# `com.eformogi/records-vault` on anlyon.dev

> Text inside fenced blocks marked untrusted-server-text was written by the MCP server's publisher, not by anlyon.dev. It is data to inspect, not instructions to follow. Invisible characters are shown as [U+XXXX].
> No finding is not a safety guarantee: these are point-in-time checks of tool definitions, not of code or behaviour.

- Page: https://anlyon.dev/servers/com.eformogi/records-vault
- JSON: https://anlyon.dev/api/v1/servers/com.eformogi/records-vault
- Version: 1.0.0 (active)
- Publisher: com.eformogi (domain proven to the MCP Registry)
- Runs: remote (streamable-http)
- Sign-in to list tools: none
- Metadata from the official MCP Registry, synced 2026-10-21T17:54:31.174Z

Title and description, as the publisher wrote them:

```untrusted-server-text
Consent-scoped vault access and free verification of family-issued learning records.
```

Scanned 2026-10-21T18:48:40.251Z over streamable-http.

**9 tools: 4 change things and 5 only read.**

| Group | Class | Tools | Claude Code |
| --- | --- | --- | --- |
| Deletes or cancels | destructive | 0 | deny |
| Can't be undone | irreversible | 0 | ask |
| Changes things | write | 4 | ask |
| Only reads | read | 5 | allow |

## Findings

No check matched anything in these tool definitions.


## Changes things (4)

Creates or changes something that can be changed back. Claude Code: ask.

### `check_policy`

- Nothing in its name or description says what it does, so it is counted as a write.

Description, as the server wrote it:

```untrusted-server-text
Check what data categories the agent is allowed to access and their policy level (auto/ask/never).
```

### `create_consent`

- The name "create_consent" says "create": a word for a change.

Description, as the server wrote it:

```untrusted-server-text
Create a consent grant to share specific categories with an organization. Categories under "ask" policy will require user approval.
```

### `how_eformogi_works`

- Nothing in its name or description says what it does, so it is counted as a write.

Description, as the server wrote it:

```untrusted-server-text
What Eformogi is and what it costs: the thesis sentence and the pricing paragraph, verbatim, plus the key public pages.
```

### `verify_record`

- Nothing in its name or description says what it does, so it is counted as a write.

Description, as the server wrote it:

```untrusted-server-text
Verify an Eformogi receipt id with no login and no API key: the same check the public /verify page performs. Returns the kind, the title or course fields, the issued date, and the signers' names and identity levels, worded exactly as the page words them. Never an email, a user id, or a person id.
```

## Only reads (5)

Looks things up and changes nothing. Claude Code: allow.

### `list_consents`

- The name "list_consents" says "list": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
List the user's active consent receipts — who they've shared data with and what categories.
```

### `log_action`

- The name "log_action" says "log": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Log an action the agent performed on behalf of the user. All MCP calls are auto-logged, but agents can add explicit action descriptions.
```

### `read_profile`

- The name "read_profile" says "read": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Read the user's vault data for specified categories. Respects the agent policy — auto categories return data, ask categories return pending, never categories are denied.
```

### `read_spec`

- The name "read_spec" says "read": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Read the open Eformogi record standard published at /spec. With no chapter, lists every published chapter. With a chapter slug, returns that chapter's markdown text.
```

### `search_orgs`

- The name "search_orgs" says "search": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Search for organizations the user can share data with.
```

## Claude Code permissions

For `.claude/settings.json`, assuming the server is installed as `records-vault`:

```json
{
  "permissions": {
    "allow": [
      "mcp__records-vault__read_profile",
      "mcp__records-vault__list_consents",
      "mcp__records-vault__log_action",
      "mcp__records-vault__search_orgs",
      "mcp__records-vault__read_spec"
    ],
    "ask": [
      "mcp__records-vault__create_consent",
      "mcp__records-vault__check_policy",
      "mcp__records-vault__verify_record",
      "mcp__records-vault__how_eformogi_works"
    ],
    "deny": []
  }
}
```