YourICP
by youricp.com · remote · local (npm) · no sign-in to list tools · v0.1.3 · published by com.youricp
Enrich contacts by email or LinkedIn URL and build targeted B2B audiences.
13 tools: 2 can delete or cancel things, 1 do something that can't be undone, 5 change things and 5 only read.
Scanned Oct 21, 2026
- Deletes or cancels2Claude Code: deny: see these tools
- Can't be undone1Claude Code: ask: see these tools
- Changes things5Claude Code: ask: see these tools
- Only reads5Claude Code: allow: see these tools
7 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.
claude mcp add --transport http youricp https://mcp.youricp.com/sseFindings
Matches of fixed checks, with the text they matched.
- Warnset_auth_token
The server marks "set_auth_token" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true}; The name "set_auth_token" says "set": a word for a change.
- Warnset_token
The server marks "set_token" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true}; The name "set_token" says "set": a word for a change.
- Warncheck_payment
The server marks "check_payment" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true}; The name "check_payment" says "payment": a word that usually means money moves, which cannot be taken back.
- Warnaudience_start
The server marks "audience_start" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true}; The name "audience_start" says "start": a word for a change.
The server marks "audience_download_run" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true}; The name "audience_download_run" says "run": a word for a change.
- Infoset_auth_token
The description mentions "credential".
What this check looks forMatched text
description: "...auth token in the chat. This is an API credential, NOT YourICP billing tokens — billing t..."
Show 1 more findingShow fewer
The description mentions "credential".
What this check looks forMatched text
description: "...re NOT the auth token — that is the API credential set by set_auth_token. Call this before..."
Tools
Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.
13 tools
Deletes or cancels 2Claude Code: deny
audience_start_runStart a contact pull run for a built audience.No findings
Why it is in this group
- The name "audience_start_run" says "start": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Start a contact pull run for a built audience. Requires audienceId from the build step and totalContacts from preview. If logged in, the run is charged to the account's YourICP billing-token balance (29 billing tokens per contact, where 100 billing tokens = $1.00) and returns a runId — call audience_download_run immediately after. Call check_billing_balance first if you want to tell the user the cost before spending. If the balance is short, this returns error "mcp_insufficient_tokens" with required, available and shortfall counts — tell the user exactly how many tokens to top up at app.youricp.com and do NOT retry until they have. If it returns "mcp_no_billing_account", the client is not linked to an account yet and only support can fix it — do NOT retry. If not logged in, card payment is required instead (capped at $1,000) — this tool returns a checkoutUrl and sessionId, then call check_payment, then audience_download_run with the runId.
Annotations the server declares
- title: Start Audience Run
- readOnlyHint: false
- destructiveHint: true
submit_lookupSubmit a contact enrichment job for one or more email addresses or LinkedIn profile URLs.No findings
Why it is in this group
- The name "submit_lookup" says "submit": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Submit a contact enrichment job for one or more email addresses or LinkedIn profile URLs. Provide emails, linkedInUrls, or both. If logged in, the job is charged to the account's YourICP billing-token balance (1 billing token per contact matched, 29 if phone validation runs, where 100 billing tokens = $1.00) and returns a jobId — call check_lookup to retrieve results. check_billing_balance shows what the balance covers. If the balance is short, this returns error "mcp_insufficient_tokens" with required, available and shortfall counts — tell the user exactly how many tokens to top up at app.youricp.com and do NOT retry until they have. If it returns "mcp_no_billing_account", only support can fix it — do NOT retry. If the user is not logged in, card payment is required instead: this tool returns a checkoutUrl and sessionId — present the URL, then call check_payment. Do NOT retry automatically on failure.
Annotations the server declares
- title: Submit Contact Lookup
- readOnlyHint: false
- destructiveHint: true
Can't be undone 1Claude Code: ask
check_paymentCheck whether a Stripe checkout session has been paid and execute the next step.1 finding
Why it is in this group
- The name "check_payment" says "payment": a word that usually means money moves, which cannot be taken back.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "check_payment" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true}; The name "check_payment" says "payment": a word that usually means money moves, which cannot be taken back.
Description, as the server wrote it Check whether a Stripe checkout session has been paid and execute the next step. Call this after presenting the checkoutUrl to the user. If status is "pending", wait a few seconds and call again. - If called after submit_lookup: once status is "done" call check_lookup with the returned jobId. - If called after audience_start_run: once status is "done" call audience_download_run with the returned runId.
Annotations the server declares
- title: Check Payment Status
- readOnlyHint: true
Changes things 5Claude Code: ask
activate_loginActivate a login completed in the browser.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Activate a login completed in the browser. Call this after signing in at the login page. Automatically retrieves the auth token and activates it for this session — no copy/paste needed.
Annotations the server declares
- title: Activate Browser Login
- readOnlyHint: true
audience_download_runGet the download link for a completed audience run.1 finding
Why it is in this group
- The name "audience_download_run" says "run": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "audience_download_run" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true}; The name "audience_download_run" says "run": a word for a change.
Description, as the server wrote it Get the download link for a completed audience run. Returns a presigned URL the user can click to download their contact list. RENDERING — MANDATORY, VERBATIM: The response contains a download link already formatted as a markdown link with an angle-bracket destination: [Download ...](<https://...>). Present it exactly as returned. Keep the angle brackets around the URL, do NOT percent-encode or decode any query parameters, and do NOT drop, reorder, or truncate any parameter — every response-content-* and X-Amz-* param must be preserved byte-for-byte. Do NOT rewrite it into a code block, a bare URL, or an HTML anchor; emit the markdown link as the backend sent it.
Annotations the server declares
- title: Download Audience Run
- readOnlyHint: true
audience_startEntry point for all audience-building workflows.1 finding
Why it is in this group
- The name "audience_start" says "start": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "audience_start" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true}; The name "audience_start" says "start": a word for a change.
Description, as the server wrote it Entry point for all audience-building workflows. Always call this first when the user wants to find contacts, build an audience, or get a contact list. This tool decides which options to offer based on the connected client: clients that can render the interactive filter widget (e.g. Claude) are offered both (A) describe their target in free text and (B) pick filters interactively; other clients are offered free text only. Present EXACTLY the options contained in this tool's response and nothing more — in particular, do not offer or mention the interactive filter picker unless the response includes it. Do not call audience_quick_preview, audience_preview, or audience_get_filters without calling this tool first.
Annotations the server declares
- title: Start Audience Builder
- readOnlyHint: true
set_auth_tokenSet the user's YourICP auth token for this session.2 findings
Why it is in this group
- The name "set_auth_token" says "set": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Info
The description mentions "credential".
What this check looks forMatched text
description: "...auth token in the chat. This is an API credential, NOT YourICP billing tokens — billing t..."
- Warn
The server marks "set_auth_token" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true}; The name "set_auth_token" says "set": a word for a change.
Description, as the server wrote it Set the user's YourICP auth token for this session. Call this when the user pastes their auth token in the chat. This is an API credential, NOT YourICP billing tokens — billing tokens are the prepaid currency a run spends, and check_billing_balance reads them. Once set, the auth token is used for all API requests and card payment is no longer required. To get an auth token, the user can log in at https://mcp.youricp.com/authorize.
Annotations the server declares
- title: Set Auth Token
- readOnlyHint: true
set_tokenDEPRECATED — call set_auth_token instead.1 finding
Why it is in this group
- The name "set_token" says "set": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "set_token" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true}; The name "set_token" says "set": a word for a change.
Description, as the server wrote it DEPRECATED — call set_auth_token instead. Sets the user's YourICP auth token for this session.
Annotations the server declares
- title: Set Auth Token (deprecated)
- readOnlyHint: true
Only reads 5Claude Code: allow
audience_get_filtersFetch all available audience filter categories as an interactive filter picker.No findings
Why it is in this group
- The name "audience_get_filters" says "get": a word for reading.
Description, as the server wrote it Fetch all available audience filter categories as an interactive filter picker. Only call this after audience_start has been called and the user chose Option B (interactive filter picker). Do not call this tool to guess or pre-populate filters on behalf of the user. RENDERING — MANDATORY, VERBATIM: The response is usually a complete HTML document. Pass the returned HTML string unchanged to the visualizer/render tool. Do NOT rebuild, restyle, summarize, trim, or hand-author a replacement UI. If the response is plain text instead of an HTML document (this happens on clients that cannot render HTML), simply present that text to the user as-is and let them pick filter values by name — do not look for a visualizer. Render EVERY tab and EVERY chip exactly as received, in the order received, using the exact data-cat and data-val attributes the backend emitted. This includes tabs whose chip list is empty — render the empty tab as-is, do NOT drop it and do NOT invent or backfill chips for it. ALWAYS keep the "Get estimation" button (id="getEstBtn") in the rendered widget. It is the action control the user clicks to run the preview — never remove, hide, rename, or replace it. Do NOT move a chip from the tab/category the backend placed it in. If a value arrives under data-cat="industries", it is rendered and reported under industries — the client must not re-route it to seniority, departments, buying_roles, employee_size, or revenue based on its label. Field placement is the backend's responsibility, not the client's. When the user makes selections, resolve names→keys ONLY via the <script id="filter-key-map"> JSON in the returned HTML, then call audience_preview with those exact keys.
Annotations the server declares
- title: Get Audience Filters
- readOnlyHint: true
audience_previewPreview audience size from explicit filter selections made by the user in the filter picker UI.No findings
Why it is in this group
- The name "audience_preview" says "preview": a word for reading.
Description, as the server wrote it Preview audience size from explicit filter selections made by the user in the filter picker UI. IMPORTANT: Only call this after audience_get_filters has been shown and the user has made their own selections. Never infer or pre-fill filter values — only pass values the user explicitly selected. If the user has not yet seen the filter picker, call audience_start then audience_get_filters first.
Annotations the server declares
- title: Audience Preview
- readOnlyHint: true
audience_quick_previewPreview audience size from a free-text description the user provided in this conversation.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "audience_quick_preview" says "preview": a word for reading.
What it can reach
- private-dataThe description's first sentence says "preview" and "conversation": it reads messages.
- untrusted-inputThe description's first sentence says "preview" and "conversation": it reads messages, which other people can write.
Description, as the server wrote it Preview audience size from a free-text description the user provided in this conversation. IMPORTANT: Only call this after audience_start has been called and the user has described their target audience in their own words (Option A). Never pre-select or assume filter values — only use criteria the user explicitly stated. If the user has not yet described their audience, call audience_start first.
Annotations the server declares
- title: Audience Quick Preview
- readOnlyHint: true
check_billing_balanceRead the YourICP BILLING TOKEN balance this account's runs are charged against.1 finding
Why it is in this group
- The description's first verb is "read": a word for reading.
Findings
- Info
The description mentions "credential".
What this check looks forMatched text
description: "...re NOT the auth token — that is the API credential set by set_auth_token. Call this before..."
Description, as the server wrote it Read the YourICP BILLING TOKEN balance this account's runs are charged against. Billing tokens are YourICP's prepaid currency: 100 billing tokens = $1.00, and an audience contact costs 29 billing tokens. They are NOT the auth token — that is the API credential set by set_auth_token. Call this before audience_start_run when the user asks what a run will cost, or after an "mcp_insufficient_tokens" error to confirm the balance. Requires the user to be logged in.
Annotations the server declares
- title: Check Billing Token Balance
- readOnlyHint: true
check_lookupCheck the result of a previously submitted contact enrichment job by jobId.Reads private dataNo findings
Why it is in this group
- The name "check_lookup" says "lookup": a word for reading.
What it can reach
- private-dataThe description's first sentence says "contact": it reads contacts.
Description, as the server wrote it Check the result of a previously submitted contact enrichment job by jobId. Polls every 5 seconds until the job is complete (max 2 minutes). Returns enriched contact data or an error message.
Annotations the server declares
- title: Check Lookup Result
- readOnlyHint: true
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Exfil surface
Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.
No private-data, untrusted-input, outbound path in this server alone: no tool is tagged outbound.
- Reads private data2
- Reads files, mail, messages, databases, secrets, calendars or repositories.
- Reads text others write1
- Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
- Can send data out0
- Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.
Remote posture
What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.
Looked at Oct 22, 2026, 14:44 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.
- Reachable
- yes
- HTTP status of an anonymous initialize
- 200
- tools/list served without credentials
- yes
- Tools that change things, listed without credentials
- 8
- Protocol version
- 2025-06-18
- WWW-Authenticate on 401
- not observed
- resource_metadata in WWW-Authenticate
- none
- RFC 9728 protected resource metadata
- https://mcp.youricp.com/.well-known/oauth-protected-resource
- Authorization servers
- https://mcp.youricp.com
- Legacy HTTP+SSE transport
- no
- Dynamic client registration
- yes
- Client ID metadata documents
- no
- HighThe whole server
The endpoint served tools/list without credentials, and the list has 8 tools that change things (2 destructive, 1 irreversible, 5 write). Whether a call also works without credentials was not tested: tools are never called.
What this check looks forMatched text
https://mcp.youricp.com/sse: tools/list returned 13 tools to an anonymous client, including submit_lookup (destructive), audience_start_run (destructive), check_payment (irreversible), set_auth_token (write), set_token (write) and 3 more
Install
Pinned to version 0.1.3. Values in angle brackets are yours to fill in.
claude mcp add --transport http youricp https://mcp.youricp.com/sseRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__youricp__check_lookup",
"mcp__youricp__audience_get_filters",
"mcp__youricp__audience_quick_preview",
"mcp__youricp__audience_preview",
"mcp__youricp__check_billing_balance"
],
"ask": [
"mcp__youricp__set_auth_token",
"mcp__youricp__set_token",
"mcp__youricp__activate_login",
"mcp__youricp__check_payment",
"mcp__youricp__audience_start",
"mcp__youricp__audience_download_run"
],
"deny": [
"mcp__youricp__submit_lookup",
"mcp__youricp__audience_start_run"
]
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as youricp. Review it before you use it.
Capability tags behind 2 rules
- mcp__youricp__check_lookup private-data
- mcp__youricp__audience_quick_preview private-data, untrusted-input