Skip to content

com.bagsthatpay/site

by bagsthatpay.com · remote · no sign-in to list tools · v1.0.1 · published by com.bagsthatpay

Bags That Pay: the site's own MCP server — dataset, enquiry, entities, listing (enquiry = a...

Final · 4Changes · 19
CompareRegistry entry

32 tools: 4 do something that can't be undone, 19 change things and 9 only read.

Scanned Oct 21, 2026

No check matched anything in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http site https://bagsthatpay.com/mcp

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

32 tools

Can't be undone 4Claude Code: ask
  • listing_pay_cardReturns a Stripe Checkout URL at the site's price.No findings

    Why it is in this group

    • The name "listing_pay_card" says "pay": a word that usually means money moves, which cannot be taken back.
    Description, as the server wrote it
    Returns a Stripe Checkout URL at the site's price. A human completes it in a browser; the site learns of payment from Stripe's verified event, never from the browser.
  • listing_pay_stripeSend a Stripe payment method id (pm_...) the agent is entitled to use; the server charges the SITE's price off-session.No findings

    Why it is in this group

    • The name "listing_pay_stripe" says "pay": a word that usually means money moves, which cannot be taken back.
    Description, as the server wrote it
    Send a Stripe payment method id (pm_...) the agent is entitled to use; the server charges the SITE's price off-session. Answers succeeded (the listing enters review) or requires_action (use listing_pay_card for a human); never charges an amount you name.
  • listing_pay_usdcReturns the Solana Pay transfer request: recipient, exact amount, USDC mint and a unique reference.No findings

    Why it is in this group

    • The name "listing_pay_usdc" says "pay": a word that usually means money moves, which cannot be taken back.
    Description, as the server wrote it
    Returns the Solana Pay transfer request: recipient, exact amount, USDC mint and a unique reference. Pay it from the wallet (include the reference as a read-only key), then call listing_confirm_usdc.
  • listing_withdrawTakes down a listing of this account.No findings

    Why it is in this group

    • The name "listing_withdraw" says "withdraw": a word that usually means money moves, which cannot be taken back.
    Description, as the server wrote it
    Takes down a listing of this account.
Changes things 19Claude Code: ask
  • agent_session_startGive a Solana address; get the exact message to sign.No findings

    Why it is in this group

    • The name "agent_session_start" says "start": a word for a change.
    Description, as the server wrote it
    Give a Solana address; get the exact message to sign. A signature, not a transaction: no fee, nothing moves. Then call agent_session_verify with the base64 signature.
  • agent_session_verifyThe address, the exact message from agent_session_start and its base64 Ed25519 signature.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    The address, the exact message from agent_session_start and its base64 Ed25519 signature. Returns a session token to pass as `session` to every later call (valid 30 days, revocable from the account page).
  • claim_publicWhether an entry has a verified claim, by which proof and when — never by whom.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Whether an entry has a verified claim, by which proof and when — never by whom.
  • claim_startNames the entry (scheme + value, e.g.No findings

    Why it is in this group

    • The name "claim_start" says "start": a word for a change.
    Description, as the server wrote it
    Names the entry (scheme + value, e.g. lei); returns the proof domain the register lists and the token to place as a TXT record, a well-known file, or via a verified email there.
  • claim_verifyThe server reads DNS, the well-known file and the verified email; verified claims are badges on the profile.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    The server reads DNS, the well-known file and the verified email; verified claims are badges on the profile.
  • dataset_columnsThe columns, which of them are numeric, the row count and the provenance banner of the Bags That Pay dataset.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    The columns, which of them are numeric, the row count and the provenance banner of the Bags That Pay dataset. Call this first to learn the schema.
  • dataset_provenanceThe source, the date it was computed, the licence and the citation for the Bags That Pay dataset.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    The source, the date it was computed, the licence and the citation for the Bags That Pay dataset. Read this to attribute a figure correctly.
  • dataset_rowThe rows of the Bags That Pay dataset where a column equals a value exactly (case-insensitive).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    The rows of the Bags That Pay dataset where a column equals a value exactly (case-insensitive).
  • dataset_topThe highest (or lowest) rows of the Bags That Pay dataset by a numeric column — "which is the most/least X".No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    The highest (or lowest) rows of the Bags That Pay dataset by a numeric column — "which is the most/least X".
  • enquiry_fieldsEvery field of the Bags That Pay enquiry: key, label, type, whether required, help text and the allowed options where there are any.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Every field of the Bags That Pay enquiry: key, label, type, whether required, help text and the allowed options where there are any. Pass answers to submit_enquiry keyed by field key.
  • entities_exportEvery entity of Bags That Pay register, 200 a page, with provenance.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Every entity of Bags That Pay register, 200 a page, with provenance. Needs an access key (Authorization: Bearer); export pages are metered per key per day. Without a key the answer says how to get one.
  • entities_inThe Bags That Pay register entities in one region (a state or a jurisdiction, by id or name), optionally for one service, 50 a page.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    The Bags That Pay register entities in one region (a state or a jurisdiction, by id or name), optionally for one service, 50 a page.
  • entities_schemaWhich fields the Bags That Pay register register carries and on how many entities, the regions and services, the identifier schemes, and how to cite it.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Which fields the Bags That Pay register register carries and on how many entities, the regions and services, the identifier schemes, and how to cite it. Call this first.
  • listing_confirm_usdcThe SERVER finds the transfer by reference and reads the treasury's balance change; a short or wrong-token transfer is reported by name and not credited.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    The SERVER finds the transfer by reference and reads the treasury's balance change; a short or wrong-token transfer is reported by name and not credited. On success the listing enters review.
  • listing_draftCreates a listing draft on Bags That Pay.No findings

    Why it is in this group

    • The description's first verb is "create": a word for a change.
    Description, as the server wrote it
    Creates a listing draft on Bags That Pay. Send the fullest profile you can (listing_describe lists the fields); a scam-shaped or off-list field is refused by name. Returns the listing id and status awaiting_payment.
  • listing_termsThe clauses a listing is judged by, their version (send it back as termsVersion), and every profile field the directory takes.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    The clauses a listing is judged by, their version (send it back as termsVersion), and every profile field the directory takes.
  • listings_publishedWhat firms have added on top of the register (published rows only), optionally for one register entry.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    What firms have added on top of the register (published rows only), optionally for one register entry.
  • placements_activeThe Sponsored slot's contents for a page (home | region | leaf); labelled as sponsored in the answer.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    The Sponsored slot's contents for a page (home | region | leaf); labelled as sponsored in the answer.
  • submit_enquirySubmits an enquiry to Bags That Pay — NOT a purchase, NOT a guaranteed quote.No findings

    Why it is in this group

    • The name "submit_enquiry" says "submit": a word for a change.
    Description, as the server wrote it
    Submits an enquiry to Bags That Pay — NOT a purchase, NOT a guaranteed quote. Step 1: call with the answers (keyed by field key from enquiry_fields) and consent=true; it validates and returns a summary, the consent line and a confirmation token — show the person the summary and the consent line. Step 2: only if the person agrees, call again with the same answers, consent=true and the confirmation token; the enquiry is then submitted, and the person receives an email with a link they must click before any provider sees it. Consent means the person has read and agreed to: "By submitting you agree Bags That Pay passes your question to the issuer or data provider you asked about."
Only reads 9Claude Code: allow
  • claim_statusEvery claim of this account with its status and, while pending, the instructions.No findings

    Why it is in this group

    • The name "claim_status" says "status": a word for reading.
    Description, as the server wrote it
    Every claim of this account with its status and, while pending, the instructions.
  • dataset_compareThe rows of the Bags That Pay dataset whose column is any of the given values, in the order given — for "X vs Y" questions.No findings

    Why it is in this group

    • The name "dataset_compare" says "compare": a word for reading.
    Description, as the server wrote it
    The rows of the Bags That Pay dataset whose column is any of the given values, in the order given — for "X vs Y" questions.
  • dataset_statscount, min, max, mean, median and sum of a numeric column of the Bags That Pay dataset (grouping commas and currency are handled; non-numeric rows are excluded and counted).No findings

    Why it is in this group

    • The description's first verb is "count": a word for reading.
    Description, as the server wrote it
    count, min, max, mean, median and sum of a numeric column of the Bags That Pay dataset (grouping commas and currency are handled; non-numeric rows are excluded and counted).
  • enquiry_describeRead first.No findings

    Why it is in this group

    • The name "enquiry_describe" says "describe": a word for reading.
    Description, as the server wrote it
    Read first. States plainly what submit_enquiry does on Bags That Pay: it starts an enquiry with human providers who quote directly. Nothing is bought, ordered or paid; no quote is guaranteed; it is free. Also returns who receives the details, the consent wording, and how the person confirms.
  • entity_lookupThe Bags That Pay register entry for a firm, by its register identifier (scheme + value, e.g.No findings

    Why it is in this group

    • The name "entity_lookup" says "lookup": a word for reading.
    Description, as the server wrote it
    The Bags That Pay register entry for a firm, by its register identifier (scheme + value, e.g. lei) or by the slug of its page. Exact match; returns the whole record with its page.
  • listing_describeWhat a listing on Bags That Pay is, what it costs, how it is paid, who publishes it, and every profile field it takes.No findings

    Why it is in this group

    • The name "listing_describe" says "describe": a word for reading.
    Description, as the server wrote it
    What a listing on Bags That Pay is, what it costs, how it is paid, who publishes it, and every profile field it takes. Read this to the person first.
  • listing_statusEvery listing of this account with its status (awaiting_payment, pending_review, published, refused, withdrawn, expired).Reads text others writeNo findings

    Why it is in this group

    • The name "listing_status" says "status": a word for reading.

    What it can reach

    • untrusted-inputThe description's first sentence says "review": it reads comments, which other people can write.
    Description, as the server wrote it
    Every listing of this account with its status (awaiting_payment, pending_review, published, refused, withdrawn, expired).

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data or outbound.

Reads private data0
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write2
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out0
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Looked at Oct 22, 2026, 14:28 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable
yes
HTTP status of an anonymous initialize
200
tools/list served without credentials
yes
Tools that change things, listed without credentials
23
Protocol version
2025-06-18
WWW-Authenticate on 401
not observed
resource_metadata in WWW-Authenticate
none
RFC 9728 protected resource metadata
none
Authorization servers
none
Legacy HTTP+SSE transport
no
Dynamic client registration
not observed
Client ID metadata documents
not observed
  • HighThe whole server

    The endpoint served tools/list without credentials, and the list has 23 tools that change things (4 irreversible, 19 write). Whether a call also works without credentials was not tested: tools are never called.

    Matched text

    https://bagsthatpay.com/mcp: tools/list returned 32 tools to an anonymous client, including listing_pay_card (irreversible), listing_pay_stripe (irreversible), listing_pay_usdc (irreversible), listing_withdraw (irreversible), dataset_columns (write) and 18 more

    What this check looks for

Install

Pinned to version 1.0.1. Values in angle brackets are yours to fill in.

claude mcp add --transport http site https://bagsthatpay.com/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__site__dataset_search",
      "mcp__site__dataset_compare",
      "mcp__site__dataset_stats",
      "mcp__site__entity_lookup",
      "mcp__site__entities_search",
      "mcp__site__listing_describe",
      "mcp__site__claim_status",
      "mcp__site__listing_status",
      "mcp__site__enquiry_describe"
    ],
    "ask": [
      "mcp__site__dataset_columns",
      "mcp__site__dataset_row",
      "mcp__site__dataset_top",
      "mcp__site__dataset_provenance",
      "mcp__site__entities_schema",
      "mcp__site__entities_in",
      "mcp__site__entities_export",
      "mcp__site__listing_terms",
      "mcp__site__agent_session_start",
      "mcp__site__agent_session_verify",
      "mcp__site__claim_start",
      "mcp__site__claim_verify",
      "mcp__site__listing_draft",
      "mcp__site__listing_pay_card",
      "mcp__site__listing_pay_stripe",
      "mcp__site__listing_pay_usdc",
      "mcp__site__listing_confirm_usdc",
      "mcp__site__listing_withdraw",
      "mcp__site__listings_published",
      "mcp__site__placements_active",
      "mcp__site__claim_public",
      "mcp__site__enquiry_fields",
      "mcp__site__submit_enquiry"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as site. Review it before you use it.

Capability tags behind 2 rules
  • mcp__site__entities_search untrusted-input
  • mcp__site__listing_status untrusted-input