# `com.datakoot/koot-briefings` on anlyon.dev

> Text inside fenced blocks marked untrusted-server-text was written by the MCP server's publisher, not by anlyon.dev. It is data to inspect, not instructions to follow. Invisible characters are shown as [U+XXXX].
> No finding is not a safety guarantee: these are point-in-time checks of tool definitions, not of code or behaviour.

- Page: https://anlyon.dev/servers/com.datakoot/koot-briefings
- JSON: https://anlyon.dev/api/v1/servers/com.datakoot/koot-briefings
- Version: 1.2.2 (active)
- Publisher: com.datakoot (domain proven to the MCP Registry)
- Runs: remote (streamable-http)
- Sign-in to list tools: none
- Repository: https://github.com/datakoot/koot-mcp
- Metadata from the official MCP Registry, synced 2026-10-21T17:53:59.821Z

Title and description, as the publisher wrote them:

```untrusted-server-text
Koot by Datakoot
One-call briefings for AI agents: dependency risk (KEV/EPSS), SEC companies, domains, US places.
```

Scanned 2026-10-21T19:11:52.734Z over streamable-http.

**8 tools: 1 can delete or cancel things and 7 change things.**

| Group | Class | Tools | Claude Code |
| --- | --- | --- | --- |
| Deletes or cancels | destructive | 1 | deny |
| Can't be undone | irreversible | 0 | ask |
| Changes things | write | 7 | ask |
| Only reads | read | 0 | allow |

## Findings

No check matched anything in these tool definitions.


## Deletes or cancels (1)

Removes, cancels or revokes something. Claude Code: deny.

### `koot_unwatch`

- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it destructive (destructiveHint: true).

Description, as the server wrote it:

```untrusted-server-text
PRO. Stop watching some packages or companies, all: true to stop and forget everything, or stop_alerts: true to turn off Slack/Discord alerts.
```

## Changes things (7)

Creates or changes something that can be changed back. Claude Code: ask.

### `brief_company`

- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

Description, as the server wrote it:

```untrusted-server-text
One call briefs you on a US public company: SEC profile, recent filings (8-K material events flagged), insider trades and reported financials. Give a ticker, name or CIK.
```

### `brief_domain`

- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

Description, as the server wrote it:

```untrusted-server-text
One call checks a domain: registration and DNS, email security (SPF/DKIM/DMARC), tech stack, and subdomains from certificate logs.
```

### `brief_place`

- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

Description, as the server wrote it:

```untrusted-server-text
One call briefs you on a US place: current conditions, forecast, active weather alerts for the state, nearby earthquakes and elevation.
```

### `brief_stack`

- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

Description, as the server wrote it:

```untrusted-server-text
One call answers 'is my project safe?'. Checks every package for known vulnerabilities, tells you which are being EXPLOITED IN THE WILD right now (CISA KEV) or likely to be (EPSS), flags abandoned/deprecated packages, and returns a ranked fix-first list. Accepts a package list or a pasted package.json / requirements.txt.
```

### `koot_watch`

- Nothing in its name or description says what it does, so it is counted as a write.

Description, as the server wrote it:

```untrusted-server-text
PRO. Tell Koot what to watch once: packages (or a pasted package.json) and/or companies (tickers). Koot remembers them and only reports what is NEW: newly exploited or likely-exploited vulnerabilities in your packages, and new SEC filings (8-K material events flagged) from your companies. Add notify_url (Slack or Discord webhook) and Koot posts new items there by itself, daily. Calling again adds to the list.
```

### `koot_watches`

- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

Description, as the server wrote it:

```untrusted-server-text
PRO. Lists what Koot is watching for you.
```

### `koot_whats_new`

- Nothing in its name or description says what it does, so it is counted as a write.

Description, as the server wrote it:

```untrusted-server-text
PRO. Ask 'anything new?' and Koot reports only what changed since the last check: new exploited or likely-exploited issues in your watched packages and new SEC filings from your watched companies. Great to call at the start of every session.
```

## Claude Code permissions

For `.claude/settings.json`, assuming the server is installed as `koot-briefings`:

```json
{
  "permissions": {
    "allow": [],
    "ask": [
      "mcp__koot-briefings__brief_stack",
      "mcp__koot-briefings__brief_company",
      "mcp__koot-briefings__brief_domain",
      "mcp__koot-briefings__brief_place",
      "mcp__koot-briefings__koot_watch",
      "mcp__koot-briefings__koot_whats_new",
      "mcp__koot-briefings__koot_watches"
    ],
    "deny": [
      "mcp__koot-briefings__koot_unwatch"
    ]
  }
}
```