Skip to content

Rollstack

com.rollstack/mcprollstack.comstreamable-httpv1.0.70Scanned

Build, refresh and send Rollstack reports and slide decks from your company's data.

46 tools: 14 can delete or cancel things, 2 do something that can't be undone, 11 change things and 19 only read.

Tools: 14 delete, 2 irreversible, 11 write, 19 read.
  • Reads private data · 11
  • Reads text others write · 9
  • Can send data out · 6
  • 8 findings

Anlyon alternative

27 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

46 tools

Deletes or cancels 14Claude Code: deny
  • approveReportMessageProposalApproves the proposal of a settings_proposal or email_send_proposal reply, as its Approve button in the app's chat does: Rollstack makes the change, or sends the email.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "approveReportMessageProposal" says "approve": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "approveReportMessageProposal" says "approve" and "message": it writes something other people read.
    Description, as the server wrote it
    Approves the proposal of a settings_proposal or email_send_proposal reply, as its Approve button in the app's chat does: Rollstack makes the change, or sends the email. Only approve what the user approved after seeing the reply's proposal. Answers the reply with the proposal's status: applied once the change is made, and queued for a send, which getReportMessage then follows through sending to sent, partially_sent, failed or unconfirmed, with its counts. Needs also slide_decks:email for an email change or send, and slide_decks:write for the rest. Approving a send answers 409 while the report is updating, such as after a filter change the same message asked for, and counts against the 5 email sends a minute, as sendReportEmail does. Only the user who sent the message may, while they can edit the report. A proposal already decided answers 409.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • cancelReportMessageStops a message to the slides agent: a queued one leaves the queue, and a running one stops.1 finding

    Why it is in this group

    • The name "cancelReportMessage" says "cancel": a word for removing or ending something.
    • The server marks it not destructive (destructiveHint: false), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "cancelReportMessage" not destructive (destructiveHint: false), and its own name, description or input give the class "destructive".

      Matched text

      annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":false}; The name "cancelReportMessage" says "cancel": a word for removing or ending something.

      What this check looks for
    Description, as the server wrote it
    Stops a message to the slides agent: a queued one leaves the queue, and a running one stops. A finished one stays as it is. Only the user who sent it may.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • cancelReportRunCancels a run of a report, whoever started it.1 finding

    Why it is in this group

    • The name "cancelReportRun" says "cancel": a word for removing or ending something.
    • The server marks it not destructive (destructiveHint: false), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "cancelReportRun" not destructive (destructiveHint: false), and its own name, description or input give the class "destructive".

      Matched text

      annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":false}; The name "cancelReportRun" says "cancel": a word for removing or ending something.

      What this check looks for
    Description, as the server wrote it
    Cancels a run of a report, whoever started it. Only its editors may. A run that already ended stays as it is.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • deleteDatasetDeletes an uploaded CSV file or workbook.No findings

    Why it is in this group

    • The name "deleteDataset" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Deletes an uploaded CSV file or workbook. Reports built on it keep what they last showed, and their datasheets fail on the next read. Only the user who created it may.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • removeBurstVariantsRemoves variants of a burst by their ids, and deletes their reports.No findings

    Why it is in this group

    • The name "removeBurstVariants" says "remove": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Removes variants of a burst by their ids, and deletes their reports. Find the ids with listBurstVariants, which shows each variant's parameter values, and confirm them with the user. The user must be able to edit every variant passed, or nothing is removed: the burst's owner and admins can edit them all, other members only their own.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • replaceDatasetReplaces an uploaded CSV file's rows, or a workbook's content with a new .xlsx sent as multipart/form-data in the file field.No findings

    Why it is in this group

    • The name "replaceDataset" says "replace": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Replaces an uploaded CSV file's rows, or a workbook's content with a new .xlsx sent as multipart/form-data in the file field. It keeps its id, and a CSV is never replaced by a workbook or the other way round. Reports built on it show the new content after their next run or message to the slides agent. An invalid file leaves the current one in place, and a sheet or range the new workbook no longer has fails its datasheets' reads. Only the user who created it may.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • sendReportMessageAsks the slides agent to build or change a report, or to answer a question about it, as the app's chat does.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "sendReportMessage" says "send": a word for sending, and what is sent cannot be taken back.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "sendReportMessage" says "send": it sends or publishes something to other people.
    Description, as the server wrote it
    Asks the slides agent to build or change a report, or to answer a question about it, as the app's chat does. Answers the message's id at once: follow it with getReportMessage. Without chatId the message starts a new chat, which shows in the user's chat history in the app. With it, the message continues that chat and waits its turn while a reply is still generating. Several chats on a report can generate at once; an agent working on a part of the report another chat is editing works on something else or says so. For slides built from your own data, a connected dashboard or a spreadsheet, upload the data with createDataset, find the dashboard with searchDashboards or the spreadsheet with searchSpreadsheets, add any of them with addReportDatasheets and pass the datasheet ids as datasheetIds. Only its editors may. At most 6 messages a minute per user.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • shareReportShares a report of any type with a member of the organization to view or edit it, or changes their permission.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Shares a report of any type with a member of the organization to view or edit it, or changes their permission. They get an email. A report that updates a file, such as a Google Slides presentation, also shares the file with them, as the app does.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • startBurstRunStarts a run of every variant of a burst, or of the variants passed, as startReportRun does for each: it refreshes the variant's data and repairs its slides with AI.No findings

    Why it is in this group

    • The name "startBurstRun" says "start": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Starts a run of every variant of a burst, or of the variants passed, as startReportRun does for each: it refreshes the variant's data and repairs its slides with AI. The template report isn't run; run it with startReportRun. Answers each variant's run at once: follow them in listBurstVariants, whose running and lastRunStatus tell where each stands, or one by one with getReportRun. A variant already running answers that run and starts nothing.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • startReportRunRefreshes a report's data, or only some of its datasheets, then repairs failed calculations and the slides with AI.No findings

    Why it is in this group

    • The name "startReportRun" says "start": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Refreshes a report's data, or only some of its datasheets, then repairs failed calculations and the slides with AI. On a report of another type than SlideDeck, such as a Google Slides presentation, refreshes every visualization instead, as Update in the app does, updating its file when it has one (an Email report has none), and emails the report when its email trigger is all. Answers the run's id at once; while a run of the report is already going, from the API, the app or its schedule, it answers that run's id with started false and starts nothing.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • unshareReportRemoves a user's share of a report of any type, and their access to its file when it updates one, as the app does.No findings

    Why it is in this group

    • The description's first verb is "remove": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Removes a user's share of a report of any type, and their access to its file when it updates one, as the app does.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • updateBurstVariantRecipientsSets who each variant's email goes to, replacing its to, cc and bcc.No findings

    Why it is in this group

    • The name "updateBurstVariantRecipients" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Sets who each variant's email goes to, replacing its to, cc and bcc. Its other email settings, such as its sender and which runs send it, stay as copied from the template; a variant without email settings gets the defaults. Sends no email. As in the app, the burst's owner and admins can set any variant's recipients, other members only those of variants they own or can edit; the others are skipped, as is a variant with several recipient groups, which the app asks to reconcile first.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • updateReportEmailConfigSets who a report's email goes to and how it is sent, replacing the whole setup.Can send data out1 finding

    Why it is in this group

    • The name "updateReportEmailConfig" says "update": a word for a change.
    • The input addresses people (input.body.to): what it sends cannot be taken back.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • outboundThe name "updateReportEmailConfig" says "update" and "email": it writes something other people read.

    Findings

    • Info

      The input schema at properties.body.properties.ignoredFailureStatusMessages.description mentions "credentials".

      Matched text

      inputSchema.properties.body.properties.ignoredFailureStatusMessages.description: "...`invalid_credentials`: the connection's credentials are invalid. - `missing_credentials`: t..."

      What this check looks for
    Description, as the server wrote it
    Sets who a report's email goes to and how it is sent, replacing the whole setup. Only its editors may. The sender must be the user's own or shared with the organization.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • updateReportSchedulesReplaces the schedules of a report of any type, at most 10; an empty list removes them all.No findings

    Why it is in this group

    • The name "updateReportSchedules" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Replaces the schedules of a report of any type, at most 10; an empty list removes them all. Only its editors may. Every scheduled run updates the whole report: an AI update on a SlideDeck report, and a refresh of every visualization on a report that updates a file. Schedules are checked every 15 minutes, so a cron that fires more often still runs at most once per 15 minutes.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
Can't be undone 2Claude Code: ask
  • sendReportEmailEmails a report to its recipients now, as it is.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "sendReportEmail" says "send": a word for sending, and what is sent cannot be taken back.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "sendReportEmail" says "send": it sends or publishes something to other people.
    Description, as the server wrote it
    Emails a report to its recipients now, as it is. Only its editors may. Answers 400 when it has no recipients. Sends in the background; while the user's send of the report is going, starts nothing. At most 5 sends a minute per user, test sends included.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • sendReportTestEmailSends a report's email to the user only, and waits until it is sent.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "sendReportTestEmail" says "send": a word for sending, and what is sent cannot be taken back.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "sendReportTestEmail" says "send": it sends or publishes something to other people.
    Description, as the server wrote it
    Sends a report's email to the user only, and waits until it is sent. Only its editors may. Counts against the 5 sends a minute.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
Changes things 11Claude Code: ask
  • addBurstVariantsAdds variants to a burst by their values of its report parameters: each is a copy of the template report that reads its datasheets with its own values, then runs once to fetch its …No findings

    Why it is in this group

    • The name "addBurstVariants" says "add": a word for a change.
    Description, as the server wrote it
    Adds variants to a burst by their values of its report parameters: each is a copy of the template report that reads its datasheets with its own values, then runs once to fetch its data. Values are checked first, so a request with one the template's filters can't take adds nothing. Answers at once with the names the variants are added with; follow them in adding from listBurstVariants.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • addReportDatasheetsAdds sources to a report as datasheets, and answers their ids in the order of the sources.No findings

    Why it is in this group

    • The name "addReportDatasheets" says "add": a word for a change.
    Description, as the server wrote it
    Adds sources to a report as datasheets, and answers their ids in the order of the sources. A source is a CSV file uploaded with createDataset, or a dashboard of a Looker, Metabase, Omni, Lightdash, Sigma, Tableau or Power BI connection: find it with searchDashboards, confirm it with the user, optionally check its tabs and charts with getDashboard, and add it by its connection, id and tabId from getDashboard's tabs, or from searchDashboards for a Sigma workbook found by a link (else the tab it opens on, a Power BI report's or Sigma workbook's first page). A dashboard comes in as one picture of the tab, read with the user's access to the connection, from which the slides agent can add its charts, except Tableau's and Power BI's, whose charts only the app lists. A source can also be a range of a Google Sheets or Excel file the user added in the app: find the file with searchSpreadsheets, take the sheet's id from getSpreadsheet, and pass the range inside the sheet in A1 notation, like A1:F20. A range comes in as a table, read with the user's own Google or Microsoft account on every run. Pass the ids as datasheetIds on sendReportMessage for the slides agent to build slides from them. Only the report's editors may.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • createBurstMakes a report the template of a new burst whose variants differ by the report parameters given, and answers the burst, named after the report and with no variants yet.No findings

    Why it is in this group

    • The name "createBurst" says "create": a word for a change.
    Description, as the server wrote it
    Makes a report the template of a new burst whose variants differ by the report parameters given, and answers the burst, named after the report and with no variants yet. Add them with addBurstVariants. Only the report's editors may.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • createDatasetStores a CSV for the slides agent to build slides from: a header row, then at least one data row, at most 10 MB.No findings

    Why it is in this group

    • The name "createDataset" says "create": a word for a change.
    Description, as the server wrote it
    Stores a CSV for the slides agent to build slides from: a header row, then at least one data row, at most 10 MB. Add it to a report with addReportDatasheets. Over MCP the CSV is written into the tool call, so send large files to this REST endpoint instead. Or send an Excel workbook (.xlsx, at most 10 MB) as multipart/form-data in the file field: it is stored as it is, with all its sheets, formatting and charts, and the user picks its sheets and ranges for a report in the app's editor. Legacy .xls, macro-enabled and password-protected workbooks are rejected. A workbook is read as saved: formulas show their saved results, and nothing is recalculated.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • createReportCreates a report of type SlideDeck, in a folder the user can see when folderId is set.No findings

    Why it is in this group

    • The name "createReport" says "create": a word for a change.
    Description, as the server wrote it
    Creates a report of type SlideDeck, in a folder the user can see when folderId is set. It starts empty, or with the look of templateDeckId: its theme, masters and layouts, without its slides. The template must be a SlideDeck report the user may duplicate.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • createReportParameterCreates a parameter of a report, linked to the dashboard filters given, as the app's report parameters editor does.No findings

    Why it is in this group

    • The name "createReportParameter" says "create": a word for a change.
    Description, as the server wrote it
    Creates a parameter of a report, linked to the dashboard filters given, as the app's report parameters editor does. With a value, writes it into those filters and reads their datasheets again. Answers the parameter. Only the report's editors may.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • exportReportExports a report as PDF or PowerPoint and answers a download link valid for 15 minutes.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Exports a report as PDF or PowerPoint and answers a download link valid for 15 minutes. At most 10 exports a minute per user.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • getReportRunA run's status and the datasheets, or visualizations on a report of another type than SlideDeck, it could not refresh.1 finding

    Why it is in this group

    • The name "getReportRun" says "get": a word for reading.
    • The description's first verb is "run": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "getReportRun" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "getReportRun" says "get": a word for reading.

      What this check looks for
    Description, as the server wrote it
    A run's status and the datasheets, or visualizations on a report of another type than SlideDeck, it could not refresh. Waits up to waitSeconds for the run to end and answers as soon as it does, so call it again while the status is running. A user's later run of the report reuses the id, so this describes the latest one.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • rejectReportMessageProposalRejects the proposal of a settings_proposal or email_send_proposal reply, as its Reject button in the app's chat does: nothing changes.Can send data outNo findings

    Why it is in this group

    • The name "rejectReportMessageProposal" says "reject": a word for a change.

    What it can reach

    • outboundThe name "rejectReportMessageProposal" says "reject" and "message": it writes something other people read.
    Description, as the server wrote it
    Rejects the proposal of a settings_proposal or email_send_proposal reply, as its Reject button in the app's chat does: nothing changes. Answers the reply with the proposal's status, rejected for a change and cancelled for an email send. Only the user who sent the message may, while they can edit the report. A proposal already decided answers 409.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • submitFeedbackTells the Rollstack team about something the user asked for that you couldn't do: a tool or endpoint that is missing, a call that was refused or failed, or a task nothing covers.1 finding

    Why it is in this group

    • The name "submitFeedback" says "submit": a word for a change.

    Findings

    • Info

      The input schema at properties.body.properties.message.description mentions "credentials".

      Matched text

      inputSchema.properties.body.properties.message.description: "...and the errors they answered. Leave out credentials."

      What this check looks for
    Description, as the server wrote it
    Tells the Rollstack team about something the user asked for that you couldn't do: a tool or endpoint that is missing, a call that was refused or failed, or a task nothing covers. Send it whenever you get stuck, before you answer the user. The team reads every message to decide what to build next; it doesn't answer, and it doesn't fix the problem for the user.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • updateReportRenames a report of any type, moves it, or changes its timezone or failure notifications.No findings

    Why it is in this group

    • The name "updateReport" says "update": a word for a change.
    Description, as the server wrote it
    Renames a report of any type, moves it, or changes its timezone or failure notifications. Renaming a report that updates a file, such as a Google Slides presentation, also renames the file, as the app does. Only its editors may.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
Only reads 19Show 19 read-only tools
  • getDashboardA dashboard of a Looker, Metabase, Omni, Lightdash, Sigma, Tableau or Power BI connection, read with the user's access to the connection: its tabs, and the charts and filters of th…No findings

    Why it is in this group

    • The name "getDashboard" says "get": a word for reading.
    Description, as the server wrote it
    A dashboard of a Looker, Metabase, Omni, Lightdash, Sigma, Tableau or Power BI connection, read with the user's access to the connection: its tabs, and the charts and filters of the tab tabId names, one of the ids in tabs (else the one the dashboard opens on, a Power BI report's or Sigma workbook's first page). Tableau and Power BI list no charts or filters, which only the app reads; a Sigma page lists its charts and tables, and the workbook's controls as its filters. Find the dashboard's id with searchDashboards. Confirm the dashboard and tab with the user, then add it to a report with addReportDatasheets; for another tab, call it again with that tab's id from tabs.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • getReportA report of any type with its schedules, who it is shared with and who is emailed when a run fails.No findings

    Why it is in this group

    • The name "getReport" says "get": a word for reading.
    Description, as the server wrote it
    A report of any type with its schedules, who it is shared with and who is emailed when a run fails. lastRunStatus and running tell how its latest run went and whether one is going, and appUrl opens it in Rollstack. type tells which other endpoints work on it.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • getReportContentWhat a viewer sees on a report's visible slides: titles, text, and each chart's and table's values.Reads private dataNo findings

    Why it is in this group

    • The name "getReportContent" says "get": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "table": it reads databases.
    Description, as the server wrote it
    What a viewer sees on a report's visible slides: titles, text, and each chart's and table's values. On a long report, pass slideIds for only the slides you need, such as a reply's changedSlideIds.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • getReportDatasheetDataThe table a report's chart is drawn from: the datasheet's steps run over the copies stored at its sources' last reads; the source is never queried.Reads private data1 finding

    Why it is in this group

    • The name "getReportDatasheetData" says "get": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "table": it reads databases.

    Findings

    • Info

      The description mentions "credentials".

      Matched text

      description: "...ay: the table was read with an editor's credentials, can hold columns and rows the slides n..."

      What this check looks for
    Description, as the server wrote it
    The table a report's chart is drawn from: the datasheet's steps run over the copies stored at its sources' last reads; the source is never queried. Only the report's editors may: the table was read with an editor's credentials, can hold columns and rows the slides never show, and skips the source's row-level security. Fails until every source it reads has been read, after a source's latest read failed, and once a stored copy expires, 30 days after its read. At most 30 reads a minute per user.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • getReportEmailConfigWho a report's email goes to and how it is sent.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "getReportEmailConfig" says "get": a word for reading.

    What it can reach

    • private-dataThe name "getReportEmailConfig" says "get" and "email": it reads mail.
    • private-dataThe description's first sentence says "email": it reads mail.
    • untrusted-inputThe name "getReportEmailConfig" says "get" and "email": it reads inbound email, which other people can write.
    • untrusted-inputThe description's first sentence says "email": it reads inbound email, which other people can write.
    Description, as the server wrote it
    Who a report's email goes to and how it is sent. Answers 404 until its email is set up.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • getReportMessageA message to the slides agent and its replies.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "getReportMessage" says "get": a word for reading.

    What it can reach

    • private-dataThe name "getReportMessage" says "get" and "message": it reads messages.
    • private-dataThe description's first sentence says "message": it reads messages.
    • untrusted-inputThe name "getReportMessage" says "get" and "message": it reads messages, which other people can write.
    • untrusted-inputThe description's first sentence says "message": it reads messages, which other people can write.
    Description, as the server wrote it
    A message to the slides agent and its replies. Waits up to waitSeconds for the message to finish and answers as soon as it does, so call it again while the status is queued or running. A clarification reply asks questions: ask the user, then send the options they pick as answers in a new message on the same chat. A proposal reply changes nothing until it is approved: show the user what its proposal changes, then approve or reject it as they decide. Only the user who sent the message may read it, while they can edit the report.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • getReportParametersA report's parameters, with which ones a burst can vary by, and the dashboard filters a parameter can link, with the parameter that already links each.No findings

    Why it is in this group

    • The name "getReportParameters" says "get": a word for reading.
    Description, as the server wrote it
    A report's parameters, with which ones a burst can vary by, and the dashboard filters a parameter can link, with the parameter that already links each.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • getReportSlideImagesRenders slides of a report as images, as viewers see them, so you can check how they look: text that overflows or overlaps, or a chart too small to read.No findings

    Why it is in this group

    • The name "getReportSlideImages" says "get": a word for reading.
    Description, as the server wrote it
    Renders slides of a report as images, as viewers see them, so you can check how they look: text that overflows or overlaps, or a chart too small to read. After a message's turn, pass its replies' changedSlideIds. At most 10 slides a call; hidden slides are left out. Counts against the 10 exports a minute per user.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • getSpreadsheetA Google Sheets or Excel file the user added in the app, with its sheets, read with the user's own Google or Microsoft account.Reads private dataNo findings

    Why it is in this group

    • The name "getSpreadsheet" says "get": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "file": it reads files.
    Description, as the server wrote it
    A Google Sheets or Excel file the user added in the app, with its sheets, read with the user's own Google or Microsoft account. Fails with user-missing-oauth when the user hasn't connected that account in the app. Find the file's id with searchSpreadsheets, then add a range of one of its sheets to a report with addReportDatasheets by the sheet's id.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • listBurstsThe bursts of reports the user can see, newest first, with the report parameters their variants differ by and the template report they are copied from.No findings

    Why it is in this group

    • The name "listBursts" says "list": a word for reading.
    Description, as the server wrote it
    The bursts of reports the user can see, newest first, with the report parameters their variants differ by and the template report they are copied from. You can filter by name, ignoring case. Answers up to limit bursts, 50 by default and 200 at most, and a nextCursor: pass it as cursor for the next page, until it is null. listReports leaves out the reports of a burst, its template and variants.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • listBurstVariantsA burst's variants the user can open, oldest first, each with its values of the burst's parameters, how its latest run went, whether one is going, and who its email goes to.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "listBurstVariants" says "list": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "email": it reads mail.
    • untrusted-inputThe description's first sentence says "email": it reads inbound email, which other people can write.
    Description, as the server wrote it
    A burst's variants the user can open, oldest first, each with its values of the burst's parameters, how its latest run went, whether one is going, and who its email goes to. adding lists the variants the user is still adding. Answers up to limit variants, 50 by default and 200 at most, and a nextCursor: pass it as cursor for the next page, until it is null.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • listConnectionsThe data source connections the user can see, without their credentials: each one's type, name, settings such as its URL, owner, admins, default user and whether any user's access …Reads private dataReads text others write1 finding

    Why it is in this group

    • The name "listConnections" says "list": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "credential": it reads secrets.
    • untrusted-inputThe description's first sentence says "url": it reads web pages, which anyone can write.

    Findings

    • Info

      The description mentions "credentials".

      Matched text

      description: "...ections the user can see, without their credentials: each one's type, name, settings such a..."

      What this check looks for
    Description, as the server wrote it
    The data source connections the user can see, without their credentials: each one's type, name, settings such as its URL, owner, admins, default user and whether any user's access works.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • listFoldersThe folders the user can see, each with its parent, null at the top level, and the user's permission on it: null, view, edit or manage.Reads private dataNo findings

    Why it is in this group

    • The name "listFolders" says "list": a word for reading.

    What it can reach

    • private-dataThe name "listFolders" says "list" and "folder": it reads files.
    • private-dataThe description's first sentence says "folder": it reads files.
    Description, as the server wrote it
    The folders the user can see, each with its parent, null at the top level, and the user's permission on it: null, view, edit or manage. Pass a folder's id as folderId to listReports or createReport.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • listMembersThe members of the organization, with their role, authentication role, insights access and whether they are active.No findings

    Why it is in this group

    • The name "listMembers" says "list": a word for reading.
    Description, as the server wrote it
    The members of the organization, with their role, authentication role, insights access and whether they are active. Optionally only those with a status, active or deactivated, or with an email.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • listReportDatasheetsThe datasheets a report's charts and tables are built from, with their source and when each was last read.Reads private dataNo findings

    Why it is in this group

    • The name "listReportDatasheets" says "list": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "table": it reads databases.
    Description, as the server wrote it
    The datasheets a report's charts and tables are built from, with their source and when each was last read.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • listReportsThe reports the user can see, of every type, newest first.No findings

    Why it is in this group

    • The name "listReports" says "list": a word for reading.
    Description, as the server wrote it
    The reports the user can see, of every type, newest first. Each report's type tells which endpoints work on it: the slides agent, exports, content, datasheets, parameters, email and ownership transfer take SlideDeck reports only. You can filter by folderId, name and type; when several are set, all must match, and name matching ignores case. Answers up to limit reports, 50 by default and 200 at most, and a nextCursor: pass it as cursor for the next page, until it is null.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • listSmtpConnectionsThe user's SMTP connections and the ones shared with the organization, without their credentials.Reads private data1 finding

    Why it is in this group

    • The name "listSmtpConnections" says "list": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "credential": it reads secrets.

    Findings

    • Info

      The description mentions "credentials".

      Matched text

      description: "...ed with the organization, without their credentials."

      What this check looks for
    Description, as the server wrote it
    The user's SMTP connections and the ones shared with the organization, without their credentials.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • searchDashboardsThe dashboards of a Looker, Metabase, Omni, Lightdash, Sigma, Tableau or Power BI connection whose name holds any word of query or its singular, in any case, at most 50: those the …No findings

    Why it is in this group

    • The name "searchDashboards" says "search": a word for reading.
    Description, as the server wrote it
    The dashboards of a Looker, Metabase, Omni, Lightdash, Sigma, Tableau or Power BI connection whose name holds any word of query or its singular, in any case, at most 50: those the most of the organization's reports read first, copies, old and personal ones last, then most words first, read with the user's access to the connection. A Tableau dashboard is a workbook, its views its tabs; a Power BI one a report, its pages its tabs; a Sigma one a workbook, its pages its tabs. On a Sigma connection, query can be a link to a workbook the user pasted: it finds only that workbook, with the page the link opens on as tabId, but not the link's control values, saved view or tag, and a link to another Sigma organization is rejected. Search by the name the user gives, confirm the dashboard with the user, then check its tabs and charts with getDashboard or add it to a report with addReportDatasheets. listConnections gives the connection's type and id.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • searchSpreadsheetsThe Google Sheets and Excel files the user added in the app whose name holds any word of query, in any case, most words first, at most 50.Reads private dataNo findings

    Why it is in this group

    • The name "searchSpreadsheets" says "search": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "file": it reads files.
    Description, as the server wrote it
    The Google Sheets and Excel files the user added in the app whose name holds any word of query, in any case, most words first, at most 50. Rollstack can't search the user's whole Google Drive or OneDrive: for another file, ask the user to add it in the app. Confirm the file with the user, then list its sheets with getSpreadsheet.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

594 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 6 outbound tools breaks every one.

Reads text others write9
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out6
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
deny to break every path
{
  "permissions": {
    "deny": [
      "mcp__rollstack__approveReportMessageProposal",
      "mcp__rollstack__rejectReportMessageProposal",
      "mcp__rollstack__sendReportEmail",
      "mcp__rollstack__sendReportMessage",
      "mcp__rollstack__sendReportTestEmail",
      "mcp__rollstack__updateReportEmailConfig"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

3 warn5 info
  • The server marks "cancelReportMessage" not destructive (destructiveHint: false), and its own name, description or input give the class "destructive".

    Matched text

    annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":false}; The name "cancelReportMessage" says "cancel": a word for removing or ending something.

    What this check looks for
  • The server marks "getReportRun" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "getReportRun" says "get": a word for reading.

    What this check looks for
  • The server marks "cancelReportRun" not destructive (destructiveHint: false), and its own name, description or input give the class "destructive".

    Matched text

    annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":false}; The name "cancelReportRun" says "cancel": a word for removing or ending something.

    What this check looks for
  • The description mentions "credentials".

    Matched text

    description: "...ay: the table was read with an editor's credentials, can hold columns and rows the slides n..."

    What this check looks for
  • The input schema at properties.body.properties.ignoredFailureStatusMessages.description mentions "credentials".

    Matched text

    inputSchema.properties.body.properties.ignoredFailureStatusMessages.description: "...`invalid_credentials`: the connection's credentials are invalid. - `missing_credentials`: t..."

    What this check looks for
  • The description mentions "credentials".

    Matched text

    description: "...ections the user can see, without their credentials: each one's type, name, settings such a..."

    What this check looks for
Show 2 more findings

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

Install

Pinned to version 1.0.70. Values in angle brackets are yours to fill in.

claude mcp add --transport http rollstack https://api.rollstack.com/public/v1/mcp
claude mcp add --transport http rollstack https://api.rollstack.com/public/v1/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__rollstack__listReports",
      "mcp__rollstack__getReport",
      "mcp__rollstack__getReportMessage",
      "mcp__rollstack__getReportContent",
      "mcp__rollstack__getReportSlideImages",
      "mcp__rollstack__listReportDatasheets",
      "mcp__rollstack__getReportDatasheetData",
      "mcp__rollstack__getReportParameters",
      "mcp__rollstack__getReportEmailConfig",
      "mcp__rollstack__listBursts",
      "mcp__rollstack__listBurstVariants",
      "mcp__rollstack__listConnections",
      "mcp__rollstack__searchDashboards",
      "mcp__rollstack__getDashboard",
      "mcp__rollstack__searchSpreadsheets",
      "mcp__rollstack__getSpreadsheet",
      "mcp__rollstack__listSmtpConnections",
      "mcp__rollstack__listFolders",
      "mcp__rollstack__listMembers"
    ],
    "ask": [
      "mcp__rollstack__createReport",
      "mcp__rollstack__updateReport",
      "mcp__rollstack__rejectReportMessageProposal",
      "mcp__rollstack__getReportRun",
      "mcp__rollstack__exportReport",
      "mcp__rollstack__createDataset",
      "mcp__rollstack__addReportDatasheets",
      "mcp__rollstack__createReportParameter",
      "mcp__rollstack__sendReportEmail",
      "mcp__rollstack__sendReportTestEmail",
      "mcp__rollstack__addBurstVariants",
      "mcp__rollstack__createBurst",
      "mcp__rollstack__submitFeedback"
    ],
    "deny": [
      "mcp__rollstack__sendReportMessage",
      "mcp__rollstack__approveReportMessageProposal",
      "mcp__rollstack__cancelReportMessage",
      "mcp__rollstack__startReportRun",
      "mcp__rollstack__cancelReportRun",
      "mcp__rollstack__replaceDataset",
      "mcp__rollstack__deleteDataset",
      "mcp__rollstack__shareReport",
      "mcp__rollstack__unshareReport",
      "mcp__rollstack__updateReportSchedules",
      "mcp__rollstack__updateReportEmailConfig",
      "mcp__rollstack__startBurstRun",
      "mcp__rollstack__updateBurstVariantRecipients",
      "mcp__rollstack__removeBurstVariants"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as rollstack. Review it before you use it.

Capability tags behind 18 rules
  • mcp__rollstack__getReportMessage private-data, untrusted-input
  • mcp__rollstack__sendReportMessage untrusted-input, outbound
  • mcp__rollstack__approveReportMessageProposal untrusted-input, outbound
  • mcp__rollstack__rejectReportMessageProposal outbound
  • mcp__rollstack__getReportContent private-data
  • mcp__rollstack__listReportDatasheets private-data
  • mcp__rollstack__getReportDatasheetData private-data
  • mcp__rollstack__shareReport untrusted-input
  • mcp__rollstack__getReportEmailConfig private-data, untrusted-input
  • mcp__rollstack__updateReportEmailConfig outbound
  • mcp__rollstack__sendReportEmail untrusted-input, outbound
  • mcp__rollstack__sendReportTestEmail untrusted-input, outbound
  • mcp__rollstack__listBurstVariants private-data, untrusted-input
  • mcp__rollstack__listConnections private-data, untrusted-input
  • mcp__rollstack__searchSpreadsheets private-data
  • mcp__rollstack__getSpreadsheet private-data
  • mcp__rollstack__listSmtpConnections private-data
  • mcp__rollstack__listFolders private-data

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/com.rollstack/mcp/verify?hash=43ed4dfc82546fbe79123114a7d0e2ef8968608e119c27a7bd0d43e1b4cdc8ec" | jq -e '.changed == false'

Pinned hash 43ed4dfc8254, from Nov 4, 2026, 23:18 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/com.rollstack/mcp/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for com.rollstack/mcp
[![anlyon.dev](https://anlyon.dev/badge/com.rollstack/mcp.svg)](https://anlyon.dev/servers/com.rollstack/mcp)

Source: MCP Registry. Synced Nov 5, 2026, 00:17 UTC.