Skip to content

Starcovery

by starcovery.com · remote · no sign-in to list tools · v1.0.0 · published by com.starcovery

MCP tools to find and hire Instagram and TikTok creators from a plain-language brief.

Deletes · 6Changes · 13

28 tools: 6 can delete or cancel things, 13 change things and 9 only read.

Scanned Oct 21, 2026

27 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http starcovery https://www.starcovery.com/api/mcp

Findings

Matches of fixed checks, with the text they matched.

1 warn26 info
Show 21 more findings

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

28 tools

Deletes or cancels 6Claude Code: deny
  • delete_campaignDelete a campaign and its matches.1 finding

    Why it is in this group

    • The name "delete_campaign" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).

    Findings

    • Info

      The description mentions "credential".

      Matched text

      description: "...a tool error naming the reason. Needs a credential."

      What this check looks for
    Description, as the server wrote it
    Delete a campaign and its matches. A funded campaign, a campaign with a signed hire, or a campaign with a proposal delivery returns a tool error naming the reason. Needs a credential.

    Annotations the server declares

    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: false
    • title: Delete campaign
  • delete_campaign_attachmentDelete one file attached to a campaign of the caller's organization.1 finding

    Why it is in this group

    • The name "delete_campaign_attachment" says "delete": a word for removing or ending something.
    • The description says "Irreversible".
    • The server marks it destructive (destructiveHint: true).

    Findings

    • Info

      The description mentions "credential".

      Matched text

      description: "...organization returns not_found. Needs a credential."

      What this check looks for
    Description, as the server wrote it
    Delete one file attached to a campaign of the caller's organization. Irreversible. An attachment or a campaign outside the caller's organization returns not_found. Needs a credential.

    Annotations the server declares

    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: false
    • title: Delete campaign attachment
  • delete_listDelete one List of the caller's organization and its saved creators.1 finding

    Why it is in this group

    • The name "delete_list" says "delete": a word for removing or ending something.
    • The description says "Irreversible".
    • The server marks it destructive (destructiveHint: true).

    Findings

    • Info

      The description mentions "credential".

      Matched text

      description: "...organization returns not_found. Needs a credential."

      What this check looks for
    Description, as the server wrote it
    Delete one List of the caller's organization and its saved creators. Campaigns keep the creators added from it. Irreversible. A List outside the caller's organization returns not_found. Needs a credential.

    Annotations the server declares

    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: false
    • title: Delete list
  • remove_campaign_matchRemove one matched creator from a campaign by match id.1 finding

    Why it is in this group

    • The name "remove_campaign_match" says "remove": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).

    Findings

    • Info

      The description mentions "credential".

      Matched text

      description: "...a tool error naming the reason. Needs a credential."

      What this check looks for
    Description, as the server wrote it
    Remove one matched creator from a campaign by match id. A match that already has a proposal delivery, or any match while a send request is open, once the campaign is sent, or while it is archived, returns a tool error naming the reason. Needs a credential.

    Annotations the server declares

    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: false
    • title: Remove campaign match
  • revoke_api_keyRevoke an API key by id.1 finding

    Why it is in this group

    • The name "revoke_api_key" says "revoke": a word for removing or ending something.
    • The description says "Irreversible".
    • The server marks it destructive (destructiveHint: true).

    Findings

    • Info

      The description mentions "credential".

      Matched text

      description: "...ay enabled until revoked by id. Needs a credential other than an agent access token or an..."

      What this check looks for
    Description, as the server wrote it
    Revoke an API key by id. An owner or admin revokes any key of the organization; a member revokes only a key they minted, and another key returns not_found. Irreversible, and touches only that key: keys minted with it stay enabled until revoked by id. Needs a credential other than an agent access token or an OAuth access token.

    Annotations the server declares

    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: false
    • title: Revoke API key
  • update_campaignUpdate campaign fields: name, goal, visibility, or status (draft, archived, or active; Starcovery sets active when the team sends the proposals, and active reopens an archived camp…1 finding

    Why it is in this group

    • The name "update_campaign" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    Findings

    • Info

      The description mentions "credential".

      Matched text

      description: "...still changes the other fields. Needs a credential."

      What this check looks for
    Description, as the server wrote it
    Update campaign fields: name, goal, visibility, or status (draft, archived, or active; Starcovery sets active when the team sends the proposals, and active reopens an archived campaign whose proposals were sent). A campaign that is active or holds a delivery cannot return to draft, a campaign with an open send or funding request cannot be archived, and a campaign that is not archived or was never sent cannot be set active; each change returns a tool error naming the reason. Changing visibility to private costs 1 credit; already-private updates do not. Contract (deliverable, compensationCents, and platforms, the platforms one payment covers), creator posting date, campaign details declassifying date (embargoUntil), disclosure, and marketInformation are accepted. Null marketInformation clears it. While a funding request is open or the campaign holds funds, a changed or cleared marketInformation returns a tool error naming the reason; a campaign whose reserve was refunded to zero takes a new answer. After Starcovery sends the proposals, a changed or cleared contract returns a tool error naming the reason, and a call without contract still changes the other fields. Needs a credential.

    Annotations the server declares

    • destructiveHint: true
    • openWorldHint: true
    • readOnlyHint: false
    • title: Update campaign
Changes things 13Claude Code: ask
  • add_campaign_matchAdd a creator as a manual match to a campaign by profileId, with its fitScore.1 finding

    Why it is in this group

    • The name "add_campaign_match" says "add": a word for a change.

    Findings

    • Info

      The description mentions "credential".

      Matched text

      description: "...a tool error naming the reason. Needs a credential."

      What this check looks for
    Description, as the server wrote it
    Add a creator as a manual match to a campaign by profileId, with its fitScore. Idempotent on (campaign, profileId). Stores the platform, handle, name, picture, and follower count of the catalog profile, so the input carries nothing else, and any other key, platform or username included, fails the call with a validation error; a profileId with no catalog profile returns not_found. While a send request is open, once the campaign is sent, or while it is archived, it returns a tool error naming the reason. Needs a credential.

    Annotations the server declares

    • destructiveHint: false
    • openWorldHint: true
    • readOnlyHint: false
    • title: Add campaign match
  • add_campaign_matchesAdd several creators as manual matches to a campaign in one call.1 finding

    Why it is in this group

    • The name "add_campaign_matches" says "add": a word for a change.

    Findings

    • Info

      The description mentions "credential".

      Matched text

      description: "...a tool error naming the reason. Needs a credential."

      What this check looks for
    Description, as the server wrote it
    Add several creators as manual matches to a campaign in one call. Each creator is a profileId and fitScore pick: the id and fitScore of a search_creators creator, or the profileId and fitScore of a get_list creator. Idempotent on (campaign, profileId). Stores the platform, handle, name, picture, and follower count of each catalog profile, so a creator carries nothing else, and any other key on a creator fails the call with a validation error. A profileId outside the catalog fails the call with a tool error naming it, and nothing is added. Returns added, the count of new matches, and present, the count already on the campaign, with addedCreators and presentCreators, the same counts per person, so a person with two matched profiles counts once. A campaign outside the caller's organization returns not_found. While a send request is open, once the campaign is sent, or while it is archived, it returns a tool error naming the reason. Needs a credential.

    Annotations the server declares

    • destructiveHint: false
    • openWorldHint: true
    • readOnlyHint: false
    • title: Add campaign matches
  • create_api_keyMint a new API key.1 finding

    Why it is in this group

    • The name "create_api_key" says "create": a word for a change.

    Findings

    • Info

      The description mentions "credential".

      Matched text

      description: "...minting key leaves it working. Needs a credential other than an agent access token or an..."

      What this check looks for
    Description, as the server wrote it
    Mint a new API key. Returns the plaintext key once; it is not shown again. The new key is an ordinary key of the same member, not a child of the minting key: revoking the minting key leaves it working. Needs a credential other than an agent access token or an OAuth access token.

    Annotations the server declares

    • destructiveHint: false
    • openWorldHint: false
    • readOnlyHint: false
    • title: Create API key
  • create_campaignCreate a campaign with a goal (what to advertise or attain).1 finding

    Why it is in this group

    • The name "create_campaign" says "create": a word for a change.

    Findings

    • Info

      The description mentions "credential".

      Matched text

      description: "...anything is created or charged. Needs a credential."

      What this check looks for
    Description, as the server wrote it
    Create a campaign with a goal (what to advertise or attain). A campaign opens only to its organization until its proposals are sent, at no charge. It is public and free by default, which opens it to any identified caller once sent; setting visibility "private" costs 1 credit and keeps it to the organization after the send. Contract (deliverable, compensationCents, and platforms, the platforms one payment covers), creator posting date, campaign details declassifying date (embargoUntil), disclosure, and marketInformation are accepted. Optional creators, each a profileId and fitScore pick, adds them as manual matches in the same call, as add_campaign_matches does, and the result carries matches with the added and present counts; any other key on a creator fails the call with a validation error; a creator id outside the catalog fails the call before anything is created or charged. Needs a credential.

    Annotations the server declares

    • destructiveHint: false
    • openWorldHint: true
    • readOnlyHint: false
    • title: Create campaign
  • enrich_creatorsRun shortlist AI enrichment (niche, celebrity, evidence, signal) for creators from search_creators.No findings

    Why it is in this group

    • The description's first verb is "run": a word for a change.
    Description, as the server wrote it
    Run shortlist AI enrichment (niche, celebrity, evidence, signal) for creators from search_creators. It takes the same creators array, query string (search query.q), and the shortlistId search_creators returned with them. Returns one analysis object per creatorId. A shortlistId works once, for 4 hours, and only for the caller who searched; enrichment spends no credits. Holds the call open until the result, up to 800 seconds.

    Annotations the server declares

    • destructiveHint: false
    • openWorldHint: false
    • readOnlyHint: false
    • title: Enrich creators
  • export_campaignExport a campaign as CSV (Rank, Handle, Name, Platform, Followers, Fit, Source).1 finding

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Info

      The description mentions "credential".

      Matched text

      description: "...). Same access as get_campaign. Needs a credential."

      What this check looks for
    Description, as the server wrote it
    Export a campaign as CSV (Rank, Handle, Name, Platform, Followers, Fit, Source). Same access as get_campaign. Needs a credential.

    Annotations the server declares

    • destructiveHint: false
    • openWorldHint: false
    • readOnlyHint: true
    • title: Export campaign CSV
  • generate_campaign_matchesGenerate creator matches from the campaign goal.1 finding

    Why it is in this group

    • The name "generate_campaign_matches" says "generate": a word for a change.

    Findings

    • Info

      The description mentions "credential".

      Matched text

      description: "...reason before any search runs. Needs a credential."

      What this check looks for
    Description, as the server wrote it
    Generate creator matches from the campaign goal. Runs one creator search (same daily grant and prepaid credits as search_creators; pre-claim agent tokens spend prepaid credits only) and saves matches; idempotent on (campaign, profileId). Optional filters narrow the search. Holds the call open until the result, up to 800 seconds. While a send request is open, once the campaign is sent, or while it is archived, it returns a tool error naming the reason before any search runs. Needs a credential.

    Annotations the server declares

    • destructiveHint: false
    • openWorldHint: true
    • readOnlyHint: false
    • title: Generate campaign matches
  • request_campaign_fundingRequest campaign funding for a campaign the caller's organization owns.1 finding

    Why it is in this group

    • The name "request_campaign_funding" says "request": a word for a change.

    Findings

    • Info

      The description mentions "credential".

      Matched text

      description: "...tCents set to the quoted total. Needs a credential."

      What this check looks for
    Description, as the server wrote it
    Request campaign funding for a campaign the caller's organization owns. Starcovery Payouts runs concierge: this call records one open funding request for the accepted creators not yet funded, per person, with the quoted total (compensation per creator times those people, plus the platform fee that the market information answer sets), and notifies the Starcovery team, who invoice the organization. Only organization owners and admins may call it. Needs a saved contract, an answered market information question, and at least one creator who accepted and is not yet funded. Returns a tool error naming the reason when the campaign is not the caller's, it is archived, a step is missing, or a request is already open. An archived campaign is funded only after it is reopened with update_campaign status active. The reason creators_changed means a creator accepted while the request was prepared; the same call then succeeds. Returns the request row with amountCents set to the quoted total. Needs a credential.

    Annotations the server declares

    • destructiveHint: false
    • openWorldHint: false
    • readOnlyHint: false
    • title: Request campaign funding
  • request_campaign_sendRequest a proposal send for a draft campaign the caller's organization owns.1 finding

    Why it is in this group

    • The name "request_campaign_send" says "request": a word for a change.

    Findings

    • Info

      The description mentions "credential".

      Matched text

      description: "...sent. Returns the request row. Needs a credential."

      What this check looks for
    Description, as the server wrote it
    Request a proposal send for a draft campaign the caller's organization owns. Starcovery Proposals runs concierge: this call records one open send request and notifies the Starcovery team, who send the proposals from the staff queue. Needs a saved contract whose creator posting date, when set, is today or a later day in UTC, a captured disclosure, and at least one match. Returns a tool error naming the reason when the campaign is not the caller's, a step is missing, a request is already open, or the campaign is already sent. Returns the request row. Needs a credential.

    Annotations the server declares

    • destructiveHint: false
    • openWorldHint: false
    • readOnlyHint: false
    • title: Request proposal send
  • reveal_contactReveal a creator contact address.1 finding

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    Findings

    • Info

      The description mentions "credential".

      Matched text

      description: "...n the address without charging. Needs a credential."

      What this check looks for
    Description, as the server wrote it
    Reveal a creator contact address. Costs 1 prepaid credit the first time this organization reveals that profile. Later calls return the address without charging. Needs a credential.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: false
    • title: Reveal contact
  • save_listSave a set of creators as a List for the organization, with the brief and filters of the search that produced it.1 finding

    Why it is in this group

    • The name "save_list" says "save": a word for a change.

    Findings

    • Info

      The description mentions "credential".

      Matched text

      description: "...Returns the saved List summary. Needs a credential."

      What this check looks for
    Description, as the server wrote it
    Save a set of creators as a List for the organization, with the brief and filters of the search that produced it. The List takes the name in name, or a name cut from the brief when name is omitted, with a number from 2 appended when another List of the organization holds that name. Each creator is a profileId and fitScore pick: profileId is the creator id from search_creators, and fitScore its fit. The List stores the platform, handle, name, picture, and follower count of each catalog profile, so a creator carries nothing else, and any other key on a creator fails the call with a validation error. A profileId outside the catalog fails the call with a tool error naming it, and no List is saved. Returns the saved List summary. Needs a credential.

    Annotations the server declares

    • destructiveHint: false
    • openWorldHint: false
    • readOnlyHint: false
    • title: Save list
  • search_creatorsSearch Instagram and TikTok creators with a natural-language brief.1 finding

    Why it is in this group

    • The name "search_creators" says "search": a word for reading.
    • The server marks it as not read-only (readOnlyHint: false).

    Findings

    • Warn

      The server marks "search_creators" as not read-only (readOnlyHint: false), and its words say it reads.

      Matched text

      annotations: {"readOnlyHint":false,"destructiveHint":false,"openWorldHint":false}; The name "search_creators" says "search": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Search Instagram and TikTok creators with a natural-language brief. Returns up to 50 ranked creators with fit score, follower count, platform, the 3 best-matching videos, and a shortlistId for enrich_creators when available. Bios and captions are cut to 150 characters. The creator's website link is returned as written, or null when it is longer than 200 characters. Every other link is a short link that redirects for 24 hours. When the result would pass 140,000 characters, the lowest ranked creators are left out until it fits. The brief in q sets no filter; platform, country, and tier filter. Contact addresses stay empty until reveal_contact. Holds the call open until the result, up to 800 seconds. Each search is one use. Unsigned callers get 100 uses per rolling 24 hours per IP. Identified callers get 200 uses per rolling 24 hours, then prepaid credits. Pre-claim agent tokens skip the daily grant and use prepaid credits only. enrich_creators takes these creators, query.q, and shortlistId for niche, evidence, and signal analysis.

    Annotations the server declares

    • destructiveHint: false
    • openWorldHint: false
    • readOnlyHint: false
    • title: Search creators
  • thread_turnRun the next turn of a search thread and return the settled brief, its filters, the operations the turn ran, the reply, and the creators of the thread result set with a shortlistId…1 finding

    Why it is in this group

    • The description's first verb is "run": a word for a change.

    Findings

    • Info

      The description mentions "credential".

      Matched text

      description: "...at finds it spent runs nothing. Needs a credential."

      What this check looks for
    Description, as the server wrote it
    Run the next turn of a search thread and return the settled brief, its filters, the operations the turn ran, the reply, and the creators of the thread result set with a shortlistId for enrich_creators. creatorCount counts the whole set; creators holds at most the 50 best fit of them, fewer when the result would pass 140,000 characters. The reply, statement, and error are cut to 4,000 characters, and operations lists at most the first 20. Without threadId the call opens a new thread; the threadId in the result is the durable handle for the next turn. A pasted website address is read into a brief; anything else refines the brief, or answers a question about the organization's campaigns, Lists, credits, or API keys from read tools without changing them. Sends notifications/progress when the caller passes a progressToken. MCP cannot stream a tool result, so the call is blocking and waits until the turn ends, up to 800 seconds. Each turn costs 1 use plus 1 for each search and each exclusion it runs, from the same daily grant as search_creators and then 1 prepaid credit each. A refinement returns the set it built; the first brief runs one search for its creators, billed like search_creators. The thread stores the set, so reading it again with GET /api/threads/{threadId}/results is free. When the allowance runs out, exhausted is set and creators is empty; a turn that finds it spent runs nothing. Needs a credential.

    Annotations the server declares

    • destructiveHint: false
    • openWorldHint: true
    • readOnlyHint: false
    • title: Run thread turn
Only reads 9Claude Code: allow
  • get_campaignGet one campaign and its matched creators.1 finding

    Why it is in this group

    • The name "get_campaign" says "get": a word for reading.

    Findings

    • Info

      The description mentions "credential".

      Matched text

      description: "...and empty once no step is left. Needs a credential."

      What this check looks for
    Description, as the server wrote it
    Get one campaign and its matched creators. Ordinary public campaigns whose proposals are sent are free to read for any identified caller. A private campaign, and any campaign whose proposals are not yet sent, reads as not found for a caller outside the organization. Contract, creator posting date, campaign details declassifying date, and disclosure are present for members of the organization and may be null on open and summary reads. For members of the organization, people lists each person on the campaign once, with their profiles, their answer to the proposal, their funding (requested or funded), and their signed hire with the payout amount, paidAt (null while the payout is pending), and posts, each live post Starcovery recorded with its link, viewCount, and engagementCount (likes plus comments); people also lists a hire that matches no creator on the campaign, and is null for other callers. Hires and payouts are counted in people. For members of the organization, nextStep names the step the web app shows next, as list_campaigns does; it is null for other callers and once no step is left. currentSteps lists every step under way in campaign order in the same shape, because a step before nextStep can still wait, such as proposals Starcovery has not sent; currentSteps, not nextStep or status, tells whether a step is finished. It is null for other callers and empty once no step is left. Needs a credential.

    Annotations the server declares

    • destructiveHint: false
    • openWorldHint: false
    • readOnlyHint: true
    • title: Get campaign
  • get_creditsRead the prepaid credit balance, the identified daily search grant status, and whether a card is on file.1 finding

    Why it is in this group

    • The name "get_credits" says "get": a word for reading.

    Findings

    • Info

      The description mentions "credential".

      Matched text

      description: "...out or change payment settings. Needs a credential."

      What this check looks for
    Description, as the server wrote it
    Read the prepaid credit balance, the identified daily search grant status, and whether a card is on file. Does not start checkout or change payment settings. Needs a credential.

    Annotations the server declares

    • destructiveHint: false
    • openWorldHint: false
    • readOnlyHint: true
    • title: Get credits
  • get_listGet one List of the caller's organization with its brief, filters, and saved creators, best fit first.1 finding

    Why it is in this group

    • The name "get_list" says "get": a word for reading.

    Findings

    • Info

      The description mentions "credential".

      Matched text

      description: "...organization returns not_found. Needs a credential."

      What this check looks for
    Description, as the server wrote it
    Get one List of the caller's organization with its brief, filters, and saved creators, best fit first. The creators carry the saved creator shape that intersect_lists takes. add_campaign_matches, create_campaign, and save_list take only the profileId and fitScore of each. A List outside the caller's organization returns not_found. Needs a credential.

    Annotations the server declares

    • destructiveHint: false
    • openWorldHint: false
    • readOnlyHint: true
    • title: Get list
  • intersect_listsKeep the creators that appear in both lists, in the order of the left list.1 finding

    Why it is in this group

    • The name "intersect_lists" says "list": a word for reading.

    Findings

    • Info

      The description mentions "credential".

      Matched text

      description: "...geUrl, and username carry over. Needs a credential."

      What this check looks for
    Description, as the server wrote it
    Keep the creators that appear in both lists, in the order of the left list. Nothing is stored. A search_creators result maps to the saved creator shape: profileId is the creator id, and fitScore, followerCount, name, platform, profileImageUrl, and username carry over. Needs a credential.

    Annotations the server declares

    • destructiveHint: false
    • openWorldHint: false
    • readOnlyHint: true
    • title: Intersect lists
  • list_api_keysList API keys for the active organization (id, name, prefix, timestamps).1 finding

    Why it is in this group

    • The name "list_api_keys" says "list": a word for reading.

    Findings

    • Info

      The description mentions "credential".

      Matched text

      description: ".... Never returns plaintext keys. Needs a credential other than an agent access token or an..."

      What this check looks for
    Description, as the server wrote it
    List API keys for the active organization (id, name, prefix, timestamps). An owner or admin sees every key; a member sees only the keys they minted. Never returns plaintext keys. Needs a credential other than an agent access token or an OAuth access token.

    Annotations the server declares

    • destructiveHint: false
    • openWorldHint: false
    • readOnlyHint: true
    • title: List API keys
  • list_campaign_attachmentsList the files attached to a campaign of the caller's organization, with id, filename, content type, byte size, and upload time.1 finding

    Why it is in this group

    • The name "list_campaign_attachments" says "list": a word for reading.

    Findings

    • Info

      The description mentions "credential".

      Matched text

      description: "...organization returns not_found. Needs a credential."

      What this check looks for
    Description, as the server wrote it
    List the files attached to a campaign of the caller's organization, with id, filename, content type, byte size, and upload time. Returns no file contents. A campaign outside the caller's organization returns not_found. Needs a credential.

    Annotations the server declares

    • destructiveHint: false
    • openWorldHint: false
    • readOnlyHint: true
    • title: List campaign attachments
  • list_campaignsList the caller's campaigns with goal, status, visibility, match counts, and nextStep: the step the web app shows next, with its id, label, actor (you for the organization, starcov…1 finding

    Why it is in this group

    • The name "list_campaigns" says "list": a word for reading.

    Findings

    • Info

      The description mentions "credential".

      Matched text

      description: "...reator was reached or accepted. Needs a credential."

      What this check looks for
    Description, as the server wrote it
    List the caller's campaigns with goal, status, visibility, match counts, and nextStep: the step the web app shows next, with its id, label, actor (you for the organization, starcovery, creators, or one creator by name), and line, the sentence that says what the step waits on. nextStep is null once no step is left: the campaign is done or archived, or no creator was reached or accepted. Needs a credential.

    Annotations the server declares

    • destructiveHint: false
    • openWorldHint: false
    • readOnlyHint: true
    • title: List campaigns
  • list_listsList the organization's saved Lists with brief, filters, creatorCount (each person once), itemCount (each saved profile), and last update.1 finding

    Why it is in this group

    • The name "list_lists" says "list": a word for reading.

    Findings

    • Info

      The description mentions "credential".

      Matched text

      description: "...aved profile), and last update. Needs a credential."

      What this check looks for
    Description, as the server wrote it
    List the organization's saved Lists with brief, filters, creatorCount (each person once), itemCount (each saved profile), and last update. Needs a credential.

    Annotations the server declares

    • destructiveHint: false
    • openWorldHint: false
    • readOnlyHint: true
    • title: List lists
  • whoamiShow the current credential, the bound user and organization, and whether the next search draws from the user daily grant or the organization balance.1 finding

    Why it is in this group

    • The name "whoami" says "whoami": a word for reading.

    Findings

    • Info

      The description mentions "credential".

      Matched text

      description: "Show the current credential, the bound user and organization, and w..."

      What this check looks for
    Description, as the server wrote it
    Show the current credential, the bound user and organization, and whether the next search draws from the user daily grant or the organization balance. Needs a credential.

    Annotations the server declares

    • destructiveHint: false
    • openWorldHint: false
    • readOnlyHint: true
    • title: Who am I

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http starcovery https://www.starcovery.com/api/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__starcovery__list_campaigns",
      "mcp__starcovery__get_campaign",
      "mcp__starcovery__list_campaign_attachments",
      "mcp__starcovery__whoami",
      "mcp__starcovery__get_credits",
      "mcp__starcovery__list_api_keys",
      "mcp__starcovery__intersect_lists",
      "mcp__starcovery__list_lists",
      "mcp__starcovery__get_list"
    ],
    "ask": [
      "mcp__starcovery__search_creators",
      "mcp__starcovery__enrich_creators",
      "mcp__starcovery__reveal_contact",
      "mcp__starcovery__create_campaign",
      "mcp__starcovery__generate_campaign_matches",
      "mcp__starcovery__add_campaign_match",
      "mcp__starcovery__add_campaign_matches",
      "mcp__starcovery__export_campaign",
      "mcp__starcovery__request_campaign_send",
      "mcp__starcovery__request_campaign_funding",
      "mcp__starcovery__create_api_key",
      "mcp__starcovery__thread_turn",
      "mcp__starcovery__save_list"
    ],
    "deny": [
      "mcp__starcovery__update_campaign",
      "mcp__starcovery__delete_campaign",
      "mcp__starcovery__remove_campaign_match",
      "mcp__starcovery__delete_campaign_attachment",
      "mcp__starcovery__revoke_api_key",
      "mcp__starcovery__delete_list"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as starcovery. Review it before you use it.