Skip to content
anlyon.devby Anlyon

Safe Rate

com.saferate/saferatesaferate.comstreamable-httpv1.0.0Scanned

US mortgage rate estimates, lender rankings and research, and US Treasury market data.

22 tools: 9 change things and 13 only read.

Tools: 0 delete, 0 irreversible, 9 write, 13 read.
  • Reads private data · 1
  • Reads text others write · 1
  • Can send data out · 0
  • 2 findings

Anlyon alternative

9 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →
Compare with similar serversMarkdownJSONReport this listing

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

22 tools

Changes things 9Claude Code: ask
  • assess_property_contextAssess hazard exposure and insurance conditions for a US location: FEMA National Risk Index score, flood-zone coverage and whether flood insurance is likely to be required for a mo…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Assess hazard exposure and insurance conditions for a US location: FEMA National Risk Index score, flood-zone coverage and whether flood insurance is likely to be required for a mortgage, wildfire and earthquake exposure, and local insurance-market conditions. Describes the area, not a specific property.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_treasury_indexGet Safe Rate's Treasury total-return indices — by maturity bucket, plus bills, TIPS, floating-rate and aggregate.1 finding

    Why it is in this group

    • The name "get_treasury_index" says "get": a word for reading.
    • The input takes a statement or command to run (input.code), which can change anything it can reach.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "get_treasury_index" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "get_treasury_index" says "get": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Get Safe Rate's Treasury total-return indices — by maturity bucket, plus bills, TIPS, floating-rate and aggregate. Call with no code to list every index with its current level and discover the codes. These are TOTAL RETURN levels, not yields: a rising level usually means yields fell. Constructed by Safe Rate, not an official Treasury statistic.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • price_treasury_securityConvert between price and yield for a Treasury bill, note or bond.1 finding

    Why it is in this group

    • The description's first verb is "convert": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "price_treasury_security" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "convert": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Convert between price and yield for a Treasury bill, note or bond. Supply exactly one side — a price or a yield (a discount rate for a bill) — and the other is returned, with accrued interest, dirty price and the investment rate as applicable. For a note or bond, a CUSIP looks the terms up instead of restating them.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • research_lenderLook up any US mortgage lender by name or NMLS ID: origination volume, approval and pull-through rates, product mix, geographic footprint, and responsiveness, from federal HMDA dat…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Look up any US mortgage lender by name or NMLS ID: origination volume, approval and pull-through rates, product mix, geographic footprint, and responsiveness, from federal HMDA data.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • share_applicationRequires the shopper's Safe Rate sign-in (scope poppy:read).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Requires the shopper's Safe Rate sign-in (scope poppy:read). Does NOT share anything: sharing an application with a lender always takes the shopper's own click on saferate.com. Returns the link where the shopper reviews and shares it themselves.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
  • start_my_applicationRequires the shopper's Safe Rate sign-in (scope poppy:write).No findings

    Why it is in this group

    • The name "start_my_application" says "start": a word for a change.
    Description, as the server wrote it
    Requires the shopper's Safe Rate sign-in (scope poppy:write). Start building the shopper's Universal Application from a loan scenario. If they already have one, nothing changes and it is returned. Holds no personal information: no name, SSN or date of birth.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: false
  • track_quote_estimateCheck a previously created Safe Rate rate estimate by its estimate ID.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Check a previously created Safe Rate rate estimate by its estimate ID. Returns the original scenario, how rates have moved since the estimate was created, and current rates for the same scenario. No account or contact information required.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • update_my_applicationRequires the shopper's Safe Rate sign-in (scope poppy:write).No findings

    Why it is in this group

    • The name "update_my_application" says "update": a word for a change.
    Description, as the server wrote it
    Requires the shopper's Safe Rate sign-in (scope poppy:write). Change answers in the loan scenario of the shopper's Universal Application. Send only the fields that change: everything else keeps its saved value, and nothing is saved if the result would be invalid. Cannot share the application or record an SSN — those are the shopper's own click on saferate.com.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: false
  • value_savings_bondValue a U.S.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Value a U.S. Series I or Series EE savings bond: what it is worth now, how it got there, and what the holder would actually receive. Bonds under five years old forfeit three months of interest on redemption, and bonds under twelve months cannot be redeemed at all — report the net, not just the accrued value. The purchase date is the bond's issue date.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
Only reads 13Show 13 read-only tools
  • fetchFetch one Safe Rate published page by the id returned from `search`.No findings

    Why it is in this group

    • The name "fetch" says "fetch": a word for reading.
    Description, as the server wrote it
    Fetch one Safe Rate published page by the id returned from `search`. Returns plain text carrying its own as-of date, canonical URL, data license, and citation notice — quote and cite it rather than paraphrasing. Rate index pages are indicative and refreshed daily; they are not a quote for a specific borrower.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • find_lenders_in_marketList the lenders Safe Rate publishes rankings for in a metro area, sliced by loan type OR by institution type.No findings

    Why it is in this group

    • The name "find_lenders_in_market" says "find": a word for reading.
    Description, as the server wrote it
    List the lenders Safe Rate publishes rankings for in a metro area, sliced by loan type OR by institution type. Rankings are derived from public federal HMDA filings; placement cannot be purchased. This is a starting list, not a recommendation for a specific borrower.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_market_contextGet local housing-market context for a US location: median home value with its national percentile, median rent, recent price appreciation, and historical mortgage activity from HM…No findings

    Why it is in this group

    • The name "get_market_context" says "get": a word for reading.
    Description, as the server wrote it
    Get local housing-market context for a US location: median home value with its national percentile, median rent, recent price appreciation, and historical mortgage activity from HMDA filings. Use this to answer whether a price or a market is typical.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_my_applicationRequires the shopper's Safe Rate sign-in (scope poppy:read).No findings

    Why it is in this group

    • The name "get_my_application" says "get": a word for reading.
    Description, as the server wrote it
    Requires the shopper's Safe Rate sign-in (scope poppy:read). Read the shopper's own Safe Rate Universal Application, the one application they build to share with the lenders they choose (building it is not applying for a loan): their loan scenario (price, down payment, ZIP, occupancy and so on), how far along it is, and its status. Identity details such as a Social Security number are never returned.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
  • get_my_quotesRequires the shopper's Safe Rate sign-in (scope poppy:read).No findings

    Why it is in this group

    • The name "get_my_quotes" says "get": a word for reading.
    Description, as the server wrote it
    Requires the shopper's Safe Rate sign-in (scope poppy:read). List the quote requests the shopper sent to lenders and the offers that came back (rate, APR, points, product). Offers from Safe Rate Mortgage stay hidden until the shopper accepts the affiliated business disclosure on saferate.com.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
  • get_quote_estimateGet live mortgage rate estimates for any US location without collecting the borrower's name, email, or phone number.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "get_quote_estimate" says "get": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "get" and "email": it reads mail.
    • untrusted-inputThe description's first sentence says "get" and "email": it reads inbound email, which other people can write.
    Description, as the server wrote it
    Get live mortgage rate estimates for any US location without collecting the borrower's name, email, or phone number. Rates are Safe Rate's non-binding estimates (never quotes; a lender's actual quote may differ), and include an estimate ID the borrower can use to track rate changes.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • get_savings_bond_ratesGet current and historical U.S.No findings

    Why it is in this group

    • The name "get_savings_bond_rates" says "get": a word for reading.
    Description, as the server wrote it
    Get current and historical U.S. savings bond rates — the Series I composite, its fixed and inflation components, and Series EE rates by issue cohort — and optionally how many bonds the public holds and how many are being sold. An I bond's headline rate applies for six months only; the fixed component is the part that lasts.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_treasury_curveGet the U.S.No findings

    Why it is in this group

    • The name "get_treasury_curve" says "get": a word for reading.
    Description, as the server wrote it
    Get the U.S. Treasury yield curve for a single day: the fitted zero-coupon (spot) curve and, on request, the par curve, money-market curve, TIPS real curve, breakeven inflation, the prior trading day for day-over-day moves, and per-CUSIP yields. Omit the date for the most recent published day, which is what you want on a weekend or holiday. Treasury yields are not mortgage rates.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_treasury_debtGet the U.S.No findings

    Why it is in this group

    • The name "get_treasury_debt" says "get": a word for reading.
    Description, as the server wrote it
    Get the U.S. federal debt from the monthly Treasury statement: debt held by the public, total public debt outstanding, and its composition, plus the STRIPS float on request. These two headline figures differ by trillions — debt held by the public excludes intragovernmental trust-fund holdings — so always say which one you are quoting.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_treasury_rate_historyGet a history of U.S.No findings

    Why it is in this group

    • The name "get_treasury_rate_history" says "get": a word for reading.
    Description, as the server wrote it
    Get a history of U.S. Treasury yields between two dates: the nominal zero curve, the short-end money-market curve, or the TIPS real curve, one row per trading day. Use this for 'how have rates moved' questions. Coverage starts 2008-09-02. Keep ranges tight — a decade is thousands of rows.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_treasury_securityLook up one Treasury security by CUSIP: its terms, price history, and analytics including duration, convexity, DV01 and key-rate durations, plus TIPS and floating-rate analytics wh…No findings

    Why it is in this group

    • The name "get_treasury_security" says "get": a word for reading.
    Description, as the server wrote it
    Look up one Treasury security by CUSIP: its terms, price history, and analytics including duration, convexity, DV01 and key-rate durations, plus TIPS and floating-rate analytics where they apply, and the amount outstanding. Use list_treasury_securities first if you have a description like 'the current 10-year' rather than a CUSIP.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_treasury_securitiesList Treasury securities as at a date: which security is on-the-run for each tenor (this is how to resolve 'the current 10-year' to a CUSIP), the full outstanding and priced univer…No findings

    Why it is in this group

    • The name "list_treasury_securities" says "list": a word for reading.
    Description, as the server wrote it
    List Treasury securities as at a date: which security is on-the-run for each tenor (this is how to resolve 'the current 10-year' to a CUSIP), the full outstanding and priced universe, or just the priced CUSIPs. Omit the date for the most recent day with prices.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged outbound.

Reads private data1
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write1
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out0
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

2 warn
  • Warnprice_treasury_security

    The server marks "price_treasury_security" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "convert": a word for a change.

    What this check looks for
  • Warnget_treasury_index

    The server marks "get_treasury_index" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "get_treasury_index" says "get": a word for reading.

    What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http saferate https://mcp.saferate.com/mcp
claude mcp add --transport http saferate https://mcp.saferate.com/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__saferate__get_quote_estimate",
      "mcp__saferate__get_market_context",
      "mcp__saferate__find_lenders_in_market",
      "mcp__saferate__search",
      "mcp__saferate__fetch",
      "mcp__saferate__get_treasury_curve",
      "mcp__saferate__get_treasury_rate_history",
      "mcp__saferate__get_treasury_security",
      "mcp__saferate__list_treasury_securities",
      "mcp__saferate__get_savings_bond_rates",
      "mcp__saferate__get_treasury_debt",
      "mcp__saferate__get_my_application",
      "mcp__saferate__get_my_quotes"
    ],
    "ask": [
      "mcp__saferate__track_quote_estimate",
      "mcp__saferate__assess_property_context",
      "mcp__saferate__research_lender",
      "mcp__saferate__price_treasury_security",
      "mcp__saferate__value_savings_bond",
      "mcp__saferate__get_treasury_index",
      "mcp__saferate__start_my_application",
      "mcp__saferate__update_my_application",
      "mcp__saferate__share_application"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as saferate. Review it before you use it.

Capability tags behind 1 rule
  • mcp__saferate__get_quote_estimate private-data, untrusted-input

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/com.saferate/saferate/verify?hash=c0d454c8fbcdd3b550d2145a22d46ebcc7b9dcb5910cc88a4de10f81e60ae851" | jq -e '.changed == false'

Pinned hash c0d454c8fbcd, from Nov 5, 2026, 14:18 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/com.saferate/saferate/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for com.saferate/saferate
[![anlyon.dev](https://anlyon.dev/badge/com.saferate/saferate.svg)](https://anlyon.dev/servers/com.saferate/saferate)

Source: MCP Registry. Synced Nov 5, 2026, 14:17 UTC.