Skip to content
anlyon.devby Anlyon

llms.ink MCP server

ink.llms/llms-inkllms.inkstreamable-httpv0.6.0Scanned

Any link as llms.txt; check llms.txt; see how AI crawlers read a page; draft AGENTS.md.

7 tools: 3 change things and 4 only read.

Tools: 0 delete, 0 irreversible, 3 write, 4 read.
  • Reads private data · 1
  • Reads text others write · 6
  • Can send data out · 7
  • 2 findings

Tools listed without sign-in. Remote posture

With Anlyon

3 tools here change things. Govern them.

  • Anlyon lists the tools and adopts none.
  • Each tool you adopt gets approvals and receipts.
  • Your agent never holds the key.
Govern this server →

A tool your agent calls directly is not routed through Anlyon and is not governed by it. anlyon.dev only lists and labels, and these labels are the same either way.

Compare with similar serversMarkdownJSONReport this listing

What the llms.ink MCP server can do

The llms.ink MCP server is published by llms.ink, a domain the MCP Registry verified. It has 7 tools. It can create or change data (3 tools: create_clip_link, check_llms_txt and generate_draft), but cannot delete data. 4 tools only read.

1 tool reads private data (llms_full_txt); 6 tools bring in text other people can write (llms_txt, llms_full_txt, video_frame and 3 more); 7 tools can send data out of your system (create_clip_link, llms_txt, llms_full_txt and 4 more). On its own it has all three parts of a prompt-injection exfiltration path: private data, text others write, and a way out.

The fixed checks matched 2 findings (annotation-conflict). Each one comes with the text it matched.

Its remote endpoint lists its tools without sign-in, and its tools changed 5 times since anlyon.dev first saw them.

Last scanned Nov 14, 2026, version 0.6.0.

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

7 tools

Changes things 3Claude Code: ask
  • check_llms_txtCheck an llms.txt against the format (H1 title, blockquote summary, H2 sections of `- [name](url): notes` links) and size.Reads text others writeCan send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Check an llms.txt against the format (H1 title, blockquote summary, H2 sections of `- [name](url): notes` links) and size. Pass `url` to check the file a site publishes, including whether its first 25 links answer; or pass `text` to check a file you have (a draft, a local copy), with `base` for where it lives and `links` to also test its links. Returns a short report with each issue and its line, and the sections with their link counts.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • generate_draftDraft fixes for a site or repo owner to review, each tied to its sources.Reads text others writeCan send data out1 finding

    Why it is in this group

    • The name "generate_draft" says "generate": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.

    Findings

    • Warn

      The server marks "generate_draft" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "generate_draft" says "generate": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Draft fixes for a site or repo owner to review, each tied to its sources. kind `agents-md`: an AGENTS.md (setup, commands, layout, conventions) for a GitHub repo or docs site, every line citing its file and line. `jsonld`: WebSite/Organization/Product/SoftwareApplication JSON-LD built only from facts on the site. `alt-text`: alt text for images missing it, from image descriptions. `answers`: per H2 section, a question-shaped heading and an answer-first sentence drawn only from that section. Drafts never contain URLs, commands or numbers not in the sources. Cached 24h; counts as a new link.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
Only reads 4Show 4 read-only tools
  • agent_viewReport how AI crawlers and agents see a page: robots.txt per AI bot (search, user fetches, training) and Content-Signal, firewall blocks found by fetching with bot User-Agents, tex…Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "agent_view" says "view": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe input takes a URL (input.url), and the tool reads it: it reads web pages, which anyone can write.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.

    Claude Code: ask, because it is tagged outbound.

    Description, as the server wrote it
    Report how AI crawlers and agents see a page: robots.txt per AI bot (search, user fetches, training) and Content-Signal, firewall blocks found by fetching with bot User-Agents, text present without JavaScript, what survives Markdown conversion, title/first paragraph/facts/noindex/canonical/sitemap, hidden instructions, and llms.txt, .md URLs, Accept: text/markdown, Link headers, ard.json. Each check is pass/warn/fail/info with a fix; robots.txt and header fixes include the changed file. Use it to tell a site owner why assistants can’t read or cite a page and what to change.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • llms_full_txtGet llms-full.txt for any link: the llms.txt index followed by the full Markdown of up to 20 pages it links to (or the page/document itself; for a video, its description and timest…Reads private dataReads text others writeCan send data outNo findings

    Why it is in this group

    • The description's first verb is "get": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "get" and "document": it reads documents.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe input takes a URL (input.url), and the tool reads it: it reads web pages, which anyone can write.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.

    Claude Code: ask, because it is tagged outbound.

    Description, as the server wrote it
    Get llms-full.txt for any link: the llms.txt index followed by the full Markdown of up to 20 pages it links to (or the page/document itself; for a video, its description and timestamped transcript). Can be large — prefer llms_txt when you only need to find pages. Cached 24h.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • llms_txtGet an llms.txt index for any link: title, one-line summary, and sections of the most useful links with short descriptions.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The description's first verb is "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe input takes a URL (input.url), and the tool reads it: it reads web pages, which anyone can write.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.

    Claude Code: ask, because it is tagged outbound.

    Description, as the server wrote it
    Get an llms.txt index for any link: title, one-line summary, and sections of the most useful links with short descriptions. Returns the site’s own llms.txt when it has one. Cached 24h.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • video_frameGet one frame of a video (YouTube, Instagram, X, TikTok, a direct .mp4 link…) as a JPEG image, to see what is on screen at a given time.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The description's first verb is "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe input takes a URL (input.url), and the tool reads it: it reads web pages, which anyone can write.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.

    Claude Code: ask, because it is tagged outbound.

    Description, as the server wrote it
    Get one frame of a video (YouTube, Instagram, X, TikTok, a direct .mp4 link…) as a JPEG image, to see what is on screen at a given time. Pair with llms_full_txt: the transcript is timestamped.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

42 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 1 private-data tool breaks every one.

Reads private data1
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write6
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out7
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
deny to break every path
{
  "permissions": {
    "deny": [
      "mcp__llms-ink__llms_full_txt"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Tools listed without sign-in

Looked at Nov 14, 2026, 12:19 UTC, unchanged since Nov 14, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable
yes
HTTP status of an anonymous initialize
200
tools/list served without credentials
yes
Tools that change things, listed without credentials
2
Protocol version
2025-06-18
WWW-Authenticate on 401
not observed
resource_metadata in WWW-Authenticate
not observed
RFC 9728 protected resource metadata
not observed
Authorization servers
not observed
Legacy HTTP+SSE transport
no
Dynamic client registration
not observed
Client ID metadata documents
not observed
  • WarnThe whole server

    The endpoint served tools/list without credentials, and the list has 2 tools that change things (2 write). Whether a call also works without credentials was not tested: tools are never called.

    Matched text

    https://llms.ink/mcp: tools/list returned 5 tools to an anonymous client, including create_clip_link (write), check_llms_txt (write)

    What this check looks for

Findings

Matches of fixed checks, with the text they matched.

2 warn
  • Warncreate_clip_link

    The server marks "create_clip_link" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "create_clip_link" says "create": a word for a change.

    What this check looks for
  • Warngenerate_draft

    The server marks "generate_draft" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "generate_draft" says "generate": a word for a change.

    What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

  1. Tools2 added.+2 addedView diff
  2. Tools1 changed.~1 changedView diff
  3. Tools5 changed.~5 changedView diff
  4. Tools1 added.+1 addedView diff
  5. Tools1 added.+1 addedView diff
All changes to this server

Install

Pinned to version 0.6.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http llms-ink https://llms.ink/mcp
claude mcp add --transport http llms-ink https://llms.ink/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [],
    "ask": [
      "mcp__llms-ink__create_clip_link",
      "mcp__llms-ink__llms_txt",
      "mcp__llms-ink__llms_full_txt",
      "mcp__llms-ink__video_frame",
      "mcp__llms-ink__check_llms_txt",
      "mcp__llms-ink__generate_draft",
      "mcp__llms-ink__agent_view"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as llms-ink. Review it before you use it.

Capability tags behind 7 rules
  • mcp__llms-ink__create_clip_link outbound
  • mcp__llms-ink__llms_txt untrusted-input, outbound
  • mcp__llms-ink__llms_full_txt private-data, untrusted-input, outbound
  • mcp__llms-ink__video_frame untrusted-input, outbound
  • mcp__llms-ink__check_llms_txt untrusted-input, outbound
  • mcp__llms-ink__generate_draft untrusted-input, outbound
  • mcp__llms-ink__agent_view untrusted-input, outbound

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/ink.llms/llms-ink/verify?hash=b7db7d0cbc98b18aca28dd8e2dd2e9385877dde1a0ef5fd2cdd47b5398a90e75" | jq -e '.changed == false'

Pinned hash b7db7d0cbc98, from Nov 14, 2026, 18:18 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/ink.llms/llms-ink/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for ink.llms/llms-ink
[![anlyon.dev](https://anlyon.dev/badge/ink.llms/llms-ink.svg)](https://anlyon.dev/servers/ink.llms/llms-ink)

Source: MCP Registry. Synced Nov 14, 2026, 19:17 UTC.

llms.ink MCP server: questions and answers

Answered from the scan above, not from the publisher's description.

Is the llms.ink MCP server safe?

No scan can promise that. What its definitions show: 7 tools, 3 of which can change, send or delete something, and 2 findings from fixed checks. Allow the reads, ask before each change, and deny the deletes; the permissions block on this page does that.

Can the llms.ink MCP server delete data?

No tool is classed as destructive: going by their definitions, none of them deletes, cancels or revokes anything.

Can the llms.ink MCP server do things that cannot be undone?

No tool is classed as irreversible: none of them sends, pays, publishes or merges, going by their definitions.

What tools does the llms.ink MCP server have?

7 tools: 3 write, 4 read. create_clip_link, check_llms_txt, generate_draft, llms_txt, llms_full_txt, video_frame and agent_view.

Does the llms.ink MCP server need sign-in or OAuth?

Its remote endpoint listed its tools to an anonymous client, without sign-in.

Does the llms.ink MCP server send data to outside services?

7 tools can carry data out (it sends, posts or publishes, or takes a recipient, channel or URL): create_clip_link, llms_txt, llms_full_txt, video_frame, check_llms_txt, generate_draft and 1 more.

Has the llms.ink MCP server changed its tools?

Yes, 5 times since anlyon.dev started tracking it, most recently on Nov 14, 2026. Every change is on this page and in its Atom feed.