Skip to content
anlyon.devby Anlyon

MoneyTools Settle MCP server

dev.moneytools/settlemoneytools.devstreamable-httpv1.1.12Scanned

Call before signing an x402 payment: advisory budget check, 0.005 USDC/call

17 tools: 12 change things and 5 only read.

Tools: 0 delete, 0 irreversible, 12 write, 5 read.
  • Reads private data · 0
  • Reads text others write · 4
  • Can send data out · 2
  • 2 findings

Tools listed without sign-in. Remote posture

With Anlyon

12 tools here change things. Govern them.

  • Anlyon lists the tools and adopts none.
  • Each tool you adopt gets approvals and receipts.
  • Your agent never holds the key.
Govern this server →

A tool your agent calls directly is not routed through Anlyon and is not governed by it. anlyon.dev only lists and labels, and these labels are the same either way.

Compare with similar serversMarkdownJSONReport this listing

What the MoneyTools Settle MCP server can do

The MoneyTools Settle MCP server is published by moneytools.dev, a domain the MCP Registry verified. It has 17 tools. It can create or change data (12 tools: settle_report, settle_verify, settle_watch, settle_gate_claim and 8 more), but cannot delete data. 5 tools only read.

4 tools bring in text other people can write (settle_report, settle_verify, settle_watch and 1 more); 2 tools can send data out of your system (settle_watch and receipt_create).

The fixed checks matched 2 findings (annotation-conflict). Each one comes with the text it matched.

Its remote endpoint lists its tools without sign-in, and its tools changed 2 times since anlyon.dev first saw them.

Last scanned Nov 12, 2026, version 1.1.12.

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

17 tools

Changes things 12Claude Code: ask
  • receipt_createCreate a delivery receipt (status paid) for an order/request ref; idempotent per ref.Can send data outNo findings

    Why it is in this group

    • The name "receipt_create" says "create": a word for a change.

    What it can reach

    • outboundThe input takes a URL (input.webhook): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Create a delivery receipt (status paid) for an order/request ref; idempotent per ref. Needs a key mts_ (X-API-Key header or apiKey argument). No key? call settle_trial_key (free, 50 calls/7 days). Full plan 1 USDC/30d incl. 1,000 calls via x402.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • receipt_updateMove a receipt paid -> delivered | failed | refunded (refundTx optional).No findings

    Why it is in this group

    • The name "receipt_update" says "update": a word for a change.
    Description, as the server wrote it
    Move a receipt paid -> delivered | failed | refunded (refundTx optional). Needs a key mts_ (X-API-Key header or apiKey argument). No key? call settle_trial_key (free, 50 calls/7 days). Full plan 1 USDC/30d incl. 1,000 calls via x402.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • settle_gate_claimIdempotency gate: claim an EIP-3009 authorization (payer+nonce) before settling.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Idempotency gate: claim an EIP-3009 authorization (payer+nonce) before settling. claimed:false means duplicate — do not settle again. Needs a key mts_ (X-API-Key header or apiKey argument). No key? call settle_trial_key (free, 50 calls/7 days). Full plan 1 USDC/30d incl. 1,000 calls via x402.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • settle_gate_completeMark a claimed authorization settled or failed (failed allows a retry).No findings

    Why it is in this group

    • The description's first verb is "mark": a word for a change.
    Description, as the server wrote it
    Mark a claimed authorization settled or failed (failed allows a retry). Needs a key mts_ (X-API-Key header or apiKey argument). No key? call settle_trial_key (free, 50 calls/7 days). Full plan 1 USDC/30d incl. 1,000 calls via x402.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • settle_reportPaid, read-only, no arguments: x402 settlement health report for Base USDC — Base RPC head/latency, PayAI facilitator reachability, settlement-watch outcomes (24h); with a key also…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Paid, read-only, no arguments: x402 settlement health report for Base USDC — Base RPC head/latency, PayAI facilitator reachability, settlement-watch outcomes (24h); with a key also your receipts/open watches/caps/spend. $0.005 USDC per call via x402 over MCP (unpaid call returns PaymentRequired; retry with params._meta["x402/payment"]), or 1 call of your Settle key (apiKey).

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • settle_subscribe_infoPricing: pay per call via x402 with no key (spend_check / spend_cap_get / spend_cap_set / spend_record / settle_verify / spend_log 0.005 USDC).1 finding

    Why it is in this group

    • The name "settle_subscribe_info" says "subscribe": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "settle_subscribe_info" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "settle_subscribe_info" says "subscribe": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Pricing: pay per call via x402 with no key (spend_check / spend_cap_get / spend_cap_set / spend_record / settle_verify / spend_log 0.005 USDC). Optional upgrade: 1 USDC / 30 days incl. 1,000 calls, or a free trial key. Read-only.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • settle_trial_keyGet a free MoneyTools Settle trial key right now (50 calls, 7 days, 1 per client per day; bucketed by IPv6 /64 or CF-Worker zone) with ready-to-run first calls.1 finding

    Why it is in this group

    • The description's first verb is "get": a word for reading.
    • The server marks it as not read-only (readOnlyHint: false).

    Findings

    • Warn

      The server marks "settle_trial_key" as not read-only (readOnlyHint: false), and its words say it reads.

      Matched text

      annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":false}; The description's first verb is "get": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Get a free MoneyTools Settle trial key right now (50 calls, 7 days, 1 per client per day; bucketed by IPv6 /64 or CF-Worker zone) with ready-to-run first calls. Pass the returned apiKey as the apiKey argument of any tool.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • settle_verify0.005 USDC per call via x402, no key (unpaid call returns PaymentRequired; retry with params._meta["x402/payment"]).Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    0.005 USDC per call via x402, no key (unpaid call returns PaymentRequired; retry with params._meta["x402/payment"]). Verify an x402 settlement on Base USDC right now (by tx hash, or payer+nonce / paymentPayload via USDC.authorizationState). Returns settled|failed|pending|not_settled|expired|unknown. Needs a key mts_ (X-API-Key header or apiKey argument). No key? call settle_trial_key (free, 50 calls/7 days). Full plan 1 USDC/30d incl. 1,000 calls via x402.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • settle_watchWatch a timed-out/unknown x402 settlement: re-checked on-chain for up to 24h; POSTs your webhook when it becomes settled/failed/expired.Reads text others writeCan send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.webhook): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Watch a timed-out/unknown x402 settlement: re-checked on-chain for up to 24h; POSTs your webhook when it becomes settled/failed/expired. Needs a key mts_ (X-API-Key header or apiKey argument). No key? call settle_trial_key (free, 50 calls/7 days). Full plan 1 USDC/30d incl. 1,000 calls via x402.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • spend_cap_set0.005 USDC per call via x402, no key (unpaid call returns PaymentRequired; retry with params._meta["x402/payment"]).No findings

    Why it is in this group

    • The name "spend_cap_set" says "set": a word for a change.
    Description, as the server wrote it
    0.005 USDC per call via x402, no key (unpaid call returns PaymentRequired; retry with params._meta["x402/payment"]). Advisory spend caps that complement your wallet's enforced hard limits (Coinbase Agentic Wallet / CDP spendControls); cannot block payments. Set per-call / per-day (rolling 24h) / per-session USD limits and optional allow-lists (payTo, hosts, networks) for a payer wallet address (replaces the previous policy for that payer). Optional ownerLock secret so the agent cannot loosen the caps later. Advisory and non-custodial. Needs a key mts_ (X-API-Key header or apiKey argument). No key? call settle_trial_key (free, 50 calls/7 days). Full plan 1 USDC/30d incl. 1,000 calls via x402.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • spend_check0.005 USDC per call via x402, no key (unpaid call returns PaymentRequired; retry with params._meta["x402/payment"]).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    0.005 USDC per call via x402, no key (unpaid call returns PaymentRequired; retry with params._meta["x402/payment"]). Advisory pre-sign check (your wallet's own hard limits still apply; we cannot block a payment): 'would this payment exceed my cap?'. Pass the 402 PAYMENT-REQUIRED (header or body) or amountUsd, plus payer and optional sessionId/host. Returns allow|deny with reasons and remaining budget; reserve:true also logs it as pending. Needs a key mts_ (X-API-Key header or apiKey argument). No key? call settle_trial_key (free, 50 calls/7 days). Full plan 1 USDC/30d incl. 1,000 calls via x402.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • spend_record0.005 USDC per call via x402, no key (unpaid call returns PaymentRequired; retry with params._meta["x402/payment"]).Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    0.005 USDC per call via x402, no key (unpaid call returns PaymentRequired; retry with params._meta["x402/payment"]). Record an x402 payment the agent made (or update a reserved one by spendId/ref): status settled|failed|pending|refunded, tx; verify:true checks a Base tx on-chain (read-only). Builds the spend log / receipts. Needs a key mts_ (X-API-Key header or apiKey argument). No key? call settle_trial_key (free, 50 calls/7 days). Full plan 1 USDC/30d incl. 1,000 calls via x402.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
Only reads 5Show 5 read-only tools
  • receipt_getRead a delivery receipt and its history.No findings

    Why it is in this group

    • The name "receipt_get" says "get": a word for reading.
    Description, as the server wrote it
    Read a delivery receipt and its history. Needs a key mts_ (X-API-Key header or apiKey argument). No key? call settle_trial_key (free, 50 calls/7 days). Full plan 1 USDC/30d incl. 1,000 calls via x402.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • settle_key_statusShow remaining calls/expiry of your MoneyTools Settle key.No findings

    Why it is in this group

    • The name "settle_key_status" says "status": a word for reading.
    Description, as the server wrote it
    Show remaining calls/expiry of your MoneyTools Settle key. Needs a key mts_ (X-API-Key header or apiKey argument). No key? call settle_trial_key (free, 50 calls/7 days). Full plan 1 USDC/30d incl. 1,000 calls via x402.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • settle_watch_statusStatus of a settlement watch.No findings

    Why it is in this group

    • The name "settle_watch_status" says "status": a word for reading.
    Description, as the server wrote it
    Status of a settlement watch. Needs a key mts_ (X-API-Key header or apiKey argument). No key? call settle_trial_key (free, 50 calls/7 days). Full plan 1 USDC/30d incl. 1,000 calls via x402.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • spend_cap_get0.005 USDC per call via x402, no key (unpaid call returns PaymentRequired; retry with params._meta["x402/payment"]).No findings

    Why it is in this group

    • The name "spend_cap_get" says "get": a word for reading.
    Description, as the server wrote it
    0.005 USDC per call via x402, no key (unpaid call returns PaymentRequired; retry with params._meta["x402/payment"]). Advisory (complements your wallet's enforced hard limits): read the spend caps of a payer address plus what it spent in the last 24h (and in a session). Needs a key mts_ (X-API-Key header or apiKey argument). No key? call settle_trial_key (free, 50 calls/7 days). Full plan 1 USDC/30d incl. 1,000 calls via x402.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • spend_log0.005 USDC per call via x402, no key (unpaid call returns PaymentRequired; retry with params._meta["x402/payment"]).No findings

    Why it is in this group

    • The name "spend_log" says "log": a word for reading.
    Description, as the server wrote it
    0.005 USDC per call via x402, no key (unpaid call returns PaymentRequired; retry with params._meta["x402/payment"]). Spend log / receipts for a payer address: totals (settled, pending, refunded), top sellers and the latest receipts over the last N days (1-31; read from Settle's own receipt records, not from Base RPC history). Needs a key mts_ (X-API-Key header or apiKey argument). No key? call settle_trial_key (free, 50 calls/7 days). Full plan 1 USDC/30d incl. 1,000 calls via x402.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data.

Reads private data0
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write4
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out2
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Tools listed without sign-in

Looked at Nov 10, 2026, 08:19 UTC, unchanged since Nov 10, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable
yes
HTTP status of an anonymous initialize
200
tools/list served without credentials
yes
Tools that change things, listed without credentials
12
Protocol version
2025-06-18
WWW-Authenticate on 401
not observed
resource_metadata in WWW-Authenticate
not observed
RFC 9728 protected resource metadata
not observed
Authorization servers
not observed
Legacy HTTP+SSE transport
no
Dynamic client registration
not observed
Client ID metadata documents
not observed
  • WarnThe whole server

    The endpoint served tools/list without credentials, and the list has 12 tools that change things (12 write). Whether a call also works without credentials was not tested: tools are never called.

    Matched text

    https://settle.moneytools.dev/mcp: tools/list returned 17 tools to an anonymous client, including settle_report (write), settle_verify (write), settle_watch (write), settle_gate_claim (write), settle_gate_complete (write) and 7 more

    What this check looks for

Findings

Matches of fixed checks, with the text they matched.

2 warn
  • Warnsettle_trial_key

    The server marks "settle_trial_key" as not read-only (readOnlyHint: false), and its words say it reads.

    Matched text

    annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":false}; The description's first verb is "get": a word for reading.

    What this check looks for
  • Warnsettle_subscribe_info

    The server marks "settle_subscribe_info" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "settle_subscribe_info" says "subscribe": a word for a change.

    What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

  1. Tools8 changed.~8 changedView diff
  2. Tools7 changed.~7 changedView diff
All changes to this server

Install

Pinned to version 1.1.12. Values in angle brackets are yours to fill in.

claude mcp add --transport http settle https://settle.moneytools.dev/mcp
claude mcp add --transport http settle https://settle.moneytools.dev/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__settle__settle_watch_status",
      "mcp__settle__receipt_get",
      "mcp__settle__spend_cap_get",
      "mcp__settle__spend_log",
      "mcp__settle__settle_key_status"
    ],
    "ask": [
      "mcp__settle__settle_report",
      "mcp__settle__settle_verify",
      "mcp__settle__settle_watch",
      "mcp__settle__settle_gate_claim",
      "mcp__settle__settle_gate_complete",
      "mcp__settle__receipt_create",
      "mcp__settle__receipt_update",
      "mcp__settle__spend_cap_set",
      "mcp__settle__spend_check",
      "mcp__settle__spend_record",
      "mcp__settle__settle_trial_key",
      "mcp__settle__settle_subscribe_info"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as settle. Review it before you use it.

Capability tags behind 5 rules
  • mcp__settle__settle_report untrusted-input
  • mcp__settle__settle_verify untrusted-input
  • mcp__settle__settle_watch untrusted-input, outbound
  • mcp__settle__receipt_create outbound
  • mcp__settle__spend_record untrusted-input

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/dev.moneytools/settle/verify?hash=8ed2bd1b0d84a596b43a8b85d5f8bf7f36a1af6ac4fa86ff31f0714ea85cce48" | jq -e '.changed == false'

Pinned hash 8ed2bd1b0d84, from Nov 12, 2026, 13:18 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/dev.moneytools/settle/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for dev.moneytools/settle
[![anlyon.dev](https://anlyon.dev/badge/dev.moneytools/settle.svg)](https://anlyon.dev/servers/dev.moneytools/settle)

Source: MCP Registry. Synced Nov 12, 2026, 13:17 UTC.

MoneyTools Settle MCP server: questions and answers

Answered from the scan above, not from the publisher's description.

Is the MoneyTools Settle MCP server safe?

No scan can promise that. What its definitions show: 17 tools, 12 of which can change, send or delete something, and 2 findings from fixed checks. Allow the reads, ask before each change, and deny the deletes; the permissions block on this page does that.

Can the MoneyTools Settle MCP server delete data?

No tool is classed as destructive: going by their definitions, none of them deletes, cancels or revokes anything.

Can the MoneyTools Settle MCP server do things that cannot be undone?

No tool is classed as irreversible: none of them sends, pays, publishes or merges, going by their definitions.

What tools does the MoneyTools Settle MCP server have?

17 tools: 12 write, 5 read. settle_report, settle_verify, settle_watch, settle_gate_claim, settle_gate_complete, receipt_create, receipt_update, spend_cap_set and 9 more.

Does the MoneyTools Settle MCP server need sign-in or OAuth?

Its remote endpoint listed its tools to an anonymous client, without sign-in.

Does the MoneyTools Settle MCP server send data to outside services?

2 tools can carry data out (it sends, posts or publishes, or takes a recipient, channel or URL): settle_watch and receipt_create.

Has the MoneyTools Settle MCP server changed its tools?

Yes, 2 times since anlyon.dev started tracking it, most recently on Nov 12, 2026. Every change is on this page and in its Atom feed.