VTC Spaces

by vtc.com · remote · no sign-in to list tools · v0.5.1 · published by com.vtc

Search public VTC Spaces and people; sign in to query Space data and run AI actions and workflows.

Changes · 10

Compare Registry entry

29 tools: 10 change things and 19 only read.

Scanned Oct 22, 2026

Deletes or cancels0Claude Code: deny
Can't be undone0Claude Code: ask
Changes things10Claude Code: ask: see these tools
Only reads19Claude Code: allow: see these tools

1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http vtc https://mcp.vtc.com/mcp

Findings

Matches of fixed checks, with the text they matched.

1 warn

Warnexecute_action
The description names a tool "confirm_required" that this server does not list.
Matched text
description: "...te (same path as in-product Guide). For confirm_required tools: first call WITHOUT confirmation_token..."
What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

29 tools

Changes things 10Creates or changes something that can be changed back.Claude Code: ask

execute_actionExecute an AI Guide tool via ZAPI /ai/tools/execute (same path as in-product Guide).1 finding
Why it is in this group
- The name "execute_action" says "execute": a word for a change.
Findings
- Warn
  The description names a tool "confirm_required" that this server does not list.
  Matched text
  description: "...te (same path as in-product Guide). For confirm_required tools: first call WITHOUT confirmation_token..."
  What this check looks for
Description, as the server wrote it
Execute an AI Guide tool via ZAPI /ai/tools/execute (same path as in-product Guide). For confirm_required tools: first call WITHOUT confirmation_token returns a proposal; second call WITH confirmation_token performs the action. Read-only tools (confirm_required=false) run immediately. Do not set confirmed yourself without a token.
explain_space_contextCall this first after auth.No findings
Why it is in this group
- The name "explain_space_context" says "explain": a word for reading.
- The description's first verb is "call": a word for a change.
Description, as the server wrote it
Call this first after auth. Summarizes environment, group_id, user, and role so you do not query the wrong Space or live vs beta.
login_with_otpStart ZAPI OTP login for an existing account.No findings
Why it is in this group
- The description's first verb is "start": a word for a change.
Description, as the server wrote it
Start ZAPI OTP login for an existing account. Then call verify_otp with the code and space group_id. Prefer explain_space_context after auth before querying.
propose_workflowDraft a workflow from natural language via ZAPI /ai/propose-workflow.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Draft a workflow from natural language via ZAPI /ai/propose-workflow. Does not persist — review then save_workflow. Prefer this over inventing step schemas.
run_workflowRun a saved workflow.No findings
Why it is in this group
- The name "run_workflow" says "run": a word for a change.
Description, as the server wrote it
Run a saved workflow. dry_run=true (default) previews without side effects. dry_run=false requires confirmation_token from a prior proposal. Does not call /ai/execute-agent.
save_workflowCreate a workflow in the Space (space admin JWT).No findings
Why it is in this group
- The name "save_workflow" says "save": a word for a change.
Description, as the server wrote it
Create a workflow in the Space (space admin JWT). First call returns confirmation_token; second call with that token persists. Defaults automation_enabled to false unless you set true explicitly. Does not use /ai/execute-agent.
set_guest_contextBind a Space for guest/public tools (no login).No findings
Why it is in this group
- The name "set_guest_context" says "set": a word for a change.
Description, as the server wrote it
Bind a Space for guest/public tools (no login). Accepts a numeric id, public slug (dexi), or a name that matches one public space. Prefer search_public_spaces when the name may match several spaces.
set_session_jwtSet/replace the in-memory JWT (space-scoped token from the app).No findings
Why it is in this group
- The name "set_session_jwt" says "set": a word for a change.
Description, as the server wrote it
Set/replace the in-memory JWT (space-scoped token from the app). Prefer OTP for interactive use. JWT is never written to disk.
space_db_infoCall after auth (and ideally after explain_space_context).No findings
Why it is in this group
- The description's first verb is "call": a word for a change.
Description, as the server wrote it
Call after auth (and ideally after explain_space_context). Resolves the current Shared space silo via ZAPI (URI redacted). Does not accept group_id — silo is always the JWT space.
verify_otpComplete OTP login and store a space-scoped JWT in memory only (not on disk).No findings
Why it is in this group
- The input takes a statement or command to run (input.code), which can change anything it can reach.
Description, as the server wrote it
Complete OTP login and store a space-scoped JWT in memory only (not on disk). group_id is required for Shared space DB access.

Only reads 19Looks things up and changes nothing.Claude Code: allow

count_documentsCount documents with an optional filter.No findings
Why it is in this group
- The name "count_documents" says "count": a word for reading.
Description, as the server wrote it
Count documents with an optional filter. Soft-deleted rows (status=deleted) are excluded by default when the collection has status — set include_deleted=true to override.
describe_public_app_surfaceAI manifest plus guest/public read hints for one app (module_code).No findings
Why it is in this group
- The name "describe_public_app_surface" says "describe": a word for reading.
Description, as the server wrote it
AI manifest plus guest/public read hints for one app (module_code). No Space JWT required.
fetch_app_public_routeGET an allowlisted HTTPS public API URL on *.apps.vtc.com (path must include /public).No findings
Why it is in this group
- The name "fetch_app_public_route" says "fetch": a word for reading.
Description, as the server wrote it
GET an allowlisted HTTPS public API URL on *.apps.vtc.com (path must include /public). No JWT.
find_documentsFind documents (max 50, skip capped).No findings
Why it is in this group
- The name "find_documents" says "find": a word for reading.
Description, as the server wrote it
Find documents (max 50, skip capped). Prefer narrow filter + projection. Call list_collections and sample_document before guessing schema. Soft-deletes excluded by default; sensitive fields redacted by default.
get_ai_manifestFetch the AI tool manifest for a module_code (installed app).No findings
Why it is in this group
- The name "get_ai_manifest" says "get": a word for reading.
Description, as the server wrote it
Fetch the AI tool manifest for a module_code (installed app). Use after list_space_apps when you need tool schemas — not for inspecting Mongo collections.
get_space_summaryLightweight summary of the authenticated Space from JWT claims (group_id, network_id, role).No findings
Why it is in this group
- The name "get_space_summary" says "get": a word for reading.
Description, as the server wrote it
Lightweight summary of the authenticated Space from JWT claims (group_id, network_id, role). Does not query Mongo. Prefer this or explain_space_context before DB tools.
get_workflowFetch one space workflow by id (steps, trigger, gaps).No findings
Why it is in this group
- The name "get_workflow" says "get": a word for reading.
Description, as the server wrote it
Fetch one space workflow by id (steps, trigger, gaps). Read-only.
list_available_actionsList AI Guide tools the current JWT may run (default: platform.* only).No findings
Why it is in this group
- The name "list_available_actions" says "list": a word for reading.
Description, as the server wrote it
List AI Guide tools the current JWT may run (default: platform.* only). Opt into installed app manifests with include_apps or VTC_MCP_ACTION_MODULES. Call explain_space_context first. Does not execute anything.
list_collectionsList collections in the authenticated space silo (excludes system.*).No findings
Why it is in this group
- The name "list_collections" says "list": a word for reading.
Description, as the server wrote it
List collections in the authenticated space silo (excludes system.*). Call this before assuming collection names. Use include_counts sparingly.
list_developer_catalogPublic ZAPI developer catalog of app-facing API services (no auth).No findings
Why it is in this group
- The name "list_developer_catalog" says "list": a word for reading.
Description, as the server wrote it
Public ZAPI developer catalog of app-facing API services (no auth). Use when discovering platform endpoints for child apps — not for Space Mongo data.
list_guest_public_appsList apps on a Space dashboard that allow guest browse (public_guest_access=yes).No findings
Why it is in this group
- The name "list_guest_public_apps" says "list": a word for reading.
Description, as the server wrote it
List apps on a Space dashboard that allow guest browse (public_guest_access=yes). Uses public ZAPI — no Space JWT.
list_public_collection_documentsRead documents from a collection the Space marked public-read (ZAPI).No findings
Why it is in this group
- The name "list_public_collection_documents" says "list": a word for reading.
Description, as the server wrote it
Read documents from a collection the Space marked public-read (ZAPI). No JWT.
list_space_appsList apps installed / owned in the authenticated Space (JWT group_id).No findings
Why it is in this group
- The name "list_space_apps" says "list": a word for reading.
Description, as the server wrote it
List apps installed / owned in the authenticated Space (JWT group_id). Call explain_space_context first. Not a Mongo query.
list_workflowsList saved workflows in the authenticated Space.No findings
Why it is in this group
- The name "list_workflows" says "list": a word for reading.
Description, as the server wrote it
List saved workflows in the authenticated Space. Call explain_space_context first. Read-only.
sample_documentReturn one document for schema inference.No findings
Why it is in this group
- The description's first verb is "return": a word for reading.
Description, as the server wrote it
Return one document for schema inference. Sensitive fields are redacted by default. Prefer this before large finds.
search_publicSearch public people by username, and public spaces or networks by name or username (no login).No findings
Why it is in this group
- The name "search_public" says "search": a word for reading.
Description, as the server wrote it
Search public people by username, and public spaces or networks by name or username (no login). Networks are spaces with kind "network". Use a space or network id with set_guest_context.
search_public_peopleFind public people by username (optional leading @).No findings
Why it is in this group
- The name "search_public_people" says "search": a word for reading.
Description, as the server wrote it
Find public people by username (optional leading @). No login. People who opted out of search, or who are only in a private network, are omitted. Email is not searchable.
search_public_spacesFind public VTC Spaces by space name or space username/slug (no login).No findings
Why it is in this group
- The name "search_public_spaces" says "search": a word for reading.
Description, as the server wrote it
Find public VTC Spaces by space name or space username/slug (no login). Use the returned id with set_guest_context.
validate_jwtDecode the current session JWT claims (no signature verify — ZAPI verifies on /db/).No findings
Why it is in this group
- The name "validate_jwt" says "validate": a word for reading.
Description, as the server wrote it
Decode the current session JWT claims (no signature verify — ZAPI verifies on /db/).

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 0.5.1. Values in angle brackets are yours to fill in.

claude mcp add --transport http vtc https://mcp.vtc.com/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__vtc__validate_jwt",
      "mcp__vtc__search_public",
      "mcp__vtc__search_public_spaces",
      "mcp__vtc__search_public_people",
      "mcp__vtc__list_guest_public_apps",
      "mcp__vtc__describe_public_app_surface",
      "mcp__vtc__list_public_collection_documents",
      "mcp__vtc__fetch_app_public_route",
      "mcp__vtc__list_collections",
      "mcp__vtc__count_documents",
      "mcp__vtc__find_documents",
      "mcp__vtc__sample_document",
      "mcp__vtc__list_developer_catalog",
      "mcp__vtc__list_space_apps",
      "mcp__vtc__get_ai_manifest",
      "mcp__vtc__get_space_summary",
      "mcp__vtc__list_available_actions",
      "mcp__vtc__list_workflows",
      "mcp__vtc__get_workflow"
    ],
    "ask": [
      "mcp__vtc__login_with_otp",
      "mcp__vtc__verify_otp",
      "mcp__vtc__set_session_jwt",
      "mcp__vtc__explain_space_context",
      "mcp__vtc__set_guest_context",
      "mcp__vtc__space_db_info",
      "mcp__vtc__execute_action",
      "mcp__vtc__propose_workflow",
      "mcp__vtc__save_workflow",
      "mcp__vtc__run_workflow"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as vtc. Review it before you use it.

Keep track

Get told when this server's tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/com.vtc/mcp/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Anlyon alternative

10 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Compare with other servers for the same product.

Source: MCP Registry. Synced Oct 22, 2026, 01:17 UTC.

For agents: Markdown · JSON · report this listing