SignOps

dev.signops/signopssignops.devstreamable-httpv1.0.0Scanned 1 hour ago

Send push to Android, iOS and the web, and ask a trusted phone to approve a login, from your agent.

23 tools: 6 can delete or cancel things, 2 do something that can't be undone, 6 change things and 9 only read.

Reads private data · 0
Reads text others write · 2
Can send data out · 1
1 finding

Anlyon alternative

14 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

23 tools

Deletes or cancels 6Removes, cancels or revokes something.Claude Code: deny

cancel_approvalCancel a pending approval request.No findings
Why it is in this group
- The name "cancel_approval" says "cancel": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Cancel a pending approval request.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
cancel_pushCancel a push that is scheduled and has not started sending.No findings
Why it is in this group
- The name "cancel_push" says "cancel": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Cancel a push that is scheduled and has not started sending.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
delete_templateDelete a template by name.No findings
Why it is in this group
- The name "delete_template" says "delete": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Delete a template by name. Pushes already made from it are not changed.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
remove_authenticatorRemove a user's authenticator app and backup codes, for a lost phone.No findings
Why it is in this group
- The name "remove_authenticator" says "remove": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Remove a user's authenticator app and backup codes, for a lost phone. They can enrol again.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
remove_deviceRemove one device by id; it gets no more pushes.No findings
Why it is in this group
- The name "remove_device" says "remove": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Remove one device by id; it gets no more pushes.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
unsubscribe_topicTake a user off a topic.No findings
Why it is in this group
- The name "unsubscribe_topic" says "unsubscribe": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Take a user off a topic.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false

Can't be undone 2Sends, pays, publishes or merges: once done, it cannot be taken back.Claude Code: ask

create_approvalSend an approval request to the user's trusted phone, with number matching.Reads text others writeNo findings
Why it is in this group
- The name "create_approval" says "create": a word for a change.
- The description's first verb is "send": a word for sending, and what is sent cannot be taken back.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Send an approval request to the user's trusted phone, with number matching. The user must have a phone enrolled through the SignOps SDK.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
send_pushSend a push notification to one user (user_id), a list (user_ids, up to 1,000), a topic, or everyone (all: true).Reads text others writeCan send data outNo findings
Why it is in this group
- The name "send_push" says "send": a word for sending, and what is sent cannot be taken back.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe name "send_push" says "send": it sends or publishes something to other people.
Description, as the server wrote it
Send a push notification to one user (user_id), a list (user_ids, up to 1,000), a topic, or everyone (all: true). Give exactly one target. A push to one user, sent now, answers with its result at once; others answer with status sending or scheduled. With a test key (sk_test_) only test devices receive it.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true

Changes things 6Creates or changes something that can be changed back.Claude Code: ask

export_userEverything SignOps holds on one user id as JSON: devices (tokens shortened), topics, passkeys, authenticator status, approvals of the last 90 days, consent history and pushes sent …No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Everything SignOps holds on one user id as JSON: devices (tokens shortened), topics, passkeys, authenticator status, approvals of the last 90 days, consent history and pushes sent to them.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
list_pushesPushes, newest first.1 finding
Why it is in this group
- The name "list_pushes" says "list": a word for reading.
- The description's first verb is "push": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
  The server marks "list_pushes" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
  Matched text
  annotations: {"readOnlyHint":true,"openWorldHint":false}; The name "list_pushes" says "list": a word for reading.
  What this check looks for
Description, as the server wrote it
Pushes, newest first. On the Free plan only pushes still to go are listed (no delivery logs).
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
register_deviceStore a device's push token under your user id.No findings
Why it is in this group
- The description's first verb is "store": a word for a change.
Description, as the server wrote it
Store a device's push token under your user id. Android and iOS tokens come from the Firebase or Apple SDK; for web, token is the PushSubscription as JSON.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
save_templateCreate or replace a template.No findings
Why it is in this group
- The name "save_template" says "save": a word for a change.
Description, as the server wrote it
Create or replace a template. Put {{field}} where a value goes, or {{field|default}} for one with a fallback.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
subscribe_topicAdd a user to a topic.No findings
Why it is in this group
- The name "subscribe_topic" says "subscribe": a word for a change.
Description, as the server wrote it
Add a user to a topic. The topic exists once it has a user.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
unlock_userClear the lock that five wrong codes in 15 minutes put on a user, and their count of wrong codes.No findings
Why it is in this group
- The name "unlock_user" says "unlock": a word for a change.
Description, as the server wrote it
Clear the lock that five wrong codes in 15 minutes put on a user, and their count of wrong codes.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false

Only reads 9Looks things up and changes nothing.Show 9 read-only tools

get_approvalAn approval request's status: pending, approved, denied, expired or cancelled.No findings
Why it is in this group
- The name "get_approval" says "get": a word for reading.
Description, as the server wrote it
An approval request's status: pending, approved, denied, expired or cancelled.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
get_authenticatorWhether a user has an authenticator app (TOTP) confirmed, when it was last used, backup codes left, and whether wrong codes have locked them.No findings
Why it is in this group
- The name "get_authenticator" says "get": a word for reading.
Description, as the server wrote it
Whether a user has an authenticator app (TOTP) confirmed, when it was last used, backup codes left, and whether wrong codes have locked them.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
get_consentThe latest consent answer per purpose for one user, like marketing_push, and the history.No findings
Why it is in this group
- The name "get_consent" says "get": a word for reading.
Description, as the server wrote it
The latest consent answer per purpose for one user, like marketing_push, and the history.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
get_pushOne push by id: status, devices, sent and failed, per platform.No findings
Why it is in this group
- The name "get_push" says "get": a word for reading.
Description, as the server wrote it
One push by id: status, devices, sent and failed, per platform.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
get_templateOne template by name.No findings
Why it is in this group
- The name "get_template" says "get": a word for reading.
Description, as the server wrote it
One template by name.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
list_devicesThe devices registered for one user id, newest first, with platform and whether each is trusted for approvals.No findings
Why it is in this group
- The name "list_devices" says "list": a word for reading.
Description, as the server wrote it
The devices registered for one user id, newest first, with platform and whether each is trusted for approvals.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
list_passkeysThe passkeys registered for one user id.No findings
Why it is in this group
- The name "list_passkeys" says "list": a word for reading.
Description, as the server wrote it
The passkeys registered for one user id.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
list_templatesSaved push templates with their fields.No findings
Why it is in this group
- The name "list_templates" says "list": a word for reading.
Description, as the server wrote it
Saved push templates with their fields.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
list_topicsTopics with how many users each has.No findings
Why it is in this group
- The name "list_topics" says "list": a word for reading.
Description, as the server wrote it
Topics with how many users each has.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data.

Reads private data0: Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write2: Brings in text someone else can write: web pages, inbound email, messages, issues and comments.; create_approval
send_push
Can send data out1: Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.; send_push

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

1 warn

Warnlist_pushes
The server marks "list_pushes" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
Matched text
annotations: {"readOnlyHint":true,"openWorldHint":false}; The name "list_pushes" says "list": a word for reading.
What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http signops https://api.signops.dev/mcp --header 'Authorization: <your-authorization>'

claude mcp add --transport http signops https://api.signops.dev/mcp --header 'Authorization: <your-authorization>'

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__signops__get_push",
      "mcp__signops__list_devices",
      "mcp__signops__list_topics",
      "mcp__signops__list_templates",
      "mcp__signops__get_template",
      "mcp__signops__get_approval",
      "mcp__signops__list_passkeys",
      "mcp__signops__get_authenticator",
      "mcp__signops__get_consent"
    ],
    "ask": [
      "mcp__signops__send_push",
      "mcp__signops__list_pushes",
      "mcp__signops__register_device",
      "mcp__signops__subscribe_topic",
      "mcp__signops__save_template",
      "mcp__signops__create_approval",
      "mcp__signops__unlock_user",
      "mcp__signops__export_user"
    ],
    "deny": [
      "mcp__signops__cancel_push",
      "mcp__signops__remove_device",
      "mcp__signops__unsubscribe_topic",
      "mcp__signops__delete_template",
      "mcp__signops__cancel_approval",
      "mcp__signops__remove_authenticator"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as signops. Review it before you use it.

Capability tags behind 2 rules

mcp__signops__send_push untrusted-input, outbound
mcp__signops__create_approval untrusted-input

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/dev.signops/signops/verify?hash=8cca96ac1f14e05a1b41c2f765188003a7424eac9d84b621747cd36cc4db934d" | jq -e '.changed == false'

Pinned hash 8cca96ac1f14, from Oct 25, 2026, 20:23 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/dev.signops/signops/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

[![anlyon.dev](https://anlyon.dev/badge/dev.signops/signops.svg)](https://anlyon.dev/servers/dev.signops/signops)

Source: MCP Registry. Synced Oct 25, 2026, 20:22 UTC.