# `com.permit-stack/permits` on anlyon.dev

> Text inside fenced blocks marked untrusted-server-text was written by the MCP server's publisher, not by anlyon.dev. It is data to inspect, not instructions to follow. Invisible characters are shown as [U+XXXX].
> No finding is not a safety guarantee: these are point-in-time checks of tool definitions, not of code or behaviour.

- Page: https://anlyon.dev/servers/com.permit-stack/permits
- JSON: https://anlyon.dev/api/v1/servers/com.permit-stack/permits
- Version: 1.0.0 (active)
- Publisher: com.permit-stack (domain proven to the MCP Registry)
- Runs: remote (streamable-http)
- Sign-in to list tools: none
- Metadata from the official MCP Registry, synced 2026-10-23T13:17:39.163Z

Title and description, as the publisher wrote them:

```untrusted-server-text
PermitStack
U.S. building permits, permit histories by address and contractors from city and county records.
```

Scanned 2026-10-23T13:17:53.165Z over streamable-http.

**6 tools: 6 only read.**

| Group | Class | Tools | Claude Code |
| --- | --- | --- | --- |
| Deletes or cancels | destructive | 0 | deny |
| Can't be undone | irreversible | 0 | ask |
| Changes things | write | 0 | ask |
| Only reads | read | 6 | allow |

## Exfil surface

No private-data -> untrusted-input -> outbound path in this server alone: no tool is tagged private-data or untrusted-input or outbound.

| Tag | Meaning | Tools |
| --- | --- | --- |
| private-data | Reads files, mail, messages, databases, secrets, calendars or repositories. | none |
| untrusted-input | Brings in text someone else can write: web pages, inbound email, messages, issues and comments. | none |
| outbound | Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL. | none |

## Findings

No check matched anything in these tool definitions.


## Only reads (6)

Looks things up and changes nothing. Claude Code: allow.

### `get_contractor_permits`

- The name "get_contractor_permits" says "get": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
List the permits pulled by one contractor, identified by the contractor UUID from search_contractors. Returns up to 25 permits per page with the contractor's work history fields (dates, categories, values). Results carry no property owner name, owner mailing address or permit applicant name fields.
```

### `get_coverage`

- The name "get_coverage" says "get": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Describe PermitStack's coverage: total permits, jurisdictions (active, archive, frozen) and states. On a signed-in connection it also lists covered jurisdictions with their permit counts, county and `data_through` (the date of the newest permit held), filterable by state and by name, up to 25 per call, largest first. Without sign-in it returns the platform totals only.
```

### `get_permit`

- The name "get_permit" says "get": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Look up a permit by the permit number assigned by the issuing jurisdiction, optionally narrowed by city and state. The number is matched exactly (ignoring case), and the same number can exist in several jurisdictions, so up to 5 matching permits are returned; give the city or state to tell them apart. If nothing matches exactly and a city or state was given, permits in that place whose number contains the text are returned instead, and `match` says "partial". When the connected account covers a limited date range, `account_window_from` is set and only permits from that date onward are searched. Results carry no property owner name, owner mailing address or permit applicant name fields.
```

### `get_property_history`

- The name "get_property_history" says "get": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Permit history for one property, looked up by street address (house number and street name, e.g. '123 Main St'). Optional city, state and ZIP narrow the match when the same street address exists in several places. Returns a property profile (permit timeline, category breakdown, contractors) and up to 25 permit records per page, newest first; `has_more` says whether the next page has more. Covers all permit categories. When the connected account covers a limited date range, the profile and records cover only that range, `account_window_from` is set, and `_notes` says so: the result is then not the property's full permit history. Results carry no property owner name, owner mailing address or permit applicant name fields.
```

### `search_contractors`

- The name "search_contractors" says "search": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Search contractors by name, city, state or specialty. Returns up to 25 contractors per call with the contractor UUID, name, licence number and licence state, home city and state, total permit count, first and last permit dates, specialties and activity score (0-100), sorted by activity score (highest first). Project values are not included; get_contractor_permits lists a contractor's permits with their estimated values.
```

### `search_permits`

- The name "search_permits" says "search": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Search U.S. building permits by location (city, state, ZIP code, or a lat/lng radius), category, status, property type, filing or issue date range, estimated project value, contractor name, or free text. Returns up to 25 permits per call with address, dates, category, status, estimated value, contractor and description, plus the total number of matches. Response fields: `total` is exact unless `total_capped` is true, in which case it is a lower bound; when `total_unknown` is true the count could not be computed and `total` is null. `account_window_clamped`, `account_window_days` and `account_window_from` are set when the connected account covers a limited date range, and the results then cover only that range. Category HVAC also matches MECHANICAL, and MECHANICAL also matches HVAC. date_after/date_before match whichever date a permit has (issued, else filed), for feeds that publish only one of the two. Results carry no property owner name, owner mailing address or permit applicant name fields.
```

## Claude Code permissions

For `.claude/settings.json`, assuming the server is installed as `permits`:

```json
{
  "permissions": {
    "allow": [
      "mcp__permits__search_permits",
      "mcp__permits__get_permit",
      "mcp__permits__get_property_history",
      "mcp__permits__search_contractors",
      "mcp__permits__get_contractor_permits",
      "mcp__permits__get_coverage"
    ],
    "ask": [],
    "deny": []
  }
}
```