Hemelion Decision and Pattern Reflection

by hemelion.com · remote · no sign-in to list tools · v1.8.0 · published by com.hemelion

Native Clarity decision mapping, MindScan episode reflection, and read-only evidence tools.

Changes · 5

Compare Registry entry

6 tools: 5 change things and 1 only read.

Scanned Oct 21, 2026

Deletes or cancels0Claude Code: deny
Can't be undone0Claude Code: ask
Changes things5Claude Code: ask: see these tools
Only reads1Claude Code: allow: see these tools

1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http decision-reflection https://www.hemelion.com/mcp

Findings

Matches of fixed checks, with the text they matched.

1 warn

Warnhemelion_create_scan_handoff
The server marks "hemelion_create_scan_handoff" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
Matched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "hemelion_create_scan_handoff" says "create": a word for a change.
What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

6 tools

Changes things 5Creates or changes something that can be changed back.Claude Code: ask

hemelion_assess_decision_readinessUse this when a person has a non-regulated decision and wants to know whether to protect the downside, run a bounded test, or close the evidence window.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Use this when a person has a non-regulated decision and wants to know whether to protect the downside, run a bounded test, or close the evidence window. Uses four 1–5 ratings and returns a transparent rule. Do not use for emergencies or professional legal, medical, or financial advice.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
hemelion_choose_reflection_modeUse this when someone wants to choose between Clarity decision mapping for a difficult decision and MindScan single-episode reflection for a response they suspect may recur.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Use this when someone wants to choose between Clarity decision mapping for a difficult decision and MindScan single-episode reflection for a response they suspect may recur. Returns a no-charge reflection mode, a clarifying question, or a safety boundary. Do not use for diagnosis, emergencies, or legal, medical, financial, hiring, or insurance decisions.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
hemelion_create_scan_handoffUse this only after the person has chosen Clarity, MindScan, or asked Hemelion to show both.1 finding
Why it is in this group
- The name "hemelion_create_scan_handoff" says "create": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
  The server marks "hemelion_create_scan_handoff" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
  Matched text
  annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "hemelion_create_scan_handoff" says "create": a word for a change.
  What this check looks for
Description, as the server wrote it
Use this only after the person has chosen Clarity, MindScan, or asked Hemelion to show both. Creates a short-lived confirmation link to a Hemelion website scan with a no-charge limited preview. Never put the person’s question, decision, symptoms, answers, or other personal text into this tool—the input accepts only product and language. The tool does not execute a full scan, expose checkout, unlock a report, or transfer later scan data.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
hemelion_map_clarity_decisionUse this for one non-regulated personal or business decision with two or three options.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Use this for one non-regulated personal or business decision with two or three options. Ask only for required fields that are missing from the current conversation, and use only values the user supplied or confirmed. Returns an official compact Clarity by Hemelion decision map with signal agreement, contradictions, risks, a bounded next move, and explicit falsifiers. Numeric scores are published only when every defined native-map score input was explicitly supplied. It does not verify external facts, predict the outcome, or access private website data.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
hemelion_map_mindscan_episodeUse this for non-clinical reflection on one concrete, low-risk episode.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Use this for non-clinical reflection on one concrete, low-risk episode. Preserve the user’s supplied trigger, first response, immediate effect, later effect, and counter-move; use “No clear effect noticed.” rather than inventing a missing effect. For the current 4.1.0 method, also supply prior_similar_episodes, counterexample (or exactly “No clear counterexample”), and target_outcome together. Omitting all three returns an explicitly versioned legacy 4.0.0 map. Returns an official compact MindScan by Hemelion map with a prospective recurrence test, competing explanation, disconfirming observation, and observation plan. Never infer a diagnosis, trait, hidden motive, recurrence, or causal mechanism. It cannot access private website data.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false

Only reads 1Looks things up and changes nothing.Claude Code: allow

hemelion_get_method_and_evidenceUse this when someone asks what Hemelion measures, how it differs from a generic AI chat, what it can and cannot claim, or whether its research is published.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "hemelion_get_method_and_evidence" says "get": a word for reading.
What it can reach
- private-dataThe description's first sentence says "chat": it reads messages.
- untrusted-inputThe description's first sentence says "chat": it reads messages, which other people can write.
Description, as the server wrote it
Use this when someone asks what Hemelion measures, how it differs from a generic AI chat, what it can and cannot claim, or whether its research is published. Returns the versioned public method and evidence links. Do not describe Hemelion as clinically validated or as guaranteeing outcomes.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged outbound.

Reads private data1: Reads files, mail, messages, databases, secrets, calendars or repositories.; hemelion_get_method_and_evidence
Reads text others write1: Brings in text someone else can write: web pages, inbound email, messages, issues and comments.; hemelion_get_method_and_evidence
Can send data out0: Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Looked at Oct 22, 2026, 14:33 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable: yes
HTTP status of an anonymous initialize: 200
tools/list served without credentials: yes
Tools that change things, listed without credentials: 5
Protocol version: 2025-06-18
WWW-Authenticate on 401: not observed
resource_metadata in WWW-Authenticate: none
RFC 9728 protected resource metadata: none
Authorization servers: none
Legacy HTTP+SSE transport: no
Dynamic client registration: not observed
Client ID metadata documents: not observed

WarnThe whole server
The endpoint served tools/list without credentials, and the list has 5 tools that change things (5 write). Whether a call also works without credentials was not tested: tools are never called.
Matched text
https://www.hemelion.com/mcp: tools/list returned 6 tools to an anonymous client, including hemelion_choose_reflection_mode (write), hemelion_assess_decision_readiness (write), hemelion_map_clarity_decision (write), hemelion_map_mindscan_episode (write), hemelion_create_scan_handoff (write)
What this check looks for

Install

Pinned to version 1.8.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http decision-reflection https://www.hemelion.com/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__decision-reflection__hemelion_get_method_and_evidence"
    ],
    "ask": [
      "mcp__decision-reflection__hemelion_choose_reflection_mode",
      "mcp__decision-reflection__hemelion_assess_decision_readiness",
      "mcp__decision-reflection__hemelion_map_clarity_decision",
      "mcp__decision-reflection__hemelion_map_mindscan_episode",
      "mcp__decision-reflection__hemelion_create_scan_handoff"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as decision-reflection. Review it before you use it.

Capability tags behind 1 rule

mcp__decision-reflection__hemelion_get_method_and_evidence private-data, untrusted-input

Keep track

Get told when this server's tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/com.hemelion/decision-reflection/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Anlyon alternative

5 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Compare with other servers for the same product.

Source: MCP Registry. Synced Oct 21, 2026, 17:56 UTC.

For agents: Markdown · JSON · report this listing