Moltbound Sandbox

dev.moltbound/sandboxmoltbound.devstreamable-httpv1.0.0Scanned 45 minutes ago

Test-only US sandbox: AI agents get simulated quotes for 20 services; purchases need a passkey.

17 tools: 1 can delete or cancel things, 1 do something that can't be undone, 11 change things and 4 only read.

Reads private data · 0
Reads text others write · 0
Can send data out · 0
No findings

Anlyon alternative

13 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

17 tools

Deletes or cancels 1Removes, cancels or revokes something.Claude Code: deny

moltbound_revoke_grantRevoke an active data grant on behalf of the user.No findings
Why it is in this group
- The name "moltbound_revoke_grant" says "revoke": a word for removing or ending something.
Description, as the server wrote it
Revoke an active data grant on behalf of the user. SANDBOX: use fictitious data only. Do not enter real personal details.

Can't be undone 1Sends, pays, publishes or merges: once done, it cannot be taken back.Claude Code: ask

moltbound_complete_purchaseAfter the human approved on Moltbound's website (or via moltbound_human_sim_approve): complete the fictional purchase within 15 minutes.No findings
Why it is in this group
- The name "moltbound_complete_purchase" says "purchase": a word that usually means money moves, which cannot be taken back.
Description, as the server wrote it
After the human approved on Moltbound's website (or via moltbound_human_sim_approve): complete the fictional purchase within 15 minutes. Bound to that exact quote and agent: repeating the call for the same approved quote is idempotent (returns the existing purchase_id), while reusing an approval for any other quote or agent returns consent_used and an expired approval returns consent_expired. SANDBOX: use fictitious data only. Do not enter real personal details.

Changes things 11Creates or changes something that can be changed back.Claude Code: ask

moltbound_approval_requestAfter the human linked you and you quoted: ask them to approve one quote.No findings
Why it is in this group
- The name "moltbound_approval_request" says "request": a word for a change.
Description, as the server wrote it
After the human linked you and you quoted: ask them to approve one quote. SANDBOX: use fictitious data only. Do not enter real personal details.
moltbound_consent_linkGive the human a code to link you so they can approve a (fictional) purchase with their passkey.No findings
Why it is in this group
- The name "moltbound_consent_link" says "link": a word for a change.
Description, as the server wrote it
Give the human a code to link you so they can approve a (fictional) purchase with their passkey. SANDBOX: use fictitious data only. Do not enter real personal details.
moltbound_get_quotesRequest simulated quotes (cheapest first) with the human's answers.No findings
Why it is in this group
- The name "moltbound_get_quotes" says "get": a word for reading.
- The description's first verb is "request": a word for a change.
Description, as the server wrote it
Request simulated quotes (cheapest first) with the human's answers. Pass parameters directly for any of the 20 services. SANDBOX: use fictitious data only. Do not enter real personal details.
moltbound_human_sim_approveApprove a sandbox consent_request_id in email-only simulated human mode using human_sim_token (or email + code).No findings
Why it is in this group
- The name "moltbound_human_sim_approve" says "approve": a word for a change.
- The input takes a statement or command to run (input.code), which can change anything it can reach.
Description, as the server wrote it
Approve a sandbox consent_request_id in email-only simulated human mode using human_sim_token (or email + code). Never billable. SANDBOX: use fictitious data only. Do not enter real personal details.
moltbound_human_sim_startMoltbook / Email-Only Simulated Human mode (sandbox test-only): send a 6-digit verification code to an email address so an autonomous agent can simulate the human side without a br…No findings
Why it is in this group
- The name "moltbound_human_sim_start" says "start": a word for a change.
Description, as the server wrote it
Moltbook / Email-Only Simulated Human mode (sandbox test-only): send a 6-digit verification code to an email address so an autonomous agent can simulate the human side without a browser passkey. SANDBOX: use fictitious data only. Do not enter real personal details.
moltbound_human_sim_verifyVerify the 6-digit email code from moltbound_human_sim_start.No findings
Why it is in this group
- The input takes a statement or command to run (input.code), which can change anything it can reach.
Description, as the server wrote it
Verify the 6-digit email code from moltbound_human_sim_start. Returns a session_token, mandate_id (defaulting to '*' all 20 services), and human_sim_token for sandbox purchase approval. SANDBOX: use fictitious data only. Do not enter real personal details.
moltbound_poll_grantPoll for human approval of a data grant using link_id and poll_secret.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Poll for human approval of a data grant using link_id and poll_secret. SANDBOX: use fictitious data only. Do not enter real personal details.
moltbound_quick_quoteOne-shot quotes across any service.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
One-shot quotes across any service. Accepts a natural language prompt, partial fields, or a full risk profile. When auto_default is true, missing fields are populated with safe sandbox defaults (car insurance driver fields numberOfDrivers and driverAges are filled only when both are missing; rejected if only one is missing). Pass grant_token for Protected Mode. SANDBOX: use fictitious data only. Do not enter real personal details.
moltbound_request_grantRequest a scoped data grant for an agent.No findings
Why it is in this group
- The name "moltbound_request_grant" says "request": a word for a change.
Description, as the server wrote it
Request a scoped data grant for an agent. Returns an 8-character user_code and verification URL for human passkey approval. SANDBOX: use fictitious data only. Do not enter real personal details.
moltbound_requirementsFields to ask the human for a service.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Fields to ask the human for a service. SANDBOX: use fictitious data only. Do not enter real personal details. Pass service_id to inspect any of the 20 services.
moltbound_start_sessionStart an anonymous TEST-ONLY quote session.No findings
Why it is in this group
- The name "moltbound_start_session" says "start": a word for a change.
Description, as the server wrote it
Start an anonymous TEST-ONLY quote session. TEST ONLY. Moltbound is a sandbox. Every partner is fictional and every quote is simulated: these are not real quotes, not financial advice, and nothing will be bought for real. Moltbound is not an insurer or broker. United States only. SANDBOX: use fictitious data only. Do not enter real personal details. Relay the notice to your human, then continue. SANDBOX: use fictitious data only. Do not enter real personal details.

Only reads 4Looks things up and changes nothing.Show 4 read-only tools

moltbound_grant_statusInspect the status and approved fields of an active data grant.No findings
Why it is in this group
- The name "moltbound_grant_status" says "status": a word for reading.
Description, as the server wrote it
Inspect the status and approved fields of an active data grant. SANDBOX: use fictitious data only. Do not enter real personal details.
moltbound_list_servicesList all 20 services across 9 categories with partner counts, descriptions, and required fields.No findings
Why it is in this group
- The name "moltbound_list_services" says "list": a word for reading.
Description, as the server wrote it
List all 20 services across 9 categories with partner counts, descriptions, and required fields. Answers 'What sort of quotes can you provide?'. SANDBOX: use fictitious data only. Do not enter real personal details.
moltbound_purchase_statusPoll the status of a fictional purchase by purchase_id until 'bound'.No findings
Why it is in this group
- The name "moltbound_purchase_status" says "status": a word for reading.
Description, as the server wrote it
Poll the status of a fictional purchase by purchase_id until 'bound'. Returns partner's policy_number. SANDBOX: use fictitious data only. Do not enter real personal details.
moltbound_quote_statusPoll a quote job until complete, then show the human the quotes.No findings
Why it is in this group
- The name "moltbound_quote_status" says "status": a word for reading.
Description, as the server wrote it
Poll a quote job until complete, then show the human the quotes. Optional sort/filter: sort (price_asc|price_desc|deductible_asc|deductible_desc|cover_desc|partner), partner, cover (basic|standard|comprehensive, comma list), max_deductible, max_price, limit. The human picks which quote to continue with. SANDBOX: use fictitious data only. Do not enter real personal details.

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data or untrusted-input or outbound.

Reads private data0: Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write0: Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out0: Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

No check matched anything in these tool definitions. That is not a safety guarantee.

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http sandbox https://moltbound.dev/kapi/mcp

claude mcp add --transport http sandbox https://moltbound.dev/kapi/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__sandbox__moltbound_list_services",
      "mcp__sandbox__moltbound_quote_status",
      "mcp__sandbox__moltbound_purchase_status",
      "mcp__sandbox__moltbound_grant_status"
    ],
    "ask": [
      "mcp__sandbox__moltbound_start_session",
      "mcp__sandbox__moltbound_requirements",
      "mcp__sandbox__moltbound_get_quotes",
      "mcp__sandbox__moltbound_consent_link",
      "mcp__sandbox__moltbound_complete_purchase",
      "mcp__sandbox__moltbound_approval_request",
      "mcp__sandbox__moltbound_quick_quote",
      "mcp__sandbox__moltbound_request_grant",
      "mcp__sandbox__moltbound_poll_grant",
      "mcp__sandbox__moltbound_human_sim_start",
      "mcp__sandbox__moltbound_human_sim_verify",
      "mcp__sandbox__moltbound_human_sim_approve"
    ],
    "deny": [
      "mcp__sandbox__moltbound_revoke_grant"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as sandbox. Review it before you use it.

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/dev.moltbound/sandbox/verify?hash=a1a1a6f59838c2d088985857bd6db6e8e75b3f13aeeb93ef67c28d01f8056af2" | jq -e '.changed == false'

Pinned hash a1a1a6f59838, from Oct 29, 2026, 05:18 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/dev.moltbound/sandbox/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

[![anlyon.dev](https://anlyon.dev/badge/dev.moltbound/sandbox.svg)](https://anlyon.dev/servers/dev.moltbound/sandbox)

Source: MCP Registry. Synced Oct 29, 2026, 05:17 UTC.