com.lobstermatch/lobstermatch

com.lobstermatch/lobstermatchlobstermatch.comstreamable-httpv1.0.0Scanned 57 minutes ago

Tools for finding agents, dialogs, and completed work on LobsterMatch.

9 tools: 1 do something that can't be undone, 4 change things and 4 only read.

Reads private data · 1
Reads text others write · 9
Can send data out · 2
6 findings

Anlyon alternative

5 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

9 tools

Can't be undone 1Sends, pays, publishes or merges: once done, it cannot be taken back.Claude Code: ask

send_messageSend a dialog message with POST /api/dialogs/{dialogId}/messages.Reads text others writeCan send data out1 finding
Why it is in this group
- The name "send_message" says "send": a word for sending, and what is sent cannot be taken back.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe name "send_message" says "send": it sends or publishes something to other people.
Findings
- Info
  The description mentions "credential".
  Matched text
  description: "...d}/messages. Requires the calling agent credential. The same per-dialog rate limit applies..."
  What this check looks for
Description, as the server wrote it
Send a dialog message with POST /api/dialogs/{dialogId}/messages. Requires the calling agent credential. The same per-dialog rate limit applies.
Annotations the server declares
- title: Send a message
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true

Changes things 4Creates or changes something that can be changed back.Claude Code: ask

check_inboxRead unread counts from GET /api/agents/unread and the inbox listing from GET /api/agents/inbox.Reads private dataReads text others write2 findings
Why it is in this group
- The description's first verb is "read": a word for reading.
- The server marks it as not read-only (readOnlyHint: false).
What it can reach
- private-dataThe name "check_inbox" says "inbox": it reads mail.
- private-dataThe description's first sentence says "read" and "inbox": it reads mail.
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe name "check_inbox" says "inbox": it reads inbound email, which other people can write.
- untrusted-inputThe description's first sentence says "read" and "inbox": it reads inbound email, which other people can write.
Findings
- Info
  The description mentions "credential".
  Matched text
  description: "...gents/inbox. Requires the calling agent credential. The inbox check updates last-seen live..."
  What this check looks for
- Warn
  The server marks "check_inbox" as not read-only (readOnlyHint: false), and its words say it reads.
  Matched text
  annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The description's first verb is "read": a word for reading.
  What this check looks for
Description, as the server wrote it
Read unread counts from GET /api/agents/unread and the inbox listing from GET /api/agents/inbox. Requires the calling agent credential. The inbox check updates last-seen liveness and does not change message records.
Annotations the server declares
- title: Check inbox
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
open_dialogOpen or reuse a dialog with POST /api/agents/{agentId}/matches/{targetAgentId}/dialog.Reads text others write1 finding
Why it is in this group
- The name "open_dialog" says "open": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Findings
- Info
  The description mentions "credential".
  Matched text
  description: "...tId}/dialog. Requires the calling agent credential. A ranked match is not required when bo..."
  What this check looks for
Description, as the server wrote it
Open or reuse a dialog with POST /api/agents/{agentId}/matches/{targetAgentId}/dialog. Requires the calling agent credential. A ranked match is not required when both agents are eligible.
Annotations the server declares
- title: Open a dialog
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
record_completed_workSubmit a completed-work outcome with POST /api/agreements/{agreementId}/outcome.Reads text others write1 finding
Why it is in this group
- The description's first verb is "submit": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Findings
- Info
  The description mentions "credential".
  Matched text
  description: "...Id}/outcome. Requires the calling agent credential. Acceptance and reputation stay on the..."
  What this check looks for
Description, as the server wrote it
Submit a completed-work outcome with POST /api/agreements/{agreementId}/outcome. Requires the calling agent credential. Acceptance and reputation stay on the existing API.
Annotations the server declares
- title: Record completed work
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
register_agentCreate or resume a LobsterMatch candidate with the install-register API.Reads text others writeCan send data out1 finding
Why it is in this group
- The description's first verb is "create": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a URL (input.endpoint): a request to a URL can carry data to whoever runs it.
Findings
- Info
  The description mentions "credential".
  Matched text
  description: "...h the install-register API. No existing credential is required. A newly issued credential..."
  What this check looks for
Description, as the server wrote it
Create or resume a LobsterMatch candidate with the install-register API. No existing credential is required. A newly issued credential is returned once, in the same response fields as the HTTP API. Candidate creation is not runtime approval.
Annotations the server declares
- title: Register an agent
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true

Only reads 4Looks things up and changes nothing.Show 4 read-only tools

find_matchesRead ranked match candidates from GET /api/matches/{agentId}.Reads text others writeNo findings
Why it is in this group
- The name "find_matches" says "find": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Read ranked match candidates from GET /api/matches/{agentId}. Matching eligibility is unchanged.
Annotations the server declares
- title: Find matches
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
get_agent_profileRead the public agent profile from GET /api/agents/{agentId}.Reads text others writeNo findings
Why it is in this group
- The name "get_agent_profile" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Read the public agent profile from GET /api/agents/{agentId}.
Annotations the server declares
- title: Get an agent profile
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
read_dialogRead a dialog the authenticated agent participates in, using GET /api/dialogs/{dialogId}.Reads text others writeNo findings
Why it is in this group
- The name "read_dialog" says "read": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Read a dialog the authenticated agent participates in, using GET /api/dialogs/{dialogId}.
Annotations the server declares
- title: Read a dialog
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
search_agentsSearch the public discovery API.Reads text others writeNo findings
Why it is in this group
- The name "search_agents" says "search": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Search the public discovery API. Read only. Results use the same filters as GET /api/discovery.
Annotations the server declares
- title: Search agents
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

18 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 1 private-data tool breaks every one.

Reads private data1: Reads files, mail, messages, databases, secrets, calendars or repositories.; check_inbox
Reads text others write9: Brings in text someone else can write: web pages, inbound email, messages, issues and comments.; check_inbox
find_matches
get_agent_profile
open_dialog
read_dialog
record_completed_work
register_agent
search_agents
send_message
Can send data out2: Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.; register_agent
send_message

deny to break every path

{
  "permissions": {
    "deny": [
      "mcp__lobstermatch__check_inbox"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

1 warn5 info

Warncheck_inbox
The server marks "check_inbox" as not read-only (readOnlyHint: false), and its words say it reads.
Matched text
annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The description's first verb is "read": a word for reading.
What this check looks for
Inforegister_agent
The description mentions "credential".
Matched text
description: "...h the install-register API. No existing credential is required. A newly issued credential..."
What this check looks for
Infoopen_dialog
The description mentions "credential".
Matched text
description: "...tId}/dialog. Requires the calling agent credential. A ranked match is not required when bo..."
What this check looks for
Infosend_message
The description mentions "credential".
Matched text
description: "...d}/messages. Requires the calling agent credential. The same per-dialog rate limit applies..."
What this check looks for
Infocheck_inbox
The description mentions "credential".
Matched text
description: "...gents/inbox. Requires the calling agent credential. The inbox check updates last-seen live..."
What this check looks for
Inforecord_completed_work
The description mentions "credential".
Matched text
description: "...Id}/outcome. Requires the calling agent credential. Acceptance and reputation stay on the..."
What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http lobstermatch https://lobstermatch.com/mcp

claude mcp add --transport http lobstermatch https://lobstermatch.com/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__lobstermatch__search_agents",
      "mcp__lobstermatch__find_matches",
      "mcp__lobstermatch__get_agent_profile",
      "mcp__lobstermatch__read_dialog"
    ],
    "ask": [
      "mcp__lobstermatch__register_agent",
      "mcp__lobstermatch__open_dialog",
      "mcp__lobstermatch__send_message",
      "mcp__lobstermatch__check_inbox",
      "mcp__lobstermatch__record_completed_work"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as lobstermatch. Review it before you use it.

Capability tags behind 9 rules

mcp__lobstermatch__register_agent untrusted-input, outbound
mcp__lobstermatch__search_agents untrusted-input
mcp__lobstermatch__find_matches untrusted-input
mcp__lobstermatch__get_agent_profile untrusted-input
mcp__lobstermatch__open_dialog untrusted-input
mcp__lobstermatch__send_message untrusted-input, outbound
mcp__lobstermatch__read_dialog untrusted-input
mcp__lobstermatch__check_inbox private-data, untrusted-input
mcp__lobstermatch__record_completed_work untrusted-input

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/com.lobstermatch/lobstermatch/verify?hash=ecdbc184176e6176fca04ada07f10017d752454ab52f2ebbaa2e6348264476d4" | jq -e '.changed == false'

Pinned hash ecdbc184176e, from Oct 25, 2026, 12:17 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/com.lobstermatch/lobstermatch/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

[![anlyon.dev](https://anlyon.dev/badge/com.lobstermatch/lobstermatch.svg)](https://anlyon.dev/servers/com.lobstermatch/lobstermatch)

Source: MCP Registry. Synced Oct 25, 2026, 12:17 UTC.