Skip to content

ToolRouter

by Humanleap · remote · no sign-in to list tools · v0.3.2 · published by GitHub user Humanleap

The OpenRouter for tools. One MCP connection gives any AI agent 254 hosted tools, pay per call.

Deletes · 6Final · 1Changes · 22
CompareRegistry entry

48 tools: 6 can delete or cancel things, 1 do something that can't be undone, 22 change things and 19 only read.

Scanned Oct 21, 2026

32 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http toolrouter https://api.toolrouter.com/mcp

Findings

Matches of fixed checks, with the text they matched.

5 warn27 info
  • Warnaccount_preferences

    The server marks "account_preferences" as not read-only (readOnlyHint: false), and its words say it reads.

    Matched text

    annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "read": a word for reading.

    What this check looks for
  • Warnsubscription_manage

    The server marks "subscription_manage" as not read-only (readOnlyHint: false), and its words say it reads.

    Matched text

    annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":true}; The description's first verb is "get": a word for reading.

    What this check looks for
  • Warnbrain_lint

    The server marks "brain_lint" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "run": a word for a change.

    What this check looks for
  • Warnbrain_settings

    The server marks "brain_settings" as not read-only (readOnlyHint: false), and its words say it reads.

    Matched text

    annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "view": a word for reading.

    What this check looks for
  • Warnconnector_permissions

    The server marks "connector_permissions" as not read-only (readOnlyHint: false), and its words say it reads.

    Matched text

    annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":false}; The description's first verb is "view": a word for reading.

    What this check looks for
  • Infoaccount_list

    The description mentions "credentials".

    Matched text

    description: "...and pointers to the team's connectors, credentials, keys, and files."

    What this check looks for
Show 26 more findings

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

48 tools

Deletes or cancels 6Claude Code: deny
  • brain_deleteArchive a brain page.No findings

    Why it is in this group

    • The name "brain_delete" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Archive a brain page. It will no longer appear in searches or tool consultations.

    Annotations the server declares

    • title: Delete brain page
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • connector_removeDisconnect a connector.No findings

    Why it is in this group

    • The name "connector_remove" says "remove": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Disconnect a connector. Pass slug.

    Annotations the server declares

    • title: Remove Connector
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • credential_deleteRemove a saved credential.5 findings

    Why it is in this group

    • The name "credential_delete" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).

    Findings

    • Info

      The title mentions "Credential".

      Matched text

      title: "Delete Credential"

      What this check looks for
    • Info

      The annotations title mentions "Credential".

      Matched text

      annotations.title: "Delete Credential"

      What this check looks for
    • Info

      The description mentions "credential".

      Matched text

      description: "Remove a saved credential. If label is provided, removes only tha..."

      What this check looks for
    • Info

      The input schema at properties.name.description mentions "Credential".

      Matched text

      inputSchema.properties.name.description: "Credential name to delete (e.g. "ios_app_id")."

      What this check looks for
    • Info

      The input schema at properties.label.description mentions "credential".

      Matched text

      inputSchema.properties.label.description: "...te. Omit to remove all entries for this credential name."

      What this check looks for
    Description, as the server wrote it
    Remove a saved credential. If label is provided, removes only that specific entry. If no label, removes ALL entries for that credential name.

    Annotations the server declares

    • title: Delete Credential
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • file_deleteDelete a file.No findings

    Why it is in this group

    • The name "file_delete" says "delete": a word for removing or ending something.
    • The description says "Cannot be undone".
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Delete a file. Cannot be undone. For team files: requires owner/admin role.

    Annotations the server declares

    • title: Delete File
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • job_cancelCancel a running job.No findings

    Why it is in this group

    • The name "job_cancel" says "cancel": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Cancel a running job.

    Annotations the server declares

    • title: Cancel Job
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • key_deleteRevoke an API key.No findings

    Why it is in this group

    • The name "key_delete" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Revoke an API key. Refuses to revoke the currently-authenticating key.

    Annotations the server declares

    • title: Delete API Key
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
Can't be undone 1Claude Code: ask
  • routeSend a natural-language intent and optionally any dimensions you already know (tool, skill, model, input fields).No findings

    Why it is in this group

    • The description's first verb is "send": a word for sending, and what is sent cannot be taken back.
    Description, as the server wrote it
    Send a natural-language intent and optionally any dimensions you already know (tool, skill, model, input fields). Fills only the blanks via Jev, then either executes the call or returns a ready-to-run use_tool payload. Explicit values are never overridden. Returns candidates when confidence is low or no tool fits. Flow: route → if confident and complete, result is returned; otherwise use the pre-filled call with use_tool.

    Annotations the server declares

    • title: Route Intent
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
Changes things 22Claude Code: ask
  • account_preferencesRead or write billing preferences (auto-reload, budget cap, default context).1 finding

    Why it is in this group

    • The description's first verb is "read": a word for reading.
    • The server marks it as not read-only (readOnlyHint: false).

    Findings

    • Warn

      The server marks "account_preferences" as not read-only (readOnlyHint: false), and its words say it reads.

      Matched text

      annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "read": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Read or write billing preferences (auto-reload, budget cap, default context). Pass action: "get" to read, action: "set" with fields to write.

    Annotations the server declares

    • title: Account Preferences
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • account_setupInitialize or re-check your account, provision it when needed, and return your user ID and plan.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Initialize or re-check your account, provision it when needed, and return your user ID and plan. CALL THIS FIRST when the user asks to set up ToolRouter, connect their account, check their account status, or get started.

    Annotations the server declares

    • title: Set Up Account
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • account_switchSet the active billing context.No findings

    Why it is in this group

    • The description's first verb is "set": a word for a change.
    Description, as the server wrote it
    Set the active billing context. Accepts a slug (e.g. "personal", "team:nd7fx…") or team ID.

    Annotations the server declares

    • title: Switch Account
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • brain_addCreate a new brain page.No findings

    Why it is in this group

    • The name "brain_add" says "add": a word for a change.
    Description, as the server wrote it
    Create a new brain page. Knowledge you add here will be available to all future tool calls. Optional wing/room/hall organise the page in the MemPalace hierarchy for sharper retrieval.

    Annotations the server declares

    • title: Add to brain
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • brain_adminBrain admin operations.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Brain admin operations. Pass action: "lint" | "link" | "promote" | "rebuild_index" | "team_sleep". team_sleep enables/disables/runs the nightly team consolidation cycle — pass sub_action "enable" (with optional timezone), "disable", "status", or "run_now". Team admin role required for team_sleep actions.

    Annotations the server declares

    • title: Brain Admin
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • brain_lintRun maintenance checks on your brain: find stale pages, orphaned knowledge, and other issues.1 finding

    Why it is in this group

    • The description's first verb is "run": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "brain_lint" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "run": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Run maintenance checks on your brain: find stale pages, orphaned knowledge, and other issues.

    Annotations the server declares

    • title: Brain lint
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • brain_settingsView and toggle your brain settings.1 finding

    Why it is in this group

    • The description's first verb is "view": a word for reading.
    • The server marks it as not read-only (readOnlyHint: false).

    Findings

    • Warn

      The server marks "brain_settings" as not read-only (readOnlyHint: false), and its words say it reads.

      Matched text

      annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "view": a word for reading.

      What this check looks for
    Description, as the server wrote it
    View and toggle your brain settings. Currently supports: drawers_enabled (store raw tool output alongside summaries for richer recall).

    Annotations the server declares

    • title: Brain settings
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • brain_updateEdit an existing brain page's content or metadata.No findings

    Why it is in this group

    • The name "brain_update" says "update": a word for a change.
    Description, as the server wrote it
    Edit an existing brain page's content or metadata. wing/room/hall can be patched to re-file a page. scope can be changed to move a page between your personal and team brain — useful when an auto-ingested page landed in the wrong place. Moving a page to team scope requires team admin role.

    Annotations the server declares

    • title: Update brain page
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • connector_addConnect a new OAuth account or MCP server.No findings

    Why it is in this group

    • The name "connector_add" says "add": a word for a change.
    Description, as the server wrote it
    Connect a new OAuth account or MCP server. For OAuth: pass type: "oauth", kind: "slack". For MCP catalog: pass catalog_slug. For custom MCP: pass url + auth_type.

    Annotations the server declares

    • title: Add Connector
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • connector_permissionsView or set permissions for tools on a connected MCP server — which tools are allowed, rate limits, budget caps, argument restrictions.1 finding

    Why it is in this group

    • The description's first verb is "view": a word for reading.
    • The server marks it as not read-only (readOnlyHint: false).

    Findings

    • Warn

      The server marks "connector_permissions" as not read-only (readOnlyHint: false), and its words say it reads.

      Matched text

      annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":false}; The description's first verb is "view": a word for reading.

      What this check looks for
    Description, as the server wrote it
    View or set permissions for tools on a connected MCP server — which tools are allowed, rate limits, budget caps, argument restrictions. Pass the connector slug (from connector_list) and action: "list" to see current rules, or action: "set" with tool_name + rules to update one. Team scope requires admin role.

    Annotations the server declares

    • title: Connector Permissions
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • credential_defaultSet the default value for a multi-value credential.4 findings

    Why it is in this group

    • The description's first verb is "set": a word for a change.

    Findings

    • Info

      The title mentions "Credential".

      Matched text

      title: "Set Default Credential"

      What this check looks for
    • Info

      The annotations title mentions "Credential".

      Matched text

      annotations.title: "Set Default Credential"

      What this check looks for
    • Info

      The description mentions "credential".

      Matched text

      description: "Set the default value for a multi-value credential."

      What this check looks for
    • Info

      The input schema at properties.name.description mentions "Credential".

      Matched text

      inputSchema.properties.name.description: "Credential name (e.g. "ios_app_id")."

      What this check looks for
    Description, as the server wrote it
    Set the default value for a multi-value credential.

    Annotations the server declares

    • title: Set Default Credential
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • credential_saveSave a credential (BYOK provider API key).7 findings

    Why it is in this group

    • The name "credential_save" says "save": a word for a change.

    Findings

    • Info

      The title mentions "Credential".

      Matched text

      title: "Save Credential"

      What this check looks for
    • Info

      The annotations title mentions "Credential".

      Matched text

      annotations.title: "Save Credential"

      What this check looks for
    • Info

      The description mentions "credential".

      Matched text

      description: "Save a credential (BYOK provider API key). Saved keys per..."

      What this check looks for
    • Info

      The input schema at properties.name.description mentions "Credential".

      Matched text

      inputSchema.properties.name.description: "Credential name from the tool requirements (e.g. "..."

      What this check looks for
    • Info

      The input schema at properties.value.description mentions "credential".

      Matched text

      inputSchema.properties.value.description: "The credential value to save."

      What this check looks for
    • Info

      The input schema at properties.label.description mentions "credential".

      Matched text

      inputSchema.properties.label.description: "...hen saving multiple values for the same credential."

      What this check looks for
    • Info

      The input schema at properties.is_default.description mentions "credential".

      Matched text

      inputSchema.properties.is_default.description: "Set this value as the default for this credential."

      What this check looks for
    Description, as the server wrote it
    Save a credential (BYOK provider API key). Saved keys persist across sessions and are used automatically.

    Annotations the server declares

    • title: Save Credential
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • credits_balanceCurrent balance, plan tier, rate limits, and any negative-balance warnings for the active context.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Current balance, plan tier, rate limits, and any negative-balance warnings for the active context.

    Annotations the server declares

    • title: Credits Balance
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • credits_usageUsage summary or history.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Usage summary or history. Pass scope: "me" | "team" and detail: "tool" | "skill". Sorted by cost with _others rollup.

    Annotations the server declares

    • title: Credits Usage
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • feedback_debugReport a ToolRouter platform bug that blocks you from completing the user's task.1 finding

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    Findings

    • Info

      The description mentions "credentials".

      Matched text

      description: "...cted errors like invalid input, missing credentials, insufficient balance, rate limits, or..."

      What this check looks for
    Description, as the server wrote it
    Report a ToolRouter platform bug that blocks you from completing the user's task. Use this when you suspect the issue is on our side — a tool crashed, returned malformed data, timed out unexpectedly, or behaved inconsistently. Include the relevant ToolRouter errors, call IDs, non-sensitive input shape, retries, and expected behavior. Do not include chat history, unrelated conversation text, uploaded file contents, personal data, API keys, or secrets. Reports are stored and reviewed within hours. Skip this for expected errors like invalid input, missing credentials, insufficient balance, rate limits, or genuine "not found" results — those aren't bugs. Limit: 5 reports per hour.

    Annotations the server declares

    • title: Report a Bug
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • feedback_request_toolAsk ToolRouter to build a tool that does not exist yet.No findings

    Why it is in this group

    • The name "feedback_request_tool" says "request": a word for a change.
    Description, as the server wrote it
    Ask ToolRouter to build a tool that does not exist yet. Use this when discover returned nothing useful for what the user needs. Describe the capability in plain terms — do not include personal data, API keys, or secrets. Requests go straight to the team. Limit: 5 per hour.

    Annotations the server declares

    • title: Request a Tool
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • feedback_reviewSubmit a review or star rating.No findings

    Why it is in this group

    • The description's first verb is "submit": a word for a change.
    Description, as the server wrote it
    Submit a review or star rating.

    Annotations the server declares

    • title: Submit Review
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • file_writeCreate or update a file.No findings

    Why it is in this group

    • The name "file_write" says "write": a word for a change.
    Description, as the server wrote it
    Create or update a file. Pass mode: "create" | "update". Binary uploads: call with binary: true to get an upload_url, then PUT bytes, then call with mode: "finalize".

    Annotations the server declares

    • title: Write File
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • key_createCreate a new API key.No findings

    Why it is in this group

    • The name "key_create" says "create": a word for a change.
    Description, as the server wrote it
    Create a new API key. Returns the secret once — save it immediately.

    Annotations the server declares

    • title: Create API Key
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • subscription_manageGet a Stripe management URL (portal, upgrade, or cancel).1 finding

    Why it is in this group

    • The description's first verb is "get": a word for reading.
    • The server marks it as not read-only (readOnlyHint: false).

    Findings

    • Warn

      The server marks "subscription_manage" as not read-only (readOnlyHint: false), and its words say it reads.

      Matched text

      annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":true}; The description's first verb is "get": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Get a Stripe management URL (portal, upgrade, or cancel). Also covers billing portal — returns the URL for the user to open.

    Annotations the server declares

    • title: Manage Subscription
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • top_up_creditsAdd credits to your account.No findings

    Why it is in this group

    • The description's first verb is "add": a word for a change.
    Description, as the server wrote it
    Add credits to your account. Returns a Stripe checkout URL — share it with the user to complete payment. Minimum $1.

    Annotations the server declares

    • title: Top Up Credits
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • use_toolCall a ToolRouter catalogue tool.No findings

    Why it is in this group

    • The description's first verb is "call": a word for a change.
    Description, as the server wrote it
    Call a ToolRouter catalogue tool. Prefer `route` with a natural-language intent when you do not already know the tool and skill — it picks them, fills arguments, and runs the call. Use discover when you need schemas or a catalogue listing, then pass the exact tool name and skill here. IMPORTANT: "discover", "route", "credits_balance", and other built-in tools are NOT catalogue tools — call them directly, never through use_tool. Long-running tools return a job_id — poll with job_get. If a skill needs an image_url or file URL and you have a local file or base64 image, use file_write first to get a hosted URL, then pass that URL to the skill. BRAIN: Some tools require you to consult brain_query first. If use_tool returns an error about brain_context, call brain_query with a relevant query, then pass the result text as brain_context in your use_tool input.

    Annotations the server declares

    • title: Use Tool
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
Only reads 19Claude Code: allow
  • account_listList all billing contexts (personal + teams) or get detail on one.1 finding

    Why it is in this group

    • The name "account_list" says "list": a word for reading.

    Findings

    • Info

      The description mentions "credentials".

      Matched text

      description: "...and pointers to the team's connectors, credentials, keys, and files."

      What this check looks for
    Description, as the server wrote it
    List all billing contexts (personal + teams) or get detail on one. No slug → summary list. With slug → full detail including team members, role, subscription status, and pointers to the team's connectors, credentials, keys, and files.

    Annotations the server declares

    • title: List Accounts & Teams
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • brain_expandRetrieve the verbatim source text (a "drawer") linked from a brain page.1 finding

    Why it is in this group

    • The description's first verb is "retrieve": a word for reading.

    Findings

    • Info

      The description mentions "credentials".

      Matched text

      description: "...the original tool output, redacted for credentials. Returns 404 if the page has no linked..."

      What this check looks for
    Description, as the server wrote it
    Retrieve the verbatim source text (a "drawer") linked from a brain page. Use this when a summary lacks specifics you need — drawers contain the original tool output, redacted for credentials. Returns 404 if the page has no linked drawer (not all pages do — drawers are a Step 4 feature for allowlisted tools only).

    Annotations the server declares

    • title: Expand brain page (reveal raw source)
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • brain_querySearch your knowledge brain for relevant information.No findings

    Why it is in this group

    • The name "brain_query" says "query": a word for reading.
    Description, as the server wrote it
    Search your knowledge brain for relevant information. Returns pages ranked by relevance. Optional wing/hall narrow the search to a slice of the brain (e.g. wing="engineering", hall="preference").

    Annotations the server declares

    • title: Search brain
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • brain_statusView brain page counts and recent pages for your personal and team brain.No findings

    Why it is in this group

    • The name "brain_status" says "status": a word for reading.
    Description, as the server wrote it
    View brain page counts and recent pages for your personal and team brain.

    Annotations the server declares

    • title: Brain status
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • brain_wingsList the wings of your brain — the top-level areas your knowledge is organised under (e.g.No findings

    Why it is in this group

    • The description's first verb is "list": a word for reading.
    Description, as the server wrote it
    List the wings of your brain — the top-level areas your knowledge is organised under (e.g. "engineering", "family"). For each wing returns the rooms and halls inside, page count, and last-updated time. Use this to discover the right wing/hall to pass to brain_query.

    Annotations the server declares

    • title: List brain wings
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • connector_listList connected accounts and MCP servers (summary) or detail on one connector.No findings

    Why it is in this group

    • The name "connector_list" says "list": a word for reading.
    Description, as the server wrote it
    List connected accounts and MCP servers (summary) or detail on one connector. Pass slug for detail including every tool the connector exposes. Optional type: "oauth" | "mcp" filter. Pass include_available: true to also see available catalog MCPs you can connect.

    Annotations the server declares

    • title: List Connectors
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • credential_guideGet setup instructions for a specific credential.4 findings

    Why it is in this group

    • The description's first verb is "get": a word for reading.

    Findings

    • Info

      The title mentions "Credential".

      Matched text

      title: "Credential Setup Guide"

      What this check looks for
    • Info

      The annotations title mentions "Credential".

      Matched text

      annotations.title: "Credential Setup Guide"

      What this check looks for
    • Info

      The description mentions "credential".

      Matched text

      description: "Get setup instructions for a specific credential."

      What this check looks for
    • Info

      The input schema at properties.name.description mentions "Credential".

      Matched text

      inputSchema.properties.name.description: "Credential name (e.g. "ios_app_id", "play_store_ap..."

      What this check looks for
    Description, as the server wrote it
    Get setup instructions for a specific credential.

    Annotations the server declares

    • title: Credential Setup Guide
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • credential_listList saved credentials (summary) or detail on one.4 findings

    Why it is in this group

    • The name "credential_list" says "list": a word for reading.

    Findings

    • Info

      The title mentions "Credentials".

      Matched text

      title: "List Credentials"

      What this check looks for
    • Info

      The annotations title mentions "Credentials".

      Matched text

      annotations.title: "List Credentials"

      What this check looks for
    • Info

      The description mentions "credentials".

      Matched text

      description: "List saved credentials (summary) or detail on one. Pass name f..."

      What this check looks for
    • Info

      The input schema at properties.name.description mentions "Credential".

      Matched text

      inputSchema.properties.name.description: "Credential name for detail view. Omit to list all..."

      What this check looks for
    Description, as the server wrote it
    List saved credentials (summary) or detail on one. Pass name for detail view. Pass show_available: true to include the full credential catalog.

    Annotations the server declares

    • title: List Credentials
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • discoverFind the right ToolRouter tool for your task.No findings

    Why it is in this group

    • The description's first verb is "find": a word for reading.
    Description, as the server wrote it
    Find the right ToolRouter tool for your task. Describe what you need in plain language. Examples: "analyze a website", "research competitors", "find prospect companies", "check DNS records". Exact tool name (e.g. "seo") returns full schemas and examples. Flow: prefer route({ intent }) to pick and run a tool. Use discover when you need schemas or a listing, then call use_tool(tool, skill, input). Every discover response also includes a top-level `connectors` array listing SaaS accounts the user has already connected (LinkedIn, Google, Notion, etc.). Use that to pick the right tool and account without asking — e.g. if `connectors` shows LinkedIn, the linkedin-post tool is ready to use. Categories: data, media, search, marketing, development, communication, analytics, productivity, ai, finance, security, infrastructure

    Annotations the server declares

    • title: Discover Tools
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • file_listList or search files.No findings

    Why it is in this group

    • The name "file_list" says "list": a word for reading.
    Description, as the server wrote it
    List or search files. Optional query triggers semantic search. Supports section, tags, plan_status, limit, cursor filters.

    Annotations the server declares

    • title: List Files
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • file_readRead a file's full content.No findings

    Why it is in this group

    • The name "file_read" says "read": a word for reading.
    Description, as the server wrote it
    Read a file's full content. Text files return content inline. Binary files (images, video) return a download URL.

    Annotations the server declares

    • title: Read File
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • invoice_listList invoices for the active billing context.No findings

    Why it is in this group

    • The name "invoice_list" says "list": a word for reading.
    Description, as the server wrote it
    List invoices for the active billing context.

    Annotations the server declares

    • title: List Invoices
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • job_getGet job status and result.No findings

    Why it is in this group

    • The name "job_get" says "get": a word for reading.
    Description, as the server wrote it
    Get job status and result. Returns status: running | completed | failed and result when terminal. Keep polling until you get a terminal status.

    Annotations the server declares

    • title: Get Job
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • job_listList your active and recent jobs.No findings

    Why it is in this group

    • The name "job_list" says "list": a word for reading.
    Description, as the server wrote it
    List your active and recent jobs. Optional status filter.

    Annotations the server declares

    • title: List Jobs
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • key_listList API keys (summary) or get detail on one key.No findings

    Why it is in this group

    • The name "key_list" says "list": a word for reading.
    Description, as the server wrote it
    List API keys (summary) or get detail on one key. Pass key_id for detail view.

    Annotations the server declares

    • title: List API Keys
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • outfit_listList your outfits.No findings

    Why it is in this group

    • The name "outfit_list" says "list": a word for reading.
    Description, as the server wrote it
    List your outfits.

    Annotations the server declares

    • title: List Outfits
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • persona_listList your personas.No findings

    Why it is in this group

    • The name "persona_list" says "list": a word for reading.
    Description, as the server wrote it
    List your personas.

    Annotations the server declares

    • title: List Personas
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • product_listList your products.No findings

    Why it is in this group

    • The name "product_list" says "list": a word for reading.
    Description, as the server wrote it
    List your products.

    Annotations the server declares

    • title: List Products
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • scene_listList your scenes.No findings

    Why it is in this group

    • The name "scene_list" says "list": a word for reading.
    Description, as the server wrote it
    List your scenes.

    Annotations the server declares

    • title: List Scenes
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 0.3.2. Values in angle brackets are yours to fill in.

claude mcp add --transport http toolrouter https://api.toolrouter.com/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__toolrouter__account_list",
      "mcp__toolrouter__invoice_list",
      "mcp__toolrouter__key_list",
      "mcp__toolrouter__credential_list",
      "mcp__toolrouter__credential_guide",
      "mcp__toolrouter__file_list",
      "mcp__toolrouter__file_read",
      "mcp__toolrouter__persona_list",
      "mcp__toolrouter__scene_list",
      "mcp__toolrouter__product_list",
      "mcp__toolrouter__outfit_list",
      "mcp__toolrouter__connector_list",
      "mcp__toolrouter__job_list",
      "mcp__toolrouter__job_get",
      "mcp__toolrouter__discover",
      "mcp__toolrouter__brain_query",
      "mcp__toolrouter__brain_status",
      "mcp__toolrouter__brain_expand",
      "mcp__toolrouter__brain_wings"
    ],
    "ask": [
      "mcp__toolrouter__account_setup",
      "mcp__toolrouter__account_switch",
      "mcp__toolrouter__account_preferences",
      "mcp__toolrouter__credits_balance",
      "mcp__toolrouter__credits_usage",
      "mcp__toolrouter__subscription_manage",
      "mcp__toolrouter__key_create",
      "mcp__toolrouter__credential_save",
      "mcp__toolrouter__credential_default",
      "mcp__toolrouter__file_write",
      "mcp__toolrouter__connector_add",
      "mcp__toolrouter__brain_admin",
      "mcp__toolrouter__feedback_review",
      "mcp__toolrouter__feedback_debug",
      "mcp__toolrouter__feedback_request_tool",
      "mcp__toolrouter__top_up_credits",
      "mcp__toolrouter__route",
      "mcp__toolrouter__use_tool",
      "mcp__toolrouter__brain_add",
      "mcp__toolrouter__brain_update",
      "mcp__toolrouter__brain_lint",
      "mcp__toolrouter__brain_settings",
      "mcp__toolrouter__connector_permissions"
    ],
    "deny": [
      "mcp__toolrouter__key_delete",
      "mcp__toolrouter__credential_delete",
      "mcp__toolrouter__file_delete",
      "mcp__toolrouter__connector_remove",
      "mcp__toolrouter__job_cancel",
      "mcp__toolrouter__brain_delete"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as toolrouter. Review it before you use it.