dev.mcphost/mcphost

by mcphost.dev · remote · no sign-in to list tools · v0.112.38 · published by dev.mcphost

Hosted MCP runtime where your agent publishes its own tools by tool call and keeps working.

Final · 2Changes · 91 high finding

Compare Registry entry

18 tools: 2 do something that can't be undone, 9 change things and 7 only read.

Scanned Oct 21, 2026

Deletes or cancels0Claude Code: deny
Can't be undone2Claude Code: ask: see these tools
Changes things9Claude Code: ask: see these tools
Only reads7Claude Code: allow: see these tools

3 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http mcphost https://mcphost.dev/mcp

Findings

Matches of fixed checks, with the text they matched.

1 high2 info

Highsignup
The description contains "<secret>", a tag of the kind used to mark instructions for the model.
Matched text
description: "...enant implicitly and returns its own /u/<secret>/mcp URL in the response's onboarding fi..."
What this check looks for
Infosignup
The description mentions "credential".
Matched text
description: "...edeem call, if it leaks, carries a dead credential. The raw-key path (handoff omitted) sta..."
What this check looks for
Infohost.whoami
The description mentions "credential".
Matched text
description: "...y_age_s and key_rotated_at for auditing credential hygiene."
What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

18 tools

Can't be undone 2Sends, pays, publishes or merges: once done, it cannot be taken back.Claude Code: ask

host.feedback.sendTell the host's humans what you needed: kind, up to 2048 bytes of text, optional context.No findings
Why it is in this group
- The name "host.feedback.send" says "send": a word for sending, and what is sent cannot be taken back.
Description, as the server wrote it
Tell the host's humans what you needed: kind, up to 2048 bytes of text, optional context. Works before signup. Returns feedback_id.
host.tool_publishPublish a tool of a registered kind (e.g.No findings
Why it is in this group
- The name "host.tool_publish" says "publish": a word for a change that another call does not undo.
Description, as the server wrote it
Publish a tool of a registered kind (e.g. python, http or echo; the kind argument's enum lists them all) under this tenant's namespace. Call host.quickstart(kind) first for a filled-in example spec and the full publish-to-call sequence. Python's sandbox API: import mcphost (mcphost.table, mcphost.state, mcphost.docs). Name must match ^[a-z][a-z0-9_]{1,40}$; a rejection names the failing field and a corrected example. Try host.tool_test before a real call.

Changes things 9Creates or changes something that can be changed back.Claude Code: ask

billing.plansThe plan catalog (price and quotas per plan) and whether Stripe billing is configured on this host.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
The plan catalog (price and quotas per plan) and whether Stripe billing is configured on this host. Anonymous callers get the same answer as tenants.
host.errorsList every error code this host can return, each with its class (agent_fault | host_refusal | upstream_fault | plan_limit | host_fault), family, remedy, docs anchor, retryable flag…No findings
Why it is in this group
- The description's first verb is "list": a word for reading.
- The input takes a statement or command to run (input.code), which can change anything it can reach.
Description, as the server wrote it
List every error code this host can return, each with its class (agent_fault | host_refusal | upstream_fault | plan_limit | host_fault), family, remedy, docs anchor, retryable flag and help_url -- the same object GET /errors.json serves. Pass code to get one row; a misspelt code answers tool_not_found with did_you_mean. Read-only, anonymous, no tenant data.
host.redeemExchange a signup(handoff: true) handoff_token for the tenant key it was issued for.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Exchange a signup(handoff: true) handoff_token for the tenant key it was issued for. Single-use: a second redemption fails with handoff_token_redeemed; past its expiry it fails with handoff_token_expired. Unauthenticated -- the token itself is the proof.
host.resumeResume where you left off in one call (at most 4096 bytes): your tools with each one's last call status, unfinished runs, your newest notes, what changed on the host since your las…No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Resume where you left off in one call (at most 4096 bytes): your tools with each one's last call status, unfinished runs, your newest notes, what changed on the host since your last call, and one suggested next_call. truncated names any section that was cut -- call that section's own tool (host.tool.list, host.runs.list, host.note.list, host.changelog) for the rest. Read-only. An unauthenticated caller gets the onboarding block and creates no tenant.
host.state.setWrite one key in this tenant's key-value state namespace; value may be any JSON value.No findings
Why it is in this group
- The name "host.state.set" says "set": a word for a change.
Description, as the server wrote it
Write one key in this tenant's key-value state namespace; value may be any JSON value. Overrun of the plan's state_bytes_max quota fails with state_quota_exceeded and writes nothing.
host.tool_callInvoke a tool this tenant has already published, by its local name -- the same real, metered call as calling it directly by its namespaced name (<namespace>.<name>), for a session …No findings
Why it is in this group
- The name "host.tool_call" says "call": a word for a change.
Description, as the server wrote it
Invoke a tool this tenant has already published, by its local name -- the same real, metered call as calling it directly by its namespaced name (<namespace>.<name>), for a session that has no way to see its own namespaced tool name yet. Unlike host.tool_test, this counts toward host.usage and appears in host.tool_logs. Pass async: true for a tool that needs more than the call deadline: returns {run_id, status: "queued"} immediately instead of running inline -- see host.runs.get/wait. Pass version to pin the call to one of host.tool_history's versions instead of whichever is current.
host.tool_shareShare one of this tenant's published tools with everyone (visibility: "public") or with a named group this tenant owns (visibility: "group", group: <name>).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Share one of this tenant's published tools with everyone (visibility: "public") or with a named group this tenant owns (visibility: "group", group: <name>). The tool keeps running in this tenant's own sandbox with this tenant's own secrets; a caller reaches it as <this tenant's namespace>.<name>.
host.tool_testDry-run a published tool by name: verdict (pass/will_fail/unverifiable), writes rolled back (dry_run); see host.quickstart.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Dry-run a published tool by name: verdict (pass/will_fail/unverifiable), writes rolled back (dry_run); see host.quickstart.
signupExplicit signup, for a client that cannot keep a session across calls: create a tenant and receive a bearer key and namespace.2 findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Findings
- High
  The description contains "<secret>", a tag of the kind used to mark instructions for the model.
  Matched text
  description: "...enant implicitly and returns its own /u/<secret>/mcp URL in the response's onboarding fi..."
  What this check looks for
- Info
  The description mentions "credential".
  Matched text
  description: "...edeem call, if it leaks, carries a dead credential. The raw-key path (handoff omitted) sta..."
  What this check looks for
Description, as the server wrote it
Explicit signup, for a client that cannot keep a session across calls: create a tenant and receive a bearer key and namespace. Unauthenticated. Most clients never need this -- any other host.*/billing.* call from a fresh connection creates a tenant implicitly and returns its own /u/<secret>/mcp URL in the response's onboarding field. Recommended here: pass handoff: true to receive a short-lived, single-use handoff_token instead of the raw key -- redeem it once with host.redeem to get the key, so a transcript of this call and the redeem call, if it leaks, carries a dead credential. The raw-key path (handoff omitted) stays fully supported.

Only reads 7Looks things up and changes nothing.Claude Code: allow

host.feedback.listList your own feedback (newest first, status received).No findings
Why it is in this group
- The name "host.feedback.list" says "list": a word for reading.
Description, as the server wrote it
List your own feedback (newest first, status received). Anonymous callers get [].
host.help.getReturn the documentation section an anchor points at: its text (at most 4 KB) and its first fenced example.No findings
Why it is in this group
- The name "host.help.get" says "get": a word for reading.
Description, as the server wrote it
Return the documentation section an anchor points at: its text (at most 4 KB) and its first fenced example. Pass an anchor exactly as an error, hint or help entry printed it, e.g. a rate_limited error's `anchor`. Read-only, anonymous, no tenant data. An unknown anchor is anchor_not_found with the nearest anchors in did_you_mean.
host.help.searchSearch this host's own documentation and tool descriptions.No findings
Why it is in this group
- The name "host.help.search" says "search": a word for reading.
Description, as the server wrote it
Search this host's own documentation and tool descriptions. Returns up to k hits (default 3, response under 2 KB), each with a snippet, the nearest runnable example and an anchor. Read-only, anonymous, no tenant data -- call it with the error text or import line you are stuck on before reading any docs file.
host.quickstartReturn the shortest ordered sequence of calls to a working tool of `kind`, with your namespace and a filled-in example already substituted in, plus the current limits and a try_bef…No findings
Why it is in this group
- The description's first verb is "return": a word for reading.
Description, as the server wrote it
Return the shortest ordered sequence of calls to a working tool of `kind`, with your namespace and a filled-in example already substituted in, plus the current limits and a try_before_call table naming the one dry-run tool for each case. Read-only -- this call alone never creates a tenant. Call this before host.tool_publish if you're not sure what a spec should look like. Unauthenticated callers get a worked example with no tenant data; any other host.*/billing.* call creates a tenant on first use, no signup required.
host.state.getRead one key from this tenant's key-value state namespace.No findings
Why it is in this group
- The name "host.state.get" says "get": a word for reading.
Description, as the server wrote it
Read one key from this tenant's key-value state namespace. Returns found: false (not an error) if the key was never set.
host.state.listList keys (with their current values) in this tenant's key-value state namespace, optionally filtered by prefix.No findings
Why it is in this group
- The name "host.state.list" says "list": a word for reading.
Description, as the server wrote it
List keys (with their current values) in this tenant's key-value state namespace, optionally filtered by prefix.
host.whoamiReturn the calling tenant's identity, including key_age_s and key_rotated_at for auditing credential hygiene.1 finding
Why it is in this group
- The name "host.whoami" says "whoami": a word for reading.
Findings
- Info
  The description mentions "credential".
  Matched text
  description: "...y_age_s and key_rotated_at for auditing credential hygiene."
  What this check looks for
Description, as the server wrote it
Return the calling tenant's identity, including key_age_s and key_rotated_at for auditing credential hygiene.

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 0.112.38. Values in angle brackets are yours to fill in.

claude mcp add --transport http mcphost https://mcphost.dev/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__mcphost__host_quickstart",
      "mcp__mcphost__host_help_search",
      "mcp__mcphost__host_help_get",
      "mcp__mcphost__host_whoami",
      "mcp__mcphost__host_state_get",
      "mcp__mcphost__host_state_list",
      "mcp__mcphost__host_feedback_list"
    ],
    "ask": [
      "mcp__mcphost__signup",
      "mcp__mcphost__host_errors",
      "mcp__mcphost__host_redeem",
      "mcp__mcphost__billing_plans",
      "mcp__mcphost__host_tool_publish",
      "mcp__mcphost__host_tool_call",
      "mcp__mcphost__host_tool_test",
      "mcp__mcphost__host_state_set",
      "mcp__mcphost__host_tool_share",
      "mcp__mcphost__host_feedback_send",
      "mcp__mcphost__host_resume"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as mcphost. Review it before you use it.

Keep track

Get told when this server's tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/dev.mcphost/mcphost/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Anlyon alternative

11 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Compare with other servers for the same product.

Source: MCP Registry · repository. Synced Oct 21, 2026, 18:11 UTC.

For agents: Markdown · JSON · report this listing