_x402-preflight",
      "mcp__api-acre__developer_dependency-audit",
      "mcp__api-acre__developer_license-audit",
      "mcp__api-acre__developer_secret-scan",
      "mcp__api-acre__developer_code-metrics",
      "mcp__api-acre__developer_sql-change-review",
      "mcp__api-acre__research_feed-normalize",
      "mcp__api-acre__research_news-aggregate",
      "mcp__api-acre__developer_openapi-test-generate",
      "mcp__api-acre__data_vin-decode",
      "mcp__api-acre__research_sec-filing-signals",
      "mcp__api-acre__data_ecb-fx-reference",
      "mcp__api-acre__data_us-address-geocode",
      "mcp__api-acre__data_timezone-convert",
      "mcp__api-acre__crypto_base-usdc-transfers",
      "mcp__api-acre__crypto_base-gas-estimate",
      "mcp__api-acre__crypto_base-contract-read"
    ],
    "deny": [
      "mcp__api-acre__data_deduplicate"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as api-acre. Review it before you use it.

Capability tags behind 48 rules
  • mcp__api-acre__web_extract untrusted-input, outbound
  • mcp__api-acre__web_metadata untrusted-input, outbound
  • mcp__api-acre__web_seo-audit untrusted-input, outbound
  • mcp__api-acre__web_security-audit untrusted-input, outbound
  • mcp__api-acre__web_accessibility-audit untrusted-input, outbound
  • mcp__api-acre__web_performance-profile untrusted-input, outbound
  • mcp__api-acre__web_links untrusted-input, outbound
  • mcp__api-acre__web_robots-sitemap untrusted-input, outbound
  • mcp__api-acre__web_tech-fingerprint untrusted-input, outbound
  • mcp__api-acre__web_email-auth untrusted-input
  • mcp__api-acre__web_domain-intelligence untrusted-input, outbound
  • mcp__api-acre__web_full-audit untrusted-input, outbound
  • mcp__api-acre__web_business-due-diligence untrusted-input, outbound
  • mcp__api-acre__commerce_product-price untrusted-input, outbound
  • mcp__api-acre__research_lei-entity-search untrusted-input
  • mcp__api-acre__document_diff private-data
  • mcp__api-acre__developer_x402-preflight untrusted-input, outbound
  • mcp__api-acre__developer_dependency-audit untrusted-input
  • mcp__api-acre__developer_code-change-review untrusted-input
  • mcp__api-acre__research_feed-normalize untrusted-input, outbound
  • mcp__api-acre__research_news-aggregate untrusted-input
  • mcp__api-acre__research_us-contract-search untrusted-input
  • mcp__api-acre__research_federal-register-search untrusted-input
  • mcp__api-acre__research_ofac-entity-search private-data, untrusted-input
  • mcp__api-acre__research_organization-evidence untrusted-input
  • mcp__api-acre__data_vin-decode untrusted-input
  • mcp__api-acre__data_worldbank-snapshot untrusted-input
  • mcp__api-acre__research_sec-filing-signals untrusted-input
  • mcp__api-acre__research_sec-insider-transactions untrusted-input
  • mcp__api-acre__research_sec-financial-facts untrusted-input
  • mcp__api-acre__research_sec-company-evidence untrusted-input
  • mcp__api-acre__research_crossref-work-search untrusted-input
  • mcp__api-acre__research_crossref-doi-metadata untrusted-input
  • mcp__api-acre__research_wikidata-organization-search untrusted-input
  • mcp__api-acre__data_ecb-fx-reference untrusted-input
  • mcp__api-acre__data_us-address-geocode untrusted-input
  • mcp__api-acre__data_current-weather untrusted-input
  • mcp__api-acre__data_us-weather-forecast untrusted-input
  • mcp__api-acre__crypto_base-account-snapshot untrusted-input
  • mcp__api-acre__crypto_base-account-status untrusted-input
  • mcp__api-acre__crypto_base-usdc-transfers untrusted-input
  • mcp__api-acre__crypto_base-event-logs untrusted-input
  • mcp__api-acre__crypto_base-gas-estimate untrusted-input, outbound
  • mcp__api-acre__crypto_base-network-status untrusted-input
  • mcp__api-acre__crypto_base-block-inspect untrusted-input
  • mcp__api-acre__crypto_base-contract-inspect untrusted-input
  • mcp__api-acre__crypto_base-contract-read untrusted-input
  • mcp__api-acre__crypto_base-transaction-inspect untrusted-input