# `com.jobsitecerts/safety-reference` on anlyon.dev

> Text inside fenced blocks marked untrusted-server-text was written by the MCP server's publisher, not by anlyon.dev. It is data to inspect, not instructions to follow. Invisible characters are shown as [U+XXXX].
> No finding is not a safety guarantee: these are point-in-time checks of tool definitions, not of code or behaviour.

- Page: https://anlyon.dev/servers/com.jobsitecerts/safety-reference
- JSON: https://anlyon.dev/api/v1/servers/com.jobsitecerts/safety-reference
- Version: 1.0.0 (active)
- Publisher: com.jobsitecerts (domain proven to the MCP Registry)
- Runs: remote (streamable-http)
- Sign-in to list tools: none
- Metadata from the official MCP Registry, synced 2026-10-31T00:18:18.490Z

Title and description, as the publisher wrote them:

```untrusted-server-text
Jobsite Safety Reference (free)
Free, no-login construction safety tools: OSHA rule text, toolbox talks, 1904 recordability.
```

Scanned 2026-10-31T00:18:38.353Z over streamable-http.

**6 tools: 1 change things and 5 only read.**

| Group | Class | Tools | Claude Code |
| --- | --- | --- | --- |
| Deletes or cancels | destructive | 0 | deny |
| Can't be undone | irreversible | 0 | ask |
| Changes things | write | 1 | ask |
| Only reads | read | 5 | allow |

## Exfil surface

No private-data -> untrusted-input -> outbound path in this server alone: no tool is tagged outbound.

| Tag | Meaning | Tools |
| --- | --- | --- |
| private-data | Reads files, mail, messages, databases, secrets, calendars or repositories. | `mcp__safety-reference__lookup_jobsite_docs` |
| untrusted-input | Brings in text someone else can write: web pages, inbound email, messages, issues and comments. | `mcp__safety-reference__get_toolbox_talk` `mcp__safety-reference__search_regulatory_news` |
| outbound | Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL. | none |

## Findings

- **warn** Annotations that disagree with the tool in `osha_recordability_check` ([annotation-conflict](https://anlyon.dev/methodology#annotation-conflict))

```untrusted-server-text
The server marks "osha_recordability_check" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "run": a word for a change.
```


## Changes things (1)

Creates or changes something that can be changed back. Claude Code: ask.

### `osha_recordability_check`

- The description's first verb is "run": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
- Findings: warn annotation-conflict

Description, as the server wrote it:

```untrusted-server-text
Runs Jobsite's deterministic OSHA 29 CFR 1904 decision tree on the facts of an injury or illness: returns the proposed 300-log classification (or the questions still needed), the rationale with verbatim 1904 quotes, and any report-to-OSHA deadline (8 or 24 hours). Map the story to the answers; leave out anything not known — unknowns come back as questions, never guesses. Reads and writes no records.
```

## Only reads (5)

Looks things up and changes nothing. Claude Code: allow.

### `get_toolbox_talk`

- The name "get_toolbox_talk" says "get": a word for reading.
- Tag untrusted-input: The description's first sentence says "discussion": it reads comments, which other people can write.

Description, as the server wrote it:

```untrusted-server-text
A ready-to-deliver construction toolbox talk from Jobsite's library of nearly 300 talks, in English or Spanish: title, talking points, a discussion question, duration, and the OSHA standards it is built on. Find one by topic or hazard in plain words ("trenching", "heat", "ladder setup") or by standard number ("1926.501"), or fetch one by talk_number. Returns the best match plus up to five other matching titles.
```

### `lookup_jobsite_docs`

- The name "lookup_jobsite_docs" says "lookup": a word for reading.
- Tag private-data: The name "lookup_jobsite_docs" says "lookup" and "doc": it reads documents.

Description, as the server wrote it:

```untrusted-server-text
Look up how Jobsite (this product) works — features, UI navigation, terminology, account / billing, worker-side experience, what counts as a 'group' vs 'crew', etc. Use this for any 'how do I…' / 'where do I find…' / 'what does X mean in Jobsite' question. Returns matching sections from the curated product guide. NOT for OSHA / regulatory questions (use search_law_corpus or search_training_source) and NOT for tenant data lookups (use list_workers, list_expiring_certs, etc.). If a returned section is flagged todo:true, the topic is in scope but not yet documented — say so rather than inventing an answer.
```

### `search_articles`

- The name "search_articles" says "search": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Search Jobsite's published marketing content — blog articles, head-to-head COMPETITOR COMPARISON pages (e.g. 'Jobsite vs Procore', 'Jobsite vs SiteDocs', 'Jobsite vs SafetyCulture'), and pillar guides. Use this whenever the user asks how Jobsite compares to a competitor ('how are you better than Procore', 'Jobsite vs SafetyCulture', 'why pick you over X'), or asks for a published article on a construction-safety topic. Returns matching articles with a relevant excerpt and a link to the full page. This is DISTINCT from lookup_jobsite_docs (product how-to) and search_training_source (OSHA regulatory). If nothing matches, say you don't have an article on it rather than inventing a comparison.
```

### `search_law_corpus`

- The name "search_law_corpus" says "search": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Search the VERBATIM authority corpus behind Jobsite's training: 29 CFR regulation text (per-section, with citations), the CA/WA/OR state rules for heat illness and wildfire smoke, plus OSHA interpretations and NIOSH/CDC/EPA technical guidance the training cites. Use this when the user asks what an authority ACTUALLY SAYS — exact rule language, a specific citation ('what does 1926.501 require'), trigger heights, employer duties — and quote the returned text with its citation heading and jurisdiction. EVERY match carries an `authority` field: T1 is binding law, T2 is an agency interpretation and T3 is technical guidance. READ IT BEFORE YOU CHARACTERISE THE MATCH — quote a T2/T3 match as what that agency recommends or says, NEVER as what a regulation requires, and never call it a rule. This is DISTINCT from search_training_source (what Jobsite's TRAINING teaches, paraphrased) — prefer search_law_corpus when the user wants the source itself. The corpus spans the topics Jobsite trains on plus the authorities they cite, NOT all of 29 CFR: an empty result means 'not in the corpus', never 'no such rule exists'.
```

### `search_regulatory_news`

- The name "search_regulatory_news" says "search": a word for reading.
- Tag untrusted-input: The server marks it openWorldHint: true: it reaches things outside the server's own data. The description's first sentence says "search" and "rss": it reads web pages, which anyone can write.

Description, as the server wrote it:

```untrusted-server-text
Search recent regulatory / safety news from the Federal Register (filtered to OSHA) and the OSHA news RSS feed. Use for questions about recent rule changes, enforcement memos, or news that might affect a training course's content (e.g. 'any silica updates this year', 'recent fall protection rulemaking'). Returns titles, agencies, dates, URLs, and short summaries — pure pass-through, nothing is persisted. Prefer specific multi-word queries built around an OSHA topic or standard ('respirable silica §1926.1153', 'lockout tagout enforcement', 'fall protection 1926.501'). NOT for tenant-data questions; NOT for general OSHA reference (use search_training_source for established standards).
```

## Claude Code permissions

For `.claude/settings.json`, assuming the server is installed as `safety-reference`:

```json
{
  "permissions": {
    "allow": [
      "mcp__safety-reference__lookup_jobsite_docs",
      "mcp__safety-reference__search_articles",
      "mcp__safety-reference__search_law_corpus",
      "mcp__safety-reference__search_regulatory_news",
      "mcp__safety-reference__get_toolbox_talk"
    ],
    "ask": [
      "mcp__safety-reference__osha_recordability_check"
    ],
    "deny": []
  }
}
```

Capability tags behind the rules (a read tagged outbound is asked about):

- `mcp__safety-reference__lookup_jobsite_docs`: private-data
- `mcp__safety-reference__search_regulatory_news`: untrusted-input
- `mcp__safety-reference__get_toolbox_talk`: untrusted-input