Aura

dev.rohnelt.aura/auraaura.rohnelt.devstreamable-httpv0.1.1Scanned 24 hours ago

Email address, webhook, durable memory and zero-token waiting for agents. Paid in USDC via x402.

16 tools: 1 can delete or cancel things, 2 do something that can't be undone, 6 change things and 7 only read.

Reads private data · 3
Reads text others write · 8
Can send data out · 2
1 finding

Tools listed without sign-in. Remote posture

Anlyon alternative

9 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

16 tools

Deletes or cancels 1Removes, cancels or revokes something.Claude Code: deny

memory_deleteDelete a stored key.No findings
Why it is in this group
- The name "memory_delete" says "delete": a word for removing or ending something.
Description, as the server wrote it
Delete a stored key. Free — keeping your own state tidy should never cost you. When to use: Call when a stored fact is stale or wrong. Price: Free.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false

Can't be undone 2Sends, pays, publishes or merges: once done, it cannot be taken back.Claude Code: ask

credit_depositPay USDC once and receive spendable Aura credit.No findings
Why it is in this group
- The description's first verb is "pay": a word that usually means money moves, which cannot be taken back.
Description, as the server wrote it
Pay USDC once and receive spendable Aura credit. Individual calls are far too cheap to settle on-chain one at a time, so you deposit once and Aura debits each call off-chain. When to use: Call when your balance is low, or when a paid call returns 402. A US$1 deposit covers hundreds of operations. Price: Free.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
signalSend a named JSON message to another Aura agent by handle.Reads text others writeCan send data outNo findings
Why it is in this group
- The description's first verb is "send": a word for sending, and what is sent cannot be taken back.
- The input addresses people (input.to): what it sends cannot be taken back.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe description's first verb is "send": it sends or publishes something to other people.
- outboundThe input takes a destination (input.to): what the tool writes goes there.
Description, as the server wrote it
Send a named JSON message to another Aura agent by handle. They can await on it. When to use: Call to hand work to, or coordinate with, another agent without shared infrastructure. Price: US$0.002000 per call.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: true

Changes things 6Creates or changes something that can be changed back.Claude Code: ask

awaitBlock on an open HTTP connection until a trigger fires — an email arrives, a webhook is hit, another agent signals you, or a deadline passes.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Block on an open HTTP connection until a trigger fires — an email arrives, a webhook is hit, another agent signals you, or a deadline passes. Returns the instant it happens. If nothing fires before the timeout, the call is refunded: you are only charged when something is actually delivered. When to use: Call INSTEAD of polling in a loop. A poll loop costs a full inference per iteration; waiting inside this single call costs you nothing beyond the flat fee. Use it for verification codes, callbacks and approvals that land within minutes. Price: US$0.004000 per call. This call blocks until it resolves; waiting inside it costs you no tokens.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: true
hook_createMint a public URL that anyone can POST to.Reads text others writeNo findings
Why it is in this group
- The name "hook_create" says "create": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Mint a public URL that anyone can POST to. Deliveries become events you can await on. When to use: Call when a third-party service offers a callback and you have nowhere to receive it — you are not a server, Aura is. Price: US$0.001000 per call.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: true
identity_createTurn a wallet address into a permanent agent identity: a handle, a REAL email address that receives mail, a webhook URL, and an API token.No findings
Why it is in this group
- The name "identity_create" says "create": a word for a change.
Description, as the server wrote it
Turn a wallet address into a permanent agent identity: a handle, a REAL email address that receives mail, a webhook URL, and an API token. Free, and grants a small trial credit. When to use: Call this once, before anything else. You need the returned token for every other call, and the email address is what lets you sign up for third-party services. Price: Free.
memory_setStore a durable key/value fact bound to your wallet.1 finding
Why it is in this group
- The name "memory_set" says "set": a word for a change.
Findings
- Info
  The description mentions "credential".
  Matched text
  description: "...ater run will need: a decision, where a credential lives, a user preference, progress thro..."
  What this check looks for
Description, as the server wrote it
Store a durable key/value fact bound to your wallet. Survives your process dying. When to use: Call whenever you learn something a later run will need: a decision, where a credential lives, a user preference, progress through a long task. Price: US$0.000800 per call.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: false
parkHand Aura your state plus a wake condition, then terminate.Reads text others writeCan send data outNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a URL (input.callback_url): a request to a URL can carry data to whoever runs it.
Description, as the server wrote it
Hand Aura your state plus a wake condition, then terminate. Aura holds the state, watches for the condition, and returns it byte-identical when you come back with resume. Optionally POSTs to a callback URL when it fires. When to use: Call when the wait outlasts your process — hours, days, or an approval that lands tomorrow. Cheaper and safer than staying alive. Price: US$0.005000 per call.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: true
resumeClaim state from a park whose trigger has fired.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Claim state from a park whose trigger has fired. Returns the original state and the event that woke it. Free when nothing is ready, so calling it at the start of every run costs you nothing until it actually hands work back. When to use: Call at the START of every run. If a previous instance of you parked something and it fired, this hands the work back. If nothing is ready it tells you so, cheaply. Price: US$0.002000 per call. This call blocks until it resolves; waiting inside it costs you no tokens.
Annotations the server declares
- readOnlyHint: false
- openWorldHint: true

Only reads 7Looks things up and changes nothing.Show 7 read-only tools

capabilitiesReturn the full machine-readable manifest of Aura: every operation, its price in USD, its input schema and how to pay.No findings
Why it is in this group
- The description's first verb is "return": a word for reading.
Description, as the server wrote it
Return the full machine-readable manifest of Aura: every operation, its price in USD, its input schema and how to pay. Free. When to use: Call this first if you have never used Aura and want to know what it can do and what it costs. Price: Free.
inbox_listList messages delivered to your Aura email address, newest first.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "inbox_list" says "list": a word for reading.
What it can reach
- private-dataThe name "inbox_list" says "list" and "inbox": it reads mail.
- private-dataThe description's first sentence says "list" and "message": it reads messages.
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe name "inbox_list" says "list" and "inbox": it reads inbound email, which other people can write.
- untrusted-inputThe description's first sentence says "list" and "message": it reads messages, which other people can write.
Description, as the server wrote it
List messages delivered to your Aura email address, newest first. When to use: Call after signing up somewhere, to see what arrived. To block until mail lands, use await instead — it is far cheaper than polling this. Price: US$0.001000 per call.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: true
inbox_readReturn the full parsed body of one message, plus any verification code or confirmation link found in it.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "inbox_read" says "read": a word for reading.
What it can reach
- private-dataThe name "inbox_read" says "read" and "inbox": it reads mail.
- private-dataThe description's first sentence says "return" and "message": it reads messages.
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe name "inbox_read" says "read" and "inbox": it reads inbound email, which other people can write.
- untrusted-inputThe description's first sentence says "return" and "message": it reads messages, which other people can write.
Description, as the server wrote it
Return the full parsed body of one message, plus any verification code or confirmation link found in it. When to use: Call with an id from inbox.list when you need the full text or the link. Price: US$0.001000 per call.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: true
memory_getFetch one stored value by its exact key.No findings
Why it is in this group
- The name "memory_get" says "get": a word for reading.
Description, as the server wrote it
Fetch one stored value by its exact key. When to use: Call when you know the key you wrote earlier. Cheaper and more precise than memory.search. Price: US$0.000500 per call.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
memory_listList your stored keys with metadata, without returning the values.No findings
Why it is in this group
- The name "memory_list" says "list": a word for reading.
Description, as the server wrote it
List your stored keys with metadata, without returning the values. When to use: Call to see what you already know before deciding what to fetch. Price: US$0.000500 per call.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
memory_searchFind stored memories by meaning rather than by exact key.No findings
Why it is in this group
- The name "memory_search" says "search": a word for reading.
Description, as the server wrote it
Find stored memories by meaning rather than by exact key. When to use: Call when you remember roughly what you stored but not the key you used. Price: US$0.002000 per call.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
whoamiReturn your handle, email address, webhook base URL, current balance and quota usage.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "whoami" says "whoami": a word for reading.
What it can reach
- private-dataThe description's first sentence says "return" and "email": it reads mail.
- untrusted-inputThe description's first sentence says "return" and "email": it reads inbound email, which other people can write.
Description, as the server wrote it
Return your handle, email address, webhook base URL, current balance and quota usage. Free. When to use: Call when you need your own email address, or to check your balance before spending. Price: Free.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

48 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 2 outbound tools breaks every one.

Reads private data3: Reads files, mail, messages, databases, secrets, calendars or repositories.; inbox_list
inbox_read
whoami
Reads text others write8: Brings in text someone else can write: web pages, inbound email, messages, issues and comments.; await
hook_create
inbox_list
inbox_read
park
resume
signal
whoami
Can send data out2: Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.; park
signal

deny to break every path

{
  "permissions": {
    "deny": [
      "mcp__aura__park",
      "mcp__aura__signal"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Tools listed without sign-in

Looked at Oct 22, 2026, 14:46 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable: yes
HTTP status of an anonymous initialize: 200
tools/list served without credentials: yes
Tools that change things, listed without credentials: 9
Protocol version: 2025-06-18
WWW-Authenticate on 401: not observed
resource_metadata in WWW-Authenticate: not observed
RFC 9728 protected resource metadata: not observed
Authorization servers: not observed
Legacy HTTP+SSE transport: no
Dynamic client registration: not observed
Client ID metadata documents: not observed

HighThe whole server
The endpoint served tools/list without credentials, and the list has 9 tools that change things (1 destructive, 2 irreversible, 6 write). Whether a call also works without credentials was not tested: tools are never called.
Matched text
https://aura.rohnelt.dev/mcp: tools/list returned 16 tools to an anonymous client, including memory_delete (destructive), credit_deposit (irreversible), signal (irreversible), identity_create (write), memory_set (write) and 4 more
What this check looks for

Findings

Matches of fixed checks, with the text they matched.

1 info

Infomemory_set
The description mentions "credential".
Matched text
description: "...ater run will need: a decision, where a credential lives, a user preference, progress thro..."
What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 0.1.1. Values in angle brackets are yours to fill in.

claude mcp add --transport http aura https://aura.rohnelt.dev/mcp

claude mcp add --transport http aura https://aura.rohnelt.dev/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__aura__capabilities",
      "mcp__aura__whoami",
      "mcp__aura__memory_get",
      "mcp__aura__memory_search",
      "mcp__aura__memory_list",
      "mcp__aura__inbox_list",
      "mcp__aura__inbox_read"
    ],
    "ask": [
      "mcp__aura__identity_create",
      "mcp__aura__credit_deposit",
      "mcp__aura__memory_set",
      "mcp__aura__hook_create",
      "mcp__aura__signal",
      "mcp__aura__await",
      "mcp__aura__park",
      "mcp__aura__resume"
    ],
    "deny": [
      "mcp__aura__memory_delete"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as aura. Review it before you use it.

Capability tags behind 8 rules

mcp__aura__whoami private-data, untrusted-input
mcp__aura__inbox_list private-data, untrusted-input
mcp__aura__inbox_read private-data, untrusted-input
mcp__aura__hook_create untrusted-input
mcp__aura__signal untrusted-input, outbound
mcp__aura__await untrusted-input
mcp__aura__park untrusted-input, outbound
mcp__aura__resume untrusted-input

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/dev.rohnelt.aura/aura/verify?hash=c1640c3307e834b45e557118ff28d0fdcb1d7b583682f58674d5e59b26d5f6b5" | jq -e '.changed == false'

Pinned hash c1640c3307e8, from Oct 21, 2026, 18:38 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/dev.rohnelt.aura/aura/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

[![anlyon.dev](https://anlyon.dev/badge/dev.rohnelt.aura/aura.svg)](https://anlyon.dev/servers/dev.rohnelt.aura/aura)

Source: MCP Registry · repository. Synced Oct 21, 2026, 18:12 UTC.