Rollstack
com.rollstack/mcprollstack.comstreamable-httpv1.0.70Scanned
Build, refresh and send Rollstack reports and slide decks from your company's data.
46 tools: 14 can delete or cancel things, 2 do something that can't be undone, 11 change things and 19 only read.
- Reads private data · 11
- Reads text others write · 9
- Can send data out · 6
- 8 findings
Anlyon alternative
27 of these tools change something. Run those as governed actions.
Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.
Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.
Import an OpenAPI spec →Tools
Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.
46 tools
Deletes or cancels 14Claude Code: deny
approveReportMessageProposalApproves the proposal of a settings_proposal or email_send_proposal reply, as its Approve button in the app's chat does: Rollstack makes the change, or sends the email.Reads text others writeCan send data outNo findings
Why it is in this group
- The name "approveReportMessageProposal" says "approve": a word for a change.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe name "approveReportMessageProposal" says "approve" and "message": it writes something other people read.
Description, as the server wrote it Approves the proposal of a settings_proposal or email_send_proposal reply, as its Approve button in the app's chat does: Rollstack makes the change, or sends the email. Only approve what the user approved after seeing the reply's proposal. Answers the reply with the proposal's status: applied once the change is made, and queued for a send, which getReportMessage then follows through sending to sent, partially_sent, failed or unconfirmed, with its counts. Needs also slide_decks:email for an email change or send, and slide_decks:write for the rest. Approving a send answers 409 while the report is updating, such as after a filter change the same message asked for, and counts against the 5 email sends a minute, as sendReportEmail does. Only the user who sent the message may, while they can edit the report. A proposal already decided answers 409.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: false
- openWorldHint: true
cancelReportMessageStops a message to the slides agent: a queued one leaves the queue, and a running one stops.1 finding
Why it is in this group
- The name "cancelReportMessage" says "cancel": a word for removing or ending something.
- The server marks it not destructive (destructiveHint: false), but an annotation never lowers a class.
Findings
- Warn
The server marks "cancelReportMessage" not destructive (destructiveHint: false), and its own name, description or input give the class "destructive".
What this check looks forMatched text
annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":false}; The name "cancelReportMessage" says "cancel": a word for removing or ending something.
Description, as the server wrote it Stops a message to the slides agent: a queued one leaves the queue, and a running one stops. A finished one stays as it is. Only the user who sent it may.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
cancelReportRunCancels a run of a report, whoever started it.1 finding
Why it is in this group
- The name "cancelReportRun" says "cancel": a word for removing or ending something.
- The server marks it not destructive (destructiveHint: false), but an annotation never lowers a class.
Findings
- Warn
The server marks "cancelReportRun" not destructive (destructiveHint: false), and its own name, description or input give the class "destructive".
What this check looks forMatched text
annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":false}; The name "cancelReportRun" says "cancel": a word for removing or ending something.
Description, as the server wrote it Cancels a run of a report, whoever started it. Only its editors may. A run that already ended stays as it is.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
deleteDatasetDeletes an uploaded CSV file or workbook.No findings
Why it is in this group
- The name "deleteDataset" says "delete": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Deletes an uploaded CSV file or workbook. Reports built on it keep what they last showed, and their datasheets fail on the next read. Only the user who created it may.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
removeBurstVariantsRemoves variants of a burst by their ids, and deletes their reports.No findings
Why it is in this group
- The name "removeBurstVariants" says "remove": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Removes variants of a burst by their ids, and deletes their reports. Find the ids with listBurstVariants, which shows each variant's parameter values, and confirm them with the user. The user must be able to edit every variant passed, or nothing is removed: the burst's owner and admins can edit them all, other members only their own.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
replaceDatasetReplaces an uploaded CSV file's rows, or a workbook's content with a new .xlsx sent as multipart/form-data in the file field.No findings
Why it is in this group
- The name "replaceDataset" says "replace": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Replaces an uploaded CSV file's rows, or a workbook's content with a new .xlsx sent as multipart/form-data in the file field. It keeps its id, and a CSV is never replaced by a workbook or the other way round. Reports built on it show the new content after their next run or message to the slides agent. An invalid file leaves the current one in place, and a sheet or range the new workbook no longer has fails its datasheets' reads. Only the user who created it may.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
sendReportMessageAsks the slides agent to build or change a report, or to answer a question about it, as the app's chat does.Reads text others writeCan send data outNo findings
Why it is in this group
- The name "sendReportMessage" says "send": a word for sending, and what is sent cannot be taken back.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe name "sendReportMessage" says "send": it sends or publishes something to other people.
Description, as the server wrote it Asks the slides agent to build or change a report, or to answer a question about it, as the app's chat does. Answers the message's id at once: follow it with getReportMessage. Without chatId the message starts a new chat, which shows in the user's chat history in the app. With it, the message continues that chat and waits its turn while a reply is still generating. Several chats on a report can generate at once; an agent working on a part of the report another chat is editing works on something else or says so. For slides built from your own data, a connected dashboard or a spreadsheet, upload the data with createDataset, find the dashboard with searchDashboards or the spreadsheet with searchSpreadsheets, add any of them with addReportDatasheets and pass the datasheet ids as datasheetIds. Only its editors may. At most 6 messages a minute per user.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: false
- openWorldHint: true
startBurstRunStarts a run of every variant of a burst, or of the variants passed, as startReportRun does for each: it refreshes the variant's data and repairs its slides with AI.No findings
Why it is in this group
- The name "startBurstRun" says "start": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Starts a run of every variant of a burst, or of the variants passed, as startReportRun does for each: it refreshes the variant's data and repairs its slides with AI. The template report isn't run; run it with startReportRun. Answers each variant's run at once: follow them in listBurstVariants, whose running and lastRunStatus tell where each stands, or one by one with getReportRun. A variant already running answers that run and starts nothing.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: false
- openWorldHint: false
startReportRunRefreshes a report's data, or only some of its datasheets, then repairs failed calculations and the slides with AI.No findings
Why it is in this group
- The name "startReportRun" says "start": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Refreshes a report's data, or only some of its datasheets, then repairs failed calculations and the slides with AI. On a report of another type than SlideDeck, such as a Google Slides presentation, refreshes every visualization instead, as Update in the app does, updating its file when it has one (an Email report has none), and emails the report when its email trigger is all. Answers the run's id at once; while a run of the report is already going, from the API, the app or its schedule, it answers that run's id with started false and starts nothing.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: false
- openWorldHint: false
updateBurstVariantRecipientsSets who each variant's email goes to, replacing its to, cc and bcc.No findings
Why it is in this group
- The name "updateBurstVariantRecipients" says "update": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Sets who each variant's email goes to, replacing its to, cc and bcc. Its other email settings, such as its sender and which runs send it, stay as copied from the template; a variant without email settings gets the defaults. Sends no email. As in the app, the burst's owner and admins can set any variant's recipients, other members only those of variants they own or can edit; the others are skipped, as is a variant with several recipient groups, which the app asks to reconcile first.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
updateReportEmailConfigSets who a report's email goes to and how it is sent, replacing the whole setup.Can send data out1 finding
Why it is in this group
- The name "updateReportEmailConfig" says "update": a word for a change.
- The input addresses people (input.body.to): what it sends cannot be taken back.
- The server marks it destructive (destructiveHint: true).
What it can reach
- outboundThe name "updateReportEmailConfig" says "update" and "email": it writes something other people read.
Findings
- Info
The input schema at properties.body.properties.ignoredFailureStatusMessages.description mentions "credentials".
What this check looks forMatched text
inputSchema.properties.body.properties.ignoredFailureStatusMessages.description: "...`invalid_credentials`: the connection's credentials are invalid. - `missing_credentials`: t..."
Description, as the server wrote it Sets who a report's email goes to and how it is sent, replacing the whole setup. Only its editors may. The sender must be the user's own or shared with the organization.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
updateReportSchedulesReplaces the schedules of a report of any type, at most 10; an empty list removes them all.No findings
Why it is in this group
- The name "updateReportSchedules" says "update": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Replaces the schedules of a report of any type, at most 10; an empty list removes them all. Only its editors may. Every scheduled run updates the whole report: an AI update on a SlideDeck report, and a refresh of every visualization on a report that updates a file. Schedules are checked every 15 minutes, so a cron that fires more often still runs at most once per 15 minutes.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
Can't be undone 2Claude Code: ask
sendReportEmailEmails a report to its recipients now, as it is.Reads text others writeCan send data outNo findings
Why it is in this group
- The name "sendReportEmail" says "send": a word for sending, and what is sent cannot be taken back.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe name "sendReportEmail" says "send": it sends or publishes something to other people.
Description, as the server wrote it Emails a report to its recipients now, as it is. Only its editors may. Answers 400 when it has no recipients. Sends in the background; while the user's send of the report is going, starts nothing. At most 5 sends a minute per user, test sends included.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
sendReportTestEmailSends a report's email to the user only, and waits until it is sent.Reads text others writeCan send data outNo findings
Why it is in this group
- The name "sendReportTestEmail" says "send": a word for sending, and what is sent cannot be taken back.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe name "sendReportTestEmail" says "send": it sends or publishes something to other people.
Description, as the server wrote it Sends a report's email to the user only, and waits until it is sent. Only its editors may. Counts against the 5 sends a minute.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
Changes things 11Claude Code: ask
addBurstVariantsAdds variants to a burst by their values of its report parameters: each is a copy of the template report that reads its datasheets with its own values, then runs once to fetch its …No findings
Why it is in this group
- The name "addBurstVariants" says "add": a word for a change.
Description, as the server wrote it Adds variants to a burst by their values of its report parameters: each is a copy of the template report that reads its datasheets with its own values, then runs once to fetch its data. Values are checked first, so a request with one the template's filters can't take adds nothing. Answers at once with the names the variants are added with; follow them in adding from listBurstVariants.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
addReportDatasheetsAdds sources to a report as datasheets, and answers their ids in the order of the sources.No findings
Why it is in this group
- The name "addReportDatasheets" says "add": a word for a change.
Description, as the server wrote it Adds sources to a report as datasheets, and answers their ids in the order of the sources. A source is a CSV file uploaded with createDataset, or a dashboard of a Looker, Metabase, Omni, Lightdash, Sigma, Tableau or Power BI connection: find it with searchDashboards, confirm it with the user, optionally check its tabs and charts with getDashboard, and add it by its connection, id and tabId from getDashboard's tabs, or from searchDashboards for a Sigma workbook found by a link (else the tab it opens on, a Power BI report's or Sigma workbook's first page). A dashboard comes in as one picture of the tab, read with the user's access to the connection, from which the slides agent can add its charts, except Tableau's and Power BI's, whose charts only the app lists. A source can also be a range of a Google Sheets or Excel file the user added in the app: find the file with searchSpreadsheets, take the sheet's id from getSpreadsheet, and pass the range inside the sheet in A1 notation, like A1:F20. A range comes in as a table, read with the user's own Google or Microsoft account on every run. Pass the ids as datasheetIds on sendReportMessage for the slides agent to build slides from them. Only the report's editors may.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
createBurstMakes a report the template of a new burst whose variants differ by the report parameters given, and answers the burst, named after the report and with no variants yet.No findings
Why it is in this group
- The name "createBurst" says "create": a word for a change.
Description, as the server wrote it Makes a report the template of a new burst whose variants differ by the report parameters given, and answers the burst, named after the report and with no variants yet. Add them with addBurstVariants. Only the report's editors may.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
createDatasetStores a CSV for the slides agent to build slides from: a header row, then at least one data row, at most 10 MB.No findings
Why it is in this group
- The name "createDataset" says "create": a word for a change.
Description, as the server wrote it Stores a CSV for the slides agent to build slides from: a header row, then at least one data row, at most 10 MB. Add it to a report with addReportDatasheets. Over MCP the CSV is written into the tool call, so send large files to this REST endpoint instead. Or send an Excel workbook (.xlsx, at most 10 MB) as multipart/form-data in the file field: it is stored as it is, with all its sheets, formatting and charts, and the user picks its sheets and ranges for a report in the app's editor. Legacy .xls, macro-enabled and password-protected workbooks are rejected. A workbook is read as saved: formulas show their saved results, and nothing is recalculated.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
createReportCreates a report of type SlideDeck, in a folder the user can see when folderId is set.No findings
Why it is in this group
- The name "createReport" says "create": a word for a change.
Description, as the server wrote it Creates a report of type SlideDeck, in a folder the user can see when folderId is set. It starts empty, or with the look of templateDeckId: its theme, masters and layouts, without its slides. The template must be a SlideDeck report the user may duplicate.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
createReportParameterCreates a parameter of a report, linked to the dashboard filters given, as the app's report parameters editor does.No findings
Why it is in this group
- The name "createReportParameter" says "create": a word for a change.
Description, as the server wrote it Creates a parameter of a report, linked to the dashboard filters given, as the app's report parameters editor does. With a value, writes it into those filters and reads their datasheets again. Answers the parameter. Only the report's editors may.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
exportReportExports a report as PDF or PowerPoint and answers a download link valid for 15 minutes.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Exports a report as PDF or PowerPoint and answers a download link valid for 15 minutes. At most 10 exports a minute per user.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
getReportRunA run's status and the datasheets, or visualizations on a report of another type than SlideDeck, it could not refresh.1 finding
Why it is in this group
- The name "getReportRun" says "get": a word for reading.
- The description's first verb is "run": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "getReportRun" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "getReportRun" says "get": a word for reading.
Description, as the server wrote it A run's status and the datasheets, or visualizations on a report of another type than SlideDeck, it could not refresh. Waits up to waitSeconds for the run to end and answers as soon as it does, so call it again while the status is running. A user's later run of the report reuses the id, so this describes the latest one.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
rejectReportMessageProposalRejects the proposal of a settings_proposal or email_send_proposal reply, as its Reject button in the app's chat does: nothing changes.Can send data outNo findings
Why it is in this group
- The name "rejectReportMessageProposal" says "reject": a word for a change.
What it can reach
- outboundThe name "rejectReportMessageProposal" says "reject" and "message": it writes something other people read.
Description, as the server wrote it Rejects the proposal of a settings_proposal or email_send_proposal reply, as its Reject button in the app's chat does: nothing changes. Answers the reply with the proposal's status, rejected for a change and cancelled for an email send. Only the user who sent the message may, while they can edit the report. A proposal already decided answers 409.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
submitFeedbackTells the Rollstack team about something the user asked for that you couldn't do: a tool or endpoint that is missing, a call that was refused or failed, or a task nothing covers.1 finding
Why it is in this group
- The name "submitFeedback" says "submit": a word for a change.
Findings
- Info
The input schema at properties.body.properties.message.description mentions "credentials".
What this check looks forMatched text
inputSchema.properties.body.properties.message.description: "...and the errors they answered. Leave out credentials."
Description, as the server wrote it Tells the Rollstack team about something the user asked for that you couldn't do: a tool or endpoint that is missing, a call that was refused or failed, or a task nothing covers. Send it whenever you get stuck, before you answer the user. The team reads every message to decide what to build next; it doesn't answer, and it doesn't fix the problem for the user.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
updateReportRenames a report of any type, moves it, or changes its timezone or failure notifications.No findings
Why it is in this group
- The name "updateReport" says "update": a word for a change.
Description, as the server wrote it Renames a report of any type, moves it, or changes its timezone or failure notifications. Renaming a report that updates a file, such as a Google Slides presentation, also renames the file, as the app does. Only its editors may.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
Only reads 19Show 19 read-only tools
getDashboardA dashboard of a Looker, Metabase, Omni, Lightdash, Sigma, Tableau or Power BI connection, read with the user's access to the connection: its tabs, and the charts and filters of th…No findings
Why it is in this group
- The name "getDashboard" says "get": a word for reading.
Description, as the server wrote it A dashboard of a Looker, Metabase, Omni, Lightdash, Sigma, Tableau or Power BI connection, read with the user's access to the connection: its tabs, and the charts and filters of the tab tabId names, one of the ids in tabs (else the one the dashboard opens on, a Power BI report's or Sigma workbook's first page). Tableau and Power BI list no charts or filters, which only the app reads; a Sigma page lists its charts and tables, and the workbook's controls as its filters. Find the dashboard's id with searchDashboards. Confirm the dashboard and tab with the user, then add it to a report with addReportDatasheets; for another tab, call it again with that tab's id from tabs.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
getReportA report of any type with its schedules, who it is shared with and who is emailed when a run fails.No findings
Why it is in this group
- The name "getReport" says "get": a word for reading.
Description, as the server wrote it A report of any type with its schedules, who it is shared with and who is emailed when a run fails. lastRunStatus and running tell how its latest run went and whether one is going, and appUrl opens it in Rollstack. type tells which other endpoints work on it.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
getReportContentWhat a viewer sees on a report's visible slides: titles, text, and each chart's and table's values.Reads private dataNo findings
Why it is in this group
- The name "getReportContent" says "get": a word for reading.
What it can reach
- private-dataThe description's first sentence says "table": it reads databases.
Description, as the server wrote it What a viewer sees on a report's visible slides: titles, text, and each chart's and table's values. On a long report, pass slideIds for only the slides you need, such as a reply's changedSlideIds.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
getReportDatasheetDataThe table a report's chart is drawn from: the datasheet's steps run over the copies stored at its sources' last reads; the source is never queried.Reads private data1 finding
Why it is in this group
- The name "getReportDatasheetData" says "get": a word for reading.
What it can reach
- private-dataThe description's first sentence says "table": it reads databases.
Findings
- Info
The description mentions "credentials".
What this check looks forMatched text
description: "...ay: the table was read with an editor's credentials, can hold columns and rows the slides n..."
Description, as the server wrote it The table a report's chart is drawn from: the datasheet's steps run over the copies stored at its sources' last reads; the source is never queried. Only the report's editors may: the table was read with an editor's credentials, can hold columns and rows the slides never show, and skips the source's row-level security. Fails until every source it reads has been read, after a source's latest read failed, and once a stored copy expires, 30 days after its read. At most 30 reads a minute per user.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
getReportEmailConfigWho a report's email goes to and how it is sent.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "getReportEmailConfig" says "get": a word for reading.
What it can reach
- private-dataThe name "getReportEmailConfig" says "get" and "email": it reads mail.
- private-dataThe description's first sentence says "email": it reads mail.
- untrusted-inputThe name "getReportEmailConfig" says "get" and "email": it reads inbound email, which other people can write.
- untrusted-inputThe description's first sentence says "email": it reads inbound email, which other people can write.
Description, as the server wrote it Who a report's email goes to and how it is sent. Answers 404 until its email is set up.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
getReportMessageA message to the slides agent and its replies.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "getReportMessage" says "get": a word for reading.
What it can reach
- private-dataThe name "getReportMessage" says "get" and "message": it reads messages.
- private-dataThe description's first sentence says "message": it reads messages.
- untrusted-inputThe name "getReportMessage" says "get" and "message": it reads messages, which other people can write.
- untrusted-inputThe description's first sentence says "message": it reads messages, which other people can write.
Description, as the server wrote it A message to the slides agent and its replies. Waits up to waitSeconds for the message to finish and answers as soon as it does, so call it again while the status is queued or running. A clarification reply asks questions: ask the user, then send the options they pick as answers in a new message on the same chat. A proposal reply changes nothing until it is approved: show the user what its proposal changes, then approve or reject it as they decide. Only the user who sent the message may read it, while they can edit the report.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
getReportParametersA report's parameters, with which ones a burst can vary by, and the dashboard filters a parameter can link, with the parameter that already links each.No findings
Why it is in this group
- The name "getReportParameters" says "get": a word for reading.
Description, as the server wrote it A report's parameters, with which ones a burst can vary by, and the dashboard filters a parameter can link, with the parameter that already links each.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
getReportSlideImagesRenders slides of a report as images, as viewers see them, so you can check how they look: text that overflows or overlaps, or a chart too small to read.No findings
Why it is in this group
- The name "getReportSlideImages" says "get": a word for reading.
Description, as the server wrote it Renders slides of a report as images, as viewers see them, so you can check how they look: text that overflows or overlaps, or a chart too small to read. After a message's turn, pass its replies' changedSlideIds. At most 10 slides a call; hidden slides are left out. Counts against the 10 exports a minute per user.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
getSpreadsheetA Google Sheets or Excel file the user added in the app, with its sheets, read with the user's own Google or Microsoft account.Reads private dataNo findings
Why it is in this group
- The name "getSpreadsheet" says "get": a word for reading.
What it can reach
- private-dataThe description's first sentence says "file": it reads files.
Description, as the server wrote it A Google Sheets or Excel file the user added in the app, with its sheets, read with the user's own Google or Microsoft account. Fails with user-missing-oauth when the user hasn't connected that account in the app. Find the file's id with searchSpreadsheets, then add a range of one of its sheets to a report with addReportDatasheets by the sheet's id.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
listBurstsThe bursts of reports the user can see, newest first, with the report parameters their variants differ by and the template report they are copied from.No findings
Why it is in this group
- The name "listBursts" says "list": a word for reading.
Description, as the server wrote it The bursts of reports the user can see, newest first, with the report parameters their variants differ by and the template report they are copied from. You can filter by name, ignoring case. Answers up to limit bursts, 50 by default and 200 at most, and a nextCursor: pass it as cursor for the next page, until it is null. listReports leaves out the reports of a burst, its template and variants.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
listBurstVariantsA burst's variants the user can open, oldest first, each with its values of the burst's parameters, how its latest run went, whether one is going, and who its email goes to.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "listBurstVariants" says "list": a word for reading.
What it can reach
- private-dataThe description's first sentence says "email": it reads mail.
- untrusted-inputThe description's first sentence says "email": it reads inbound email, which other people can write.
Description, as the server wrote it A burst's variants the user can open, oldest first, each with its values of the burst's parameters, how its latest run went, whether one is going, and who its email goes to. adding lists the variants the user is still adding. Answers up to limit variants, 50 by default and 200 at most, and a nextCursor: pass it as cursor for the next page, until it is null.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
listConnectionsThe data source connections the user can see, without their credentials: each one's type, name, settings such as its URL, owner, admins, default user and whether any user's access …Reads private dataReads text others write1 finding
Why it is in this group
- The name "listConnections" says "list": a word for reading.
What it can reach
- private-dataThe description's first sentence says "credential": it reads secrets.
- untrusted-inputThe description's first sentence says "url": it reads web pages, which anyone can write.
Findings
- Info
The description mentions "credentials".
What this check looks forMatched text
description: "...ections the user can see, without their credentials: each one's type, name, settings such a..."
Description, as the server wrote it The data source connections the user can see, without their credentials: each one's type, name, settings such as its URL, owner, admins, default user and whether any user's access works.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
listFoldersThe folders the user can see, each with its parent, null at the top level, and the user's permission on it: null, view, edit or manage.Reads private dataNo findings
Why it is in this group
- The name "listFolders" says "list": a word for reading.
What it can reach
- private-dataThe name "listFolders" says "list" and "folder": it reads files.
- private-dataThe description's first sentence says "folder": it reads files.
Description, as the server wrote it The folders the user can see, each with its parent, null at the top level, and the user's permission on it: null, view, edit or manage. Pass a folder's id as folderId to listReports or createReport.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
listMembersThe members of the organization, with their role, authentication role, insights access and whether they are active.No findings
Why it is in this group
- The name "listMembers" says "list": a word for reading.
Description, as the server wrote it The members of the organization, with their role, authentication role, insights access and whether they are active. Optionally only those with a status, active or deactivated, or with an email.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
listReportDatasheetsThe datasheets a report's charts and tables are built from, with their source and when each was last read.Reads private dataNo findings
Why it is in this group
- The name "listReportDatasheets" says "list": a word for reading.
What it can reach
- private-dataThe description's first sentence says "table": it reads databases.
Description, as the server wrote it The datasheets a report's charts and tables are built from, with their source and when each was last read.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
listReportsThe reports the user can see, of every type, newest first.No findings
Why it is in this group
- The name "listReports" says "list": a word for reading.
Description, as the server wrote it The reports the user can see, of every type, newest first. Each report's type tells which endpoints work on it: the slides agent, exports, content, datasheets, parameters, email and ownership transfer take SlideDeck reports only. You can filter by folderId, name and type; when several are set, all must match, and name matching ignores case. Answers up to limit reports, 50 by default and 200 at most, and a nextCursor: pass it as cursor for the next page, until it is null.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
listSmtpConnectionsThe user's SMTP connections and the ones shared with the organization, without their credentials.Reads private data1 finding
Why it is in this group
- The name "listSmtpConnections" says "list": a word for reading.
What it can reach
- private-dataThe description's first sentence says "credential": it reads secrets.
Findings
- Info
The description mentions "credentials".
What this check looks forMatched text
description: "...ed with the organization, without their credentials."
Description, as the server wrote it The user's SMTP connections and the ones shared with the organization, without their credentials.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
searchDashboardsThe dashboards of a Looker, Metabase, Omni, Lightdash, Sigma, Tableau or Power BI connection whose name holds any word of query or its singular, in any case, at most 50: those the …No findings
Why it is in this group
- The name "searchDashboards" says "search": a word for reading.
Description, as the server wrote it The dashboards of a Looker, Metabase, Omni, Lightdash, Sigma, Tableau or Power BI connection whose name holds any word of query or its singular, in any case, at most 50: those the most of the organization's reports read first, copies, old and personal ones last, then most words first, read with the user's access to the connection. A Tableau dashboard is a workbook, its views its tabs; a Power BI one a report, its pages its tabs; a Sigma one a workbook, its pages its tabs. On a Sigma connection, query can be a link to a workbook the user pasted: it finds only that workbook, with the page the link opens on as tabId, but not the link's control values, saved view or tag, and a link to another Sigma organization is rejected. Search by the name the user gives, confirm the dashboard with the user, then check its tabs and charts with getDashboard or add it to a report with addReportDatasheets. listConnections gives the connection's type and id.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
searchSpreadsheetsThe Google Sheets and Excel files the user added in the app whose name holds any word of query, in any case, most words first, at most 50.Reads private dataNo findings
Why it is in this group
- The name "searchSpreadsheets" says "search": a word for reading.
What it can reach
- private-dataThe description's first sentence says "file": it reads files.
Description, as the server wrote it The Google Sheets and Excel files the user added in the app whose name holds any word of query, in any case, most words first, at most 50. Rollstack can't search the user's whole Google Drive or OneDrive: for another file, ask the user to add it in the app. Confirm the file with the user, then list its sheets with getSpreadsheet.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Exfil surface
Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.
594 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 6 outbound tools breaks every one.
- Reads private data11
- Reads files, mail, messages, databases, secrets, calendars or repositories.
- Reads text others write9
- Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
- Can send data out6
- Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
{
"permissions": {
"deny": [
"mcp__rollstack__approveReportMessageProposal",
"mcp__rollstack__rejectReportMessageProposal",
"mcp__rollstack__sendReportEmail",
"mcp__rollstack__sendReportMessage",
"mcp__rollstack__sendReportTestEmail",
"mcp__rollstack__updateReportEmailConfig"
]
}
}Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.
Findings
Matches of fixed checks, with the text they matched.
The server marks "cancelReportMessage" not destructive (destructiveHint: false), and its own name, description or input give the class "destructive".
What this check looks forMatched text
annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":false}; The name "cancelReportMessage" says "cancel": a word for removing or ending something.
- WarngetReportRun
The server marks "getReportRun" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "getReportRun" says "get": a word for reading.
- WarncancelReportRun
The server marks "cancelReportRun" not destructive (destructiveHint: false), and its own name, description or input give the class "destructive".
What this check looks forMatched text
annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":false}; The name "cancelReportRun" says "cancel": a word for removing or ending something.
The description mentions "credentials".
What this check looks forMatched text
description: "...ay: the table was read with an editor's credentials, can hold columns and rows the slides n..."
The input schema at properties.body.properties.ignoredFailureStatusMessages.description mentions "credentials".
What this check looks forMatched text
inputSchema.properties.body.properties.ignoredFailureStatusMessages.description: "...`invalid_credentials`: the connection's credentials are invalid. - `missing_credentials`: t..."
- InfolistConnections
The description mentions "credentials".
What this check looks forMatched text
description: "...ections the user can see, without their credentials: each one's type, name, settings such a..."
Show 2 more findingsShow fewer
The description mentions "credentials".
What this check looks forMatched text
description: "...ed with the organization, without their credentials."
- InfosubmitFeedback
The input schema at properties.body.properties.message.description mentions "credentials".
What this check looks forMatched text
inputSchema.properties.body.properties.message.description: "...and the errors they answered. Leave out credentials."
History
Changes to its tool definitions and to its remote endpoint, newest first.
No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.
Install
Pinned to version 1.0.70. Values in angle brackets are yours to fill in.
claude mcp add --transport http rollstack https://api.rollstack.com/public/v1/mcpclaude mcp add --transport http rollstack https://api.rollstack.com/public/v1/mcpRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__rollstack__listReports",
"mcp__rollstack__getReport",
"mcp__rollstack__getReportMessage",
"mcp__rollstack__getReportContent",
"mcp__rollstack__getReportSlideImages",
"mcp__rollstack__listReportDatasheets",
"mcp__rollstack__getReportDatasheetData",
"mcp__rollstack__getReportParameters",
"mcp__rollstack__getReportEmailConfig",
"mcp__rollstack__listBursts",
"mcp__rollstack__listBurstVariants",
"mcp__rollstack__listConnections",
"mcp__rollstack__searchDashboards",
"mcp__rollstack__getDashboard",
"mcp__rollstack__searchSpreadsheets",
"mcp__rollstack__getSpreadsheet",
"mcp__rollstack__listSmtpConnections",
"mcp__rollstack__listFolders",
"mcp__rollstack__listMembers"
],
"ask": [
"mcp__rollstack__createReport",
"mcp__rollstack__updateReport",
"mcp__rollstack__rejectReportMessageProposal",
"mcp__rollstack__getReportRun",
"mcp__rollstack__exportReport",
"mcp__rollstack__createDataset",
"mcp__rollstack__addReportDatasheets",
"mcp__rollstack__createReportParameter",
"mcp__rollstack__sendReportEmail",
"mcp__rollstack__sendReportTestEmail",
"mcp__rollstack__addBurstVariants",
"mcp__rollstack__createBurst",
"mcp__rollstack__submitFeedback"
],
"deny": [
"mcp__rollstack__sendReportMessage",
"mcp__rollstack__approveReportMessageProposal",
"mcp__rollstack__cancelReportMessage",
"mcp__rollstack__startReportRun",
"mcp__rollstack__cancelReportRun",
"mcp__rollstack__replaceDataset",
"mcp__rollstack__deleteDataset",
"mcp__rollstack__shareReport",
"mcp__rollstack__unshareReport",
"mcp__rollstack__updateReportSchedules",
"mcp__rollstack__updateReportEmailConfig",
"mcp__rollstack__startBurstRun",
"mcp__rollstack__updateBurstVariantRecipients",
"mcp__rollstack__removeBurstVariants"
]
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as rollstack. Review it before you use it.
Capability tags behind 18 rules
- mcp__rollstack__getReportMessage private-data, untrusted-input
- mcp__rollstack__sendReportMessage untrusted-input, outbound
- mcp__rollstack__approveReportMessageProposal untrusted-input, outbound
- mcp__rollstack__rejectReportMessageProposal outbound
- mcp__rollstack__getReportContent private-data
- mcp__rollstack__listReportDatasheets private-data
- mcp__rollstack__getReportDatasheetData private-data
- mcp__rollstack__shareReport untrusted-input
- mcp__rollstack__getReportEmailConfig private-data, untrusted-input
- mcp__rollstack__updateReportEmailConfig outbound
- mcp__rollstack__sendReportEmail untrusted-input, outbound
- mcp__rollstack__sendReportTestEmail untrusted-input, outbound
- mcp__rollstack__listBurstVariants private-data, untrusted-input
- mcp__rollstack__listConnections private-data, untrusted-input
- mcp__rollstack__searchSpreadsheets private-data
- mcp__rollstack__getSpreadsheet private-data
- mcp__rollstack__listSmtpConnections private-data
- mcp__rollstack__listFolders private-data
Pin
Keep the decision: fail CI when the tools change, follow every change, or show a badge.
Pin in CI
Fail a build when the tools you reviewed are not the tools the server serves today.
curl -s "https://anlyon.dev/api/v1/servers/com.rollstack/mcp/verify?hash=43ed4dfc82546fbe79123114a7d0e2ef8968608e119c27a7bd0d43e1b4cdc8ec" | jq -e '.changed == false'Pinned hash 43ed4dfc8254, from Nov 4, 2026, 23:18 UTC.
Watch
Get told when its tools change: a new tool, a new description, a new class.
https://anlyon.dev/servers/com.rollstack/mcp/changes.xmlAn Atom feed. Works in any feed reader or Slack's RSS app.
Badge
[](https://anlyon.dev/servers/com.rollstack/mcp)Source: MCP Registry. Synced Nov 5, 2026, 00:17 UTC.