Skip to content
anlyon.devby Anlyon

A2A Peptides MCP server

io.github.Dosidal/a2a-peptidesDosidalstreamable-httpv1.8.9Scanned

Agent-to-Agent (A2A) + Model Context Protocol (MCP) hub for peptides.

20 tools: 6 change things and 14 only read.

Tools: 0 delete, 0 irreversible, 6 write, 14 read.
  • Reads private data · 1
  • Reads text others write · 2
  • Can send data out · 1
  • 2 findings

With Anlyon

6 tools here change things. Govern them.

  • Anlyon lists the tools and adopts none.
  • Each tool you adopt gets approvals and receipts.
  • Your agent never holds the key.
Govern this server →

A tool your agent calls directly is not routed through Anlyon and is not governed by it. anlyon.dev only lists and labels, and these labels are the same either way.

Compare with similar serversMarkdownJSONReport this listing

What the A2A Peptides MCP server can do

The A2A Peptides MCP server is published by the GitHub account Dosidal. It has 20 tools. It can create or change data (6 tools: gate_transaction, get_label_and_indication, verify_serialization, create_order_intent and 2 more), but cannot delete data. 14 tools only read.

1 tool reads private data (get_availability); 2 tools bring in text other people can write (get_enforcement_watch and get_availability); 1 tool can send data out of your system (gate_transaction). On its own it has all three parts of a prompt-injection exfiltration path: private data, text others write, and a way out.

The fixed checks matched 2 findings (credentials-mention and annotation-conflict). Each one comes with the text it matched.

Last scanned Nov 15, 2026, version 1.8.9.

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

20 tools

Changes things 6Claude Code: ask
  • a2a_handoffHand off over Agent-to-Agent (A2A).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Hand off over Agent-to-Agent (A2A). With an allow/require_rx decision: the order intent goes to the licensed counterparty's agent (envelope + card URL). With a deny for a patient, the public or an unauthorized actor: returns real licensed destinations from the provider directory (dispensers, prescribers) filtered by the decision's jurisdiction, state/province and practice scope — a referral, never a vial.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
    • readOnlyHint: false
    • title: A2A Handoff
  • create_order_intentCreate an order intent for a cleared item after the gate; the intent carries reason_code + rule_set_version and settles by x402 on peptides-x402.ai.No findings

    Why it is in this group

    • The name "create_order_intent" says "create": a word for a change.
    Description, as the server wrote it
    Create an order intent for a cleared item after the gate; the intent carries reason_code + rule_set_version and settles by x402 on peptides-x402.ai.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
    • readOnlyHint: false
    • title: Create Order Intent
  • gate_transactionThe gate: allow, deny or require_rx for a substance (name, INN or unii:), a pathway (licensed_medicine · lawful_compounding · cosmetic · food_or_supplement · ruo_not_cleared), an a…Can send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • outboundThe input takes a destination (input.channel): what the tool writes goes there.
    Description, as the server wrote it
    The gate: allow, deny or require_rx for a substance (name, INN or unii:), a pathway (licensed_medicine · lawful_compounding · cosmetic · food_or_supplement · ruo_not_cleared), an actor class, a channel and a ship-to. Returns a frozen reason code, the rule-set version, the source page and a decision_id for the downstream tools.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
    • title: Gate Transaction
  • get_label_and_indicationLabel and indication pointers for a licensed presentation only (US package NDC, CA DIN, EU EMA number).1 finding

    Why it is in this group

    • The name "get_label_and_indication" says "get": a word for reading.
    • The description's first verb is "label": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "get_label_and_indication" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "get_label_and_indication" says "get": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Label and indication pointers for a licensed presentation only (US package NDC, CA DIN, EU EMA number).

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
    • title: Get Label And Indication
  • log_auditWrite the audit line for a gate decision or an order intent (returns the line id).No findings

    Why it is in this group

    • The name "log_audit" says "log": a word for reading.
    • The description's first verb is "write": a word for a change.
    Description, as the server wrote it
    Write the audit line for a gate decision or an order intent (returns the line id).

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
    • readOnlyHint: false
    • title: Log Audit
  • verify_serializationVerify a serialised pack (GTIN + serial + lot + expiry) against the serialisation regime of the jurisdiction (DSCSA · FMD · UK · KR; none-national elsewhere).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Verify a serialised pack (GTIN + serial + lot + expiry) against the serialisation regime of the jurisdiction (DSCSA · FMD · UK · KR; none-national elsewhere).

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
    • title: Verify Serialization
Only reads 14Show 14 read-only tools
  • compare_presentationsCompare two or more authorised presentations side by side (ids as for get_item).No findings

    Why it is in this group

    • The name "compare_presentations" says "compare": a word for reading.
    Description, as the server wrote it
    Compare two or more authorised presentations side by side (ids as for get_item).

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
    • title: Compare Presentations
  • find_licensed_supplierLicensed parties for a presentation in a jurisdiction (tenant as a parameter).No findings

    Why it is in this group

    • The name "find_licensed_supplier" says "find": a word for reading.
    Description, as the server wrote it
    Licensed parties for a presentation in a jurisdiction (tenant as a parameter). Takes the decision_id of an allow or require_rx decision from gate_transaction.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
    • title: Find Licensed Supplier
  • get_availabilityAvailability of a presentation once gate_transaction has answered allow or require_rx (decision_id): the availability block — banners[] on the shelf of record with licence footnote…Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "get_availability" says "get": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "directory": it reads files.
    • untrusted-inputThe description's first sentence says "url": it reads web pages, which anyone can write.
    Description, as the server wrote it
    Availability of a presentation once gate_transaction has answered allow or require_rx (decision_id): the availability block — banners[] on the shelf of record with licence footnote, pos_count (chain points of sale from the CPG Knowledge Graph retailer registry, or licensed dispensers on the provider directory for medicines), product_urls[] (retailer product page, register page, holder page) — plus tenant offers.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
    • title: Get Availability
  • get_compounding_eligibilityWhether a substance may be lawfully compounded in a jurisdiction and under which list or standard (503A/503B, provincial, magistral, Specials), from the register.No findings

    Why it is in this group

    • The name "get_compounding_eligibility" says "get": a word for reading.
    Description, as the server wrote it
    Whether a substance may be lawfully compounded in a jurisdiction and under which list or standard (503A/503B, provincial, magistral, Specials), from the register.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
    • title: Get Compounding Eligibility
  • get_enforcement_watchDated, URL'd enforcement events for a substance or jurisdiction: warning letters, import alerts, shortage-list changes, committee votes, proposed and final rules, seizures, state n…Reads text others writeNo findings

    Why it is in this group

    • The name "get_enforcement_watch" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe description's first sentence says "url": it reads web pages, which anyone can write.
    Description, as the server wrote it
    Dated, URL'd enforcement events for a substance or jurisdiction: warning letters, import alerts, shortage-list changes, committee votes, proposed and final rules, seizures, state notices.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
    • title: Get Enforcement Watch
  • get_itemOne authorised presentation by id (US package NDC, CA DIN, EU EMA number, KR MFDS item seq, CH Swissmedic authorisation/pack code, JP approved-list entry, or the catalogue id): bra…No findings

    Why it is in this group

    • The name "get_item" says "get": a word for reading.
    Description, as the server wrote it
    One authorised presentation by id (US package NDC, CA DIN, EU EMA number, KR MFDS item seq, CH Swissmedic authorisation/pack code, JP approved-list entry, or the catalogue id): brand, strength, form, route, device, pack, holder, status, offers (tenant is a parameter).

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
    • title: Get Item
  • get_lot_coaCertificate of analysis for a lawful lot of a presentation, where the pathway permits (decision_id required).No findings

    Why it is in this group

    • The name "get_lot_coa" says "get": a word for reading.
    Description, as the server wrote it
    Certificate of analysis for a lawful lot of a presentation, where the pathway permits (decision_id required).

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
    • title: Get Lot Coa
  • get_pathway_statusThe status of a substance on one pathway in one jurisdiction (frozen vocabulary), with effective date, rule-set version and source page.No findings

    Why it is in this group

    • The name "get_pathway_status" says "get": a word for reading.
    Description, as the server wrote it
    The status of a substance on one pathway in one jurisdiction (frozen vocabulary), with effective date, rule-set version and source page.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
    • title: Get Pathway Status
  • get_pricePrice basis (list · contract · reimbursement) from a licensed party, once gate_transaction has answered allow or require_rx (decision_id).No findings

    Why it is in this group

    • The name "get_price" says "get": a word for reading.
    Description, as the server wrote it
    Price basis (list · contract · reimbursement) from a licensed party, once gate_transaction has answered allow or require_rx (decision_id).

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
    • title: Get Price
  • get_safety_labelSafety label pointers for licensed products (label page and the pharmacovigilance scheme of the jurisdiction).No findings

    Why it is in this group

    • The name "get_safety_label" says "get": a word for reading.
    Description, as the server wrote it
    Safety label pointers for licensed products (label page and the pharmacovigilance scheme of the jurisdiction).

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
    • title: Get Safety Label
  • get_substance_recordOne molecule: identifiers (INN, UNII, CAS, sequence hash), sourced aliases, class, one pathway row per jurisdiction × pathway, enforcement events, safety references.No findings

    Why it is in this group

    • The name "get_substance_record" says "get": a word for reading.
    Description, as the server wrote it
    One molecule: identifiers (INN, UNII, CAS, sequence hash), sourced aliases, class, one pathway row per jurisdiction × pathway, enforcement events, safety references. Every field carries its source page.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
    • title: Get Substance Record
  • resolve_actorResolve the actor class and channel.1 finding

    Why it is in this group

    • The name "resolve_actor" says "resolve": a word for reading.

    Findings

    • Info

      The description mentions "credential".

      Matched text

      description: "...c, and agent (inherits the class of the credential it presents; none returns DENY_UNLICENS..."

      What this check looks for
    Description, as the server wrote it
    Resolve the actor class and channel. Classes: authorized_trading_partner and its members (manufacturer · repackager · wholesale_distributor · dispenser · third_party_logistics_provider; cosmetic_responsible_person · nhp_licence_holder on the non-drug pathways), prescriber, the referral classes patient and public, and agent (inherits the class of the credential it presents; none returns DENY_UNLICENSED_AGENT). Returns communication_class: trade_information or public.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
    • title: Resolve Actor
  • resolve_jurisdictionResolve a ship-to (e.g.No findings

    Why it is in this group

    • The name "resolve_jurisdiction" says "resolve": a word for reading.
    Description, as the server wrote it
    Resolve a ship-to (e.g. 'US-CA', 'CA-ON', 'MX', 'EU-DE', 'UK', 'KR', 'JP', 'SG', 'CH') to the gate's jurisdiction (US · CA · MX · EU · UK · KR · JP · SG · CH; UK is the jurisdiction name; the ISO 3166-1 code is accepted as input, machine fields carry the ISO code and jurisdiction_label carries UK), the EU member and any state, provincial or cantonal overlay.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
    • title: Resolve Jurisdiction
  • search_cleared_itemsPresentations that passed the gate for a jurisdiction, pathway and actor class (a query by substance, brand or holder; optional banner filter on the shelf of record).No findings

    Why it is in this group

    • The name "search_cleared_items" says "search": a word for reading.
    Description, as the server wrote it
    Presentations that passed the gate for a jurisdiction, pathway and actor class (a query by substance, brand or holder; optional banner filter on the shelf of record). Only cleared statuses are returned; every item carries its availability block (banners, pos_count, product_urls).

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
    • title: Search Cleared Items

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

2 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 1 outbound tool breaks every one.

Reads private data1
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write2
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out1
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
deny to break every path
{
  "permissions": {
    "deny": [
      "mcp__a2a-peptides__gate_transaction"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

1 warn1 info
  • Warnget_label_and_indication

    The server marks "get_label_and_indication" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "get_label_and_indication" says "get": a word for reading.

    What this check looks for
  • Inforesolve_actor

    The description mentions "credential".

    Matched text

    description: "...c, and agent (inherits the class of the credential it presents; none returns DENY_UNLICENS..."

    What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 1.8.9. Values in angle brackets are yours to fill in.

claude mcp add --transport http a2a-peptides https://mcp.peptidal.ai/mcp
claude mcp add --transport http a2a-peptides https://mcp.peptidal.ai/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__a2a-peptides__resolve_jurisdiction",
      "mcp__a2a-peptides__resolve_actor",
      "mcp__a2a-peptides__get_substance_record",
      "mcp__a2a-peptides__get_pathway_status",
      "mcp__a2a-peptides__get_compounding_eligibility",
      "mcp__a2a-peptides__get_enforcement_watch",
      "mcp__a2a-peptides__search_cleared_items",
      "mcp__a2a-peptides__get_item",
      "mcp__a2a-peptides__compare_presentations",
      "mcp__a2a-peptides__find_licensed_supplier",
      "mcp__a2a-peptides__get_availability",
      "mcp__a2a-peptides__get_price",
      "mcp__a2a-peptides__get_lot_coa",
      "mcp__a2a-peptides__get_safety_label"
    ],
    "ask": [
      "mcp__a2a-peptides__gate_transaction",
      "mcp__a2a-peptides__get_label_and_indication",
      "mcp__a2a-peptides__verify_serialization",
      "mcp__a2a-peptides__create_order_intent",
      "mcp__a2a-peptides__a2a_handoff",
      "mcp__a2a-peptides__log_audit"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as a2a-peptides. Review it before you use it.

Capability tags behind 3 rules
  • mcp__a2a-peptides__gate_transaction outbound
  • mcp__a2a-peptides__get_enforcement_watch untrusted-input
  • mcp__a2a-peptides__get_availability private-data, untrusted-input

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/io.github.Dosidal/a2a-peptides/verify?hash=afac6ca358c275989cdb424f1b7c09a4af22bbd233a5cd2afc1a1d351a7f77af" | jq -e '.changed == false'

Pinned hash afac6ca358c2, from Nov 15, 2026, 00:18 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/io.github.Dosidal/a2a-peptides/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for io.github.Dosidal/a2a-peptides
[![anlyon.dev](https://anlyon.dev/badge/io.github.Dosidal/a2a-peptides.svg)](https://anlyon.dev/servers/io.github.Dosidal/a2a-peptides)

Source: MCP Registry · repository. Synced Nov 15, 2026, 00:17 UTC.

A2A Peptides MCP server: questions and answers

Answered from the scan above, not from the publisher's description.

Is the A2A Peptides MCP server safe?

No scan can promise that. What its definitions show: 20 tools, 6 of which can change, send or delete something, and 2 findings from fixed checks. Allow the reads, ask before each change, and deny the deletes; the permissions block on this page does that.

Can the A2A Peptides MCP server delete data?

No tool is classed as destructive: going by their definitions, none of them deletes, cancels or revokes anything.

Can the A2A Peptides MCP server do things that cannot be undone?

No tool is classed as irreversible: none of them sends, pays, publishes or merges, going by their definitions.

What tools does the A2A Peptides MCP server have?

20 tools: 6 write, 14 read. gate_transaction, get_label_and_indication, verify_serialization, create_order_intent, a2a_handoff, log_audit, resolve_jurisdiction, resolve_actor and 12 more.

Does the A2A Peptides MCP server send data to outside services?

1 tool can carry data out (it sends, posts or publishes, or takes a recipient, channel or URL): gate_transaction.

Has the A2A Peptides MCP server changed its tools?

Not since anlyon.dev started tracking it. Last scanned Nov 15, 2026.