Skip to content
anlyon.dev

IMBA Agent Spend

com.imbawallet/agentimbawallet.comstreamable-httpv0.1.4Scanned

IMBA spend MCP: USDT TRC-20 deposit and catalog buy with your key. No withdraw.

19 tools: 6 can delete or cancel things, 11 change things and 2 only read.

Tools: 6 delete, 0 irreversible, 11 write, 2 read.
  • Reads private data · 0
  • Reads text others write · 0
  • Can send data out · 4
  • 10 findings

Tools listed without sign-in. Remote posture

Anlyon alternative

17 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →
Compare with similar serversMarkdownJSONReport this listing

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

19 tools

Deletes or cancels 6Claude Code: deny
  • create_cardIssue a Visa/MasterCard prepaid from this agent 2401 USDT so the agent can pay merchants that require a card (airlines, hotels, SaaS, datacenter/GPU clouds).No findings

    Why it is in this group

    • The name "create_card" says "create": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Issue a Visa/MasterCard prepaid from this agent 2401 USDT so the agent can pay merchants that require a card (airlines, hotels, SaaS, datacenter/GPU clouds). POST /api/pin/create_card. ext_id required. imba_product_id is core.card_product.id. Never payment_source=stars. Never pass client_id. IMBA does not create the booking.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
  • kyt_checkScreen a crypto address for dirt (sanctions / mixer exposure).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Screen a crypto address for dirt (sanctions / mixer exposure). Use BEFORE you accept a TRC-20 send, or AFTER a wallet is blocked and the reason is unclear. POST /api/kyt_check. Body: network (tron_usdt | eth | btc) + address. Debits ~0.99 USDT from 2401. Returns a report — does not gate deposit, does not ban or unblock. TON is not in this catalog. Never pass client_id. Space ~1s.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
  • purchase_esimPOST /api/esim/new_plan5.No findings

    Why it is in this group

    • The name "purchase_esim" says "purchase": a word that usually means money moves, which cannot be taken back.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    POST /api/esim/new_plan5. Buy a travel/data eSIM plan from this agent 2401. Omit blank/null iccid so SQL takes the new-eSIM path. A set iccid must already belong to this agent. ext_id required. Never Stars.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
  • purchase_giftPOST /api/purchase.No findings

    Why it is in this group

    • The name "purchase_gift" says "purchase": a word that usually means money moves, which cannot be taken back.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    POST /api/purchase. Buy a brand gift code (Apple, Steam, Google Play, … — live list). ext_id required. Never payment_source=stars.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
  • rotate_hmacPOST /auth/v1/agent/hmac/rotate.Can send data outNo findings

    Why it is in this group

    • The description's first verb is "post": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • outboundThe description's first verb is "post": it sends or publishes something to other people.
    Description, as the server wrote it
    POST /auth/v1/agent/hmac/rotate. Previous HMAC dies immediately. Requires an existing callback_url (400 callback_url required before rotate otherwise). Pass callback_url here to PATCH webhook first. Plaintext HMAC is returned once — store it; never a Wallet JWT.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
  • topup_cardPOST /api/pin/topup_card from this agent 2401 USDT.No findings

    Why it is in this group

    • The name "topup_card" says "topup": a word that usually means money moves, which cannot be taken back.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    POST /api/pin/topup_card from this agent 2401 USDT. card_id must belong to the same agent (SQL owner guard). ext_id required. Never Stars.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
Changes things 11Claude Code: ask
  • get_card_detailsPOST /api/pin/get_card_details for a card this agent owns.2 findings

    Why it is in this group

    • The name "get_card_details" says "get": a word for reading.
    • The description's first verb is "post": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Info

      The title mentions "credentials".

      Matched text

      title: "Card payment credentials"

      What this check looks for
    • Warn

      The server marks "get_card_details" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true}; The name "get_card_details" says "get": a word for reading.

      What this check looks for
    Description, as the server wrote it
    POST /api/pin/get_card_details for a card this agent owns. Needed to present PAN at merchant checkout (airline, datacenter, SaaS). PAN/CVV arrive as card_encrypted JWE when jwe_public_key is registered (PATCH webhook). Without that key the number is masked. Never logs raw PAN. cvv defaults true. Never pass client_id.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
  • get_deposit_addressPOST /api/deposit_address blockchain=tron.No findings

    Why it is in this group

    • The name "get_deposit_address" says "get": a word for reading.
    • The description's first verb is "post": a word for a change.
    Description, as the server wrote it
    POST /api/deposit_address blockchain=tron. Address is issued for the authenticated agent only. Always re-fetch before send. Do not cache. USDT TRC-20 only. 24h unfunded hold.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
  • kyt_check_getPOST /api/kyt_check_get.1 finding

    Why it is in this group

    • The name "kyt_check_get" says "get": a word for reading.
    • The description's first verb is "post": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "kyt_check_get" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true}; The name "kyt_check_get" says "get": a word for reading.

      What this check looks for
    Description, as the server wrote it
    POST /api/kyt_check_get. Poll until the report is ready. Own check only (404 otherwise). Use after kyt_check when a wallet was blocked and you need the dirt report. Never pass client_id.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
  • kyt_checksPOST /api/kyt_checks.Can send data out1 finding

    Why it is in this group

    • The description's first verb is "post": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • outboundThe description's first verb is "post": it sends or publishes something to other people.

    Findings

    • Warn

      The server marks "kyt_checks" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true}; The description's first verb is "post": a word for a change.

      What this check looks for
    Description, as the server wrote it
    POST /api/kyt_checks. Own KYT history plus quote fields. Use to find a past address check. Space ~1s. Never pass client_id.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
  • kyt_quotePOST /api/kyt_quote.Can send data out1 finding

    Why it is in this group

    • The description's first verb is "post": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • outboundThe description's first verb is "post": it sends or publishes something to other people.

    Findings

    • Warn

      The server marks "kyt_quote" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true}; The description's first verb is "post": a word for a change.

      What this check looks for
    Description, as the server wrote it
    POST /api/kyt_quote. Price for a paid crypto-address screen (Didit). Debit is on kyt_check (~0.99 USDT from 2401), not on quote. Off unless didit.enabled and didit.agent_api. Does not gate TRON deposit. Not /api/client/kyt_* and not partner. Space ~1s.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
  • list_card_productsPOST /api/card_products.1 finding

    Why it is in this group

    • The name "list_card_products" says "list": a word for reading.
    • The description's first verb is "post": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "list_card_products" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true}; The name "list_card_products" says "list": a word for reading.

      What this check looks for
    Description, as the server wrote it
    POST /api/card_products. Use id as imba_product_id for create_card (Visa prepaid). Space catalog calls ~1s apart.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
  • list_cardsPOST /api/cards for the authenticated agent.1 finding

    Why it is in this group

    • The name "list_cards" says "list": a word for reading.
    • The description's first verb is "post": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "list_cards" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true}; The name "list_cards" says "list": a word for reading.

      What this check looks for
    Description, as the server wrote it
    POST /api/cards for the authenticated agent. No client_id argument.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
  • list_esim_plansPOST /api/esim/plans.1 finding

    Why it is in this group

    • The name "list_esim_plans" says "list": a word for reading.
    • The description's first verb is "post": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "list_esim_plans" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true}; The name "list_esim_plans" says "list": a word for reading.

      What this check looks for
    Description, as the server wrote it
    POST /api/esim/plans. Travel/data eSIM. esim_provider=yesim. Optional country ISO2. Use plan id with purchase_esim. Space catalog calls ~1s apart (agent catalog_gap).

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
  • list_gift_offersPOST /api/offers.1 finding

    Why it is in this group

    • The name "list_gift_offers" says "list": a word for reading.
    • The description's first verb is "post": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "list_gift_offers" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true}; The name "list_gift_offers" says "list": a word for reading.

      What this check looks for
    Description, as the server wrote it
    POST /api/offers. Live gift catalog (~20k positions / ~2k unique: Apple, Google Play, Steam, games, travel, retail). Optional query string. Then purchase_gift with offer_id + ext_id. Space catalog calls ~1s apart. Do not assume a SKU.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
  • list_notificationsPOST /api/notifications.1 finding

    Why it is in this group

    • The name "list_notifications" says "list": a word for reading.
    • The description's first verb is "post": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "list_notifications" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true}; The name "list_notifications" says "list": a word for reading.

      What this check looks for
    Description, as the server wrote it
    POST /api/notifications. Poll this when a Visa payment asks for 3-D Secure. Agents keep payload.code (never SMS, never Telegram). category=codes for 3-D Secure OTP. Also delivered on webhook field otp if callback_url is set, and optional email. Space catalog calls ~1s apart.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
  • set_webhookPATCH /auth/v1/agent/webhook.Can send data outNo findings

    Why it is in this group

    • The name "set_webhook" says "set": a word for a change.

    What it can reach

    • outboundThe input takes a URL (input.callback_url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    PATCH /auth/v1/agent/webhook. Sets https callback_url (required before hmac/rotate), optional X25519 jwe_public_key for card_encrypted, optional email for 3DS OTP. Not SMS. HMAC plaintext is shown once when a URL is first accepted.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
Only reads 2Show 2 read-only tools
  • get_balanceGET /api/balance.No findings

    Why it is in this group

    • The name "get_balance" says "get": a word for reading.
    Description, as the server wrote it
    GET /api/balance. USDT is the spendable catalog currency.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
  • get_spend_policyForbidden rails and tier rules.No findings

    Why it is in this group

    • The name "get_spend_policy" says "get": a word for reading.
    Description, as the server wrote it
    Forbidden rails and tier rules. Allowed catalog: Visa prepaid, travel eSIM, gift cards, paid KYT address screen. Read-only.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data or untrusted-input.

Reads private data0
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write0
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out4
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Tools listed without sign-in

Looked at Oct 22, 2026, 14:34 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable
yes
HTTP status of an anonymous initialize
200
tools/list served without credentials
yes
Tools that change things, listed without credentials
17
Protocol version
2025-06-18
WWW-Authenticate on 401
not observed
resource_metadata in WWW-Authenticate
not observed
RFC 9728 protected resource metadata
not observed
Authorization servers
not observed
Legacy HTTP+SSE transport
no
Dynamic client registration
not observed
Client ID metadata documents
not observed
  • HighThe whole server

    The endpoint served tools/list without credentials, and the list has 17 tools that change things (6 destructive, 11 write). Whether a call also works without credentials was not tested: tools are never called.

    Matched text

    https://imbawallet.com/mcp/spend: tools/list returned 19 tools to an anonymous client, including create_card (destructive), topup_card (destructive), purchase_gift (destructive), purchase_esim (destructive), rotate_hmac (destructive) and 12 more

    What this check looks for

Findings

Matches of fixed checks, with the text they matched.

9 warn1 info
  • Warnlist_cards

    The server marks "list_cards" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true}; The name "list_cards" says "list": a word for reading.

    What this check looks for
  • Warnlist_card_products

    The server marks "list_card_products" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true}; The name "list_card_products" says "list": a word for reading.

    What this check looks for
  • Warnlist_gift_offers

    The server marks "list_gift_offers" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true}; The name "list_gift_offers" says "list": a word for reading.

    What this check looks for
  • Warnlist_esim_plans

    The server marks "list_esim_plans" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true}; The name "list_esim_plans" says "list": a word for reading.

    What this check looks for
  • Warnget_card_details

    The server marks "get_card_details" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true}; The name "get_card_details" says "get": a word for reading.

    What this check looks for
  • Warnlist_notifications

    The server marks "list_notifications" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true}; The name "list_notifications" says "list": a word for reading.

    What this check looks for
Show 4 more findings
  • Warnkyt_quote

    The server marks "kyt_quote" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true}; The description's first verb is "post": a word for a change.

    What this check looks for
  • Warnkyt_check_get

    The server marks "kyt_check_get" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true}; The name "kyt_check_get" says "get": a word for reading.

    What this check looks for
  • Warnkyt_checks

    The server marks "kyt_checks" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true}; The description's first verb is "post": a word for a change.

    What this check looks for
  • Infoget_card_details

    The title mentions "credentials".

    Matched text

    title: "Card payment credentials"

    What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 0.1.4. Values in angle brackets are yours to fill in.

claude mcp add --transport http agent https://imbawallet.com/mcp/spend --header 'X-IMBA-Agent-Client-Id: <your-x-imba-agent-client-id>' --header 'X-IMBA-Agent-Private-Key: <your-x-imba-agent-private-key>'
claude mcp add --transport http agent https://imbawallet.com/mcp/spend --header 'X-IMBA-Agent-Client-Id: <your-x-imba-agent-client-id>' --header 'X-IMBA-Agent-Private-Key: <your-x-imba-agent-private-key>'

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__agent__get_spend_policy",
      "mcp__agent__get_balance"
    ],
    "ask": [
      "mcp__agent__get_deposit_address",
      "mcp__agent__list_cards",
      "mcp__agent__list_card_products",
      "mcp__agent__list_gift_offers",
      "mcp__agent__list_esim_plans",
      "mcp__agent__get_card_details",
      "mcp__agent__list_notifications",
      "mcp__agent__set_webhook",
      "mcp__agent__kyt_quote",
      "mcp__agent__kyt_check_get",
      "mcp__agent__kyt_checks"
    ],
    "deny": [
      "mcp__agent__create_card",
      "mcp__agent__topup_card",
      "mcp__agent__purchase_gift",
      "mcp__agent__purchase_esim",
      "mcp__agent__rotate_hmac",
      "mcp__agent__kyt_check"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as agent. Review it before you use it.

Capability tags behind 4 rules
  • mcp__agent__set_webhook outbound
  • mcp__agent__rotate_hmac outbound
  • mcp__agent__kyt_quote outbound
  • mcp__agent__kyt_checks outbound

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/com.imbawallet/agent/verify?hash=51f0a6f30512136ac0cf6d2ffe26afa39e1205a64e7007c42471e5af9ac63dc8" | jq -e '.changed == false'

Pinned hash 51f0a6f30512, from Oct 21, 2026, 18:34 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/com.imbawallet/agent/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for com.imbawallet/agent
[![anlyon.dev](https://anlyon.dev/badge/com.imbawallet/agent.svg)](https://anlyon.dev/servers/com.imbawallet/agent)

Source: MCP Registry · repository. Synced Oct 21, 2026, 17:56 UTC.