Siena Society
com.sienasociety/sienasienasociety.comstreamable-httpv1.0.0Scanned
Find Siena friendship dinners in London: upcoming Thursdays, how it works, and the booking link.
5 tools: 1 change things and 4 only read.
- Reads private data · 1
- Reads text others write · 0
- Can send data out · 0
- 1 finding
Anlyon alternative
1 of these tools change something. Run those as governed actions.
Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.
Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.
Import an OpenAPI spec →Tools
Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.
5 tools
Changes things 1Claude Code: ask
start_bookingReturns the link where the person books a seat at a Siena dinner on sienasociety.com.1 finding
Why it is in this group
- The name "start_booking" says "start": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "start_booking" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "start_booking" says "start": a word for a change.
Description, as the server wrote it Returns the link where the person books a seat at a Siena dinner on sienasociety.com. It books nothing and charges nothing. On the website the person signs up or signs in, answers six short questions the first time, and pays for the seat. Never ask for card details or personal data in chat.
Annotations the server declares
- title: Start a Siena booking
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
Only reads 4Show 4 read-only tools
get_dinnerGets one Siena dinner in full: date and time, where it happens, table size, seat price, the booking window and the cancellation rule.Reads private dataNo findings
Why it is in this group
- The name "get_dinner" says "get": a word for reading.
What it can reach
- private-dataThe description's first sentence says "get" and "table": it reads databases.
Description, as the server wrote it Gets one Siena dinner in full: date and time, where it happens, table size, seat price, the booking window and the cancellation rule. The restaurant stays private until Siena emails it on the Wednesday before.
Annotations the server declares
- title: Get a Siena dinner
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
how_it_worksExplains how Siena friendship dinners work: sign-up, matching, the Wednesday email, the seat price and Premium, cancellation and refunds, and links to the policies.No findings
Why it is in this group
- The description's first verb is "explain": a word for reading.
Description, as the server wrote it Explains how Siena friendship dinners work: sign-up, matching, the Wednesday email, the seat price and Premium, cancellation and refunds, and links to the policies.
Annotations the server declares
- title: How Siena works
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
list_citiesLists the cities where Siena runs friendship dinners, with the dinner night and time.No findings
Why it is in this group
- The name "list_cities" says "list": a word for reading.
Description, as the server wrote it Lists the cities where Siena runs friendship dinners, with the dinner night and time. Siena runs in London only today.
Annotations the server declares
- title: List Siena cities
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
list_upcoming_dinnersLists upcoming Siena friendship dinners in a city between two dates, and says which ones are open to book.No findings
Why it is in this group
- The name "list_upcoming_dinners" says "list": a word for reading.
Description, as the server wrote it Lists upcoming Siena friendship dinners in a city between two dates, and says which ones are open to book. Siena holds one dinner a week, on Thursday at 7:30pm London time, for small groups of strangers who want to make friends. A few holiday Thursdays have no dinner, and the list leaves them out. Booking for a Thursday opens on the Wednesday two weeks before and closes on the Tuesday before at 23:59. With no dates, the tool lists the next 4 Thursdays. It lists up to 12 weeks ahead.
Annotations the server declares
- title: List upcoming Siena dinners
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Exfil surface
Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.
No private-data, untrusted-input, outbound path in this server alone: no tool is tagged untrusted-input or outbound.
- Reads private data1
- Reads files, mail, messages, databases, secrets, calendars or repositories.
- Reads text others write0
- Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
- Can send data out0
- Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.
Findings
Matches of fixed checks, with the text they matched.
- Warnstart_booking
The server marks "start_booking" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "start_booking" says "start": a word for a change.
History
Changes to its tool definitions and to its remote endpoint, newest first.
No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.
Install
Pinned to version 1.0.0. Values in angle brackets are yours to fill in.
claude mcp add --transport http siena https://sienasociety.com/mcpclaude mcp add --transport http siena https://sienasociety.com/mcpRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__siena__list_cities",
"mcp__siena__list_upcoming_dinners",
"mcp__siena__get_dinner",
"mcp__siena__how_it_works"
],
"ask": [
"mcp__siena__start_booking"
],
"deny": []
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as siena. Review it before you use it.
Capability tags behind 1 rule
- mcp__siena__get_dinner private-data
Pin
Keep the decision: fail CI when the tools change, follow every change, or show a badge.
Pin in CI
Fail a build when the tools you reviewed are not the tools the server serves today.
curl -s "https://anlyon.dev/api/v1/servers/com.sienasociety/siena/verify?hash=a77f0c2727497c33de0e9ca835c840544f84f93ec046a6193d33ac81f20bf517" | jq -e '.changed == false'Pinned hash a77f0c272749, from Nov 2, 2026, 10:18 UTC.
Watch
Get told when its tools change: a new tool, a new description, a new class.
https://anlyon.dev/servers/com.sienasociety/siena/changes.xmlAn Atom feed. Works in any feed reader or Slack's RSS app.
Badge
[](https://anlyon.dev/servers/com.sienasociety/siena)Source: MCP Registry. Synced Nov 2, 2026, 11:17 UTC.