Skip to content
anlyon.devby Anlyon

run.zero

de.run-zero/mcprun-zero.destreamable-httpv1.0.2Scanned

Deploy apps, APIs and Postgres from your AI agent. EU PaaS hosted in Germany, OAuth sign-in.

47 tools: 17 can delete or cancel things, 10 change things and 20 only read.

Tools: 17 delete, 0 irreversible, 10 write, 20 read.
  • Reads private data · 5
  • Reads text others write · 11
  • Can send data out · 1
  • 5 findings

Anlyon alternative

27 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →
Compare with similar serversMarkdownJSONReport this listing

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

47 tools

Deletes or cancels 17Claude Code: deny
  • runzero_activate_versionPut an earlier version back online — this CHANGES what visitors see.No findings

    Why it is in this group

    • The description's first verb is "put": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Put an earlier version back online — this CHANGES what visitors see. Only do this when the user explicitly asks to go back; never on your own initiative after a failed build (fix the code instead). While an older version is active, new builds are built but NOT published, until you call this again with image "latest". If the service has a database, the container goes back but the data does not — say so and pass acknowledge_data only after the user confirms.

    Annotations the server declares

    • title: Activate version
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • runzero_db_queryRun one SQL statement against an app's PostgreSQL addon (owner/admin only).Reads private data1 finding

    Why it is in this group

    • The name "runzero_db_query" says "query": a word for reading.
    • The description's first verb is "run": a word for a change.
    • The description says "cannot be undone".
    • The input takes a statement or command to run (input.sql), which can change anything it can reach.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • private-dataThe name "runzero_db_query" says "query" and "db": it reads databases.
    • private-dataThe description's first sentence says "sql": it reads databases.
    • private-dataThe name says "query" and the input takes a statement (input.sql): it reads databases.

    Findings

    • Warn

      The server marks "runzero_db_query" destructive (destructiveHint: true), and its name says "query", a word for reading.

      Matched text

      annotations: {"readOnlyHint":false,"destructiveHint":true,"idempotentHint":false,"openWorldHint":false}; The name "runzero_db_query" says "query": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Run one SQL statement against an app's PostgreSQL addon (owner/admin only). Read-only by default: the statement runs in a READ ONLY transaction that is rolled back. With allow_write=true it CAN WRITE: INSERT/UPDATE/DELETE and DDL (DROP, ALTER, TRUNCATE) are committed immediately and cannot be undone. Before setting allow_write, show the user the exact SQL and get their explicit confirmation. Results are capped at 1000 rows; statements time out after 15s.

    Annotations the server declares

    • title: Run SQL query
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • runzero_delete_appPermanently delete an app with all its services, addons (including database data), secrets and domains.No findings

    Why it is in this group

    • The name "runzero_delete_app" says "delete": a word for removing or ending something.
    • The description says "Permanently delete".
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Permanently delete an app with all its services, addons (including database data), secrets and domains. Irreversible: only on an explicit request, and name the app back to the user before calling.

    Annotations the server declares

    • title: Delete app
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • runzero_delete_secretDelete a single secret from an app or a service.No findings

    Why it is in this group

    • The name "runzero_delete_secret" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Delete a single secret from an app or a service. Affected services are redeployed automatically.

    Annotations the server declares

    • title: Delete secret
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • runzero_delete_servicePermanently delete one service of an app: its running containers, its public URL and its configuration.No findings

    Why it is in this group

    • The name "runzero_delete_service" says "delete": a word for removing or ending something.
    • The description says "Permanently delete".
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Permanently delete one service of an app: its running containers, its public URL and its configuration. Irreversible; to only stop it, scale it to 0 with runzero_scale_service.

    Annotations the server declares

    • title: Delete service
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • runzero_delete_userPermanently delete an end-user (account, sessions, login data) from the app's login realm.No findings

    Why it is in this group

    • The name "runzero_delete_user" says "delete": a word for removing or ending something.
    • The description says "Permanently delete".
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Permanently delete an end-user (account, sessions, login data) from the app's login realm. Irreversible; to only block the login use runzero_set_user_enabled.

    Annotations the server declares

    • title: Delete app user
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • runzero_deployDeploy an app.Reads text others writeNo findings

    Why it is in this group

    • The name "runzero_deploy" says "deploy": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Deploy an app. Fetches the repo and checks for run-zero.yaml (or the older itdone.yaml). If found, syncs all services + addons + domains from config. If not, deploys the repo as a single service. Services missing from the config are scaled to 0; with prune=true they are DELETED. Run runzero_deploy_preview first to see the diff.

    Annotations the server declares

    • title: Deploy app
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
  • runzero_generate_imageGenerate an image with AI (FLUX) and commit it into the app's repo.Reads text others writeNo findings

    Why it is in this group

    • The name "runzero_generate_image" says "generate": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Generate an image with AI (FLUX) and commit it into the app's repo. Costs credits. Use for hero images, backgrounds, illustrations. The file is committed at the given path (e.g. assets/hero.jpg), replacing a file already there, and a rebuild is triggered; reference it in the code afterwards. The prompt is sent to Black Forest Labs (EU endpoint).

    Annotations the server declares

    • title: Generate image
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • runzero_publishPut the waiting changes on the real site — this is what VISITORS see, so only ever on an explicit request ("mach das live", "veröffentliche das"), never on your own initiative afte…Can send data outNo findings

    Why it is in this group

    • The name "runzero_publish" says "publish": a word for a change that another call does not undo.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • outboundThe name "runzero_publish" says "publish": it sends or publishes something to other people.
    Description, as the server wrote it
    Put the waiting changes on the real site — this is what VISITORS see, so only ever on an explicit request ("mach das live", "veröffentliche das"), never on your own initiative after finishing a change. Write `description` in the user's own words and in their language ("Tag der offenen Tür angekündigt"), because that sentence is what they will read next month when they want to go back. Only for apps that publish on request; an app that publishes automatically has nothing to publish.

    Annotations the server declares

    • title: Publish changes
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • runzero_push_filesPush changes into the app's Git repository as ONE atomic commit (create, patch, and delete in a single push).Reads text others writeNo findings

    Why it is in this group

    • The name "runzero_push_files" says "push": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Push changes into the app's Git repository as ONE atomic commit (create, patch, and delete in a single push). CHANGING an existing file? Use `edits` — an exact-snippet replacement, like your editor's edit tool. Use `files` only to create a NEW file or to genuinely rewrite one end to end: it resends the whole document, so a twelve-line change costs you the entire file. Both may appear in the same push (different paths). If the app has no repository yet, a platform-managed repo is created automatically on the first push. Text files only (UTF-8) — for binary assets (icons, images, fonts) NEVER attempt to inline the bytes; models cannot generate valid binary data. Instead use runzero_upload_assets (the user uploads via the dashboard) or set sourceUrl on a file entry (the server downloads it from the web). IMPORTANT: after the FIRST push on a fresh app, run runzero_deploy once — it creates the service(s) from the repo (single service from the root, or several from a run-zero.yaml). Later pushes rebuild existing services automatically. See runzero_get_help topic 'files' for the full flow, code layout rules and the run-zero.yaml format. Only works with platform-managed repositories, not external repos. `deletions` and `files` overwrite or remove files in the repo; earlier content stays in the Git history.

    Annotations the server declares

    • title: Push files
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • runzero_reset_user_passwordReplace an end-user's password in the app's login realm; the old one stops working at once.No findings

    Why it is in this group

    • The name "runzero_reset_user_password" says "reset": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Replace an end-user's password in the app's login realm; the old one stops working at once. Returns the new password ONCE (generated if none given).

    Annotations the server declares

    • title: Reset app user password
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • runzero_restore_releasePut an earlier published state back on the real site.No findings

    Why it is in this group

    • The description's first verb is "put": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Put an earlier published state back on the real site. Use the id from runzero_list_releases. This CHANGES what visitors see. It does not touch the code: anything changed since is still there and still waiting, so this undoes what is published, not the work. If the user wants an announcement removed rather than the whole site rolled back, edit the page instead — going back also removes every other change made since.

    Annotations the server declares

    • title: Restore release
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • runzero_scale_serviceSet the replica count of a service (0-10).No findings

    Why it is in this group

    • The description's first verb is "set": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Set the replica count of a service (0-10). Scaling to 0 takes the service offline (its URL stops answering) without deleting it; scale up again to bring it back.

    Annotations the server declares

    • title: Scale service
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • runzero_set_publish_modeSwitch between publishing every change immediately (auto) and collecting changes on a preview until the user releases them (manual).No findings

    Why it is in this group

    • The name "runzero_set_publish_mode" says "set": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Switch between publishing every change immediately (auto) and collecting changes on a preview until the user releases them (manual). Explain the consequence before switching to manual: from then on nothing reaches their visitors until they say so, which is the point but also a way to wonder for days why a change never appeared. Switching back to auto publishes whatever was waiting, immediately.

    Annotations the server declares

    • title: Set publish mode
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • runzero_set_secretsSet one or more environment variables for an app or a specific service.No findings

    Why it is in this group

    • The name "runzero_set_secrets" says "set": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Set one or more environment variables for an app or a specific service. Existing keys are overwritten; other keys are preserved. Affected services are redeployed automatically.

    Annotations the server declares

    • title: Set secrets
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • runzero_set_user_enabledEnable or disable (block) an end-user in the app's login realm.No findings

    Why it is in this group

    • The name "runzero_set_user_enabled" says "set": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Enable or disable (block) an end-user in the app's login realm. A disabled user cannot log in but is not deleted.

    Annotations the server declares

    • title: Enable or block app user
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
Changes things 10Claude Code: ask
  • runzero_add_serviceAdd a new service to an app.Reads text others writeNo findings

    Why it is in this group

    • The name "runzero_add_service" says "add": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Add a new service to an app. Clones the repo, builds with buildpacks, and deploys. The web process must listen on $PORT.

    Annotations the server declares

    • title: Add service
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • runzero_adopt_templateCreate a NEW app as a full copy of a template from runzero_list_templates: app + repo + running instance, owned by the caller.No findings

    Why it is in this group

    • The description's first verb is "create": a word for a change.
    Description, as the server wrote it
    Create a NEW app as a full copy of a template from runzero_list_templates: app + repo + running instance, owned by the caller. Use this INSTEAD of runzero_create_app when a template matches the request, then adapt the copy (texts, colors, images — placeholder assets keep their paths and get overwritten). The copy provisions asynchronously; follow with runzero_wait_for_build as usual.

    Annotations the server declares

    • title: Create app from template
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • runzero_create_appCreate a new app.Reads text others writeNo findings

    Why it is in this group

    • The name "runzero_create_app" says "create": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Create a new app. Optionally links to a Git repository — if no repo is given, you can attach one later.

    Annotations the server declares

    • title: Create app
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • runzero_create_identity_providerAdd an external login provider (Google, GitHub, Microsoft, generic OIDC/SAML) to the app's login realm, so end-users can sign in with it.Reads text others writeNo findings

    Why it is in this group

    • The name "runzero_create_identity_provider" says "create": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Add an external login provider (Google, GitHub, Microsoft, generic OIDC/SAML) to the app's login realm, so end-users can sign in with it. You need an OAuth client id/secret from the provider first. IMPORTANT: the response contains a redirect URI that the user must register in the provider's OAuth app — surface it to them. For generic 'oidc' also pass authorization_url and token_url.

    Annotations the server declares

    • title: Add login provider
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • runzero_create_userCreate an end-user in the app's login realm.No findings

    Why it is in this group

    • The name "runzero_create_user" says "create": a word for a change.
    Description, as the server wrote it
    Create an end-user in the app's login realm. Returns the generated password ONCE if none is given — relay it to the user, it cannot be retrieved later.

    Annotations the server declares

    • title: Create app user
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • runzero_deploy_previewPreview what a deploy would change without making any changes.Reads text others write1 finding

    Why it is in this group

    • The name "runzero_deploy_preview" says "deploy": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "runzero_deploy_preview" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "runzero_deploy_preview" says "deploy": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Preview what a deploy would change without making any changes. Use this before runzero_deploy to verify the diff.

    Annotations the server declares

    • title: Preview deploy changes
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • runzero_preview_versionShow an earlier version under a SECOND address without touching the live site — use this whenever the user wants to look before deciding.1 finding

    Why it is in this group

    • The name "runzero_preview_version" says "preview": a word for reading.
    • The server marks it as not read-only (readOnlyHint: false).

    Findings

    • Warn

      The server marks "runzero_preview_version" as not read-only (readOnlyHint: false), and its words say it reads.

      Matched text

      annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "runzero_preview_version" says "preview": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Show an earlier version under a SECOND address without touching the live site — use this whenever the user wants to look before deciding. Returns a url; the pod needs a few seconds, so a first request may fail — retry once. Pass `stop: true` (without `image`) to tear the preview down again; it costs nothing once stopped.

    Annotations the server declares

    • title: Preview earlier version
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • runzero_rebuild_serviceRebuild a service from the latest commit of its repo branch; on success the new version rolls out to the live URL.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Rebuild a service from the latest commit of its repo branch; on success the new version rolls out to the live URL. Use after an external repo changed; pushes via runzero_push_files rebuild on their own.

    Annotations the server declares

    • title: Rebuild service
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • runzero_upload_assetsGet the dashboard upload link for an app so the USER can upload binary assets (icons, images, fonts) via drag & drop — real bytes, nothing travels through the model.1 finding

    Why it is in this group

    • The name "runzero_upload_assets" says "upload": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "runzero_upload_assets" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "runzero_upload_assets" says "upload": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Get the dashboard upload link for an app so the USER can upload binary assets (icons, images, fonts) via drag & drop — real bytes, nothing travels through the model. Give the returned URL to the user, wait until they confirm the upload, then call runzero_list_files with path 'assets/' and reference the files in the code.

    Annotations the server declares

    • title: Get asset upload link
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • runzero_work_urlThe URL where this app's UNPUBLISHED changes can be looked at, and a link that opens it (the plain hostname refuses without one).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    The URL where this app's UNPUBLISHED changes can be looked at, and a link that opens it (the plain hostname refuses without one). Call this after EVERY change to an app that publishes on request, and give the user the link with a plain sentence: their change is on the preview, their real site is untouched, and it goes live when they say so. Without that sentence they look at their own website, see nothing, and conclude the change was lost.

    Annotations the server declares

    • title: Get preview link
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
Only reads 20Show 20 read-only tools
  • runzero_describe_addonShow exactly which environment variables an addon injects into an attached service, straight from the platform (the source of truth — use this instead of guessing env var names).1 finding

    Why it is in this group

    • The name "runzero_describe_addon" says "describe": a word for reading.

    Findings

    • Info

      The description mentions "credentials".

      Matched text

      description: "...it BEFORE writing code that reads addon credentials."

      What this check looks for
    Description, as the server wrote it
    Show exactly which environment variables an addon injects into an attached service, straight from the platform (the source of truth — use this instead of guessing env var names). Call it BEFORE writing code that reads addon credentials.

    Annotations the server declares

    • title: Describe addon
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • runzero_get_appGet one app: slug, status, publish mode, services (URL, replicas, health, env var NAMES), addons, domains.Reads text others writeNo findings

    Why it is in this group

    • The name "runzero_get_app" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe description's first sentence says "get" and "url": it reads web pages, which anyone can write.
    Description, as the server wrote it
    Get one app: slug, status, publish mode, services (URL, replicas, health, env var NAMES), addons, domains. Secret values are never returned.

    Annotations the server declares

    • title: Get app details
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • runzero_get_build_logsGet the full log stream for a specific build (all kpack steps concatenated).No findings

    Why it is in this group

    • The name "runzero_get_build_logs" says "get": a word for reading.
    Description, as the server wrote it
    Get the full log stream for a specific build (all kpack steps concatenated). Use runzero_list_builds first to find the build id.

    Annotations the server declares

    • title: Get build logs
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • runzero_get_helpLook up structured guidance on platform concepts and conventions.No findings

    Why it is in this group

    • The name "runzero_get_help" says "get": a word for reading.
    Description, as the server wrote it
    Look up structured guidance on platform concepts and conventions. Topics: workflow, files, addons, procfile, domains. Call this whenever you need to understand addons, the Procfile/PORT convention, or the typical workflow for a new app. Returns markdown.

    Annotations the server declares

    • title: Platform help
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • runzero_get_logsGet the runtime log output of one service (stdout/stderr of its running containers), last N lines.No findings

    Why it is in this group

    • The name "runzero_get_logs" says "get": a word for reading.
    Description, as the server wrote it
    Get the runtime log output of one service (stdout/stderr of its running containers), last N lines.

    Annotations the server declares

    • title: Get service logs
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • runzero_get_metricsCPU and memory usage of a service over a time window (default last hour).No findings

    Why it is in this group

    • The name "runzero_get_metrics" says "get": a word for reading.
    Description, as the server wrote it
    CPU and memory usage of a service over a time window (default last hour). Returns per-pod current/min/max/avg — CPU in millicores, memory in MiB — not raw time series, to stay compact.

    Annotations the server declares

    • title: Get service metrics
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • runzero_list_appsList the apps the authenticated user has access to (own + collaborated), newest first — one compact row each (name, slug, url, kind, status, flags).Reads text others writeNo findings

    Why it is in this group

    • The name "runzero_list_apps" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe description's first sentence says "list" and "url": it reads web pages, which anyone can write.
    Description, as the server wrote it
    List the apps the authenticated user has access to (own + collaborated), newest first — one compact row each (name, slug, url, kind, status, flags). Details of one app: runzero_get_app.

    Annotations the server declares

    • title: List apps
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • runzero_list_buildsList recent build records for an app.No findings

    Why it is in this group

    • The name "runzero_list_builds" says "list": a word for reading.
    Description, as the server wrote it
    List recent build records for an app. Returns kpack Build status (success/failed/running) per service. To WAIT for a build to finish, use runzero_wait_for_build instead of calling this in a loop.

    Annotations the server declares

    • title: List builds
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • runzero_list_filesList all files in the app's Git repository (platform-managed repos only).Reads private dataNo findings

    Why it is in this group

    • The name "runzero_list_files" says "list": a word for reading.

    What it can reach

    • private-dataThe name "runzero_list_files" says "list" and "file": it reads files.
    • private-dataThe description's first sentence says "list" and "file": it reads files.
    Description, as the server wrote it
    List all files in the app's Git repository (platform-managed repos only). Optionally filter by path prefix.

    Annotations the server declares

    • title: List files
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • runzero_list_identity_providersList external login providers (Google, GitHub, …) configured on the app's login realm.No findings

    Why it is in this group

    • The name "runzero_list_identity_providers" says "list": a word for reading.
    Description, as the server wrote it
    List external login providers (Google, GitHub, …) configured on the app's login realm. Secrets are never returned.

    Annotations the server declares

    • title: List login providers
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • runzero_list_releasesWhat the user has PUBLISHED, newest first, with the sentence they described each change with, and which one visitors see right now.No findings

    Why it is in this group

    • The name "runzero_list_releases" says "list": a word for reading.
    Description, as the server wrote it
    What the user has PUBLISHED, newest first, with the sentence they described each change with, and which one visitors see right now. This is the list to use when someone says "wie letzte Woche" or "vor der Umgestaltung" — not runzero_list_versions, which lists every build including the platform's own bookkeeping commits and is unreadable for a person. Also reports whether something is built and waiting.

    Annotations the server declares

    • title: List releases
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • runzero_list_secretsList the secret keys for an app (values are never returned).Reads private dataNo findings

    Why it is in this group

    • The name "runzero_list_secrets" says "list": a word for reading.

    What it can reach

    • private-dataThe name "runzero_list_secrets" says "list" and "secret": it reads secrets.
    • private-dataThe description's first sentence says "list" and "secret": it reads secrets.
    Description, as the server wrote it
    List the secret keys for an app (values are never returned). Includes both app-wide and per-service secrets.

    Annotations the server declares

    • title: List secret names
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • runzero_list_servicesList the services (runtime processes) of an app with their build source, port, replicas and status.No findings

    Why it is in this group

    • The name "runzero_list_services" says "list": a word for reading.
    Description, as the server wrote it
    List the services (runtime processes) of an app with their build source, port, replicas and status.

    Annotations the server declares

    • title: List services
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • runzero_list_templatesList the curated template library: finished, deployed page designs (landing pages, shops, portfolios …) that can be adopted as the starting point of a NEW app instead of building f…No findings

    Why it is in this group

    • The name "runzero_list_templates" says "list": a word for reading.
    Description, as the server wrote it
    List the curated template library: finished, deployed page designs (landing pages, shops, portfolios …) that can be adopted as the starting point of a NEW app instead of building from scratch. Each entry has a live URL and a screenshot URL plus kind/industries/tags for matching. Adopting a matching template is far cheaper and better-looking than writing a page from zero — check here FIRST on any first build.

    Annotations the server declares

    • title: List templates
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • runzero_list_usersList the end-users of an app's login realm (requires the app's keycloak addon).No findings

    Why it is in this group

    • The name "runzero_list_users" says "list": a word for reading.
    Description, as the server wrote it
    List the end-users of an app's login realm (requires the app's keycloak addon). Returns id, username, email and enabled state.

    Annotations the server declares

    • title: List app users
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • runzero_list_versionsEarlier versions of a service that can be put back online, newest first.No findings

    Why it is in this group

    • The name "runzero_list_versions" says "list": a word for reading.
    Description, as the server wrote it
    Earlier versions of a service that can be put back online, newest first. Each entry has an `image` (pass it to runzero_activate_version or runzero_preview_version), when it was built, and `summary` — the commit message, i.e. what changed. `active: true` marks what is online now. Use this when the user refers to an earlier state ("wie gestern", "vor der Umgestaltung"). Omit `service` when the app has only one.

    Annotations the server declares

    • title: List versions
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • runzero_read_fileRead a file from the app's Git repository (platform-managed repos only), UTF-8.Reads private dataNo findings

    Why it is in this group

    • The name "runzero_read_file" says "read": a word for reading.

    What it can reach

    • private-dataThe name "runzero_read_file" says "read" and "file": it reads files.
    • private-dataThe description's first sentence says "read" and "file": it reads files.
    Description, as the server wrote it
    Read a file from the app's Git repository (platform-managed repos only), UTF-8. Returns at most 250 lines per call (a note at the end says how to continue) — read the part you need with startLine/endLine instead of the whole file; every returned line is paid for on every later step.

    Annotations the server declares

    • title: Read file
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • runzero_screenshotSEE the deployed page with your own eyes: renders the live URL in a real browser and returns fresh screenshots as images — desktop (1280×800) and/or mobile (390×844).Reads text others writeNo findings

    Why it is in this group

    • The name "runzero_screenshot" says "screenshot": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe description's first sentence says "url": it reads web pages, which anyone can write.
    Description, as the server wrote it
    SEE the deployed page with your own eyes: renders the live URL in a real browser and returns fresh screenshots as images — desktop (1280×800) and/or mobile (390×844). Use it after runzero_wait_for_build to review the visual result like a designer would (spacing, contrast, overlaps, broken mobile layout) and fix what you SEE, not what you assume. Never cached; but the rollout of a fresh build lands ~30-90s after build success, so a screenshot taken too early shows the previous version — if it looks unchanged, wait briefly and call again.

    Annotations the server declares

    • title: Screenshot live page
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • runzero_wait_for_buildWait server-side until the newest build of an app is finished AND the new version is serving traffic — use this INSTEAD of polling runzero_list_builds, sleeping, or re-checking the…No findings

    Why it is in this group

    • The name "runzero_wait_for_build" says "wait": a word for reading.
    Description, as the server wrote it
    Wait server-side until the newest build of an app is finished AND the new version is serving traffic — use this INSTEAD of polling runzero_list_builds, sleeping, or re-checking the site in a loop. Blocks up to 45 seconds per call and returns {status: "success" | "failed" | "running", phase, rollout, builds}. "running" with phase "building" or "rolling-out" means: call it again. A rollout follows every successful build by 30-90 s, and until it lands the live URL, curl and screenshots still show the OLD version — do not push a fix for what you see in that window. "success" with phase "live" means every pod serves the new build; phase "done" means built but not live for a reason named in `hint` (the app publishes on request, an older version is pinned, not deployed yet). On "failed", read runzero_get_build_logs with the failed build id.

    Annotations the server declares

    • title: Wait for build
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

55 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 1 outbound tool breaks every one.

Reads private data5
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write11
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out1
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
deny to break every path
{
  "permissions": {
    "deny": [
      "mcp__run-zero__runzero_publish"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

4 warn1 info
  • Warnrunzero_deploy_preview

    The server marks "runzero_deploy_preview" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "runzero_deploy_preview" says "deploy": a word for a change.

    What this check looks for
  • Warnrunzero_preview_version

    The server marks "runzero_preview_version" as not read-only (readOnlyHint: false), and its words say it reads.

    Matched text

    annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "runzero_preview_version" says "preview": a word for reading.

    What this check looks for
  • Warnrunzero_upload_assets

    The server marks "runzero_upload_assets" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "runzero_upload_assets" says "upload": a word for a change.

    What this check looks for
  • Warnrunzero_db_query

    The server marks "runzero_db_query" destructive (destructiveHint: true), and its name says "query", a word for reading.

    Matched text

    annotations: {"readOnlyHint":false,"destructiveHint":true,"idempotentHint":false,"openWorldHint":false}; The name "runzero_db_query" says "query": a word for reading.

    What this check looks for
  • Inforunzero_describe_addon

    The description mentions "credentials".

    Matched text

    description: "...it BEFORE writing code that reads addon credentials."

    What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 1.0.2. Values in angle brackets are yours to fill in.

claude mcp add --transport http run-zero https://api.run-zero.de/mcp
claude mcp add --transport http run-zero https://api.run-zero.de/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__run-zero__runzero_get_help",
      "mcp__run-zero__runzero_list_apps",
      "mcp__run-zero__runzero_get_app",
      "mcp__run-zero__runzero_list_templates",
      "mcp__run-zero__runzero_list_services",
      "mcp__run-zero__runzero_get_logs",
      "mcp__run-zero__runzero_get_metrics",
      "mcp__run-zero__runzero_screenshot",
      "mcp__run-zero__runzero_list_secrets",
      "mcp__run-zero__runzero_list_builds",
      "mcp__run-zero__runzero_list_versions",
      "mcp__run-zero__runzero_list_releases",
      "mcp__run-zero__runzero_wait_for_build",
      "mcp__run-zero__runzero_get_build_logs",
      "mcp__run-zero__runzero_list_files",
      "mcp__run-zero__runzero_read_file",
      "mcp__run-zero__runzero_list_users",
      "mcp__run-zero__runzero_list_identity_providers",
      "mcp__run-zero__runzero_describe_addon",
      "mcp__run-zero__runzero_get_legal_profile"
    ],
    "ask": [
      "mcp__run-zero__runzero_create_app",
      "mcp__run-zero__runzero_adopt_template",
      "mcp__run-zero__runzero_rebuild_service",
      "mcp__run-zero__runzero_deploy_preview",
      "mcp__run-zero__runzero_add_service",
      "mcp__run-zero__runzero_preview_version",
      "mcp__run-zero__runzero_work_url",
      "mcp__run-zero__runzero_upload_assets",
      "mcp__run-zero__runzero_create_user",
      "mcp__run-zero__runzero_create_identity_provider"
    ],
    "deny": [
      "mcp__run-zero__runzero_delete_app",
      "mcp__run-zero__runzero_deploy",
      "mcp__run-zero__runzero_delete_service",
      "mcp__run-zero__runzero_scale_service",
      "mcp__run-zero__runzero_set_secrets",
      "mcp__run-zero__runzero_delete_secret",
      "mcp__run-zero__runzero_publish",
      "mcp__run-zero__runzero_restore_release",
      "mcp__run-zero__runzero_set_publish_mode",
      "mcp__run-zero__runzero_activate_version",
      "mcp__run-zero__runzero_push_files",
      "mcp__run-zero__runzero_delete_user",
      "mcp__run-zero__runzero_reset_user_password",
      "mcp__run-zero__runzero_set_user_enabled",
      "mcp__run-zero__runzero_generate_image",
      "mcp__run-zero__runzero_db_query",
      "mcp__run-zero__runzero_set_legal_profile"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as run-zero. Review it before you use it.

Capability tags behind 17 rules
  • mcp__run-zero__runzero_list_apps untrusted-input
  • mcp__run-zero__runzero_get_app untrusted-input
  • mcp__run-zero__runzero_create_app untrusted-input
  • mcp__run-zero__runzero_screenshot untrusted-input
  • mcp__run-zero__runzero_rebuild_service untrusted-input
  • mcp__run-zero__runzero_deploy untrusted-input
  • mcp__run-zero__runzero_deploy_preview untrusted-input
  • mcp__run-zero__runzero_add_service untrusted-input
  • mcp__run-zero__runzero_list_secrets private-data
  • mcp__run-zero__runzero_publish outbound
  • mcp__run-zero__runzero_push_files untrusted-input
  • mcp__run-zero__runzero_list_files private-data
  • mcp__run-zero__runzero_read_file private-data
  • mcp__run-zero__runzero_create_identity_provider untrusted-input
  • mcp__run-zero__runzero_generate_image untrusted-input
  • mcp__run-zero__runzero_db_query private-data
  • mcp__run-zero__runzero_get_legal_profile private-data

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/de.run-zero/mcp/verify?hash=88e26fe25df2c764693f7aa9eb02770317fcf6a2fe69c0202e4cc0259f921281" | jq -e '.changed == false'

Pinned hash 88e26fe25df2, from Nov 4, 2026, 16:18 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/de.run-zero/mcp/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for de.run-zero/mcp
[![anlyon.dev](https://anlyon.dev/badge/de.run-zero/mcp.svg)](https://anlyon.dev/servers/de.run-zero/mcp)

Source: MCP Registry · repository. Synced Nov 4, 2026, 16:17 UTC.