Carbon Forge

io.github.100monkeys-ai/carbon-forge100monkeys-aistreamable-httpv1.0.0Scanned 55 minutes ago

One record of code, files and pages that people and agents read and write, with lanes and git.

22 tools: 2 change things and 20 only read.

Reads private data · 2
Reads text others write · 2
Can send data out · 0
1 finding

Anlyon alternative

2 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

22 tools

Changes things 2Creates or changes something that can be changed back.Claude Code: ask

comments.listList the comment thread for a page or atom.1 finding
Why it is in this group
- The name "comments.list" says "comment": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
  The server marks "comments.list" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
  Matched text
  annotations: {"readOnlyHint":true}; The name "comments.list" says "comment": a word for a change.
  What this check looks for
Description, as the server wrote it
List the comment thread for a page or atom.
Annotations the server declares
- readOnlyHint: true
cortex.groundOrientation surface: instance metadata, both grounding documents, identity and capabilities, reachable workspaces, sidecar health.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Orientation surface: instance metadata, both grounding documents, identity and capabilities, reachable workspaces, sidecar health. Pass `workspace` to ground a named workspace without moving the per-token pointer. Pass a `known_grounding_at` / `known_workspace_grounding_at` you hold and an unchanged document is acknowledged, not resent. Details: https://carbonforge.dev/docs/p/api/mcp-tools-catalog
Annotations the server declares
- readOnlyHint: true

Only reads 20Looks things up and changes nothing.Show 20 read-only tools

atoms.listList atoms in the current workspace.No findings
Why it is in this group
- The name "atoms.list" says "list": a word for reading.
Description, as the server wrote it
List atoms in the current workspace. The `path_prefix`, `body_contains`, `metadata`, `sort`, `direction` and `include_metadata` arguments mirror the same arguments on pages.list.
Annotations the server declares
- readOnlyHint: true
atoms.readRead an atom by path or UUID with usage_pages projection.No findings
Why it is in this group
- The name "atoms.read" says "read": a word for reading.
Description, as the server wrote it
Read an atom by path or UUID with usage_pages projection. Returns metadata. Pass `section` with a heading's plain text to get back only that heading and the blocks under it, down to the next heading at the same or shallower level; the result then also carries `section: { heading, level, matches }`, and everything else on it is the atom's own, so a section can be read and written straight back.
Annotations the server declares
- readOnlyHint: true
discovery.list_entitiesBrowse pages or atoms inside a workspace with faceted filters (tag, author, date range, visibility, metadata containment) and sort by alphabetical, recency, or star count.Reads text others writeNo findings
Why it is in this group
- The name "discovery.list_entities" says "list": a word for reading.
What it can reach
- untrusted-inputThe description's first sentence says "browse": it reads web pages, which anyone can write.
Description, as the server wrote it
Browse pages or atoms inside a workspace with faceted filters (tag, author, date range, visibility, metadata containment) and sort by alphabetical, recency, or star count. Viewer-aware: members see everything, anonymous callers see only public entities in public workspaces. 50 items per page, cursor-based. Details: https://carbonforge.dev/docs/p/api/mcp-tools-catalog
Annotations the server declares
- readOnlyHint: true
discovery.list_instancesList instances.No findings
Why it is in this group
- The name "discovery.list_instances" says "list": a word for reading.
Description, as the server wrote it
List instances. Filter: all (default) | public | my | my_admin. public lists an instance that has public reading on, is listed in Discover, is not frozen, and has a workspace that is not private holding a page that is not private. my and my_admin list the caller's own instances (member; admin) with no such gate; all is public plus my. Without a token every filter is public.
Annotations the server declares
- readOnlyHint: true
discovery.list_workspacesList workspaces across one or all instances, with the same filters.No findings
Why it is in this group
- The name "discovery.list_workspaces" says "list": a word for reading.
Description, as the server wrote it
List workspaces across one or all instances, with the same filters. public lists a workspace when its instance has public reading on, the workspace is not private, its instance is listed in Discover and not frozen, and it holds a page that is not private. my and my_admin list the caller's own workspaces with no such gate; all is public plus my. Without a token every filter is public.
Annotations the server declares
- readOnlyHint: true
discovery.searchSearch instance and workspace metadata + grounding documents.Reads private dataNo findings
Why it is in this group
- The name "discovery.search" says "search": a word for reading.
What it can reach
- private-dataThe description's first sentence says "search" and "document": it reads documents.
Description, as the server wrote it
Search instance and workspace metadata + grounding documents. Returns parallel lists for both scopes.
Annotations the server declares
- readOnlyHint: true
files.listBrowse the workspace as a file tree, one level at a time: directories, pages, atoms, code trees (expanded at their paths) and library entries.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "files.list" says "list": a word for reading.
What it can reach
- private-dataThe name "files.list" says "list" and "file": it reads files.
- private-dataThe description's first sentence says "browse" and "file": it reads files.
- untrusted-inputThe description's first sentence says "browse": it reads web pages, which anyone can write.
Description, as the server wrote it
Browse the workspace as a file tree, one level at a time: directories, pages, atoms, code trees (expanded at their paths) and library entries. Each node names its kind, entity, current revision and digest; `at` holds the entities exactly at `path`. `surface` keeps that surface only. History: files.history. Anonymous callers see public pages and atoms, and code trees of surface code.
Annotations the server declares
- readOnlyHint: true
kg.get_relatedSemantic nearest-neighbors via similarity_edges.No findings
Why it is in this group
- The name "kg.get_related" says "get": a word for reading.
Description, as the server wrote it
Semantic nearest-neighbors via similarity_edges.
Annotations the server declares
- readOnlyHint: true
kg.list_cross_linksList incoming + outgoing cross-links for a page or atom.No findings
Why it is in this group
- The name "kg.list_cross_links" says "list": a word for reading.
Description, as the server wrote it
List incoming + outgoing cross-links for a page or atom.
Annotations the server declares
- readOnlyHint: true
media.readFetch metadata for a single media item.No findings
Why it is in this group
- The name "media.read" says "read": a word for reading.
Description, as the server wrote it
Fetch metadata for a single media item.
Annotations the server declares
- readOnlyHint: true
pages.listList pages in a workspace.No findings
Why it is in this group
- The name "pages.list" says "list": a word for reading.
Description, as the server wrote it
List pages in a workspace. `path_prefix` narrows by leading segment; `body_contains` keeps pages whose Markdown holds a literal substring; `metadata` keeps pages whose top-level metadata contains the given scalar keys; `sort` (path | updated_at | created_at) and `direction` order the set; `include_metadata` adds each page's metadata. Details: https://carbonforge.dev/docs/p/api/mcp-tools-catalog
Annotations the server declares
- readOnlyHint: true
pages.readRead a page by path or UUID.No findings
Why it is in this group
- The name "pages.read" says "read": a word for reading.
Description, as the server wrote it
Read a page by path or UUID. Returns the Markdown body plus the page metadata object. Pass `section` with a heading's plain text to get back only that heading and the blocks under it, down to the next heading at the same or shallower level; the result then also carries `section: { heading, level, matches }`. Details: https://carbonforge.dev/docs/p/api/mcp-tools-catalog
Annotations the server declares
- readOnlyHint: true
revisions.compareMarkdown-level diff between two revisions of the same page or atom.No findings
Why it is in this group
- The name "revisions.compare" says "compare": a word for reading.
Description, as the server wrote it
Markdown-level diff between two revisions of the same page or atom. Returns segments (op: equal | insert | delete) plus both Markdown projections.
Annotations the server declares
- readOnlyHint: true
revisions.getFetch a specific revision (returns Markdown body).No findings
Why it is in this group
- The name "revisions.get" says "get": a word for reading.
Description, as the server wrote it
Fetch a specific revision (returns Markdown body).
Annotations the server declares
- readOnlyHint: true
revisions.listList revisions for a page or atom (cursor-paginated).No findings
Why it is in this group
- The name "revisions.list" says "list": a word for reading.
Description, as the server wrote it
List revisions for a page or atom (cursor-paginated).
Annotations the server declares
- readOnlyHint: true
search.globalHybrid FTS + pgvector + RRF search.No findings
Why it is in this group
- The name "search.global" says "search": a word for reading.
Description, as the server wrote it
Hybrid FTS + pgvector + RRF search. Returns Markdown excerpts.
Annotations the server declares
- readOnlyHint: true
search.literalExact-substring search over the Markdown projection of pages and atoms — deterministic, unlike hybrid `search.global`.No findings
Why it is in this group
- The name "search.literal" says "search": a word for reading.
Description, as the server wrote it
Exact-substring search over the Markdown projection of pages and atoms — deterministic, unlike hybrid `search.global`. A needle shorter than 3 characters is rejected. Returns one envelope per matched entity, up to 5 hits each as `{ line, col, snippet }`. `case_sensitive` defaults to false; `scope` is workspace | all_mine | all_public. Details: https://carbonforge.dev/docs/p/api/mcp-tools-catalog
Annotations the server declares
- readOnlyHint: true
trees.getRead a code tree's revision (the current one by default), its metadata and surface, and a page of its entries in path order: path, git mode, size and blob SHA-256, optionally under…No findings
Why it is in this group
- The name "trees.get" says "tree": a word for reading.
Description, as the server wrote it
Read a code tree's revision (the current one by default), its metadata and surface, and a page of its entries in path order: path, git mode, size and blob SHA-256, optionally under `path_prefix`. A symlink's blob is its target; a submodule link has no blob and gives its `commit`. With `lane`, `metadata` is the lane's bag if it sets one. Anonymous callers read a public code tree's current one.
Annotations the server declares
- readOnlyHint: true
workspaces.listList every workspace the calling user is a member of.No findings
Why it is in this group
- The name "workspaces.list" says "list": a word for reading.
Description, as the server wrote it
List every workspace the calling user is a member of. This is a membership catalogue and not a capability: it is not narrowed by the token, so a listed workspace may still be outside this token's reach. Call cortex.ground for what this token can actually resolve.
Annotations the server declares
- readOnlyHint: true
workspaces.resolve_slugResolve a workspace slug to its id, role, and archived state.No findings
Why it is in this group
- The name "workspaces.resolve_slug" says "resolve": a word for reading.
Description, as the server wrote it
Resolve a workspace slug to its id, role, and archived state. 404 when the caller isn't a member (no enumeration).
Annotations the server declares
- readOnlyHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged outbound.

Reads private data2: Reads files, mail, messages, databases, secrets, calendars or repositories.; discovery.search
files.list
Reads text others write2: Brings in text someone else can write: web pages, inbound email, messages, issues and comments.; discovery.list_entities
files.list
Can send data out0: Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

1 warn

Warncomments.list
The server marks "comments.list" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
Matched text
annotations: {"readOnlyHint":true}; The name "comments.list" says "comment": a word for a change.
What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http carbon-forge https://carbonforge.dev/api/mcp

claude mcp add --transport http carbon-forge https://carbonforge.dev/api/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__carbon-forge__pages_list",
      "mcp__carbon-forge__pages_read",
      "mcp__carbon-forge__atoms_list",
      "mcp__carbon-forge__atoms_read",
      "mcp__carbon-forge__search_global",
      "mcp__carbon-forge__search_literal",
      "mcp__carbon-forge__discovery_list_entities",
      "mcp__carbon-forge__kg_get_related",
      "mcp__carbon-forge__kg_list_cross_links",
      "mcp__carbon-forge__revisions_list",
      "mcp__carbon-forge__revisions_get",
      "mcp__carbon-forge__revisions_compare",
      "mcp__carbon-forge__media_read",
      "mcp__carbon-forge__workspaces_list",
      "mcp__carbon-forge__workspaces_resolve_slug",
      "mcp__carbon-forge__discovery_list_instances",
      "mcp__carbon-forge__discovery_list_workspaces",
      "mcp__carbon-forge__discovery_search",
      "mcp__carbon-forge__trees_get",
      "mcp__carbon-forge__files_list"
    ],
    "ask": [
      "mcp__carbon-forge__comments_list",
      "mcp__carbon-forge__cortex_ground"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as carbon-forge. Review it before you use it.

Capability tags behind 3 rules

mcp__carbon-forge__discovery_list_entities untrusted-input
mcp__carbon-forge__discovery_search private-data
mcp__carbon-forge__files_list private-data, untrusted-input

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/io.github.100monkeys-ai/carbon-forge/verify?hash=2d2644ae88711726807861008445bf1c3587921ab33336c9a591212a8571ffb1" | jq -e '.changed == false'

Pinned hash 2d2644ae8871, from Oct 24, 2026, 00:17 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/io.github.100monkeys-ai/carbon-forge/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

[![anlyon.dev](https://anlyon.dev/badge/io.github.100monkeys-ai/carbon-forge.svg)](https://anlyon.dev/servers/io.github.100monkeys-ai/carbon-forge)

Source: MCP Registry. Synced Oct 24, 2026, 00:17 UTC.