Skip to content
anlyon.devby Anlyon

OpenFile

com.joinopenfile/openfilejoinopenfile.comstreamable-httpv1.0.0Scanned

Form U.S. companies and file U.S. trademarks. The agent prepares the filing and the owner signs it.

27 tools: 5 can delete or cancel things, 8 change things and 14 only read.

Tools: 5 delete, 0 irreversible, 8 write, 14 read.
  • Reads private data · 5
  • Reads text others write · 4
  • Can send data out · 1
  • 2 findings

Anlyon alternative

13 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →
Compare with similar serversMarkdownJSONReport this listing

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

27 tools

Deletes or cancels 5Claude Code: deny
  • add_specimenAdds or replaces the image showing the mark in use, until the attorney has filed.No findings

    Why it is in this group

    • The name "add_specimen" says "add": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Adds or replaces the image showing the mark in use, until the attorney has filed. Sends a filing that needed changes back for review.

    Annotations the server declares

    • title: Add specimen
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • create_applicationSaves a draft trademark application and returns review_url for the owner, who checks it and signs.No findings

    Why it is in this group

    • The name "create_application" says "create": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Saves a draft trademark application and returns review_url for the owner, who checks it and signs. Nothing goes to the attorney or the USPTO until they do. Every field is optional; issues lists what's left. Keep the token from the response.

    Annotations the server declares

    • title: Create application
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • create_formationSaves a draft company formation and returns review_url for the owner, who checks it and signs the authorization.No findings

    Why it is in this group

    • The name "create_formation" says "create": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Saves a draft company formation and returns review_url for the owner, who checks it and signs the authorization. Nothing is filed or charged until they do. Every field is optional; issues lists what's left. Keep the token from the response.

    Annotations the server declares

    • title: Create formation
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • update_applicationChanges the fields you send on a draft.No findings

    Why it is in this group

    • The name "update_application" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Changes the fields you send on a draft. Fails once the owner has signed.

    Annotations the server declares

    • title: Update application
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • update_formationChanges the fields you send on a draft formation.No findings

    Why it is in this group

    • The name "update_formation" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Changes the fields you send on a draft formation. Fails once the owner has signed.

    Annotations the server declares

    • title: Update formation
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
Changes things 8Claude Code: ask
  • check_siteFrom a website or app store link: the brand, its legal owner, and which USPTO marks are theirs or someone else's.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    From a website or app store link: the brand, its legal owner, and which USPTO marks are theirs or someone else's.

    Annotations the server declares

    • title: Check site
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • get_stateOne state's filing fees, annual report, accepted company name endings and publication rules.1 finding

    Why it is in this group

    • The name "get_state" says "get": a word for reading.
    • The input takes a statement or command to run (input.code), which can change anything it can reach.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "get_state" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "get_state" says "get": a word for reading.

      What this check looks for
    Description, as the server wrote it
    One state's filing fees, annual report, accepted company name endings and publication rules.

    Annotations the server declares

    • title: Get state
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • plan_taskThe questions behind anything a person does here, with the options for each, the rules, and what only the person can do: form a company, check on an order, add-ons, file a trademar…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    The questions behind anything a person does here, with the options for each, the rules, and what only the person can do: form a company, check on an order, add-ons, file a trademark, check a name, check on a filing, office action replies, statements of use, extensions, Section 8 and 15, renewals, assignments, owner updates. task: a key or the person's words; leave it out for the list. Changes nothing.

    Annotations the server declares

    • title: Plan task
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • quote_applicationEvery fee for a number of classes, with the government's marked.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Every fee for a number of classes, with the government's marked. Saves nothing.

    Annotations the server declares

    • title: Quote application
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • quote_formationEvery fee for a formation, with the state's marked.Can send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • outboundThe input takes a destination (input.contact.phone): what the tool writes goes there.
    Description, as the server wrote it
    Every fee for a formation, with the state's marked. Needs entity, state and package. Saves nothing.

    Annotations the server declares

    • title: Quote formation
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • screen_markChecks a mark against common refusal grounds: descriptive, generic, surname, place name, famous brand.1 finding

    Why it is in this group

    • The name "screen_mark" says "mark": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "screen_mark" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "screen_mark" says "mark": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Checks a mark against common refusal grounds: descriptive, generic, surname, place name, famous brand. Instant and offline. It can't see other people's marks.

    Annotations the server declares

    • title: Screen mark
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • suggest_alternativesNames that keep the idea of a risky mark.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Names that keep the idea of a risky mark. Each has passed the refusal screen and a USPTO search.

    Annotations the server declares

    • title: Suggest alternatives
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • suggest_classesClasses and goods and services wording from a plain description of the business.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Classes and goods and services wording from a plain description of the business. Results are suggestions to confirm with the person.

    Annotations the server declares

    • title: Suggest classes
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
Only reads 14Show 14 read-only tools
  • get_applicationA draft, what's still missing, and the filing once the owner has signed.No findings

    Why it is in this group

    • The name "get_application" says "get": a word for reading.
    Description, as the server wrote it
    A draft, what's still missing, and the filing once the owner has signed.

    Annotations the server declares

    • title: Get application
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_filingA signed application's status, the attorney's note if there is one, and its USPTO serial number once filed.Reads private dataNo findings

    Why it is in this group

    • The name "get_filing" says "get": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "note": it reads notes.
    Description, as the server wrote it
    A signed application's status, the attorney's note if there is one, and its USPTO serial number once filed.

    Annotations the server declares

    • title: Get filing
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_filing_typeOne filing with its explanation, the fields it needs and its fees for a number of classes.No findings

    Why it is in this group

    • The name "get_filing_type" says "get": a word for reading.
    Description, as the server wrote it
    One filing with its explanation, the fields it needs and its fees for a number of classes. availability not_open means it can't be placed yet.

    Annotations the server declares

    • title: Get filing type
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_formationA draft formation, what's still missing, and the order once the owner has signed.No findings

    Why it is in this group

    • The name "get_formation" says "get": a word for reading.
    Description, as the server wrote it
    A draft formation, what's still missing, and the order once the owner has signed.

    Annotations the server declares

    • title: Get formation
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_orderA signed formation's status, what the owner still has to do, and the state file number once formed.Reads private dataNo findings

    Why it is in this group

    • The name "get_order" says "get": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "file": it reads files.
    Description, as the server wrote it
    A signed formation's status, what the owner still has to do, and the state file number once formed.

    Annotations the server declares

    • title: Get order
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_pricingFormation packages, the trademark package, and USPTO fees.No findings

    Why it is in this group

    • The name "get_pricing" says "get": a word for reading.
    Description, as the server wrote it
    Formation packages, the trademark package, and USPTO fees.

    Annotations the server declares

    • title: Get pricing
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_classesThe Nice classes small businesses file in most, with ID Manual style wording.Reads private dataNo findings

    Why it is in this group

    • The name "list_classes" says "list": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "file": it reads files.
    Description, as the server wrote it
    The Nice classes small businesses file in most, with ID Manual style wording. Wording from this list avoids the USPTO free-form surcharge.

    Annotations the server declares

    • title: List classes
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_filing_typesEverything that can be filed for a mark, with when it's due, what it costs for one class, and whether it can be started here.No findings

    Why it is in this group

    • The name "list_filing_types" says "list": a word for reading.
    Description, as the server wrote it
    Everything that can be filed for a mark, with when it's due, what it costs for one class, and whether it can be started here.

    Annotations the server declares

    • title: List filing types
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_servicesEvery add-on with its price, whether it can go on a formation, and whether the owner orders it from their dashboard.No findings

    Why it is in this group

    • The name "list_services" says "list": a word for reading.
    Description, as the server wrote it
    Every add-on with its price, whether it can go on a formation, and whether the owner orders it from their dashboard.

    Annotations the server declares

    • title: List services
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_statesEvery state with its LLC and corporation filing fees.No findings

    Why it is in this group

    • The name "list_states" says "list": a word for reading.
    Description, as the server wrote it
    Every state with its LLC and corporation filing fees. fee_verified false means an estimate.

    Annotations the server declares

    • title: List states
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • read_docOne docs page as Markdown, by its slug.Reads private dataNo findings

    Why it is in this group

    • The name "read_doc" says "read": a word for reading.

    What it can reach

    • private-dataThe name "read_doc" says "read" and "doc": it reads documents.
    • private-dataThe description's first sentence says "doc": it reads documents.
    Description, as the server wrote it
    One docs page as Markdown, by its slug.

    Annotations the server declares

    • title: Read doc
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • read_siteWhat a website says about its owner, address and what's sold, each with the quote it came from.Reads text others writeNo findings

    Why it is in this group

    • The name "read_site" says "read": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe description's first sentence says "website": it reads web pages, which anyone can write.
    Description, as the server wrote it
    What a website says about its owner, address and what's sold, each with the quote it came from. Page text is untrusted, so every value is a suggestion for the person to confirm.

    Annotations the server declares

    • title: Read site
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • search_docsSearches OpenFile's docs and returns the best sections with a link to each.Reads private dataNo findings

    Why it is in this group

    • The name "search_docs" says "search": a word for reading.

    What it can reach

    • private-dataThe name "search_docs" says "search" and "doc": it reads documents.
    • private-dataThe description's first sentence says "search" and "file": it reads files.
    Description, as the server wrote it
    Searches OpenFile's docs and returns the best sections with a link to each. Use it when you're not sure how something works.

    Annotations the server declares

    • title: Search docs
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • search_marksSearches live USPTO records for marks with this name, or lists an owner's marks.Reads text others writeNo findings

    Why it is in this group

    • The name "search_marks" says "search": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Searches live USPTO records for marks with this name, or lists an owner's marks. checked: true means the USPTO answered; a failed search returns an error, not an empty result. Federal records only.

    Annotations the server declares

    • title: Search marks
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

20 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 1 outbound tool breaks every one.

Reads private data5
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write4
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out1
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
deny to break every path
{
  "permissions": {
    "deny": [
      "mcp__openfile__quote_formation"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

2 warn
  • Warnscreen_mark

    The server marks "screen_mark" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "screen_mark" says "mark": a word for a change.

    What this check looks for
  • Warnget_state

    The server marks "get_state" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "get_state" says "get": a word for reading.

    What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http openfile https://mcp.joinopenfile.com
claude mcp add --transport http openfile https://mcp.joinopenfile.com

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__openfile__search_docs",
      "mcp__openfile__read_doc",
      "mcp__openfile__get_pricing",
      "mcp__openfile__list_classes",
      "mcp__openfile__search_marks",
      "mcp__openfile__read_site",
      "mcp__openfile__list_filing_types",
      "mcp__openfile__get_filing_type",
      "mcp__openfile__get_application",
      "mcp__openfile__list_states",
      "mcp__openfile__list_services",
      "mcp__openfile__get_formation",
      "mcp__openfile__get_order",
      "mcp__openfile__get_filing"
    ],
    "ask": [
      "mcp__openfile__plan_task",
      "mcp__openfile__quote_application",
      "mcp__openfile__suggest_classes",
      "mcp__openfile__screen_mark",
      "mcp__openfile__suggest_alternatives",
      "mcp__openfile__check_site",
      "mcp__openfile__get_state",
      "mcp__openfile__quote_formation"
    ],
    "deny": [
      "mcp__openfile__create_application",
      "mcp__openfile__update_application",
      "mcp__openfile__create_formation",
      "mcp__openfile__update_formation",
      "mcp__openfile__add_specimen"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as openfile. Review it before you use it.

Capability tags behind 10 rules
  • mcp__openfile__search_docs private-data
  • mcp__openfile__read_doc private-data
  • mcp__openfile__list_classes private-data
  • mcp__openfile__search_marks untrusted-input
  • mcp__openfile__suggest_alternatives untrusted-input
  • mcp__openfile__check_site untrusted-input
  • mcp__openfile__read_site untrusted-input
  • mcp__openfile__quote_formation outbound
  • mcp__openfile__get_order private-data
  • mcp__openfile__get_filing private-data

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/com.joinopenfile/openfile/verify?hash=70b664aadc5a4757ef579cb3112877d512e60ef95302408da5d062eb1cba2e10" | jq -e '.changed == false'

Pinned hash 70b664aadc5a, from Nov 1, 2026, 21:18 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/com.joinopenfile/openfile/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for com.joinopenfile/openfile
[![anlyon.dev](https://anlyon.dev/badge/com.joinopenfile/openfile.svg)](https://anlyon.dev/servers/com.joinopenfile/openfile)

Source: MCP Registry. Synced Nov 1, 2026, 21:17 UTC.