Kariaa

com.kariaa/mcpkariaa.comstreamable-httpv1.1.0Scanned 24 hours ago

Find jobs worldwide, check posts for scams, see typical pay, and apply to DataHouse remote tasks.

19 tools: 1 can delete or cancel things, 2 do something that can't be undone, 11 change things and 5 only read.

Reads private data · 3
Reads text others write · 3
Can send data out · 2
4 findings

Tools listed without sign-in. Remote posture

Anlyon alternative

14 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

19 tools

Deletes or cancels 1Removes, cancels or revokes something.Claude Code: deny

remove_sampleTake back one staged sample (a wrong or bad file) so another can be uploaded in its place.No findings
Why it is in this group
- The name "remove_sample" says "remove": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Take back one staged sample (a wrong or bad file) so another can be uploaded in its place. Only before submit_samples. file_id comes from confirm_upload, get_submission or my_submissions.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- openWorldHint: false
- idempotentHint: true

Can't be undone 2Sends, pays, publishes or merges: once done, it cannot be taken back.Claude Code: ask

estimate_payWhat employers state for a role in a city or country, from recent postings that list pay: the typical range, how many postings it comes from, and examples with links.1 finding
Why it is in this group
- The name "estimate_pay" says "pay": a word that usually means money moves, which cannot be taken back.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
  The server marks "estimate_pay" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
  Matched text
  annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":false}; The name "estimate_pay" says "pay": a word that usually means money moves, which cannot be taken back.
  What this check looks for
Description, as the server wrote it
What employers state for a role in a city or country, from recent postings that list pay: the typical range, how many postings it comes from, and examples with links. When there are too few, say so and research further yourself.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: false
- title: Pay for a role
submit_samplesSend the staged samples of a task for review.No findings
Why it is in this group
- The name "submit_samples" says "submit": a word for a change.
- The description's first verb is "send": a word for sending, and what is sent cannot be taken back.
Description, as the server wrote it
Send the staged samples of a task for review. Needs every sample the task asks for. Optional text_response for notes.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: false
- idempotentHint: true

Changes things 11Creates or changes something that can be changed back.Claude Code: ask

add_text_sampleFor a text task: the person's written answer (20 to 20,000 characters), stored as a .txt sample.No findings
Why it is in this group
- The name "add_text_sample" says "add": a word for a change.
Description, as the server wrote it
For a text task: the person's written answer (20 to 20,000 characters), stored as a .txt sample.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: false
apply_to_taskJoin a DataHouse task for the person.No findings
Why it is in this group
- The name "apply_to_task" says "apply": a word for a change.
Description, as the server wrote it
Join a DataHouse task for the person. `answers` maps each question id from get_task to the answer (a string, or a list for multiselect); every required question needs one. Optional preferred rate in their words ("$2 per clip"). One application per task; a task with a sample unlocks its sample step at once.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: false
- idempotentHint: true
check_job_postWarning signs in a job post, recruiter message or offer (fees, upfront payments, personal email domains, link shorteners, pressure, requests for ID or bank details), each with the …Can send data out1 finding
Why it is in this group
- The name "check_job_post" says "post": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- outboundThe name "check_job_post" says "post": it sends or publishes something to other people.
Findings
- Warn
  The server marks "check_job_post" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
  Matched text
  annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":false}; The name "check_job_post" says "post": a word for a change.
  What this check looks for
Description, as the server wrote it
Warning signs in a job post, recruiter message or offer (fees, upfront payments, personal email domains, link shorteners, pressure, requests for ID or bank details), each with the exact quoted line. Rule-based. Pass the text in English; translate it first if needed, keeping amounts, links, phone numbers and emails exactly as written.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: false
- title: Check a job post
confirm_uploadAfter the PUT: register the object at `path` as a sample of the task.No findings
Why it is in this group
- The name "confirm_upload" says "upload": a word for a change.
Description, as the server wrote it
After the PUT: register the object at `path` as a sample of the task. Returns how many samples are in and how many the task wants.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: false
- idempotentHint: true
get_upload_linkA one-tap link to this task's upload page on kariaa.com, already signed in, where the person picks their photos, voice notes or videos from their phone or computer.Reads private data1 finding
Why it is in this group
- The name "get_upload_link" says "get": a word for reading.
- The server marks it as not read-only (readOnlyHint: false).
What it can reach
- private-dataThe description's first sentence says "note": it reads notes.
Findings
- Warn
  The server marks "get_upload_link" as not read-only (readOnlyHint: false), and its words say it reads.
  Matched text
  annotations: {"readOnlyHint":false,"destructiveHint":false,"openWorldHint":false}; The name "get_upload_link" says "get": a word for reading.
  What this check looks for
Description, as the server wrote it
A one-tap link to this task's upload page on kariaa.com, already signed in, where the person picks their photos, voice notes or videos from their phone or computer. Use it whenever you cannot send the file bytes yourself (chat apps). The link works once, for 15 minutes; give it to the person as is.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: false
list_tasksThe open DataHouse tasks: title, kind (video, photo, voice, text), the unpaid verification sample each wants and the rate paid work earns after verification.1 finding
Why it is in this group
- The name "list_tasks" says "list": a word for reading.
- The description's first verb is "open": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
  The server marks "list_tasks" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
  Matched text
  annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":false}; The name "list_tasks" says "list": a word for reading.
  What this check looks for
Description, as the server wrote it
The open DataHouse tasks: title, kind (video, photo, voice, text), the unpaid verification sample each wants and the rate paid work earns after verification. No key needed. Filter by file kind.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: false
my_saved_jobsThe jobs the person saved, newest first, with whether each is still open.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
The jobs the person saved, newest first, with whether each is still open. Needs a Kariaa API key.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: false
- title: My saved jobs
my_submissionsEvery DataHouse task the person joined, newest first, with its stage (pending_review, sample_needed, in_review, approved, rejected).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Every DataHouse task the person joined, newest first, with its stage (pending_review, sample_needed, in_review, approved, rejected).
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: false
request_uploadA one-time signed URL for ONE sample file of a task the person joined.No findings
Why it is in this group
- The name "request_upload" says "request": a word for a change.
Description, as the server wrote it
A one-time signed URL for ONE sample file of a task the person joined. PUT the raw bytes to upload_url with the returned headers, then call confirm_upload with the path. Kind must match the task; up to 100 MB; up to 10 files per task.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: false
save_jobKeep a job from search_jobs on the person's Kariaa list to come back to.No findings
Why it is in this group
- The name "save_job" says "save": a word for a change.
Description, as the server wrote it
Keep a job from search_jobs on the person's Kariaa list to come back to. Needs a Kariaa API key.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: false
- title: Save a job
- idempotentHint: true
update_profileSave the basics a task needs: legal first and last name, phone in E.164 (+1…), location as "City, Country", occupation (one to five titles, "student" is fine), language.Can send data outNo findings
Why it is in this group
- The name "update_profile" says "update": a word for a change.
What it can reach
- outboundThe input takes a destination (input.phone_number): what the tool writes goes there.
Description, as the server wrote it
Save the basics a task needs: legal first and last name, phone in E.164 (+1…), location as "City, Country", occupation (one to five titles, "student" is fine), language.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: false

Only reads 5Looks things up and changes nothing.Show 5 read-only tools

get_jobOne job from search_jobs in full: description, requirements, pay when stated, posted date and the link to apply.Reads text others writeNo findings
Why it is in this group
- The name "get_job" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
One job from search_jobs in full: description, requirements, pay when stated, posted date and the link to apply. Use it to tailor a resume or cover letter to the posting.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
- title: Open a job
get_submissionOne task the person joined: stage, staged files, review outcome and the next step.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "get_submission" says "get": a word for reading.
What it can reach
- private-dataThe description's first sentence says "file": it reads files.
- untrusted-inputThe description's first sentence says "review": it reads comments, which other people can write.
Description, as the server wrote it
One task the person joined: stage, staged files, review outcome and the next step.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: false
get_taskOne task in full: description, the task's own material (instructions: the sentences to read, texts to label, answers to rate), the unpaid verification sample with how-to steps and …Reads private dataNo findings
Why it is in this group
- The name "get_task" says "get": a word for reading.
What it can reach
- private-dataThe description's first sentence says "file": it reads files.
Description, as the server wrote it
One task in full: description, the task's own material (instructions: the sentences to read, texts to label, answers to rate), the unpaid verification sample with how-to steps and rules, allowed file kinds, the qualification questions (with ids, for apply_to_task) and the rate paid work earns after verification.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: false
search_jobsLive job openings for a role, near a place or remote, from job boards (LinkedIn, Indeed, Glassdoor, ZipRecruiter, national boards) and remote-job sites, newest relevant first, with…Reads text others writeNo findings
Why it is in this group
- The name "search_jobs" says "search": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Live job openings for a role, near a place or remote, from job boards (LinkedIn, Indeed, Glassdoor, ZipRecruiter, national boards) and remote-job sites, newest relevant first, with links to apply on the employer's page. Works without a key. Pass the role as people say it ("electrician", "nurse", "data analyst") and the place as "City, Country".
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
- title: Search jobs
whoamiThe account behind the key, whether the basics a task needs are in (legal name, phone, location, occupation), and today's usage.No findings
Why it is in this group
- The name "whoami" says "whoami": a word for reading.
Description, as the server wrote it
The account behind the key, whether the basics a task needs are in (legal name, phone, location, occupation), and today's usage.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

18 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 2 outbound tools breaks every one.

Reads private data3: Reads files, mail, messages, databases, secrets, calendars or repositories.; get_submission
get_task
get_upload_link
Reads text others write3: Brings in text someone else can write: web pages, inbound email, messages, issues and comments.; get_job
get_submission
search_jobs
Can send data out2: Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.; check_job_post
update_profile

deny to break every path

{
  "permissions": {
    "deny": [
      "mcp__kariaa__check_job_post",
      "mcp__kariaa__update_profile"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Tools listed without sign-in

Looked at Oct 22, 2026, 14:34 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable: yes
HTTP status of an anonymous initialize: 200
tools/list served without credentials: yes
Tools that change things, listed without credentials: 14
Protocol version: 2025-06-18
WWW-Authenticate on 401: not observed
resource_metadata in WWW-Authenticate: not observed
RFC 9728 protected resource metadata: https://agent.kariaa.com/.well-known/oauth-protected-resource/mcp
Authorization servers: https://agent.kariaa.com
Legacy HTTP+SSE transport: no
Dynamic client registration: yes
Client ID metadata documents: no

HighThe whole server
The endpoint served tools/list without credentials, and the list has 14 tools that change things (1 destructive, 2 irreversible, 11 write). Whether a call also works without credentials was not tested: tools are never called.
Matched text
https://agent.kariaa.com/mcp: tools/list returned 19 tools to an anonymous client, including remove_sample (destructive), submit_samples (irreversible), estimate_pay (irreversible), list_tasks (write), update_profile (write) and 9 more
What this check looks for

Findings

Matches of fixed checks, with the text they matched.

4 warn

Warnlist_tasks
The server marks "list_tasks" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
Matched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":false}; The name "list_tasks" says "list": a word for reading.
What this check looks for
Warnget_upload_link
The server marks "get_upload_link" as not read-only (readOnlyHint: false), and its words say it reads.
Matched text
annotations: {"readOnlyHint":false,"destructiveHint":false,"openWorldHint":false}; The name "get_upload_link" says "get": a word for reading.
What this check looks for
Warncheck_job_post
The server marks "check_job_post" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
Matched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":false}; The name "check_job_post" says "post": a word for a change.
What this check looks for
Warnestimate_pay
The server marks "estimate_pay" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
Matched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":false}; The name "estimate_pay" says "pay": a word that usually means money moves, which cannot be taken back.
What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 1.1.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http kariaa https://agent.kariaa.com/mcp

claude mcp add --transport http kariaa https://agent.kariaa.com/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__kariaa__get_task",
      "mcp__kariaa__whoami",
      "mcp__kariaa__get_submission",
      "mcp__kariaa__search_jobs",
      "mcp__kariaa__get_job"
    ],
    "ask": [
      "mcp__kariaa__list_tasks",
      "mcp__kariaa__update_profile",
      "mcp__kariaa__apply_to_task",
      "mcp__kariaa__request_upload",
      "mcp__kariaa__confirm_upload",
      "mcp__kariaa__get_upload_link",
      "mcp__kariaa__add_text_sample",
      "mcp__kariaa__submit_samples",
      "mcp__kariaa__my_submissions",
      "mcp__kariaa__check_job_post",
      "mcp__kariaa__estimate_pay",
      "mcp__kariaa__save_job",
      "mcp__kariaa__my_saved_jobs"
    ],
    "deny": [
      "mcp__kariaa__remove_sample"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as kariaa. Review it before you use it.

Capability tags behind 7 rules

mcp__kariaa__get_task private-data
mcp__kariaa__update_profile outbound
mcp__kariaa__get_upload_link private-data
mcp__kariaa__get_submission private-data, untrusted-input
mcp__kariaa__search_jobs untrusted-input
mcp__kariaa__get_job untrusted-input
mcp__kariaa__check_job_post outbound

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/com.kariaa/mcp/verify?hash=b206bd98c6c5ac5a3abc68f75364e56164972c74811564730917a42402c59c09" | jq -e '.changed == false'

Pinned hash b206bd98c6c5, from Oct 21, 2026, 18:51 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/com.kariaa/mcp/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

[![anlyon.dev](https://anlyon.dev/badge/com.kariaa/mcp.svg)](https://anlyon.dev/servers/com.kariaa/mcp)

Source: MCP Registry. Synced Oct 21, 2026, 17:57 UTC.