Skip to content

ClusterHack

by clusterhack.dev · remote · no sign-in to list tools · v1.0.0 · published by dev.clusterhack

Run hackathons end to end: events, teams, submissions, judging and winners.

Final · 2Changes · 28
CompareRegistry entry

60 tools: 2 do something that can't be undone, 28 change things and 30 only read.

Scanned Oct 21, 2026

10 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http clusterhack https://clusterhack.dev/mcp/

Findings

Matches of fixed checks, with the text they matched.

9 warn1 info
  • Warnsearch

    The description contains "every other tool", wording about other tools or servers.

    Matched text

    description: "...bjects with the slug or id you need for every other tool."

    What this check looks for
  • Warnevent_schedule

    The server marks "event_schedule" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":false,"openWorldHint":false}; The name "event_schedule" says "schedule": a word for a change.

    What this check looks for
  • Warnevent_share_links

    The server marks "event_share_links" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":false,"openWorldHint":false}; The name "event_share_links" says "link": a word for a change.

    What this check looks for
  • Warnevent_types

    The server marks "event_types" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":false,"openWorldHint":false}; The name "event_types" says "type": a word for a change.

    What this check looks for
  • Warninvite_preview

    The server marks "invite_preview" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":false,"openWorldHint":false}; The name "invite_preview" says "invite": a word for sending, and what is sent cannot be taken back.

    What this check looks for
  • Warnteam_open_roles

    The server marks "team_open_roles" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":false,"openWorldHint":false}; The name "team_open_roles" says "open": a word for a change.

    What this check looks for
Show 4 more findings
  • Warnteam_posts

    The server marks "team_posts" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":false,"openWorldHint":false}; The name "team_posts" says "post": a word for a change.

    What this check looks for
  • Warncompany_employment_requests

    The server marks "company_employment_requests" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":false,"openWorldHint":false}; The name "company_employment_requests" says "request": a word for a change.

    What this check looks for
  • Warncompany_get

    The server marks "company_get" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":false,"openWorldHint":false}; The name "company_get" says "get": a word for reading.

    What this check looks for
  • Infoaccount_how_to_sign_in

    The description mentions "credential".

    Matched text

    description: "...use there isn't one. ClusterHack's own credential endpoints (register, login, JWT issuanc..."

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

60 tools

Can't be undone 2Claude Code: ask
  • company_getOne company page by id: name, description, organisation type, website and logo.1 finding

    Why it is in this group

    • The name "company_get" says "get": a word for reading.
    • The description says "irreversible".
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "company_get" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":false,"openWorldHint":false}; The name "company_get" says "get": a word for reading.

      What this check looks for
    Description, as the server wrote it
    One company page by id: name, description, organisation type, website and logo. Public read. Use it after `company_list` or `search` to get the full record, and to confirm you have the right company before employment or sponsorship actions, which are irreversible for the people involved.

    Annotations the server declares

    • title: Get a company
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • invite_previewLook up what a shareable invite link opens, without redeeming it.1 finding

    Why it is in this group

    • The name "invite_preview" says "invite": a word for sending, and what is sent cannot be taken back.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "invite_preview" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":false,"openWorldHint":false}; The name "invite_preview" says "invite": a word for sending, and what is sent cannot be taken back.

      What this check looks for
    Description, as the server wrote it
    Look up what a shareable invite link opens, without redeeming it. Public and PII-free: returns the event's name and slug and whether the token is still valid (active, not expired, uses remaining). Use this before `invite_join` to show the user what they are about to join, or to explain why a link stopped working.

    Annotations the server declares

    • title: Preview an invite link
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
Changes things 28Claude Code: ask
  • account_ai_accessHow the signed-in user sees and revokes AI access to their own account — read this instead of looking for a tool that lists or cuts off connected clients, because there is delibera…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    How the signed-in user sees and revokes AI access to their own account — read this instead of looking for a tool that lists or cuts off connected clients, because there is deliberately no such tool. The controls over AI access (list connected clients, revoke one, list and end live MCP sessions, read the record of what a client did as them) are gated to the account holder signing in directly: a browser session, a JWT, or an API token they hold themselves. A connected AI client — including this one — is refused, on purpose. If it were not, a client could revoke its rivals, enumerate the user's other connections, or read the trail it leaves behind. So this tool tells the user where to go and what they will find; it makes no API call and cannot fail. Also names where account deletion and data export live: the export has a tool (`account_export_data`), the deletion deliberately does not.

    Annotations the server declares

    • title: Managing AI access to this account
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • company_about_usA company's longer "about us" blurb (up to 10,000 characters), separate from its short `description`.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    A company's longer "about us" blurb (up to 10,000 characters), separate from its short `description`. Returns `found: false` if the company has not written one yet.

    Annotations the server declares

    • title: Get a company's about-us page
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • company_employeesA company's employee roster (position, start date).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    A company's employee roster (position, start date). Without `company_id`, returns every roster row the caller can see (their own employment rows plus every company they administer) — the underlying API is already scoped that way. With `company_id`, narrows to that company only.

    Annotations the server declares

    • title: List company employees
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • company_employment_requestsPending requests to join a company.1 finding

    Why it is in this group

    • The name "company_employment_requests" says "request": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "company_employment_requests" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":false,"openWorldHint":false}; The name "company_employment_requests" says "request": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Pending requests to join a company. A company admin sees everyone waiting on their door; anyone else sees only their own outstanding applications. This is where the `request_id` for `company_decide_employment_request` comes from.

    Annotations the server declares

    • title: List employment requests
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • company_ex_employeesA company's former employees (position, start and end date) — the record created when someone is fired via `company_fire_employee`.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    A company's former employees (position, start and end date) — the record created when someone is fired via `company_fire_employee`. Without `company_id`, returns every ex-employment row the caller can see (their own, plus every company they administer).

    Annotations the server declares

    • title: List a company's former employees
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • company_rosterThe company page's public roster in one call: the people listed as employees and the people listed as moderators, exactly as the company page renders them to any visitor.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    The company page's public roster in one call: the people listed as employees and the people listed as moderators, exactly as the company page renders them to any visitor. Use this — not `company_employees` / `company_admins` — whenever you want to read *someone else's* roster. Those two are scoped to self-or-admin, so an outsider gets an empty list from them and cannot tell "nobody works here" apart from "you may not see who does". This endpoint is the part of the page that is already public, and nothing more: no join requests, no ex-employees, no write verbs.

    Annotations the server declares

    • title: A company's public roster
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • company_vacanciesThe public board of companies not yet on ClusterHack (a lightweight off-platform listing — name, description, website — not a job-posting system).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    The public board of companies not yet on ClusterHack (a lightweight off-platform listing — name, description, website — not a job-posting system). Public, no filters.

    Annotations the server declares

    • title: List off-platform companies
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • event_background_imagesThe global catalogue of certificate background templates (used for the `background` field of an event's certificate config).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    The global catalogue of certificate background templates (used for the `background` field of an event's certificate config). Not tied to one event.

    Annotations the server declares

    • title: List certificate backgrounds
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • event_citiesThe global catalogue of cities (used for the `city` field on `event_create`/`event_update` and to show where events happen).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    The global catalogue of cities (used for the `city` field on `event_create`/`event_update` and to show where events happen).

    Annotations the server declares

    • title: List cities
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • event_faqAn event's FAQ: the question/answer pairs shown on its public page.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    An event's FAQ: the question/answer pairs shown on its public page. Public read — use it to answer a participant's question from the event's own words before guessing, and to check what is already covered before adding more.

    Annotations the server declares

    • title: Get event FAQ
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • event_info_blocksAn event's additional free-form information blocks (extra sections shown on its public page beyond the main description — rules, prizes, sponsors notes, etc.).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    An event's additional free-form information blocks (extra sections shown on its public page beyond the main description — rules, prizes, sponsors notes, etc.).

    Annotations the server declares

    • title: Get event info blocks
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • event_leaderboardThe ranked leaderboard for one event: submissions ordered by weighted judge score then vote count, with each entry's rank, team and score.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    The ranked leaderboard for one event: submissions ordered by weighted judge score then vote count, with each entry's rank, team and score. Public once the organiser publishes winners; before that, only the event's admins and judges can preview it (everyone else gets a clear "not published yet" error).

    Annotations the server declares

    • title: Get an event's leaderboard
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • event_nominationsAn event's award nominations/tracks (e.g.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    An event's award nominations/tracks (e.g. "Best AI prototype"), used when creating teams, awarding winners and building the leaderboard per track.

    Annotations the server declares

    • title: Get event nominations
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • event_presetsPublic catalogue of event-creation presets (AI build day, student hackathon, corporate innovation day, ...) with sensible defaults and starter nominations.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Public catalogue of event-creation presets (AI build day, student hackathon, corporate innovation day, ...) with sensible defaults and starter nominations. Call before `event_create` when the user describes a kind of hackathon rather than exact field values.

    Annotations the server declares

    • title: Event creation presets
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • event_rolesWhich roles the signed-in user holds at one specific event.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Which roles the signed-in user holds at one specific event. Cheaper and more precise than `whoami` when you already know the event and just need to know whether the user can organise, judge or only take part.

    Annotations the server declares

    • title: My roles at an event
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • event_scheduleThe event's timeline: an ordered list of stages/activities (opening, workshops, deadlines, closing ceremony) with title, location, time window and status (past/now/future).1 finding

    Why it is in this group

    • The name "event_schedule" says "schedule": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "event_schedule" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":false,"openWorldHint":false}; The name "event_schedule" says "schedule": a word for a change.

      What this check looks for
    Description, as the server wrote it
    The event's timeline: an ordered list of stages/activities (opening, workshops, deadlines, closing ceremony) with title, location, time window and status (past/now/future). This is what participants see as "the schedule". Broadcast link and chat link are only included for the event's admins and registered participants — everyone else sees them blanked.

    Annotations the server declares

    • title: Get event schedule
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • event_sponsor_textSponsors of one event that are NOT themselves on ClusterHack (a name, description, website and logo entered as free text, with the sponsorship tier each one belongs to) — the off-p…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Sponsors of one event that are NOT themselves on ClusterHack (a name, description, website and logo entered as free text, with the sponsorship tier each one belongs to) — the off-platform counterpart to `event_sponsors`. Public read.

    Annotations the server declares

    • title: List an event's off-platform sponsors
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • event_sponsor_tiersThe sponsorship tiers/groups defined for one event (e.g.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    The sponsorship tiers/groups defined for one event (e.g. "Sponsors", "Partners", "General Partner") — the buckets `event_add_sponsor` slots companies into. Public read.

    Annotations the server declares

    • title: List an event's sponsor tiers
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • event_sponsorsThe on-platform companies sponsoring one event, with the sponsorship tier each one is slotted into (e.g.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    The on-platform companies sponsoring one event, with the sponsorship tier each one is slotted into (e.g. "Sponsors", "Partners", "General Partner"). Public read. Use `event_sponsor_text` alongside this for sponsors that are not themselves on ClusterHack yet.

    Annotations the server declares

    • title: List an event's sponsors
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • event_team_stagesAn event's team-facing reporting checkpoints (e.g.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    An event's team-facing reporting checkpoints (e.g. "Idea locked", "Demo ready") with their time windows — distinct from `event_schedule`, which is the event's own agenda. Used to track team progress through the event.

    Annotations the server declares

    • title: Get team-progress stages
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • event_typesThe global catalogue of event types (used for the `type` field on `event_create`/`event_update`).1 finding

    Why it is in this group

    • The name "event_types" says "type": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "event_types" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":false,"openWorldHint":false}; The name "event_types" says "type": a word for a change.

      What this check looks for
    Description, as the server wrote it
    The global catalogue of event types (used for the `type` field on `event_create`/`event_update`). Small and rarely changes.

    Annotations the server declares

    • title: List event types
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • server_infoWhat this MCP server is, which version it speaks, and how to connect.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    What this MCP server is, which version it speaks, and how to connect. Useful for diagnostics and for telling the user where to manage or revoke the connection.

    Annotations the server declares

    • title: Server info
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • team_matchmaking_teamsAI-ranked list of teams one free (teamless) participant could join, within the same event.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    AI-ranked list of teams one free (teamless) participant could join, within the same event. Callable by the free-agent listing's own owner, or an admin of the event. Use `event_free_agents` or `event_join_as_free_agent` to get a `free_member_id`. Throttled — do not call it in a tight loop.

    Annotations the server declares

    • title: Suggest teams for a free agent
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • team_open_rolesList the positions teams are looking to fill ("we need a designer").1 finding

    Why it is in this group

    • The name "team_open_roles" says "open": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "team_open_roles" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":false,"openWorldHint":false}; The name "team_open_roles" says "open": a word for a change.

      What this check looks for
    Description, as the server wrote it
    List the positions teams are looking to fill ("we need a designer"). Visibility is limited to what the signed-in account can already see: their own team's open roles, or — if they organise the event — every team's. It is not a public cross-team browse for a stranger looking for any team: that is `team_seeking_members`, which reads the find-a-team page's own list (pair it with `event_free_agents` and `team_matchmaking_teams`). Filter with `team_id` for one team, or `event_slug` to see everything the caller can see at that event. `team_id` is answered exactly. `event_slug` (and the unfiltered form) is not: the underlying endpoint narrows by one team at a time and has no event filter, so a very large event can return a `note` saying rows were left unscanned. Ask per team when that matters.

    Annotations the server declares

    • title: List open team roles
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • team_postsList a team's public updates ("twits") — the short build-log posts a team publishes as it works, in the order the server returns them.1 finding

    Why it is in this group

    • The name "team_posts" says "post": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "team_posts" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":false,"openWorldHint":false}; The name "team_posts" says "post": a word for a change.

      What this check looks for
    Description, as the server wrote it
    List a team's public updates ("twits") — the short build-log posts a team publishes as it works, in the order the server returns them. Use it to catch up on what a team has been doing, or to check what has already been posted before writing another update with `team_post`.

    Annotations the server declares

    • title: List a team's posts
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • team_readinessCheck whether a team has marked itself ready to present, plus whether it is banned or currently accessible for judging.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Check whether a team has marked itself ready to present, plus whether it is banned or currently accessible for judging.

    Annotations the server declares

    • title: Get a team's readiness
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
Only reads 30Claude Code: allow
  • account_how_to_sign_inExplains how to connect an account to this MCP server — read this instead of guessing at a login/registration tool, because there isn't one.1 finding

    Why it is in this group

    • The description's first verb is "explain": a word for reading.

    Findings

    • Info

      The description mentions "credential".

      Matched text

      description: "...use there isn't one. ClusterHack's own credential endpoints (register, login, JWT issuanc..."

      What this check looks for
    Description, as the server wrote it
    Explains how to connect an account to this MCP server — read this instead of guessing at a login/registration tool, because there isn't one. ClusterHack's own credential endpoints (register, login, JWT issuance, password reset) are the website's login form, not MCP tools: an MCP client authenticates by OAuth 2.1 (the same flow a human approves in a browser tab) and must never see or handle a ClusterHack password directly. This tool works with no account at all, and just explains the steps and links.

    Annotations the server declares

    • title: How to sign in
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • article_getRetrieve one CMS article by id: its body, publish date, hidden flag, and which title/slug and language it belongs to.No findings

    Why it is in this group

    • The name "article_get" says "get": a word for reading.
    Description, as the server wrote it
    Retrieve one CMS article by id: its body, publish date, hidden flag, and which title/slug and language it belongs to.

    Annotations the server declares

    • title: Get an article
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • article_languagesList the languages articles can be written in, e.g.No findings

    Why it is in this group

    • The description's first verb is "list": a word for reading.
    Description, as the server wrote it
    List the languages articles can be written in, e.g. {"language_name": "English", "short_name": "en"}. Use this to find the `language_id` `article_create` needs.

    Annotations the server declares

    • title: List article languages
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • article_listBrowse CMS articles (the pages under /articles/<language>/<slug>).No findings

    Why it is in this group

    • The name "article_list" says "list": a word for reading.
    Description, as the server wrote it
    Browse CMS articles (the pages under /articles/<language>/<slug>). Filter by `language` (a language's short code, e.g. 'en') and/or `slug` (a title's slug) to find one specific page's translations. Hidden drafts are only included for staff callers; everyone else sees only published articles.

    Annotations the server declares

    • title: List articles
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • article_titlesList the CMS "title" records — each one a page's title text and slug, e.g.No findings

    Why it is in this group

    • The description's first verb is "list": a word for reading.
    Description, as the server wrote it
    List the CMS "title" records — each one a page's title text and slug, e.g. {"title": "How to organize a hackathon", "slug": "how-to-organize"}. An article always points at one of these; use this to find the `title_id` `article_create` needs, or to see what pages exist at all.

    Annotations the server declares

    • title: List article titles
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • company_listBrowse ClusterHack company pages: name, description, org type, website and logo.No findings

    Why it is in this group

    • The name "company_list" says "list": a word for reading.
    Description, as the server wrote it
    Browse ClusterHack company pages: name, description, org type, website and logo. Public data — use this to find a company's id before calling any other company tool.

    Annotations the server declares

    • title: List companies
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • event_brandingRead an event's white-label branding: brand colours, public-page theme and dedicated subdomain, plus the resolved values actually used for rendering and `branding_enabled` — whethe…No findings

    Why it is in this group

    • The description's first verb is "read": a word for reading.
    Description, as the server wrote it
    Read an event's white-label branding: brand colours, public-page theme and dedicated subdomain, plus the resolved values actually used for rendering and `branding_enabled` — whether the evening currently wears its costume, i.e. whether those values are applied. Public, because the colours are visible on the event page anyway. Use it before `event_set_branding` to see what is already set.

    Annotations the server declares

    • title: Get event branding
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • event_free_agentsList participants at an event who are looking for a team.No findings

    Why it is in this group

    • The description's first verb is "list": a word for reading.
    Description, as the server wrote it
    List participants at an event who are looking for a team. Visibility follows the platform's own rule, not a full public roster: a normal caller only sees their own free-agent listing here, while an organiser of the event sees everyone's. Use `team_matchmaking_teams` on a listing's id for AI-ranked team suggestions for that person.

    Annotations the server declares

    • title: List free agents at an event
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • event_getGet one event's full public profile by slug: name, dates, address, topic, description, status and city.No findings

    Why it is in this group

    • The name "event_get" says "get": a word for reading.
    Description, as the server wrote it
    Get one event's full public profile by slug: name, dates, address, topic, description, status and city. Call this once you have a slug (from `event_list` or `search`) and need the details. It does not include the schedule, FAQ or nominations — use `event_schedule`, `event_faq` and `event_nominations` for those.

    Annotations the server declares

    • title: Get an event
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • event_listBrowse hackathons on the platform — filter by status, city or date.No findings

    Why it is in this group

    • The name "event_list" says "list": a word for reading.
    Description, as the server wrote it
    Browse hackathons on the platform — filter by status, city or date. Returns each event's slug, which every other event tool needs, plus name, status, dates and city. Use this when the user names an event you do not have a slug for and `search` is not precise enough, or to show a list of upcoming/past events. Hidden events only appear here for their own organisers.

    Annotations the server declares

    • title: Browse events
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • event_my_membershipSummarise the signed-in user's relationship to one event: whether they have joined, their registration answers on file, whether they are listed as a free agent, and which roles the…No findings

    Why it is in this group

    • The description's first verb is "summarise": a word for reading.
    Description, as the server wrote it
    Summarise the signed-in user's relationship to one event: whether they have joined, their registration answers on file, whether they are listed as a free agent, and which roles they hold there (organizer, judge, team lead, ...). Cheaper than combining several other tools when you just need "is this user in, and how" for one event.

    Annotations the server declares

    • title: My status at an event
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • event_my_registration_answersList the signed-in user's own answers to one event's registration questions.No findings

    Why it is in this group

    • The description's first verb is "list": a word for reading.
    Description, as the server wrote it
    List the signed-in user's own answers to one event's registration questions. Only ever returns their own data — use `event_registration_responses` (organiser only) to read other people's.

    Annotations the server declares

    • title: Get my registration answers
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • event_registration_formList the custom questions an event asks at registration time (its registration form), in display order.No findings

    Why it is in this group

    • The description's first verb is "list": a word for reading.
    Description, as the server wrote it
    List the custom questions an event asks at registration time (its registration form), in display order. Public data — the question text is visible to anyone. Use this before `event_submit_registration_answers` to know which `form_field_id`s exist and which are required.

    Annotations the server declares

    • title: Get an event's registration form
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • list_api_endpointsList the raw REST endpoints behind this server.No findings

    Why it is in this group

    • The name "list_api_endpoints" says "list": a word for reading.
    Description, as the server wrote it
    List the raw REST endpoints behind this server. Use it together with `api_request` when you need something no curated tool covers. The list is read from the live URL configuration, so it always matches what the server actually serves.

    Annotations the server declares

    • title: List API endpoints
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • list_capabilitiesThe catalogue of everything this server can do, grouped by area.No findings

    Why it is in this group

    • The name "list_capabilities" says "list": a word for reading.
    Description, as the server wrote it
    The catalogue of everything this server can do, grouped by area. Returns each tool available to the current connection with its one-line purpose, the role it is meant for and the permission it consumes. Use it when you are not sure a capability exists — it is cheaper than guessing tool names, and it shows what the user would gain by granting more permissions.

    Annotations the server declares

    • title: List capabilities
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • showcase_browseBrowse the public, cross-event showcase: shipped/submitted projects ranked for display, with title, tagline, team name, vote count and a cover image.No findings

    Why it is in this group

    • The name "showcase_browse" says "browse": a word for reading.
    Description, as the server wrote it
    Browse the public, cross-event showcase: shipped/submitted projects ranked for display, with title, tagline, team name, vote count and a cover image. Optionally narrow to one event. This is the public gallery — use `event_leaderboard` instead when you specifically need judged rankings for one event.

    Annotations the server declares

    • title: Browse the showcase
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • submission_getRetrieve one project submission by id: title, links, description, status, approval status, vote count and attached media.No findings

    Why it is in this group

    • The name "submission_get" says "get": a word for reading.
    Description, as the server wrote it
    Retrieve one project submission by id: title, links, description, status, approval status, vote count and attached media. Anonymous and unrelated callers only see it once the team has submitted (status "submitted"); drafts are visible only to the team, the event's admins and its judges. Use `submission_list` or `submission_get_mine` when you do not already know the numeric id.

    Annotations the server declares

    • title: Get a submission
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • submission_listBrowse project submissions, filterable by event, team or status.No findings

    Why it is in this group

    • The name "submission_list" says "list": a word for reading.
    Description, as the server wrote it
    Browse project submissions, filterable by event, team or status. Anonymous and unrelated callers only ever see submitted (public) projects; a signed-in caller additionally sees their own team's drafts and every submission at events they administer or judge. ``status`` narrows the returned page client-side (draft / submitted / disqualified) since the underlying list endpoint does not filter by status itself — combine with a larger `page_size` if you need it applied beyond one page.

    Annotations the server declares

    • title: List submissions
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • submission_list_mediaList the screenshots/gallery images attached to a submission.No findings

    Why it is in this group

    • The name "submission_list_media" says "list": a word for reading.
    Description, as the server wrote it
    List the screenshots/gallery images attached to a submission. Visibility mirrors the parent submission: public once submitted, otherwise limited to the team, event admins and judges.

    Annotations the server declares

    • title: List submission media
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • submission_pageRead a project's public page: the submission itself, every judge's written feedback (signed with the judge's name only where that judge consented to being named, empty otherwise), …No findings

    Why it is in this group

    • The description's first verb is "read": a word for reading.
    Description, as the server wrote it
    Read a project's public page: the submission itself, every judge's written feedback (signed with the judge's name only where that judge consented to being named, empty otherwise), and — once the organiser has published the winners — its placement, rank and judge score. This is the tool for "what did the judges say about our project?". `submission_get` returns the project's own fields and nothing about how it was received; `judging_scores_for_submission` is scoped to judges and event admins, so a team cannot read its own verdict through it. A submitted project's page is public; a draft is visible only to its team and the event's admins. Before the ceremony the placement is shown to the team and the hosts alone, flagged `placement_private` so a client says "not announced yet" instead of leaking it. `private_note` is the organisers' line and is absent — not blanked, absent — from everyone else's payload.

    Annotations the server declares

    • title: Read a project's page and its judge feedback
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • tag_listList tags used to categorize content across the platform (articles, projects and more share the same tag vocabulary).No findings

    Why it is in this group

    • The name "tag_list" says "list": a word for reading.
    Description, as the server wrote it
    List tags used to categorize content across the platform (articles, projects and more share the same tag vocabulary).

    Annotations the server declares

    • title: List tags
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • team_getGet one team's full detail: name, description, project info, readiness, accessibility flags, and which event and nomination it belongs to.No findings

    Why it is in this group

    • The name "team_get" says "get": a word for reading.
    Description, as the server wrote it
    Get one team's full detail: name, description, project info, readiness, accessibility flags, and which event and nomination it belongs to. Only visible if the signed-in user belongs to the team, created it, or administers its event.

    Annotations the server declares

    • title: Get a team
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • team_listList teams — scoped to what the signed-in account can see: teams they belong to, created, or administer via being an admin of the team's event.No findings

    Why it is in this group

    • The name "team_list" says "list": a word for reading.
    Description, as the server wrote it
    List teams — scoped to what the signed-in account can see: teams they belong to, created, or administer via being an admin of the team's event. This is never a full public directory of every team on the platform. Filter by `event_slug` to see just one event's teams, or `search` to match team/project name and description. Use `team_get` for the full detail of one team once you have its id.

    Annotations the server declares

    • title: List teams
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • team_locationsRead the physical location details linked to a team's additional-info profile (street, city, state, zip), if one has been set.No findings

    Why it is in this group

    • The description's first verb is "read": a word for reading.
    Description, as the server wrote it
    Read the physical location details linked to a team's additional-info profile (street, city, state, zip), if one has been set. There is currently no self-service way to create a new location through this API — location rows are set up separately, then referenced by id via `team_additional_info`'s `location_id`.

    Annotations the server declares

    • title: Get a team's location
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • team_membersList a team's current members with their role and caption.No findings

    Why it is in this group

    • The description's first verb is "list": a word for reading.
    Description, as the server wrote it
    List a team's current members with their role and caption. Use the row `id` (a membership id, not a user id) with `team_assign_role` or `team_remove_member`.

    Annotations the server declares

    • title: List team members
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • team_rolesList the roles a team has defined (e.g.No findings

    Why it is in this group

    • The description's first verb is "list": a word for reading.
    Description, as the server wrote it
    List the roles a team has defined (e.g. "Frontend", "Designer"), which members can be assigned via `team_assign_role`.

    Annotations the server declares

    • title: List a team's roles
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • team_seeking_membersBrowse the teams of one event that are advertising open positions — the public "who is recruiting" list behind the find-a-team page, readable by anyone, including someone who has n…No findings

    Why it is in this group

    • The description's first verb is "browse": a word for reading.
    Description, as the server wrote it
    Browse the teams of one event that are advertising open positions — the public "who is recruiting" list behind the find-a-team page, readable by anyone, including someone who has not joined the event yet. This is the tool for a person looking for a team. `team_open_roles` is the other direction: it lists open positions the caller already has access to (their own teams', or every team's if they organise the event) and shows a stranger nothing. Each row here carries the team's public profile plus its `open_roles`. Follow up with `team_request_join`, or list yourself with `event_join_as_free_agent` if nothing fits.

    Annotations the server declares

    • title: Browse teams looking for people
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • tech_listList technologies (tech-stack tags) that projects and teams can be labelled with, e.g.No findings

    Why it is in this group

    • The name "tech_list" says "list": a word for reading.
    Description, as the server wrote it
    List technologies (tech-stack tags) that projects and teams can be labelled with, e.g. "React", "PostgreSQL".

    Annotations the server declares

    • title: List technologies
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • whoamiWho is signed in, what roles they hold, and where.No findings

    Why it is in this group

    • The name "whoami" says "whoami": a word for reading.
    Description, as the server wrote it
    Who is signed in, what roles they hold, and where. Call this first in any new conversation. It returns the account, the OAuth permissions this connection was granted, and — crucially — the list of events, teams and companies the user belongs to *with the role they hold in each one* (organizer, judge, participant, team lead, free agent, builder, speaker, company admin, platform admin). Use it to decide which tools apply before calling anything else, and to resolve "my event" / "our team" into a concrete slug or id.

    Annotations the server declares

    • title: Who am I
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http clusterhack https://clusterhack.dev/mcp/

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__clusterhack__list_api_endpoints",
      "mcp__clusterhack__list_capabilities",
      "mcp__clusterhack__search",
      "mcp__clusterhack__whoami",
      "mcp__clusterhack__event_get",
      "mcp__clusterhack__event_list",
      "mcp__clusterhack__event_branding",
      "mcp__clusterhack__event_free_agents",
      "mcp__clusterhack__event_my_membership",
      "mcp__clusterhack__event_my_registration_answers",
      "mcp__clusterhack__event_registration_form",
      "mcp__clusterhack__team_get",
      "mcp__clusterhack__team_list",
      "mcp__clusterhack__team_locations",
      "mcp__clusterhack__team_members",
      "mcp__clusterhack__team_roles",
      "mcp__clusterhack__team_seeking_members",
      "mcp__clusterhack__submission_get",
      "mcp__clusterhack__submission_list",
      "mcp__clusterhack__submission_list_media",
      "mcp__clusterhack__submission_page",
      "mcp__clusterhack__showcase_browse",
      "mcp__clusterhack__company_list",
      "mcp__clusterhack__article_get",
      "mcp__clusterhack__article_languages",
      "mcp__clusterhack__article_list",
      "mcp__clusterhack__article_titles",
      "mcp__clusterhack__tag_list",
      "mcp__clusterhack__tech_list",
      "mcp__clusterhack__account_how_to_sign_in"
    ],
    "ask": [
      "mcp__clusterhack__event_roles",
      "mcp__clusterhack__server_info",
      "mcp__clusterhack__event_background_images",
      "mcp__clusterhack__event_cities",
      "mcp__clusterhack__event_faq",
      "mcp__clusterhack__event_info_blocks",
      "mcp__clusterhack__event_nominations",
      "mcp__clusterhack__event_presets",
      "mcp__clusterhack__event_schedule",
      "mcp__clusterhack__event_share_links",
      "mcp__clusterhack__event_team_stages",
      "mcp__clusterhack__event_types",
      "mcp__clusterhack__invite_preview",
      "mcp__clusterhack__team_matchmaking_teams",
      "mcp__clusterhack__team_open_roles",
      "mcp__clusterhack__team_posts",
      "mcp__clusterhack__team_readiness",
      "mcp__clusterhack__event_leaderboard",
      "mcp__clusterhack__company_about_us",
      "mcp__clusterhack__company_employees",
      "mcp__clusterhack__company_employment_requests",
      "mcp__clusterhack__company_ex_employees",
      "mcp__clusterhack__company_get",
      "mcp__clusterhack__company_roster",
      "mcp__clusterhack__company_vacancies",
      "mcp__clusterhack__event_sponsor_text",
      "mcp__clusterhack__event_sponsor_tiers",
      "mcp__clusterhack__event_sponsors",
      "mcp__clusterhack__legal_info",
      "mcp__clusterhack__account_ai_access"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as clusterhack. Review it before you use it.