Skip to content

Cloud for Bots

by botrecipe.com · remote · no sign-in to list tools · v1.0.0 · published by com.botrecipe

Sandboxes, storage, secrets, queues, timers, locks, inboxes and run ledger for AI bots. One MCP.

Deletes · 1Final · 1Changes · 413 high findings
CompareRegistry entry

48 tools: 1 can delete or cancel things, 1 do something that can't be undone, 41 change things and 5 only read.

Scanned Oct 21, 2026

3 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http cloudforbots https://cloudforbots.com/mcp --header 'Authorization: <your-authorization>'

Findings

Matches of fixed checks, with the text they matched.

3 high
  • Highbudget_reserve

    The input schema at properties.handle.description contains "<secret>", a tag of the kind used to mark instructions for the model.

    Matched text

    inputSchema.properties.handle.description: "...le from open_budget (looks like bg_<id>.<secret>). Pass it to every sub-agent so they al..."

    What this check looks for
  • Highbudget_record

    The input schema at properties.handle.description contains "<secret>", a tag of the kind used to mark instructions for the model.

    Matched text

    inputSchema.properties.handle.description: "...le from open_budget (looks like bg_<id>.<secret>). Pass it to every sub-agent so they al..."

    What this check looks for
  • Highbudget_budget_status

    The input schema at properties.handle.description contains "<secret>", a tag of the kind used to mark instructions for the model.

    Matched text

    inputSchema.properties.handle.description: "...le from open_budget (looks like bg_<id>.<secret>). Pass it to every sub-agent so they al..."

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

48 tools

Deletes or cancels 1Claude Code: deny
  • wake_cancel_wake[agent-wake] Cancel a pending wake-up by wake_id.No findings

    Why it is in this group

    • The name "wake_cancel_wake" says "cancel": a word for removing or ending something.
    Description, as the server wrote it
    [agent-wake] Cancel a pending wake-up by wake_id. Call once without confirm to preview, then with confirm=true.
Can't be undone 1Claude Code: ask
  • library_publish[bot-library] Publish or update (new version) a reusable bot recipe.No findings

    Why it is in this group

    • The name "library_publish" says "publish": a word for a change that another call does not undo.
    Description, as the server wrote it
    [bot-library] Publish or update (new version) a reusable bot recipe. The publishing key owns and signs it. Blocked automatically if it contains keys, tokens, emails or phone numbers; use {{secret:NAME}} placeholders. Args: slug (3-48 lowercase/dashes), data {name, summary, steps[], tools?[], tags?[], prompt?, memory_seed?, handoff_inbox?, forked_from?, works_with?[]}.
Changes things 41Claude Code: ask
  • ai[bot-ai] Model gateway: call Grok, Claude or GPT with one cloudforbots key.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    [bot-ai] Model gateway: call Grok, Claude or GPT with one cloudforbots key. Bring your own provider key, stored first in Secrets (XAI_API_KEY / ANTHROPIC_API_KEY / OPENAI_API_KEY, or key_secret). No markup: the provider bills you. Every call lands in the run ledger.
  • approve_check_action[approval-rules] Before a consequential action, ask whether the user's rules auto-approve it.No findings

    Why it is in this group

    • The name "approve_check_action" says "approve": a word for a change.
    Description, as the server wrote it
    [approval-rules] Before a consequential action, ask whether the user's rules auto-approve it. Returns auto_approve, needs_approval (with a plain-English approval card and a link the user can tap) or deny. Free plan is watch-only: it reports what it WOULD decide and logs it for the weekly report, but nothing counts as approved, so ask your user as you normally would.
  • approve_get_decision[approval-rules] Check whether the user approved or rejected an approval card (by card_id and card_token).No findings

    Why it is in this group

    • The name "approve_get_decision" says "approve": a word for a change.
    Description, as the server wrote it
    [approval-rules] Check whether the user approved or rejected an approval card (by card_id and card_token). Only act when status is approved.
  • approve_get_rules[approval-rules] Show the rules in effect for your key (or the default starter rules).No findings

    Why it is in this group

    • The name "approve_get_rules" says "approve": a word for a change.
    Description, as the server wrote it
    [approval-rules] Show the rules in effect for your key (or the default starter rules).
  • approve_set_rules[approval-rules] Save the user's rules (needs an API key so they stay yours).No findings

    Why it is in this group

    • The name "approve_set_rules" says "approve": a word for a change.
    Description, as the server wrote it
    [approval-rules] Save the user's rules (needs an API key so they stay yours). Each rule: {name, when:{type:[...], max_usd, min_usd, reversible, target_ends_with:[...]}, verdict:"auto"|"ask"|"deny"}. First matching rule wins; anything unmatched needs approval. Call once without confirm to preview, then with confirm=true.
  • approve_usage_and_upgrade[approval-rules] Show today's usage for your key or IP and the $49/month All Access upgrade link (cloudforbots.com/offer).No findings

    Why it is in this group

    • The name "approve_usage_and_upgrade" says "approve": a word for a change.
    Description, as the server wrote it
    [approval-rules] Show today's usage for your key or IP and the $49/month All Access upgrade link (cloudforbots.com/offer). Free tier: 200 calls/day. Not metered.
  • approve_weekly_report[approval-rules] Draft a plain-English report of the last 7 days: actions checked, how many your rules would auto-approve, how many needed you, top kinds of asks, and rule suggesti…No findings

    Why it is in this group

    • The name "approve_weekly_report" says "approve": a word for a change.
    Description, as the server wrote it
    [approval-rules] Draft a plain-English report of the last 7 days: actions checked, how many your rules would auto-approve, how many needed you, top kinds of asks, and rule suggestions. Read-only; sends nothing.
  • browser[bot-browser] A real headless Chrome per named session that pauses instead of dying: logins, cookies and tabs survive between calls and across days.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    [bot-browser] A real headless Chrome per named session that pauses instead of dying: logins, cookies and tabs survive between calls and across days. Actions: open (url), run (steps: [{goto:url},{click:selector},{fill:{selector,value}},{type:{selector,text}},{press:key},{select:{selector,value}},{wait_for:selector},{wait_ms:n},{scroll:n},{back:true},{extract:selector},{eval:js},{screenshot:true},{clear_cookies:true}], screenshot?), screenshot, pause, kill, list. Returns url, title, page text and links. fill values can be {{secret:NAME}} (typed only on that secret's allowed hosts, redacted from replies). Stuck on 2FA? action handoff (kind, note, fill: selector, submit?) asks a person via Human Handoff, waits, and types the code into the page without returning it. Uses the sandbox allowance (3 live, 60 min/day free).
  • budget_open_budget[budget-guard] Open a hard budget for one agent run before it starts: max dollars, tokens, calls and/or wall-clock seconds.No findings

    Why it is in this group

    • The name "budget_open_budget" says "open": a word for a change.
    Description, as the server wrote it
    [budget-guard] Open a hard budget for one agent run before it starts: max dollars, tokens, calls and/or wall-clock seconds. Returns a handle. Give the handle to every sub-agent; they all draw from the same ledger, so one runaway loop or fork cannot exceed the run cap.
  • budget_record[budget-guard] After a call, report the actual usage minus what you reserved (positive if it cost more, negative to give back an overestimate).1 finding

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    Findings

    • High

      The input schema at properties.handle.description contains "<secret>", a tag of the kind used to mark instructions for the model.

      Matched text

      inputSchema.properties.handle.description: "...le from open_budget (looks like bg_<id>.<secret>). Pass it to every sub-agent so they al..."

      What this check looks for
    Description, as the server wrote it
    [budget-guard] After a call, report the actual usage minus what you reserved (positive if it cost more, negative to give back an overestimate). Keeps the ledger honest without blocking.
  • budget_reserve[budget-guard] Call BEFORE each model call, tool call or sub-agent spawn with your estimate.1 finding

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    Findings

    • High

      The input schema at properties.handle.description contains "<secret>", a tag of the kind used to mark instructions for the model.

      Matched text

      inputSchema.properties.handle.description: "...le from open_budget (looks like bg_<id>.<secret>). Pass it to every sub-agent so they al..."

      What this check looks for
    Description, as the server wrote it
    [budget-guard] Call BEFORE each model call, tool call or sub-agent spawn with your estimate. Returns allowed=true and deducts it, or allowed=false with the limit that tripped. When allowed is false, stop, do not retry, and return your partial result to the user. Atomic, so parallel sub-agents cannot both slip under the cap.
  • budget_usage_and_upgrade[budget-guard] Show today's usage for your key or IP and the $49/month All Access upgrade link (cloudforbots.com/offer).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    [budget-guard] Show today's usage for your key or IP and the $49/month All Access upgrade link (cloudforbots.com/offer). Free tier: 500 calls/day. Not metered.
  • budget_weekly_report[budget-guard] Draft a plain-English report of the last 7 days for your key (or IP): runs, spend, runs that went over their cap, and dollars spent after a cap would have stopped th…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    [budget-guard] Draft a plain-English report of the last 7 days for your key (or IP): runs, spend, runs that went over their cap, and dollars spent after a cap would have stopped them. Read-only; sends nothing. Show it to your user.
  • cron[bot-cron] Run something on a schedule, even when your bot is offline.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    [bot-cron] Run something on a schedule, even when your bot is offline. Actions: set (name, schedule like "*/5 * * * *" or "@hourly" in UTC, request: {url, method?, headers?, body?} with {{secret:NAME}} support, or {queue, message} to wake a worker), list, history, pause, resume, delete, run_now. Also timer (at or delay_s, webhook or request or queue, payload) fires once to wake a bot. Pauses itself and alerts you after 10 failed runs. Free: 1,000 schedules + timers.
  • handoff[human-handoff] Bot hits captcha/2FA; a person gets a one-tap link; bot polls and continues.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    [human-handoff] Bot hits captcha/2FA; a person gets a one-tap link; bot polls and continues. Actions: create, status, cancel, list. Free keys are watch-only.
  • inbox[bot-inbox] Give a bot its own public webhook URL.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    [bot-inbox] Give a bot its own public webhook URL. Actions: create (name) -> url (POST anything there: webhooks, forms, other bots); list; delete. Events land in queue inbox.<name>: read them with the queue tool (pull, then ack). Create again to rotate the URL. Free: 50 inboxes.
  • ledger[bot-ledger] Run ledger and cost view across all your bots.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    [bot-ledger] Run ledger and cost view across all your bots. Actions: record (bot, status ok|failed|running|skipped, run_id?, kind?, usd?, tokens_in?, tokens_out?, model?, ms?, note?), feed (since?, bot?, status?, limit?) = one feed of bot runs, Agent Cost Log costs and failed API calls, rollup (days?) = per day per bot runs, failures and USD.
  • library_install[bot-library] Clone a library bot into this bot: returns the recipe steps, tools, prompt and memory_seed to run now.No findings

    Why it is in this group

    • The name "library_install" says "install": a word for a change.
    Description, as the server wrote it
    [bot-library] Clone a library bot into this bot: returns the recipe steps, tools, prompt and memory_seed to run now. Counts one install per account. Args: slug.
  • library_rate[bot-library] After running an installed recipe, report whether it worked.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    [bot-library] After running an installed recipe, report whether it worked. This is what ranks the library. Args: slug, ok (boolean).
  • library_report[bot-library] Report a broken, unsafe or spammy entry.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    [bot-library] Report a broken, unsafe or spammy entry. 3 reports from different accounts pause it automatically. Args: slug, reason.
  • lock[bot-coord] Named locks (leases) shared by every bot on your account, e.g.No findings

    Why it is in this group

    • The name "lock" says "lock": a word for a change.
    Description, as the server wrote it
    [bot-coord] Named locks (leases) shared by every bot on your account, e.g. browser.lock. Actions: acquire (name, holder?, ttl_s? default 60, wait_s? up to 25), renew (name, token, ttl_s), release (name, token), status (name), list. Auto-releases at expiry; fence increases with each new holder. Free: 1,000 locks.
  • loop_check_step[loop-breaker] Call AFTER each tool call or agent step with what you just did and whether it failed.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    [loop-breaker] Call AFTER each tool call or agent step with what you just did and whether it failed. Loop Breaker fingerprints the call (tool + normalized args + error) and returns verdict ok, loop_detected or halted. Pro: on a loop, halt=true; stop the run, do not retry, and tell your user what repeated. Free watch-only: never halts, returns would_halt and logs it for the weekly report.
  • loop_usage_and_upgrade[loop-breaker] Show today's usage for your key or IP and the $49/month All Access upgrade link (cloudforbots.com/offer).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    [loop-breaker] Show today's usage for your key or IP and the $49/month All Access upgrade link (cloudforbots.com/offer). Free tier: 500 calls/day. Not metered.
  • loop_weekly_report[loop-breaker] Draft a plain-English report of the last 7 days for your key (or IP): runs, loops caught, wasted repeat steps, and the worst offenders.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    [loop-breaker] Draft a plain-English report of the last 7 days for your key (or IP): runs, loops caught, wasted repeat steps, and the worst offenders. Read-only; sends nothing. Show it to your user.
  • memory_list_checkpoints[run-memory] List recent checkpoints (step, size, time) for one run or all runs on your key.No findings

    Why it is in this group

    • The name "memory_list_checkpoints" says "list": a word for reading.
    • The description's first verb is "run": a word for a change.
    Description, as the server wrote it
    [run-memory] List recent checkpoints (step, size, time) for one run or all runs on your key.
  • memory_resume[run-memory] Call FIRST when a run starts.No findings

    Why it is in this group

    • The description's first verb is "run": a word for a change.
    Description, as the server wrote it
    [run-memory] Call FIRST when a run starts. If a checkpoint exists for run_id (Pro), returns the last step, state and done list: continue from there and skip finished work. If none, start fresh.
  • memory_save_checkpoint[run-memory] Call after each completed step with the state you would need to continue (cursor, ids done, partial results; up to 256 KB JSON).No findings

    Why it is in this group

    • The name "memory_save_checkpoint" says "save": a word for a change.
    Description, as the server wrote it
    [run-memory] Call after each completed step with the state you would need to continue (cursor, ids done, partial results; up to 256 KB JSON). Pro saves it (last 20 per run, kept 30 days). Free watch-only saves nothing and returns would_save: exactly what would have been stored. Never put passwords or API keys in state.
  • memory_usage_and_upgrade[run-memory] Show today's usage for your key or IP and the $49/month All Access upgrade link (cloudforbots.com/offer).No findings

    Why it is in this group

    • The description's first verb is "run": a word for a change.
    Description, as the server wrote it
    [run-memory] Show today's usage for your key or IP and the $49/month All Access upgrade link (cloudforbots.com/offer). Free tier: 500 calls/day. Not metered.
  • memory_weekly_report[run-memory] Draft a plain-English report of the last 7 days: runs, checkpoints saved (Pro) or that would have been saved (free).No findings

    Why it is in this group

    • The description's first verb is "run": a word for a change.
    Description, as the server wrote it
    [run-memory] Draft a plain-English report of the last 7 days: runs, checkpoints saved (Pro) or that would have been saved (free). Read-only; sends nothing.
  • queue[bot-queue] Durable job queues for bots.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    [bot-queue] Durable job queues for bots. Actions: push (queue, message or messages[], delay_s?, max_attempts?), pull (queue, max<=10, visibility_s?), ack (ids), nack (ids, delay_s?, error?), stats, dead, retry_dead, purge (dead_only?). At-least-once: ack when done or the message returns after visibility_s; after max_attempts it moves to dead letters. Free: 1,000 queues, 10,000 pushes/day.
  • rate[bot-coord] Shared rate counters across all your bots, e.g.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    [bot-coord] Shared rate counters across all your bots, e.g. "6 posts per 6h across all lanes". Actions: take (name, limit like "6/6h", n?) -> allowed, remaining, retry_after_s; peek (name, limit); list. Sliding window. Free: 200 counters.
  • replay[run-replay] Timeline of a run: steps, loops, checkpoints, spend, stop point.No findings

    Why it is in this group

    • The description's first verb is "run": a word for a change.
    Description, as the server wrote it
    [run-replay] Timeline of a run: steps, loops, checkpoints, spend, stop point. Pass run_id; omit to list recent runs. Set ui=openui for a live card.
  • report[daily-report] Opt-in daily owner summary (loops stopped, spend blocked, approvals waiting).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    [daily-report] Opt-in daily owner summary (loops stopped, spend blocked, approvals waiting). Actions: subscribe, unsubscribe, preview.
  • sandbox[bot-sandbox] A named Linux sandbox (Python, Node, shell, internet) that pauses instead of dying: files, installed packages and running processes survive between calls and across d…No findings

    Why it is in this group

    • The input takes a statement or command to run (input.cmd), which can change anything it can reach.
    Description, as the server wrote it
    [bot-sandbox] A named Linux sandbox (Python, Node, shell, internet) that pauses instead of dying: files, installed packages and running processes survive between calls and across days. Actions: run (cmd, cwd?, timeout_s? up to 120, background?), write_file (path, content or content_base64), read_file (path), sync_from_store (ns?, prefix?, dir? = /home/user/store: copy your stored files in), sync_to_store (dir?, ns?, prefix?: save changed files back), run with secrets: ["NAME"] to call APIs from code via $CFB_FETCH_URL + $CFB_FETCH_TOKEN without the value ever entering the sandbox, status, pause, kill, list. Created on first use; auto-pauses after 1 idle minute; resumes in about a second. Free: 3 sandboxes, 60 run-minutes/day.
  • secrets[bot-secrets] Store API keys and tokens once; your bot never sees them again.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    [bot-secrets] Store API keys and tokens once; your bot never sees them again. Actions: set (name in UPPER_SNAKE_CASE, value, allowed_hosts like ["api.openai.com"]), list (names only, never values), delete. Use them with the fetch tool as {{secret:NAME}}. Free: 25 secrets.
  • store[bot-storage] Durable key-value + file storage for your bot, shared by every key on your account.No findings

    Why it is in this group

    • The name "store" says "store": a word for a change.
    Description, as the server wrote it
    [bot-storage] Durable key-value + file storage for your bot, shared by every key on your account. Survives sandbox restarts. Actions: get, set (value: any JSON, ttl_seconds?, if_version? for compare-and-set), incr (by?), delete, list (prefix?, after?, limit?), file_put (name, content_base64, content_type?), file_get, file_meta, file_delete, file_list, usage. ns = namespace (default "default"). Free: 100 MB, 100k items, values up to 256 KB, files up to 4 MB.
  • topic[bot-bus] Agent-to-agent message bus.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    [bot-bus] Agent-to-agent message bus. Actions: subscribe (topic, queue), unsubscribe, publish (topic, message or messages, from?), list. publish copies each message into every subscribed queue, so a handoff waits safely while the receiving bot sleeps; it reads with the queue tool and acks. Free: 500 subscriptions.
  • vault[login-vault] Sign-in sessions without the bot seeing passwords.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    [login-vault] Sign-in sessions without the bot seeing passwords. Actions: put, list, delete, login, fetch, end, watch (free watch-only).
  • wake_check_wakes[agent-wake] Collect wake-ups that are due for your inbox (each returned once, with its saved state and thread ID) and list upcoming ones.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    [agent-wake] Collect wake-ups that are due for your inbox (each returned once, with its saved state and thread ID) and list upcoming ones. Call this at the start of a session.
  • wake_schedule_wake[agent-wake] Schedule a wake-up for your agent.No findings

    Why it is in this group

    • The name "wake_schedule_wake" says "schedule": a word for a change.
    Description, as the server wrote it
    [agent-wake] Schedule a wake-up for your agent. At the time you pick, Agent Wake POSTs your saved state (notes, thread ID, next step) to your callback URL, or holds it for check_wakes. Use it so a later, fresh session picks up where this one stopped. Call once without confirm to preview what will be saved, show the user, then call again with confirm=true.
  • wake_usage_and_upgrade[agent-wake] Show today's usage for your key or IP and the $49/month All Access upgrade link.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    [agent-wake] Show today's usage for your key or IP and the $49/month All Access upgrade link. Free tier: 50 calls/day. Not metered.
Only reads 5Claude Code: allow
  • budget_budget_status[budget-guard] See spend vs limits, remaining budget, whether the run is stopped and why, and the last 20 ledger events.1 finding

    Why it is in this group

    • The name "budget_budget_status" says "status": a word for reading.

    Findings

    • High

      The input schema at properties.handle.description contains "<secret>", a tag of the kind used to mark instructions for the model.

      Matched text

      inputSchema.properties.handle.description: "...le from open_budget (looks like bg_<id>.<secret>). Pass it to every sub-agent so they al..."

      What this check looks for
    Description, as the server wrote it
    [budget-guard] See spend vs limits, remaining budget, whether the run is stopped and why, and the last 20 ledger events. Set close=true when the run finishes.
  • fetch[bot-secrets] Call any https API with your stored secrets filled in on our side: put {{secret:NAME}} in url, headers or body.No findings

    Why it is in this group

    • The name "fetch" says "fetch": a word for reading.
    Description, as the server wrote it
    [bot-secrets] Call any https API with your stored secrets filled in on our side: put {{secret:NAME}} in url, headers or body. Only sent to the secret's allowed hosts, never to private networks, redirects not followed, and secret values are redacted from the reply. Args: url, method?, headers?, body?, timeout_s? (max 30).
  • library_get[bot-library] Read one library entry (recipe, tools, version, signature, install and success counts).No findings

    Why it is in this group

    • The name "library_get" says "get": a word for reading.
    Description, as the server wrote it
    [bot-library] Read one library entry (recipe, tools, version, signature, install and success counts). Args: slug.
  • loop_loop_status[loop-breaker] Show a run's loops so far, whether it is halted, and its last 10 steps.No findings

    Why it is in this group

    • The name "loop_loop_status" says "status": a word for reading.
    Description, as the server wrote it
    [loop-breaker] Show a run's loops so far, whether it is halted, and its last 10 steps.

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http cloudforbots https://cloudforbots.com/mcp --header 'Authorization: <your-authorization>'

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__cloudforbots__loop_loop_status",
      "mcp__cloudforbots__budget_budget_status",
      "mcp__cloudforbots__library_search",
      "mcp__cloudforbots__library_get",
      "mcp__cloudforbots__fetch"
    ],
    "ask": [
      "mcp__cloudforbots__loop_check_step",
      "mcp__cloudforbots__loop_weekly_report",
      "mcp__cloudforbots__loop_usage_and_upgrade",
      "mcp__cloudforbots__memory_save_checkpoint",
      "mcp__cloudforbots__memory_resume",
      "mcp__cloudforbots__memory_list_checkpoints",
      "mcp__cloudforbots__memory_weekly_report",
      "mcp__cloudforbots__memory_usage_and_upgrade",
      "mcp__cloudforbots__budget_open_budget",
      "mcp__cloudforbots__budget_reserve",
      "mcp__cloudforbots__budget_record",
      "mcp__cloudforbots__budget_weekly_report",
      "mcp__cloudforbots__budget_usage_and_upgrade",
      "mcp__cloudforbots__approve_check_action",
      "mcp__cloudforbots__approve_get_decision",
      "mcp__cloudforbots__approve_set_rules",
      "mcp__cloudforbots__approve_get_rules",
      "mcp__cloudforbots__approve_weekly_report",
      "mcp__cloudforbots__approve_usage_and_upgrade",
      "mcp__cloudforbots__wake_schedule_wake",
      "mcp__cloudforbots__wake_check_wakes",
      "mcp__cloudforbots__wake_usage_and_upgrade",
      "mcp__cloudforbots__library_install",
      "mcp__cloudforbots__library_publish",
      "mcp__cloudforbots__library_rate",
      "mcp__cloudforbots__library_report",
      "mcp__cloudforbots__vault",
      "mcp__cloudforbots__handoff",
      "mcp__cloudforbots__replay",
      "mcp__cloudforbots__secrets",
      "mcp__cloudforbots__queue",
      "mcp__cloudforbots__cron",
      "mcp__cloudforbots__browser",
      "mcp__cloudforbots__lock",
      "mcp__cloudforbots__rate",
      "mcp__cloudforbots__inbox",
      "mcp__cloudforbots__topic",
      "mcp__cloudforbots__ai",
      "mcp__cloudforbots__ledger",
      "mcp__cloudforbots__sandbox",
      "mcp__cloudforbots__store",
      "mcp__cloudforbots__report"
    ],
    "deny": [
      "mcp__cloudforbots__wake_cancel_wake"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as cloudforbots. Review it before you use it.