Skip to content

Arrakis

com.goodailabs/arrakisgoodailabs.comstreamable-httpv0.1.0Scanned

Rent GPUs at live prices and serve any Hugging Face model, with spend caps for AI agents.

13 tools: 2 can delete or cancel things, 3 change things and 8 only read.

Tools: 2 delete, 0 irreversible, 3 write, 8 read.
  • Reads private data · 1
  • Reads text others write · 13
  • Can send data out · 0
  • 1 finding, 1 high

Anlyon alternative

5 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

13 tools

Deletes or cancels 2Claude Code: deny
  • schedule_removalChange when a machine is removed automatically (ISO 8601, UTC).Reads text others writeNo findings

    Why it is in this group

    • The name "schedule_removal" says "schedule": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Change when a machine is removed automatically (ISO 8601, UTC). It bills until then, and removal deletes the machine and its disk. Use it to end a rental early when the job will finish sooner, or, with a token that has no spend cap, to extend a long run. A token with a spend cap can only move removal earlier.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
  • terminate_instanceStop a machine now and delete it with everything on its disk; billing stops (the hour already started is paid).Reads text others writeNo findings

    Why it is in this group

    • The name "terminate_instance" says "terminate": a word for removing or ending something.
    • The description says "Cannot be undone".
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Stop a machine now and delete it with everything on its disk; billing stops (the hour already started is paid). Copy results off first, for example with scp or rsync over its ssh_command. Cannot be undone; terminating a machine that already ended changes nothing.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
Changes things 3Claude Code: ask
  • deploy_modelServe any model from Hugging Face on a machine of the person's, like a hosted inference API but on their own GPU: vLLM or SGLang for text models, vLLM-Omni or SGLang for image and …Reads text others writeNo findings

    Why it is in this group

    • The name "deploy_model" says "deploy": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Serve any model from Hugging Face on a machine of the person's, like a hosted inference API but on their own GPU: vLLM or SGLang for text models, vLLM-Omni or SGLang for image and video models (FLUX, Qwen-Image, Wan), vLLM-Omni for speech and music, llama.cpp for a GGUF file (owner/repo:Q4_K_M). extra_args takes the person's own engine options as they'd paste them. COSTS MONEY like rent_gpu: the machine's hourly price, paid an hour at a time from when it runs until terminate_instance or termination_hours; worst_case_usd is the most it can cost. The model's size is read from Hugging Face and, without node_id, the best-ranked clean machine that holds it is rented on as few GPUs as it allows. A gated or private model needs hf_token (read access is enough; it goes to the machine only and Arrakis keeps none). Returns the instance, the endpoint (an OpenAI-compatible base URL once RUNNING, and its api_key) and ssh_command: the person also gets root SSH. The engine downloads the model first, so it answers a few minutes after RUNNING: get_instance shows endpoint_ready. Same idempotency_key returns the same machine.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • join_partner_programJoin the Arrakis partner program and get your own partner code, link and a message to share.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Join the Arrakis partner program and get your own partner code, link and a message to share. The account earns a share of what the customers it brings pay, as cash (paid through Stripe to the person or company you act for, once they set up payouts in the console) or Arrakis credit you can spend on GPUs. Only join if the person or company you act for agrees: joining accepts the partner terms (terms_url from get_partner_earnings) for them. Pass the terms_version you read. Free; joining again returns the same code. Add ?tag=<label> to your link to tell your own channels apart. Needs a token with the billing scope.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • rent_gpuRent one machine found by search_gpus.Reads text others write1 finding

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • High

      The input schema at properties.ssh_public_key.description refers to "~/.ssh/id_ed25519.pub".

      Matched text

      inputSchema.properties.ssh_public_key.description: "...public key, for example the contents of ~/.ssh/id_ed25519.pub."

      What this check looks for
    Description, as the server wrote it
    Rent one machine found by search_gpus. COSTS MONEY: price per GPU-hour x GPUs, paid an hour at a time from when it starts running (booting is free) until terminate_instance or termination_hours, whichever comes first; worst_case_usd in the result is the most it can cost, and balance_covers_hours says how many hours the balance pays. It rents every GPU on the machine unless gpu_count says fewer (only some hosts allow that). Pass max_price_per_gpu_hour, normally the price search_gpus showed: if the live price is higher nothing is rented and the error gives the new price. Spot machines can be taken back by their host at any time. Boots the Arrakis PyTorch image unless template_id (list_images) or a public image is given; uses ssh_public_key, else ssh_key_id, else the account's first SSH key. Returns instance_id, state, the locked price, worst_case_usd and what to do next. Calling again with the same idempotency_key, or the same node_id and name within 10 minutes, returns the same machine instead of renting a second; use a new name for a second machine.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
Only reads 8Show 8 read-only tools
  • get_balanceThe account balance (what it can pay now, what the running machines cost per hour, when the money runs out, whether rentals are paused and whether auto-recharge tops it up from a s…Reads text others writeNo findings

    Why it is in this group

    • The name "get_balance" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    The account balance (what it can pay now, what the running machines cost per hour, when the money runs out, whether rentals are paused and whether auto-recharge tops it up from a saved card) and this token's spend cap: the limit, what is committed, what is left, the longest rental allowed and when the token expires. Call it before long jobs and whenever an alert mentions the balance. Free; changes nothing.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • get_eventsEvents on your machines, newest first: machine.ready (with its SSH command), machine.ended (reason says why: evicted when its host took it back or stopped working, otherwise stoppe…Reads text others writeNo findings

    Why it is in this group

    • The name "get_events" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Events on your machines, newest first: machine.ready (with its SSH command), machine.ended (reason says why: evicted when its host took it back or stopped working, otherwise stopped, removal_time, out_of_funds, paused or failed) and machine.notice (its host will take it back or restart it at notice_at, stopped answering, or it failed). Check it when a machine stops answering, and after any alert on a tool result. Free; changes nothing.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • get_instanceOne machine now: state (PENDING or PROVISIONING while it boots, which is free; RUNNING when ssh_command works; then TERMINATED or FAILED), price per hour, ssh_command, removed_by, …Reads text others writeNo findings

    Why it is in this group

    • The name "get_instance" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    One machine now: state (PENDING or PROVISIONING while it boots, which is free; RUNNING when ssh_command works; then TERMINATED or FAILED), price per hour, ssh_command, removed_by, any notice from its host (host_notice and host_notice_at, host_down_since) and, once it ended, ended_reason (evicted when its host took it back). After rent_gpu, call it every 30-60 seconds until RUNNING. Free; changes nothing.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • get_market_summaryLive market summary by GPU family: cheapest price per GPU-hour, GPUs available and machines.Reads text others writeNo findings

    Why it is in this group

    • The name "get_market_summary" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Live market summary by GPU family: cheapest price per GPU-hour, GPUs available and machines. Free; needs no token; changes nothing.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • get_partner_earningsFor partners (agents and people who bring customers to Arrakis): your partner codes with the link and a message to share, what each earns you (a share of what the customers you bri…Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "get_partner_earnings" says "get": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "message": it reads messages.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe description's first sentence says "message": it reads messages, which other people can write.
    Description, as the server wrote it
    For partners (agents and people who bring customers to Arrakis): your partner codes with the link and a message to share, what each earns you (a share of what the customers you bring pay), the customers your codes brought (each with what they paid and earned you, and your link tag; never who they are), what you have earned, what is pending until those payments reach Arrakis or held before a cash-out, what you can cash out or move to your balance, any sales target with its progress, and whether the partner program is open to join. Free; changes nothing. Wherever you recommend Arrakis, say that you earn from referrals (the partner terms). Needs a token with the billing scope.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • list_imagesImages a machine can boot, for rent_gpu's template_id: the Arrakis images (PyTorch, CUDA toolkit, Ubuntu; SSH, login banner and tools built in) and the account's saved ones, with d…Reads text others writeNo findings

    Why it is in this group

    • The name "list_images" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Images a machine can boot, for rent_gpu's template_id: the Arrakis images (PyTorch, CUDA toolkit, Ubuntu; SSH, login banner and tools built in) and the account's saved ones, with download size. Any other public image works through rent_gpu's image. Free; changes nothing.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • list_instancesEvery machine on the account with its state, price per hour, SSH command, removal time and any notice from its host.Reads text others writeNo findings

    Why it is in this group

    • The name "list_instances" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Every machine on the account with its state, price per hour, SSH command, removal time and any notice from its host. Check it at the start of a session: a machine left running keeps billing until its removal time. Free; changes nothing.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • search_gpusSearch GPU machines you can rent now at live prices: B300, B200, H200, H100, A100, RTX 5090 and more.Reads text others writeNo findings

    Why it is in this group

    • The name "search_gpus" says "search": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Search GPU machines you can rent now at live prices: B300, B200, H200, H100, A100, RTX 5090 and more. Free; changes nothing. Use it before rent_gpu and to answer what a GPU costs right now. Rows come best first: what the GPU can do (capability, H100 = 1.0), its price and how reliable its host is, with badges saying why (Reliable host, NVLink, or a warning such as a host taking it back soon); sort=price lists the cheapest first. pick is the first row with the reason, cheapest the lowest whole-machine price. Each row has node_id (for rent_gpu), gpu, gpu_count (rent_gpu rents all of them unless gpu_count says fewer; max_gpus 1 finds single-GPU machines), vram_gb per GPU, price_per_gpu_hour_usd, price_per_hour_usd for the whole machine, CPUs (and cpu, the model), RAM, disk, location, tier and network. Badges also say when renters rate a host low, it often fails to start or its GPUs are slow next to the same GPU elsewhere. Tiers: on_demand runs until its removal time; spot costs less but its host can take it back at any time, so use it only for work that saves checkpoints off the machine. Prices can move within a minute: pass the row's price to rent_gpu as max_price_per_gpu_hour. For multi-machine training add min_nic_gbps 400 and min_nics_per_gpu 1; null network fields were not reported.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged outbound.

Reads private data1
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write13
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out0
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

1 high
  • The input schema at properties.ssh_public_key.description refers to "~/.ssh/id_ed25519.pub".

    Matched text

    inputSchema.properties.ssh_public_key.description: "...public key, for example the contents of ~/.ssh/id_ed25519.pub."

    What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

Install

Pinned to version 0.1.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http arrakis https://arrakis.goodailabs.com/mcp
claude mcp add --transport http arrakis https://arrakis.goodailabs.com/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__arrakis__search_gpus",
      "mcp__arrakis__get_market_summary",
      "mcp__arrakis__get_partner_earnings",
      "mcp__arrakis__get_balance",
      "mcp__arrakis__list_images",
      "mcp__arrakis__list_instances",
      "mcp__arrakis__get_instance",
      "mcp__arrakis__get_events"
    ],
    "ask": [
      "mcp__arrakis__join_partner_program",
      "mcp__arrakis__rent_gpu",
      "mcp__arrakis__deploy_model"
    ],
    "deny": [
      "mcp__arrakis__terminate_instance",
      "mcp__arrakis__schedule_removal"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as arrakis. Review it before you use it.

Capability tags behind 13 rules
  • mcp__arrakis__search_gpus untrusted-input
  • mcp__arrakis__get_market_summary untrusted-input
  • mcp__arrakis__get_partner_earnings private-data, untrusted-input
  • mcp__arrakis__join_partner_program untrusted-input
  • mcp__arrakis__get_balance untrusted-input
  • mcp__arrakis__rent_gpu untrusted-input
  • mcp__arrakis__deploy_model untrusted-input
  • mcp__arrakis__list_images untrusted-input
  • mcp__arrakis__list_instances untrusted-input
  • mcp__arrakis__get_instance untrusted-input
  • mcp__arrakis__get_events untrusted-input
  • mcp__arrakis__terminate_instance untrusted-input
  • mcp__arrakis__schedule_removal untrusted-input

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/com.goodailabs/arrakis/verify?hash=25c533bff599c7d14ec3bdd9608f203d41b39122b6b192bee40a3bdde87010ea" | jq -e '.changed == false'

Pinned hash 25c533bff599, from Oct 31, 2026, 06:18 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/com.goodailabs/arrakis/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for com.goodailabs/arrakis
[![anlyon.dev](https://anlyon.dev/badge/com.goodailabs/arrakis.svg)](https://anlyon.dev/servers/com.goodailabs/arrakis)

Source: MCP Registry. Synced Oct 31, 2026, 06:17 UTC.