APIFleet

dev.apifleet/apifleetapifleet.devstreamable-httpv1.2.0Scanned 51 minutes ago

Build and run AI phone agents: provider matrix, call-cost estimates, config checks, call management.

67 tools: 14 can delete or cancel things, 21 change things and 32 only read.

Reads private data · 4
Reads text others write · 13
Can send data out · 4
4 findings

Anlyon alternative

35 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

67 tools

Deletes or cancels 14Removes, cancels or revokes something.Claude Code: deny

create_outbound_callPlace a real telephone call.Reads text others writeNo findings
Why it is in this group
- The name "create_outbound_call" says "create": a word for a change.
- The input addresses people (input.data.to): what it sends cannot be taken back.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Place a real telephone call. Ask the user to approve recipient, caller number and expected usage first. Billing/provider/carrier checks are the same as REST. No automatic retry or universal idempotency guarantee.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: false
- openWorldHint: true
delete_assistantDelete this assistant.Reads text others writeNo findings
Why it is in this group
- The name "delete_assistant" says "delete": a word for removing or ending something.
- The description says "cannot be undone".
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Delete this assistant. Review the identifier before deleting; the change cannot be undone.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: true
delete_knowledge_documentDelete this knowledge document.No findings
Why it is in this group
- The name "delete_knowledge_document" says "delete": a word for removing or ending something.
- The description says "cannot be undone".
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Delete this knowledge document. Review the identifier before deleting; the change cannot be undone.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
delete_recordingPermanently remove a call recording.No findings
Why it is in this group
- The name "delete_recording" says "delete": a word for removing or ending something.
- The description says "Permanently remove".
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Permanently remove a call recording. The call log remains. Confirm the identifier before deleting.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
delete_simulationDelete this simulation.No findings
Why it is in this group
- The name "delete_simulation" says "delete": a word for removing or ending something.
- The description says "cannot be undone".
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Delete this simulation. Review the identifier before deleting; the change cannot be undone.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
delete_simulation_personaDelete this simulation persona.No findings
Why it is in this group
- The name "delete_simulation_persona" says "delete": a word for removing or ending something.
- The description says "cannot be undone".
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Delete this simulation persona. Review the identifier before deleting; the change cannot be undone.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
delete_simulation_runDelete a completed simulation result.No findings
Why it is in this group
- The name "delete_simulation_run" says "delete": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Delete a completed simulation result. Running runs may reject deletion.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
delete_simulation_scenarioDelete this simulation scenario.No findings
Why it is in this group
- The name "delete_simulation_scenario" says "delete": a word for removing or ending something.
- The description says "cannot be undone".
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Delete this simulation scenario. Review the identifier before deleting; the change cannot be undone.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
delete_toolDelete this tool.No findings
Why it is in this group
- The name "delete_tool" says "delete": a word for removing or ending something.
- The description says "cannot be undone".
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Delete this tool. Review the identifier before deleting; the change cannot be undone.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
delete_webhookDelete this webhook.No findings
Why it is in this group
- The name "delete_webhook" says "delete": a word for removing or ending something.
- The description says "cannot be undone".
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Delete this webhook. Review the identifier before deleting; the change cannot be undone.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
revoke_api_keyRevoke a workspace API key immediately.No findings
Why it is in this group
- The name "revoke_api_key" says "revoke": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Revoke a workspace API key immediately. Revoking the key in use disconnects this MCP client on its next request.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
start_simulation_batchQueue every simulation for one assistant.Reads text others writeNo findings
Why it is in this group
- The name "start_simulation_batch" says "start": a word for a change.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Queue every simulation for one assistant. This can incur multiple test runs; approve the batch first.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: false
- openWorldHint: true
start_simulation_runQueue an asynchronous test.Reads text others writeNo findings
Why it is in this group
- The name "start_simulation_run" says "start": a word for a change.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Queue an asynchronous test. Models and speech can incur usage. Approve the run first and poll the returned identifier; do not enqueue again while it is running.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: false
- openWorldHint: true
unbind_numberRemove the routing binding.No findings
Why it is in this group
- The description's first verb is "remove": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Remove the routing binding. This does not release or cancel the carrier number.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false

Changes things 21Creates or changes something that can be changed back.Claude Code: ask

apifleet_check_assistant_configPublic, no key: seven static configuration checks.1 finding
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Info
  The description mentions "credential".
  Matched text
  description: "...hout secrets or customer data. No save, credential verification, full API validation or ca..."
  What this check looks for
Description, as the server wrote it
Public, no key: seven static configuration checks. Send a redacted configuration without secrets or customer data. No save, credential verification, full API validation or call-quality certification occurs.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
apifleet_estimate_call_costPublic, no key: calculate USD platform fees plus caller-supplied blended provider/carrier rates.1 finding
Why it is in this group
- The name "apifleet_estimate_call_cost" says "call": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
  The server marks "apifleet_estimate_call_cost" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
  Matched text
  annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "apifleet_estimate_call_cost" says "call": a word for a change.
  What this check looks for
Description, as the server wrote it
Public, no key: calculate USD platform fees plus caller-supplied blended provider/carrier rates. An estimate, not a provider quote or invoice. Does not place a call.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
bind_numberBind an existing carrier number to a workspace assistant.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Bind an existing carrier number to a workspace assistant. This changes incoming call routing; configure the carrier webhook separately.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
create_api_keyCreate a new full workspace key.No findings
Why it is in this group
- The name "create_api_key" says "create": a word for a change.
Description, as the server wrote it
Create a new full workspace key. The secret is returned once. Store it privately; never put it in public client code.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
create_assistantCreate a assistant.Reads text others writeNo findings
Why it is in this group
- The name "create_assistant" says "create": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Create a assistant. Saving configuration does not place a call. The REST response includes revision, configuration and attached resource identifiers.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
create_browser_test_tokenIssue a short-lived browser voice-test URL.Reads text others writeNo findings
Why it is in this group
- The name "create_browser_test_token" says "create": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Issue a short-lived browser voice-test URL. Opening its WebSocket can incur usage. Never publish the returned token.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
create_knowledge_documentCreate a knowledge document.No findings
Why it is in this group
- The name "create_knowledge_document" says "create": a word for a change.
Description, as the server wrote it
Create a knowledge document. Attach documents separately to use them in an assistant. Total injected knowledge has a 200 KiB limit.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
create_simulationCreate a simulation.No findings
Why it is in this group
- The name "create_simulation" says "create": a word for a change.
Description, as the server wrote it
Create a simulation.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
create_simulation_personaCreate a simulation persona.No findings
Why it is in this group
- The name "create_simulation_persona" says "create": a word for a change.
Description, as the server wrote it
Create a simulation persona.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
create_simulation_scenarioCreate a simulation scenario.No findings
Why it is in this group
- The name "create_simulation_scenario" says "create": a word for a change.
Description, as the server wrote it
Create a simulation scenario.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
create_toolCreate a tool.Can send data outNo findings
Why it is in this group
- The name "create_tool" says "create": a word for a change.
What it can reach
- outboundThe input takes a URL (input.data.url): a request to a URL can carry data to whoever runs it.
Description, as the server wrote it
Create a tool. Creating a tool returns its signing secret once. Configuring a tool does not invoke its URL; attached tools can call it during conversations.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
create_webhookCreate a webhook.Can send data outNo findings
Why it is in this group
- The name "create_webhook" says "create": a word for a change.
What it can reach
- outboundThe input takes a URL (input.data.url): a request to a URL can carry data to whoever runs it.
Description, as the server wrote it
Create a webhook. Creation returns a signing secret once; verify delivery signatures against the raw body. Events may be retried.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
set_assistant_knowledgeReplace all attached knowledge documents.Reads text others writeNo findings
Why it is in this group
- The name "set_assistant_knowledge" says "set": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Replace all attached knowledge documents. Each document must belong to this workspace.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
set_assistant_toolsReplace all attached HTTP tools with existing tools owned by this workspace.Reads text others writeNo findings
Why it is in this group
- The name "set_assistant_tools" says "set": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Replace all attached HTTP tools with existing tools owned by this workspace. Empty tool_ids detaches every tool.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
update_assistantUpdate selected assistant fields.Reads text others writeNo findings
Why it is in this group
- The name "update_assistant" says "update": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Update selected assistant fields. Omitted fields retain their values.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
update_knowledge_documentUpdate selected knowledge document fields.No findings
Why it is in this group
- The name "update_knowledge_document" says "update": a word for a change.
Description, as the server wrote it
Update selected knowledge document fields. Omitted fields retain their values.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
update_simulationUpdate selected simulation fields.No findings
Why it is in this group
- The name "update_simulation" says "update": a word for a change.
Description, as the server wrote it
Update selected simulation fields. Omitted fields retain their values.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
update_simulation_personaUpdate selected simulation persona fields.No findings
Why it is in this group
- The name "update_simulation_persona" says "update": a word for a change.
Description, as the server wrote it
Update selected simulation persona fields. Omitted fields retain their values.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
update_simulation_scenarioUpdate selected simulation scenario fields.No findings
Why it is in this group
- The name "update_simulation_scenario" says "update": a word for a change.
Description, as the server wrote it
Update selected simulation scenario fields. Omitted fields retain their values.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
update_toolUpdate selected tool fields.Can send data outNo findings
Why it is in this group
- The name "update_tool" says "update": a word for a change.
What it can reach
- outboundThe input takes a URL (input.data.url): a request to a URL can carry data to whoever runs it.
Description, as the server wrote it
Update selected tool fields. Omitted fields retain their values.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
update_webhookUpdate selected webhook fields.Can send data outNo findings
Why it is in this group
- The name "update_webhook" says "update": a word for a change.
What it can reach
- outboundThe input takes a URL (input.data.url): a request to a URL can carry data to whoever runs it.
Description, as the server wrote it
Update selected webhook fields. Omitted fields retain their values.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false

Only reads 32Looks things up and changes nothing.Show 32 read-only tools

apifleet_get_provider_matrixPublic, no key: discover implemented voice and carrier integrations, setup boundaries, platform pricing and documentation.No findings
Why it is in this group
- The name "apifleet_get_provider_matrix" says "get": a word for reading.
Description, as the server wrote it
Public, no key: discover implemented voice and carrier integrations, setup boundaries, platform pricing and documentation. No provider request or call is made.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
check_entitlementsRead the workspace prepaid balance and funding path.No findings
Why it is in this group
- The description's first verb is "read": a word for reading.
Description, as the server wrote it
Read the workspace prepaid balance and funding path. Does not start a checkout or call.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_assistantGet one assistant belonging to this workspace.No findings
Why it is in this group
- The name "get_assistant" says "get": a word for reading.
Description, as the server wrote it
Get one assistant belonging to this workspace.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_assistant_voice_presetsRead voices compatible with this assistant configuration.Reads text others writeNo findings
Why it is in this group
- The name "get_assistant_voice_presets" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Read voices compatible with this assistant configuration.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
get_billing_policyRead the actual workspace policy.No findings
Why it is in this group
- The name "get_billing_policy" says "get": a word for reading.
Description, as the server wrote it
Read the actual workspace policy. Internal exempt workspaces can differ from the public tariff.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_knowledge_documentGet one knowledge document belonging to this workspace.Reads private dataNo findings
Why it is in this group
- The name "get_knowledge_document" says "get": a word for reading.
What it can reach
- private-dataThe name "get_knowledge_document" says "get" and "document": it reads documents.
- private-dataThe description's first sentence says "get" and "document": it reads documents.
Description, as the server wrote it
Get one knowledge document belonging to this workspace.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_metricsRead the authenticated workspace metrics snapshot.No findings
Why it is in this group
- The name "get_metrics" says "get": a word for reading.
Description, as the server wrote it
Read the authenticated workspace metrics snapshot. Metrics may reset with the application process and are not a complete billing ledger.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_simulationGet one simulation belonging to this workspace.No findings
Why it is in this group
- The name "get_simulation" says "get": a word for reading.
Description, as the server wrote it
Get one simulation belonging to this workspace.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_simulation_personaGet one simulation persona belonging to this workspace.No findings
Why it is in this group
- The name "get_simulation_persona" says "get": a word for reading.
Description, as the server wrote it
Get one simulation persona belonging to this workspace.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_simulation_runRead a run, its evaluations and linked call when available.No findings
Why it is in this group
- The name "get_simulation_run" says "get": a word for reading.
Description, as the server wrote it
Read a run, its evaluations and linked call when available.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_simulation_scenarioGet one simulation scenario belonging to this workspace.No findings
Why it is in this group
- The name "get_simulation_scenario" says "get": a word for reading.
Description, as the server wrote it
Get one simulation scenario belonging to this workspace.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_toolGet one tool belonging to this workspace.No findings
Why it is in this group
- The name "get_tool" says "get": a word for reading.
Description, as the server wrote it
Get one tool belonging to this workspace.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_tts_settingsRead supported provider voice settings and validation ranges.No findings
Why it is in this group
- The name "get_tts_settings" says "get": a word for reading.
Description, as the server wrote it
Read supported provider voice settings and validation ranges.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_walletRead available, reserved and total prepaid funds, policy, funding availability and runtime enforcement.No findings
Why it is in this group
- The name "get_wallet" says "get": a word for reading.
Description, as the server wrote it
Read available, reserved and total prepaid funds, policy, funding availability and runtime enforcement. Amounts ending in microusd are integer millionths of a USD.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_waveformRead recording waveform metadata and available audio channels.No findings
Why it is in this group
- The name "get_waveform" says "get": a word for reading.
Description, as the server wrote it
Read recording waveform metadata and available audio channels.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
list_api_keysList this workspace API-key metadata.No findings
Why it is in this group
- The name "list_api_keys" says "list": a word for reading.
Description, as the server wrote it
List this workspace API-key metadata. Full key values cannot be retrieved.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
list_assistantsList assistants in the authenticated workspace.No findings
Why it is in this group
- The name "list_assistants" says "list": a word for reading.
Description, as the server wrote it
List assistants in the authenticated workspace.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
list_balance_activityRead balance activity and pagination cursor.No findings
Why it is in this group
- The name "list_balance_activity" says "list": a word for reading.
Description, as the server wrote it
Read balance activity and pagination cursor. Funding is credited only after verified payment processing.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
list_callsRead call logs, summary statistics and pagination.No findings
Why it is in this group
- The name "list_calls" says "list": a word for reading.
Description, as the server wrote it
Read call logs, summary statistics and pagination. Each row may contain transcript, analysis, costs and recording links; recordings require separate authentication.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
list_knowledge_documentsList knowledge in the authenticated workspace.Reads private dataNo findings
Why it is in this group
- The name "list_knowledge_documents" says "list": a word for reading.
What it can reach
- private-dataThe name "list_knowledge_documents" says "list" and "document": it reads documents.
Description, as the server wrote it
List knowledge in the authenticated workspace.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
list_numbersList number bindings.No findings
Why it is in this group
- The name "list_numbers" says "list": a word for reading.
Description, as the server wrote it
List number bindings. This does not buy phone numbers from a carrier.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
list_paymentsRead confirmed and pending workspace payment records for the configured live/test environment.No findings
Why it is in this group
- The name "list_payments" says "list": a word for reading.
Description, as the server wrote it
Read confirmed and pending workspace payment records for the configured live/test environment.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
list_provider_credentialsList which provider credentials are configured.Reads private data1 finding
Why it is in this group
- The name "list_provider_credentials" says "list": a word for reading.
What it can reach
- private-dataThe name "list_provider_credentials" says "list" and "credential": it reads secrets.
- private-dataThe description's first sentence says "list" and "credential": it reads secrets.
Findings
- Info
  The description mentions "credentials".
  Matched text
  description: "List which provider credentials are configured. Returns metadata only,..."
  What this check looks for
Description, as the server wrote it
List which provider credentials are configured. Returns metadata only, never provider secret values.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
list_simulation_personasList simulation personas in the authenticated workspace.No findings
Why it is in this group
- The name "list_simulation_personas" says "list": a word for reading.
Description, as the server wrote it
List simulation personas in the authenticated workspace.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
list_simulation_runsList simulation runs and pagination; inspect status before starting another run.No findings
Why it is in this group
- The name "list_simulation_runs" says "list": a word for reading.
Description, as the server wrote it
List simulation runs and pagination; inspect status before starting another run.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
list_simulation_scenariosList simulation scenarios in the authenticated workspace.No findings
Why it is in this group
- The name "list_simulation_scenarios" says "list": a word for reading.
Description, as the server wrote it
List simulation scenarios in the authenticated workspace.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
list_simulationsList simulations in the authenticated workspace.No findings
Why it is in this group
- The name "list_simulations" says "list": a word for reading.
Description, as the server wrote it
List simulations in the authenticated workspace.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
list_toolsList http tools in the authenticated workspace.Reads text others writeNo findings
Why it is in this group
- The name "list_tools" says "list": a word for reading.
What it can reach
- untrusted-inputThe description's first sentence says "list" and "http": it reads web pages, which anyone can write.
Description, as the server wrote it
List http tools in the authenticated workspace.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
list_tts_ratesRead configured voice-cost reference rates.No findings
Why it is in this group
- The name "list_tts_rates" says "list": a word for reading.
Description, as the server wrote it
Read configured voice-cost reference rates. These are not an invoice or a complete call price.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
list_tts_voicesRead a provider voice catalog using configured server-side credentials.Reads private dataReads text others write1 finding
Why it is in this group
- The name "list_tts_voices" says "list": a word for reading.
What it can reach
- private-dataThe description's first sentence says "read" and "credential": it reads secrets.
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Findings
- Info
  The description mentions "credentials".
  Matched text
  description: "...ce catalog using configured server-side credentials. Catalog failure may return an empty li..."
  What this check looks for
Description, as the server wrote it
Read a provider voice catalog using configured server-side credentials. Catalog failure may return an empty list and error; it is not evidence the provider has no voices.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
list_voice_presetsRead configured runnable voice presets.Reads text others writeNo findings
Why it is in this group
- The name "list_voice_presets" says "list": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Read configured runnable voice presets. Provider catalog requests may reach a vendor.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
list_webhooksList webhooks in the authenticated workspace.No findings
Why it is in this group
- The name "list_webhooks" says "list": a word for reading.
Description, as the server wrote it
List webhooks in the authenticated workspace.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

208 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 4 outbound tools breaks every one.

Reads private data4: Reads files, mail, messages, databases, secrets, calendars or repositories.; get_knowledge_document
list_knowledge_documents
list_provider_credentials
list_tts_voices
Reads text others write13: Brings in text someone else can write: web pages, inbound email, messages, issues and comments.; create_assistant
create_browser_test_token
create_outbound_call
delete_assistant
get_assistant_voice_presets
list_tools
list_tts_voices
list_voice_presets
set_assistant_knowledge
set_assistant_tools
start_simulation_batch
start_simulation_run
and 1 more
Can send data out4: Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.; create_tool
create_webhook
update_tool
update_webhook

deny to break every path

{
  "permissions": {
    "deny": [
      "mcp__apifleet__create_tool",
      "mcp__apifleet__create_webhook",
      "mcp__apifleet__update_tool",
      "mcp__apifleet__update_webhook"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

1 warn3 info

Warnapifleet_estimate_call_cost
The server marks "apifleet_estimate_call_cost" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
Matched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "apifleet_estimate_call_cost" says "call": a word for a change.
What this check looks for
Infoapifleet_check_assistant_config
The description mentions "credential".
Matched text
description: "...hout secrets or customer data. No save, credential verification, full API validation or ca..."
What this check looks for
Infolist_tts_voices
The description mentions "credentials".
Matched text
description: "...ce catalog using configured server-side credentials. Catalog failure may return an empty li..."
What this check looks for
Infolist_provider_credentials
The description mentions "credentials".
Matched text
description: "List which provider credentials are configured. Returns metadata only,..."
What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 1.2.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http apifleet https://apifleet.dev/mcp

claude mcp add --transport http apifleet https://apifleet.dev/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__apifleet__apifleet_get_provider_matrix",
      "mcp__apifleet__check_entitlements",
      "mcp__apifleet__list_assistants",
      "mcp__apifleet__get_assistant",
      "mcp__apifleet__list_numbers",
      "mcp__apifleet__list_calls",
      "mcp__apifleet__get_waveform",
      "mcp__apifleet__list_tools",
      "mcp__apifleet__get_tool",
      "mcp__apifleet__list_knowledge_documents",
      "mcp__apifleet__get_knowledge_document",
      "mcp__apifleet__list_webhooks",
      "mcp__apifleet__list_simulation_personas",
      "mcp__apifleet__get_simulation_persona",
      "mcp__apifleet__list_simulation_scenarios",
      "mcp__apifleet__get_simulation_scenario",
      "mcp__apifleet__list_simulations",
      "mcp__apifleet__get_simulation",
      "mcp__apifleet__list_simulation_runs",
      "mcp__apifleet__get_simulation_run",
      "mcp__apifleet__list_tts_rates",
      "mcp__apifleet__list_tts_voices",
      "mcp__apifleet__list_voice_presets",
      "mcp__apifleet__get_assistant_voice_presets",
      "mcp__apifleet__get_tts_settings",
      "mcp__apifleet__list_provider_credentials",
      "mcp__apifleet__list_api_keys",
      "mcp__apifleet__get_wallet",
      "mcp__apifleet__get_billing_policy",
      "mcp__apifleet__list_balance_activity",
      "mcp__apifleet__list_payments",
      "mcp__apifleet__get_metrics"
    ],
    "ask": [
      "mcp__apifleet__apifleet_estimate_call_cost",
      "mcp__apifleet__apifleet_check_assistant_config",
      "mcp__apifleet__create_assistant",
      "mcp__apifleet__update_assistant",
      "mcp__apifleet__set_assistant_tools",
      "mcp__apifleet__set_assistant_knowledge",
      "mcp__apifleet__create_browser_test_token",
      "mcp__apifleet__bind_number",
      "mcp__apifleet__create_tool",
      "mcp__apifleet__update_tool",
      "mcp__apifleet__create_knowledge_document",
      "mcp__apifleet__update_knowledge_document",
      "mcp__apifleet__create_webhook",
      "mcp__apifleet__update_webhook",
      "mcp__apifleet__create_simulation_persona",
      "mcp__apifleet__update_simulation_persona",
      "mcp__apifleet__create_simulation_scenario",
      "mcp__apifleet__update_simulation_scenario",
      "mcp__apifleet__create_simulation",
      "mcp__apifleet__update_simulation",
      "mcp__apifleet__create_api_key"
    ],
    "deny": [
      "mcp__apifleet__delete_assistant",
      "mcp__apifleet__unbind_number",
      "mcp__apifleet__create_outbound_call",
      "mcp__apifleet__delete_recording",
      "mcp__apifleet__delete_tool",
      "mcp__apifleet__delete_knowledge_document",
      "mcp__apifleet__delete_webhook",
      "mcp__apifleet__delete_simulation_persona",
      "mcp__apifleet__delete_simulation_scenario",
      "mcp__apifleet__delete_simulation",
      "mcp__apifleet__delete_simulation_run",
      "mcp__apifleet__start_simulation_run",
      "mcp__apifleet__start_simulation_batch",
      "mcp__apifleet__revoke_api_key"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as apifleet. Review it before you use it.

Capability tags behind 20 rules

mcp__apifleet__create_assistant untrusted-input
mcp__apifleet__update_assistant untrusted-input
mcp__apifleet__delete_assistant untrusted-input
mcp__apifleet__set_assistant_tools untrusted-input
mcp__apifleet__set_assistant_knowledge untrusted-input
mcp__apifleet__create_browser_test_token untrusted-input
mcp__apifleet__create_outbound_call untrusted-input
mcp__apifleet__list_tools untrusted-input
mcp__apifleet__create_tool outbound
mcp__apifleet__update_tool outbound
mcp__apifleet__list_knowledge_documents private-data
mcp__apifleet__get_knowledge_document private-data
mcp__apifleet__create_webhook outbound
mcp__apifleet__update_webhook outbound
mcp__apifleet__start_simulation_run untrusted-input
mcp__apifleet__start_simulation_batch untrusted-input
mcp__apifleet__list_tts_voices private-data, untrusted-input
mcp__apifleet__list_voice_presets untrusted-input
mcp__apifleet__get_assistant_voice_presets untrusted-input
mcp__apifleet__list_provider_credentials private-data

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/dev.apifleet/apifleet/verify?hash=1bd7fded6d25e7d267c5449e832bfb2692394810b9d5013fab6e9ebddc605b18" | jq -e '.changed == false'

Pinned hash 1bd7fded6d25, from Oct 28, 2026, 23:18 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/dev.apifleet/apifleet/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

[![anlyon.dev](https://anlyon.dev/badge/dev.apifleet/apifleet.svg)](https://anlyon.dev/servers/dev.apifleet/apifleet)

Source: MCP Registry. Synced Oct 28, 2026, 23:17 UTC.