Skip to content

YourICP

by youricp.com · remote · local (npm) · no sign-in to list tools · v0.1.3 · published by com.youricp

Enrich contacts by email or LinkedIn URL and build targeted B2B audiences.

Deletes · 2Final · 1Changes · 5

13 tools: 2 can delete or cancel things, 1 do something that can't be undone, 5 change things and 5 only read.

Scanned Oct 21, 2026

7 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http youricp https://mcp.youricp.com/sse

Findings

Matches of fixed checks, with the text they matched.

5 warn2 info
  • The server marks "set_auth_token" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true}; The name "set_auth_token" says "set": a word for a change.

    What this check looks for
  • The server marks "set_token" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true}; The name "set_token" says "set": a word for a change.

    What this check looks for
  • The server marks "check_payment" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true}; The name "check_payment" says "payment": a word that usually means money moves, which cannot be taken back.

    What this check looks for
  • The server marks "audience_start" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true}; The name "audience_start" says "start": a word for a change.

    What this check looks for
  • The server marks "audience_download_run" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true}; The name "audience_download_run" says "run": a word for a change.

    What this check looks for
  • The description mentions "credential".

    Matched text

    description: "...auth token in the chat. This is an API credential, NOT YourICP billing tokens — billing t..."

    What this check looks for
Show 1 more finding

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

13 tools

Deletes or cancels 2Claude Code: deny
  • audience_start_runStart a contact pull run for a built audience.No findings

    Why it is in this group

    • The name "audience_start_run" says "start": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Start a contact pull run for a built audience. Requires audienceId from the build step and totalContacts from preview. If logged in, the run is charged to the account's YourICP billing-token balance (29 billing tokens per contact, where 100 billing tokens = $1.00) and returns a runId — call audience_download_run immediately after. Call check_billing_balance first if you want to tell the user the cost before spending. If the balance is short, this returns error "mcp_insufficient_tokens" with required, available and shortfall counts — tell the user exactly how many tokens to top up at app.youricp.com and do NOT retry until they have. If it returns "mcp_no_billing_account", the client is not linked to an account yet and only support can fix it — do NOT retry. If not logged in, card payment is required instead (capped at $1,000) — this tool returns a checkoutUrl and sessionId, then call check_payment, then audience_download_run with the runId.

    Annotations the server declares

    • title: Start Audience Run
    • readOnlyHint: false
    • destructiveHint: true
  • submit_lookupSubmit a contact enrichment job for one or more email addresses or LinkedIn profile URLs.No findings

    Why it is in this group

    • The name "submit_lookup" says "submit": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Submit a contact enrichment job for one or more email addresses or LinkedIn profile URLs. Provide emails, linkedInUrls, or both. If logged in, the job is charged to the account's YourICP billing-token balance (1 billing token per contact matched, 29 if phone validation runs, where 100 billing tokens = $1.00) and returns a jobId — call check_lookup to retrieve results. check_billing_balance shows what the balance covers. If the balance is short, this returns error "mcp_insufficient_tokens" with required, available and shortfall counts — tell the user exactly how many tokens to top up at app.youricp.com and do NOT retry until they have. If it returns "mcp_no_billing_account", only support can fix it — do NOT retry. If the user is not logged in, card payment is required instead: this tool returns a checkoutUrl and sessionId — present the URL, then call check_payment. Do NOT retry automatically on failure.

    Annotations the server declares

    • title: Submit Contact Lookup
    • readOnlyHint: false
    • destructiveHint: true
Can't be undone 1Claude Code: ask
  • check_paymentCheck whether a Stripe checkout session has been paid and execute the next step.1 finding

    Why it is in this group

    • The name "check_payment" says "payment": a word that usually means money moves, which cannot be taken back.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "check_payment" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true}; The name "check_payment" says "payment": a word that usually means money moves, which cannot be taken back.

      What this check looks for
    Description, as the server wrote it
    Check whether a Stripe checkout session has been paid and execute the next step. Call this after presenting the checkoutUrl to the user. If status is "pending", wait a few seconds and call again. - If called after submit_lookup: once status is "done" call check_lookup with the returned jobId. - If called after audience_start_run: once status is "done" call audience_download_run with the returned runId.

    Annotations the server declares

    • title: Check Payment Status
    • readOnlyHint: true
Changes things 5Claude Code: ask
  • activate_loginActivate a login completed in the browser.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Activate a login completed in the browser. Call this after signing in at the login page. Automatically retrieves the auth token and activates it for this session — no copy/paste needed.

    Annotations the server declares

    • title: Activate Browser Login
    • readOnlyHint: true
  • audience_download_runGet the download link for a completed audience run.1 finding

    Why it is in this group

    • The name "audience_download_run" says "run": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "audience_download_run" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true}; The name "audience_download_run" says "run": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Get the download link for a completed audience run. Returns a presigned URL the user can click to download their contact list. RENDERING — MANDATORY, VERBATIM: The response contains a download link already formatted as a markdown link with an angle-bracket destination: [Download ...](<https://...>). Present it exactly as returned. Keep the angle brackets around the URL, do NOT percent-encode or decode any query parameters, and do NOT drop, reorder, or truncate any parameter — every response-content-* and X-Amz-* param must be preserved byte-for-byte. Do NOT rewrite it into a code block, a bare URL, or an HTML anchor; emit the markdown link as the backend sent it.

    Annotations the server declares

    • title: Download Audience Run
    • readOnlyHint: true
  • audience_startEntry point for all audience-building workflows.1 finding

    Why it is in this group

    • The name "audience_start" says "start": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "audience_start" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true}; The name "audience_start" says "start": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Entry point for all audience-building workflows. Always call this first when the user wants to find contacts, build an audience, or get a contact list. This tool decides which options to offer based on the connected client: clients that can render the interactive filter widget (e.g. Claude) are offered both (A) describe their target in free text and (B) pick filters interactively; other clients are offered free text only. Present EXACTLY the options contained in this tool's response and nothing more — in particular, do not offer or mention the interactive filter picker unless the response includes it. Do not call audience_quick_preview, audience_preview, or audience_get_filters without calling this tool first.

    Annotations the server declares

    • title: Start Audience Builder
    • readOnlyHint: true
  • set_auth_tokenSet the user's YourICP auth token for this session.2 findings

    Why it is in this group

    • The name "set_auth_token" says "set": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Info

      The description mentions "credential".

      Matched text

      description: "...auth token in the chat. This is an API credential, NOT YourICP billing tokens — billing t..."

      What this check looks for
    • Warn

      The server marks "set_auth_token" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true}; The name "set_auth_token" says "set": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Set the user's YourICP auth token for this session. Call this when the user pastes their auth token in the chat. This is an API credential, NOT YourICP billing tokens — billing tokens are the prepaid currency a run spends, and check_billing_balance reads them. Once set, the auth token is used for all API requests and card payment is no longer required. To get an auth token, the user can log in at https://mcp.youricp.com/authorize.

    Annotations the server declares

    • title: Set Auth Token
    • readOnlyHint: true
  • set_tokenDEPRECATED — call set_auth_token instead.1 finding

    Why it is in this group

    • The name "set_token" says "set": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "set_token" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true}; The name "set_token" says "set": a word for a change.

      What this check looks for
    Description, as the server wrote it
    DEPRECATED — call set_auth_token instead. Sets the user's YourICP auth token for this session.

    Annotations the server declares

    • title: Set Auth Token (deprecated)
    • readOnlyHint: true
Only reads 5Claude Code: allow
  • audience_get_filtersFetch all available audience filter categories as an interactive filter picker.No findings

    Why it is in this group

    • The name "audience_get_filters" says "get": a word for reading.
    Description, as the server wrote it
    Fetch all available audience filter categories as an interactive filter picker. Only call this after audience_start has been called and the user chose Option B (interactive filter picker). Do not call this tool to guess or pre-populate filters on behalf of the user. RENDERING — MANDATORY, VERBATIM: The response is usually a complete HTML document. Pass the returned HTML string unchanged to the visualizer/render tool. Do NOT rebuild, restyle, summarize, trim, or hand-author a replacement UI. If the response is plain text instead of an HTML document (this happens on clients that cannot render HTML), simply present that text to the user as-is and let them pick filter values by name — do not look for a visualizer. Render EVERY tab and EVERY chip exactly as received, in the order received, using the exact data-cat and data-val attributes the backend emitted. This includes tabs whose chip list is empty — render the empty tab as-is, do NOT drop it and do NOT invent or backfill chips for it. ALWAYS keep the "Get estimation" button (id="getEstBtn") in the rendered widget. It is the action control the user clicks to run the preview — never remove, hide, rename, or replace it. Do NOT move a chip from the tab/category the backend placed it in. If a value arrives under data-cat="industries", it is rendered and reported under industries — the client must not re-route it to seniority, departments, buying_roles, employee_size, or revenue based on its label. Field placement is the backend's responsibility, not the client's. When the user makes selections, resolve names→keys ONLY via the <script id="filter-key-map"> JSON in the returned HTML, then call audience_preview with those exact keys.

    Annotations the server declares

    • title: Get Audience Filters
    • readOnlyHint: true
  • audience_previewPreview audience size from explicit filter selections made by the user in the filter picker UI.No findings

    Why it is in this group

    • The name "audience_preview" says "preview": a word for reading.
    Description, as the server wrote it
    Preview audience size from explicit filter selections made by the user in the filter picker UI. IMPORTANT: Only call this after audience_get_filters has been shown and the user has made their own selections. Never infer or pre-fill filter values — only pass values the user explicitly selected. If the user has not yet seen the filter picker, call audience_start then audience_get_filters first.

    Annotations the server declares

    • title: Audience Preview
    • readOnlyHint: true
  • audience_quick_previewPreview audience size from a free-text description the user provided in this conversation.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "audience_quick_preview" says "preview": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "preview" and "conversation": it reads messages.
    • untrusted-inputThe description's first sentence says "preview" and "conversation": it reads messages, which other people can write.
    Description, as the server wrote it
    Preview audience size from a free-text description the user provided in this conversation. IMPORTANT: Only call this after audience_start has been called and the user has described their target audience in their own words (Option A). Never pre-select or assume filter values — only use criteria the user explicitly stated. If the user has not yet described their audience, call audience_start first.

    Annotations the server declares

    • title: Audience Quick Preview
    • readOnlyHint: true
  • check_billing_balanceRead the YourICP BILLING TOKEN balance this account's runs are charged against.1 finding

    Why it is in this group

    • The description's first verb is "read": a word for reading.

    Findings

    • Info

      The description mentions "credential".

      Matched text

      description: "...re NOT the auth token — that is the API credential set by set_auth_token. Call this before..."

      What this check looks for
    Description, as the server wrote it
    Read the YourICP BILLING TOKEN balance this account's runs are charged against. Billing tokens are YourICP's prepaid currency: 100 billing tokens = $1.00, and an audience contact costs 29 billing tokens. They are NOT the auth token — that is the API credential set by set_auth_token. Call this before audience_start_run when the user asks what a run will cost, or after an "mcp_insufficient_tokens" error to confirm the balance. Requires the user to be logged in.

    Annotations the server declares

    • title: Check Billing Token Balance
    • readOnlyHint: true
  • check_lookupCheck the result of a previously submitted contact enrichment job by jobId.Reads private dataNo findings

    Why it is in this group

    • The name "check_lookup" says "lookup": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "contact": it reads contacts.
    Description, as the server wrote it
    Check the result of a previously submitted contact enrichment job by jobId. Polls every 5 seconds until the job is complete (max 2 minutes). Returns enriched contact data or an error message.

    Annotations the server declares

    • title: Check Lookup Result
    • readOnlyHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged outbound.

Reads private data2
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write1
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out0
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Looked at Oct 22, 2026, 14:44 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable
yes
HTTP status of an anonymous initialize
200
tools/list served without credentials
yes
Tools that change things, listed without credentials
8
Protocol version
2025-06-18
WWW-Authenticate on 401
not observed
resource_metadata in WWW-Authenticate
none
RFC 9728 protected resource metadata
https://mcp.youricp.com/.well-known/oauth-protected-resource
Authorization servers
https://mcp.youricp.com
Legacy HTTP+SSE transport
no
Dynamic client registration
yes
Client ID metadata documents
no
  • HighThe whole server

    The endpoint served tools/list without credentials, and the list has 8 tools that change things (2 destructive, 1 irreversible, 5 write). Whether a call also works without credentials was not tested: tools are never called.

    Matched text

    https://mcp.youricp.com/sse: tools/list returned 13 tools to an anonymous client, including submit_lookup (destructive), audience_start_run (destructive), check_payment (irreversible), set_auth_token (write), set_token (write) and 3 more

    What this check looks for

Install

Pinned to version 0.1.3. Values in angle brackets are yours to fill in.

claude mcp add --transport http youricp https://mcp.youricp.com/sse

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__youricp__check_lookup",
      "mcp__youricp__audience_get_filters",
      "mcp__youricp__audience_quick_preview",
      "mcp__youricp__audience_preview",
      "mcp__youricp__check_billing_balance"
    ],
    "ask": [
      "mcp__youricp__set_auth_token",
      "mcp__youricp__set_token",
      "mcp__youricp__activate_login",
      "mcp__youricp__check_payment",
      "mcp__youricp__audience_start",
      "mcp__youricp__audience_download_run"
    ],
    "deny": [
      "mcp__youricp__submit_lookup",
      "mcp__youricp__audience_start_run"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as youricp. Review it before you use it.

Capability tags behind 2 rules
  • mcp__youricp__check_lookup private-data
  • mcp__youricp__audience_quick_preview private-data, untrusted-input