Skip to content
anlyon.devby Anlyon

Iris MCP server

io.github.JCLVSH/irisJCLVSHstreamable-httpv0.25.3Scanned

Run multi-channel outreach: campaigns, contacts, conversations, and AI-drafted messages.

81 tools: 17 can delete or cancel things, 27 change things and 37 only read.

Tools: 17 delete, 0 irreversible, 27 write, 37 read.
  • Reads private data · 21
  • Reads text others write · 16
  • Can send data out · 11
  • 4 findings

Tools listed without sign-in. Remote posture

With Anlyon

17 tools here can delete or cancel things. Govern them.

  • Anlyon lists the tools and adopts none.
  • Each tool you adopt gets approvals and receipts.
  • Your agent never holds the key.
Govern this server →

A tool your agent calls directly is not routed through Anlyon and is not governed by it. anlyon.dev only lists and labels, and these labels are the same either way.

Compare with similar serversMarkdownJSONReport this listing

What the Iris MCP server can do

The Iris MCP server is published by the GitHub account JCLVSH. It has 81 tools. It can delete or cancel things (17 tools: delete_campaign, delete_campaign_chat, delete_target_profile, delete_contact and 13 more) and create or change data (27 tools: create_campaign, update_campaign, add_campaign_contacts, rename_campaign_chat and 23 more). 37 tools only read.

21 tools read private data (list_campaign_contacts, list_campaign_chats, get_campaign_chat_messages and 18 more); 16 tools bring in text other people can write (list_campaign_chats, get_campaign_chat_messages, list_contact_conversations and 13 more); 11 tools can send data out of your system (rename_campaign_chat, create_contact, update_contact and 8 more). On its own it has all three parts of a prompt-injection exfiltration path: private data, text others write, and a way out.

The fixed checks matched 4 findings (annotation-conflict). Each one comes with the text it matched.

Its remote endpoint lists its tools without sign-in.

Last scanned Nov 13, 2026, version 0.25.3.

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

81 tools

Deletes or cancels 17Claude Code: deny
  • approve_messageapprove a pending message for sending.Can send data outNo findings

    Why it is in this group

    • The name "approve_message" says "approve": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • outboundThe name "approve_message" says "approve" and "message": it writes something other people read.
    Description, as the server wrote it
    approve a pending message for sending. requires send scope.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
  • bulk_message_actionapprove or reject multiple messages at once.No findings

    Why it is in this group

    • The description's first verb is "approve": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    approve or reject multiple messages at once. requires send scope.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
  • configure_respondercreate or update the responder config (merge: only the fields you send change; the first call creates the config).No findings

    Why it is in this group

    • The description's first verb is "create": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    create or update the responder config (merge: only the fields you send change; the first call creates the config). with auto_reply on, replies are sent without review. Instagram only allows a reply within 24 hours of the person's last message, and only to someone who wrote first. requires write scope.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
  • create_conversation_messagecreate a message in a conversation.Can send data outNo findings

    Why it is in this group

    • The name "create_conversation_message" says "create": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • outboundThe name "create_conversation_message" says "create" and "message": it writes something other people read.
    Description, as the server wrote it
    create a message in a conversation. status pending_approval places it in the human review queue instead of sending. requires write scope.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
  • create_responder_comment_triggercreate a comment trigger.Can send data outNo findings

    Why it is in this group

    • The name "create_responder_comment_trigger" says "create": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • outboundThe name "create_responder_comment_trigger" says "create" and "comment": it writes something other people read.
    Description, as the server wrote it
    create a comment trigger. when someone comments the keyword on the account's instagram post, iris sends that person one direct message: the owner's message as written, followed by the notice that it is automated. instagram allows one such message per comment, within 7 days of the comment, and nothing more unless the person replies. it only sends while status.comment_triggers on get_responder is ready; needs_permission means the owner has to reconnect instagram from the responder settings page in the iris web app, unavailable means the feature isn't offered on the account yet. each message sent counts as a message against the plan. needs an API key and a connected instagram account; x402 and MPP identities cannot use it. at most 20 triggers per account, and a second trigger with the same keyword on the same post is refused. requires write scope.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
  • delete_audiencedelete a library audience profile.No findings

    Why it is in this group

    • The name "delete_audience" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    delete a library audience profile. campaigns it was attached to keep their copy. requires write scope.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
  • delete_campaignsoft-delete a campaign (sets status to deleted).No findings

    Why it is in this group

    • The name "delete_campaign" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    soft-delete a campaign (sets status to deleted). requires write scope.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
  • delete_campaign_chatsoft-delete a chat session.No findings

    Why it is in this group

    • The name "delete_campaign_chat" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    soft-delete a chat session. requires write scope.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
  • delete_contactsoft-delete a contact.No findings

    Why it is in this group

    • The name "delete_contact" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    soft-delete a contact. requires write scope.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
  • delete_notificationdelete a notification.No findings

    Why it is in this group

    • The name "delete_notification" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    delete a notification. requires write scope.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
  • delete_responder_comment_triggerdelete a comment trigger.No findings

    Why it is in this group

    • The name "delete_responder_comment_trigger" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    delete a comment trigger. requires write scope.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
  • delete_target_profiledelete a target profile from a campaign.No findings

    Why it is in this group

    • The name "delete_target_profile" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    delete a target profile from a campaign. requires write scope.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
  • reject_messagereject a pending message with an optional reason.Can send data outNo findings

    Why it is in this group

    • The name "reject_message" says "reject": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • outboundThe name "reject_message" says "reject" and "message": it writes something other people read.
    Description, as the server wrote it
    reject a pending message with an optional reason. requires send scope.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
  • retry_messageretry sending a failed message.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    retry sending a failed message. requires send scope.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
  • send_channel_messagesend a message through a specific channel in a conversation.Can send data outNo findings

    Why it is in this group

    • The name "send_channel_message" says "send": a word for sending, and what is sent cannot be taken back.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • outboundThe name "send_channel_message" says "send": it sends or publishes something to other people.
    Description, as the server wrote it
    send a message through a specific channel in a conversation. requires send scope.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
  • set_conversation_responderpause or resume the responder for a single conversation.No findings

    Why it is in this group

    • The name "set_conversation_responder" says "set": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    pause or resume the responder for a single conversation. pausing works on any conversation; resuming is refused after the person asked iris to stop. requires write scope.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
  • update_responder_comment_triggerupdate a comment trigger's keyword, message, media_id, or enabled state.Can send data outNo findings

    Why it is in this group

    • The name "update_responder_comment_trigger" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • outboundThe name "update_responder_comment_trigger" says "update" and "comment": it writes something other people read.
    Description, as the server wrote it
    update a comment trigger's keyword, message, media_id, or enabled state. give at least one field besides id. someone else's trigger, or an id that isn't a comment trigger on this account, is a 404. requires write scope.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
Changes things 27Claude Code: ask
  • add_campaign_contactsadd contacts to a campaign, by id or by creating them inline.No findings

    Why it is in this group

    • The name "add_campaign_contacts" says "add": a word for a change.
    Description, as the server wrote it
    add contacts to a campaign, by id or by creating them inline. a campaign needs at least one contact before it can be activated. requires write scope.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
  • analyze_campaignqueue AI analysis of a campaign to generate its target profiles: from the product for product_promotion campaigns, from goal_description for any other campaign.1 finding

    Why it is in this group

    • The name "analyze_campaign" says "analyze": a word for reading.
    • The server marks it as not read-only (readOnlyHint: false).

    Findings

    • Warn

      The server marks "analyze_campaign" as not read-only (readOnlyHint: false), and its words say it reads.

      Matched text

      annotations: {"readOnlyHint":false,"destructiveHint":false}; The name "analyze_campaign" says "analyze": a word for reading.

      What this check looks for
    Description, as the server wrote it
    queue AI analysis of a campaign to generate its target profiles: from the product for product_promotion campaigns, from goal_description for any other campaign. runs asynchronously; poll get_campaign until analysis_status is completed, then search_campaign_contacts. requires write scope.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
  • analyze_responseanalyze an inbound message using AI to determine sentiment, intent, and suggested actions.Reads private dataReads text others write1 finding

    Why it is in this group

    • The name "analyze_response" says "analyze": a word for reading.
    • The server marks it as not read-only (readOnlyHint: false).

    What it can reach

    • private-dataThe description's first sentence says "analyze" and "message": it reads messages.
    • untrusted-inputThe description's first sentence says "analyze" and "message": it reads messages, which other people can write.

    Findings

    • Warn

      The server marks "analyze_response" as not read-only (readOnlyHint: false), and its words say it reads.

      Matched text

      annotations: {"readOnlyHint":false,"destructiveHint":false}; The name "analyze_response" says "analyze": a word for reading.

      What this check looks for
    Description, as the server wrote it
    analyze an inbound message using AI to determine sentiment, intent, and suggested actions. requires generate scope.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
  • attach_audience_to_campaigncopy a library audience into a campaign.No findings

    Why it is in this group

    • The name "attach_audience_to_campaign" says "attach": a word for a change.
    Description, as the server wrote it
    copy a library audience into a campaign. the response is the campaign's own copy (a target profile) - editing it never touches the library master. if the campaign already has a same-named profile, the existing copy is returned. requires write scope.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
  • bulk_import_contactsimport multiple contacts at once, optionally adding them to a campaign.No findings

    Why it is in this group

    • The name "bulk_import_contacts" says "import": a word for a change.
    Description, as the server wrote it
    import multiple contacts at once, optionally adding them to a campaign. requires write scope.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
  • check_channel_availabilitycheck which outreach channels are available and configured.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    check which outreach channels are available and configured. requires read scope.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
  • configure_autopilotcreate or update the autopilot config (merge: only the fields you send change; first call creates the config with defaults).No findings

    Why it is in this group

    • The description's first verb is "create": a word for a change.
    Description, as the server wrote it
    create or update the autopilot config (merge: only the fields you send change; first call creates the config with defaults). autopilot is review-only - drafts wait in the approval queue, nothing sends without approval. requires write scope.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
  • create_audiencecreate a library audience profile manually.No findings

    Why it is in this group

    • The name "create_audience" says "create": a word for a change.
    Description, as the server wrote it
    create a library audience profile manually. names are unique per library (case-insensitive). requires write scope.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
  • create_campaigncreate a new outreach campaign.No findings

    Why it is in this group

    • The name "create_campaign" says "create": a word for a change.
    Description, as the server wrote it
    create a new outreach campaign. requires write scope.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
  • create_contactcreate a new contact.Can send data outNo findings

    Why it is in this group

    • The name "create_contact" says "create": a word for a change.

    What it can reach

    • outboundThe input takes a destination (input.phone): what the tool writes goes there.
    Description, as the server wrote it
    create a new contact. requires write scope.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
  • create_conversationfind-or-create a conversation for a contact - the hub conversation by default, or the campaign-scoped thread when campaign_id is passed (contact must be in that campaign).No findings

    Why it is in this group

    • The name "create_conversation" says "create": a word for a change.
    Description, as the server wrote it
    find-or-create a conversation for a contact - the hub conversation by default, or the campaign-scoped thread when campaign_id is passed (contact must be in that campaign). requires write scope.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
  • create_target_profilecreate a target profile for a campaign.No findings

    Why it is in this group

    • The name "create_target_profile" says "create": a word for a change.
    Description, as the server wrote it
    create a target profile for a campaign. requires write scope.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
  • generate_audiencesAI-generate audience profiles from a product (scrape + analysis) into the library.Reads text others writeNo findings

    Why it is in this group

    • The name "generate_audiences" says "generate": a word for a change.

    What it can reach

    • untrusted-inputThe description's first sentence says "scrape": it reads web pages, which anyone can write.
    Description, as the server wrote it
    AI-generate audience profiles from a product (scrape + analysis) into the library. generated names already in the library are skipped, not overwritten. rate limited to 5 per hour. requires generate scope.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
  • generate_campaign_contentgenerate campaign-level outreach content (email sequence, templates) from a campaign brief.No findings

    Why it is in this group

    • The name "generate_campaign_content" says "generate": a word for a change.
    Description, as the server wrote it
    generate campaign-level outreach content (email sequence, templates) from a campaign brief. content-first: takes the strategy inline, not a campaign id. requires generate scope.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
  • generate_contentgenerate AI outreach content (email or DM draft) for a contact/campaign.No findings

    Why it is in this group

    • The name "generate_content" says "generate": a word for a change.
    Description, as the server wrote it
    generate AI outreach content (email or DM draft) for a contact/campaign. the contact's tags + enrichment_data feed the generation context automatically. requires generate scope.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
  • mark_all_notifications_readmark all notifications as read.No findings

    Why it is in this group

    • The name "mark_all_notifications_read" says "mark": a word for a change.
    Description, as the server wrote it
    mark all notifications as read. requires write scope.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
  • mark_conversation_readmark a conversation as read.No findings

    Why it is in this group

    • The name "mark_conversation_read" says "mark": a word for a change.
    Description, as the server wrote it
    mark a conversation as read. requires write scope.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
  • mark_message_sentmark a pending manual-channel draft (tiktok, or instagram cold first-touch) as sent outside the platform.Can send data outNo findings

    Why it is in this group

    • The name "mark_message_sent" says "mark": a word for a change.

    What it can reach

    • outboundThe name "mark_message_sent" says "mark" and "message": it writes something other people read.
    Description, as the server wrote it
    mark a pending manual-channel draft (tiktok, or instagram cold first-touch) as sent outside the platform. API-sendable drafts must use approve_message instead. requires write scope.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
  • rename_campaign_chatrename a chat session.Can send data outNo findings

    Why it is in this group

    • The name "rename_campaign_chat" says "rename": a word for a change.

    What it can reach

    • outboundThe input takes a destination (input.chat_id): what the tool writes goes there.
    Description, as the server wrote it
    rename a chat session. requires write scope.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
  • run_autopilot_nowqueue a manual autopilot run immediately (insights refresh + discovery top-up on the standing campaign).No findings

    Why it is in this group

    • The name "run_autopilot_now" says "run": a word for a change.
    Description, as the server wrote it
    queue a manual autopilot run immediately (insights refresh + discovery top-up on the standing campaign). steps that already completed today are skipped. rate limited to 2 per hour. requires generate scope.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
  • search_campaign_contactssearch for contacts matching a campaign's target profiles.Reads private data1 finding

    Why it is in this group

    • The name "search_campaign_contacts" says "search": a word for reading.
    • The server marks it as not read-only (readOnlyHint: false).

    What it can reach

    • private-dataThe name "search_campaign_contacts" says "search" and "contact": it reads contacts.
    • private-dataThe description's first sentence says "search" and "contact": it reads contacts.

    Findings

    • Warn

      The server marks "search_campaign_contacts" as not read-only (readOnlyHint: false), and its words say it reads.

      Matched text

      annotations: {"readOnlyHint":false,"destructiveHint":false}; The name "search_campaign_contacts" says "search": a word for reading.

      What this check looks for
    Description, as the server wrote it
    search for contacts matching a campaign's target profiles. requires generate scope.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
  • search_contactskick off a multi-source contact discovery job (Apify-backed).Reads private data1 finding

    Why it is in this group

    • The name "search_contacts" says "search": a word for reading.
    • The server marks it as not read-only (readOnlyHint: false).

    What it can reach

    • private-dataThe name "search_contacts" says "search" and "contact": it reads contacts.
    • private-dataThe description's first sentence says "contact": it reads contacts.

    Findings

    • Warn

      The server marks "search_contacts" as not read-only (readOnlyHint: false), and its words say it reads.

      Matched text

      annotations: {"readOnlyHint":false,"destructiveHint":false}; The name "search_contacts" says "search": a word for reading.

      What this check looks for
    Description, as the server wrote it
    kick off a multi-source contact discovery job (Apify-backed). returns a job_id and contacts when ready (waits up to 90s; if status=queued, poll get_discovery_job). closed source list: google_maps, instagram, twitter, tiktok, reddit. requires generate scope.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
  • submit_message_feedbacksubmit feedback on an AI-generated message to improve future generations.Can send data outNo findings

    Why it is in this group

    • The name "submit_message_feedback" says "submit": a word for a change.

    What it can reach

    • outboundThe name "submit_message_feedback" says "submit" and "message": it writes something other people read.
    Description, as the server wrote it
    submit feedback on an AI-generated message to improve future generations. requires send scope.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
  • update_campaignupdate a campaign's details.No findings

    Why it is in this group

    • The name "update_campaign" says "update": a word for a change.
    Description, as the server wrote it
    update a campaign's details. requires write scope.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
  • update_contactupdate a contact's details.Can send data outNo findings

    Why it is in this group

    • The name "update_contact" says "update": a word for a change.

    What it can reach

    • outboundThe input takes a destination (input.phone): what the tool writes goes there.
    Description, as the server wrote it
    update a contact's details. requires write scope.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
  • update_conversationupdate a conversation's status: active, archived, or closed.No findings

    Why it is in this group

    • The name "update_conversation" says "update": a word for a change.
    Description, as the server wrote it
    update a conversation's status: active, archived, or closed. requires write scope.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
  • update_notificationupdate a notification (e.g., mark as read).No findings

    Why it is in this group

    • The name "update_notification" says "update": a word for a change.
    Description, as the server wrote it
    update a notification (e.g., mark as read). requires write scope.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
Only reads 37Show 37 read-only tools
  • get_ai_usageget AI generation usage limits and current counts for the billing period.No findings

    Why it is in this group

    • The name "get_ai_usage" says "get": a word for reading.
    Description, as the server wrote it
    get AI generation usage limits and current counts for the billing period. requires read scope.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
  • get_analytics_overviewget a high-level overview of all campaign analytics.No findings

    Why it is in this group

    • The name "get_analytics_overview" says "get": a word for reading.
    Description, as the server wrote it
    get a high-level overview of all campaign analytics. requires read scope.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
  • get_autopilot_statusget autopilot status: whether it's configured, the current config, the pending-review count for the standing campaign, and the latest run's step results.Reads text others writeNo findings

    Why it is in this group

    • The name "get_autopilot_status" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe description's first sentence says "get" and "review": it reads comments, which other people can write.
    Description, as the server wrote it
    get autopilot status: whether it's configured, the current config, the pending-review count for the standing campaign, and the latest run's step results. requires read scope.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
  • get_billing_plansget all available billing plans with pricing and feature limits.No findings

    Why it is in this group

    • The name "get_billing_plans" says "get": a word for reading.
    Description, as the server wrote it
    get all available billing plans with pricing and feature limits. requires read scope.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
  • get_campaignget a campaign by ID with stats.No findings

    Why it is in this group

    • The name "get_campaign" says "get": a word for reading.
    Description, as the server wrote it
    get a campaign by ID with stats. requires read scope.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
  • get_campaign_analyticsget detailed analytics for a specific campaign.No findings

    Why it is in this group

    • The name "get_campaign_analytics" says "get": a word for reading.
    Description, as the server wrote it
    get detailed analytics for a specific campaign. requires read scope.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
  • get_campaign_chat_messageslist the messages in a chat session, oldest first.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "get_campaign_chat_messages" says "get": a word for reading.

    What it can reach

    • private-dataThe name "get_campaign_chat_messages" says "get" and "chat": it reads messages.
    • private-dataThe description's first sentence says "list" and "message": it reads messages.
    • untrusted-inputThe name "get_campaign_chat_messages" says "get" and "chat": it reads messages, which other people can write.
    • untrusted-inputThe description's first sentence says "list" and "message": it reads messages, which other people can write.
    Description, as the server wrote it
    list the messages in a chat session, oldest first. `content` is an array of opaque blocks (text / tool_use / tool_result). requires read scope.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
  • get_campaign_usageget usage limits and current counts for a campaign.No findings

    Why it is in this group

    • The name "get_campaign_usage" says "get": a word for reading.
    Description, as the server wrote it
    get usage limits and current counts for a campaign. requires read scope.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
  • get_changelogmachine-readable release history (public) - version, date, type, summary, migration notes on breaking entries.Reads private dataNo findings

    Why it is in this group

    • The name "get_changelog" says "get": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "note": it reads notes.
    Description, as the server wrote it
    machine-readable release history (public) - version, date, type, summary, migration notes on breaking entries. the X-Notice header's structured backstory.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
  • get_contactget a contact by ID.Reads private dataNo findings

    Why it is in this group

    • The name "get_contact" says "get": a word for reading.

    What it can reach

    • private-dataThe name "get_contact" says "get" and "contact": it reads contacts.
    • private-dataThe description's first sentence says "get" and "contact": it reads contacts.
    Description, as the server wrote it
    get a contact by ID. requires read scope.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
  • get_contact_handlesthe contact's social handles (instagram/twitter/tiktok) - verify a handle write landed.Reads private dataNo findings

    Why it is in this group

    • The name "get_contact_handles" says "get": a word for reading.

    What it can reach

    • private-dataThe name "get_contact_handles" says "get" and "contact": it reads contacts.
    • private-dataThe description's first sentence says "contact": it reads contacts.
    Description, as the server wrote it
    the contact's social handles (instagram/twitter/tiktok) - verify a handle write landed. requires read scope.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
  • get_contact_typesget breakdown of contacts by type/source.Reads private dataNo findings

    Why it is in this group

    • The name "get_contact_types" says "get": a word for reading.

    What it can reach

    • private-dataThe name "get_contact_types" says "get" and "contact": it reads contacts.
    • private-dataThe description's first sentence says "get" and "contact": it reads contacts.
    Description, as the server wrote it
    get breakdown of contacts by type/source. requires read scope.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
  • get_contact_usageget contact usage limits and current counts for the billing period.Reads private dataNo findings

    Why it is in this group

    • The name "get_contact_usage" says "get": a word for reading.

    What it can reach

    • private-dataThe name "get_contact_usage" says "get" and "contact": it reads contacts.
    • private-dataThe description's first sentence says "get" and "contact": it reads contacts.
    Description, as the server wrote it
    get contact usage limits and current counts for the billing period. requires read scope.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
  • get_conversationget a conversation by ID with contact and campaign details.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "get_conversation" says "get": a word for reading.

    What it can reach

    • private-dataThe name "get_conversation" says "get" and "conversation": it reads messages.
    • private-dataThe description's first sentence says "get" and "conversation": it reads messages.
    • untrusted-inputThe name "get_conversation" says "get" and "conversation": it reads messages, which other people can write.
    • untrusted-inputThe description's first sentence says "get" and "conversation": it reads messages, which other people can write.
    Description, as the server wrote it
    get a conversation by ID with contact and campaign details. requires read scope.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
  • get_conversation_messagesget all messages in a conversation.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "get_conversation_messages" says "get": a word for reading.

    What it can reach

    • private-dataThe name "get_conversation_messages" says "get" and "conversation": it reads messages.
    • private-dataThe description's first sentence says "get" and "message": it reads messages.
    • untrusted-inputThe name "get_conversation_messages" says "get" and "conversation": it reads messages, which other people can write.
    • untrusted-inputThe description's first sentence says "get" and "message": it reads messages, which other people can write.
    Description, as the server wrote it
    get all messages in a conversation. requires read scope.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
  • get_conversation_responderget the responder's status for a single conversation: active, paused, handed off, or never seen, plus the reason and reply counts.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "get_conversation_responder" says "get": a word for reading.

    What it can reach

    • private-dataThe name "get_conversation_responder" says "get" and "conversation": it reads messages.
    • private-dataThe description's first sentence says "get" and "conversation": it reads messages.
    • untrusted-inputThe name "get_conversation_responder" says "get" and "conversation": it reads messages, which other people can write.
    • untrusted-inputThe description's first sentence says "get" and "conversation": it reads messages, which other people can write.
    Description, as the server wrote it
    get the responder's status for a single conversation: active, paused, handed off, or never seen, plus the reason and reply counts. requires read scope.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
  • get_discovery_jobget the status, progress, and contacts of a discovery job.Reads private dataNo findings

    Why it is in this group

    • The name "get_discovery_job" says "get": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "get" and "contact": it reads contacts.
    Description, as the server wrote it
    get the status, progress, and contacts of a discovery job. status values: pending, running, completed, failed. contacts populated only when status=completed. requires read scope.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
  • get_engagement_metricsget overall engagement metrics across all conversations.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "get_engagement_metrics" says "get": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "get" and "conversation": it reads messages.
    • untrusted-inputThe description's first sentence says "get" and "conversation": it reads messages, which other people can write.
    Description, as the server wrote it
    get overall engagement metrics across all conversations. requires read scope.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
  • get_performance_metricsget email performance metrics over time.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "get_performance_metrics" says "get": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "get" and "email": it reads mail.
    • untrusted-inputThe description's first sentence says "get" and "email": it reads inbound email, which other people can write.
    Description, as the server wrote it
    get email performance metrics over time. requires read scope.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
  • get_responderget responder status: whether it's configured, the current config, connection and pause status, and activity counts for the last 30 days.No findings

    Why it is in this group

    • The name "get_responder" says "get": a word for reading.
    Description, as the server wrote it
    get responder status: whether it's configured, the current config, connection and pause status, and activity counts for the last 30 days. requires read scope.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
  • get_response_timeget average response time analytics.No findings

    Why it is in this group

    • The name "get_response_time" says "get": a word for reading.
    Description, as the server wrote it
    get average response time analytics. requires read scope.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
  • get_usageget your current plan, quota usage (campaigns used/remaining this period), and billing period (requires read scope)No findings

    Why it is in this group

    • The name "get_usage" says "get": a word for reading.
    Description, as the server wrote it
    get your current plan, quota usage (campaigns used/remaining this period), and billing period (requires read scope)

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
  • list_audienceslist the audience library - reusable target profiles created once and attachable to any campaign.No findings

    Why it is in this group

    • The name "list_audiences" says "list": a word for reading.
    Description, as the server wrote it
    list the audience library - reusable target profiles created once and attachable to any campaign. requires read scope.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
  • list_campaign_chatslist your iris chat sessions (the conversational campaign builder), most recently updated first, max 100.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "list_campaign_chats" says "list": a word for reading.

    What it can reach

    • private-dataThe name "list_campaign_chats" says "list" and "chat": it reads messages.
    • private-dataThe description's first sentence says "list" and "chat": it reads messages.
    • untrusted-inputThe name "list_campaign_chats" says "list" and "chat": it reads messages, which other people can write.
    • untrusted-inputThe description's first sentence says "list" and "chat": it reads messages, which other people can write.
    Description, as the server wrote it
    list your iris chat sessions (the conversational campaign builder), most recently updated first, max 100. the live chat turn itself is a server-sent-events stream outside this tool set. requires read scope.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
  • list_campaign_contactslist contacts in a campaign with optional status filter.Reads private dataNo findings

    Why it is in this group

    • The name "list_campaign_contacts" says "list": a word for reading.

    What it can reach

    • private-dataThe name "list_campaign_contacts" says "list" and "contact": it reads contacts.
    • private-dataThe description's first sentence says "list" and "contact": it reads contacts.
    Description, as the server wrote it
    list contacts in a campaign with optional status filter. requires read scope.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
  • list_campaignslist all campaigns with optional filtering by status.No findings

    Why it is in this group

    • The name "list_campaigns" says "list": a word for reading.
    Description, as the server wrote it
    list all campaigns with optional filtering by status. requires read scope.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
  • list_connected_accountslist all connected social media accounts.No findings

    Why it is in this group

    • The name "list_connected_accounts" says "list": a word for reading.
    Description, as the server wrote it
    list all connected social media accounts. requires read scope.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
  • list_contact_conversationslist all conversations for a specific contact.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "list_contact_conversations" says "list": a word for reading.

    What it can reach

    • private-dataThe name "list_contact_conversations" says "list" and "contact": it reads contacts.
    • private-dataThe description's first sentence says "list" and "conversation": it reads messages.
    • untrusted-inputThe name "list_contact_conversations" says "list" and "conversation": it reads messages, which other people can write.
    • untrusted-inputThe description's first sentence says "list" and "conversation": it reads messages, which other people can write.
    Description, as the server wrote it
    list all conversations for a specific contact. requires read scope.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
  • list_contactslist all contacts with optional search.Reads private dataNo findings

    Why it is in this group

    • The name "list_contacts" says "list": a word for reading.

    What it can reach

    • private-dataThe name "list_contacts" says "list" and "contact": it reads contacts.
    • private-dataThe description's first sentence says "list" and "contact": it reads contacts.
    Description, as the server wrote it
    list all contacts with optional search. requires read scope.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
  • list_conversationslist conversations with optional filtering.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "list_conversations" says "list": a word for reading.

    What it can reach

    • private-dataThe name "list_conversations" says "list" and "conversation": it reads messages.
    • private-dataThe description's first sentence says "list" and "conversation": it reads messages.
    • untrusted-inputThe name "list_conversations" says "list" and "conversation": it reads messages, which other people can write.
    • untrusted-inputThe description's first sentence says "list" and "conversation": it reads messages, which other people can write.
    Description, as the server wrote it
    list conversations with optional filtering. requires read scope.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
  • list_discovery_sourceslist available discovery data sources and their status.No findings

    Why it is in this group

    • The name "list_discovery_sources" says "list": a word for reading.
    Description, as the server wrote it
    list available discovery data sources and their status. requires read scope.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
  • list_notificationslist user notifications.No findings

    Why it is in this group

    • The name "list_notifications" says "list": a word for reading.
    Description, as the server wrote it
    list user notifications. requires read scope.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
  • list_pending_messageslist messages awaiting approval before sending.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "list_pending_messages" says "list": a word for reading.

    What it can reach

    • private-dataThe name "list_pending_messages" says "list" and "message": it reads messages.
    • private-dataThe description's first sentence says "list" and "message": it reads messages.
    • untrusted-inputThe name "list_pending_messages" says "list" and "message": it reads messages, which other people can write.
    • untrusted-inputThe description's first sentence says "list" and "message": it reads messages, which other people can write.
    Description, as the server wrote it
    list messages awaiting approval before sending. requires read scope.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
  • list_responder_activitylist the responder's activity log (replies sent, handoffs, skips, and failures), newest first.Reads text others writeNo findings

    Why it is in this group

    • The name "list_responder_activity" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe description's first sentence says "list" and "reply": it reads comments, which other people can write.
    Description, as the server wrote it
    list the responder's activity log (replies sent, handoffs, skips, and failures), newest first. requires read scope.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
  • list_responder_comment_triggerslist the account's comment triggers.Reads text others writeNo findings

    Why it is in this group

    • The name "list_responder_comment_triggers" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe name "list_responder_comment_triggers" says "list" and "comment": it reads comments, which other people can write.
    • untrusted-inputThe description's first sentence says "list" and "comment": it reads comments, which other people can write.
    Description, as the server wrote it
    list the account's comment triggers. a comment trigger watches for a keyword in instagram comments and sends the commenter one automatic DM. requires read scope.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
  • list_responder_postslist the account's recent instagram posts with their media ids, for limiting a comment trigger to one post.Reads text others writeNo findings

    Why it is in this group

    • The name "list_responder_posts" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe name "list_responder_posts" says "list" and "post": it reads posts, which other people can write.
    • untrusted-inputThe description's first sentence says "list" and "post": it reads posts, which other people can write.
    Description, as the server wrote it
    list the account's recent instagram posts with their media ids, for limiting a comment trigger to one post. requires read scope.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
  • list_target_profileslist target profiles for a campaign.No findings

    Why it is in this group

    • The name "list_target_profiles" says "list": a word for reading.
    Description, as the server wrote it
    list target profiles for a campaign. requires read scope.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

3696 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 11 outbound tools breaks every one.

Reads private data21
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write16
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out11
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
deny to break every path
{
  "permissions": {
    "deny": [
      "mcp__iris__approve_message",
      "mcp__iris__create_contact",
      "mcp__iris__create_conversation_message",
      "mcp__iris__create_responder_comment_trigger",
      "mcp__iris__mark_message_sent",
      "mcp__iris__reject_message",
      "mcp__iris__rename_campaign_chat",
      "mcp__iris__send_channel_message",
      "mcp__iris__submit_message_feedback",
      "mcp__iris__update_contact",
      "mcp__iris__update_responder_comment_trigger"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Tools listed without sign-in

Looked at Nov 10, 2026, 08:19 UTC, unchanged since Nov 10, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable
yes
HTTP status of an anonymous initialize
200
tools/list served without credentials
yes
Tools that change things, listed without credentials
44
Protocol version
2025-06-18
WWW-Authenticate on 401
not observed
resource_metadata in WWW-Authenticate
not observed
RFC 9728 protected resource metadata
not observed
Authorization servers
not observed
Legacy HTTP+SSE transport
no
Dynamic client registration
not observed
Client ID metadata documents
not observed
  • HighThe whole server

    The endpoint served tools/list without credentials, and the list has 44 tools that change things (17 destructive, 27 write). Whether a call also works without credentials was not tested: tools are never called.

    Matched text

    https://api.iris-ai.dev/mcp: tools/list returned 81 tools to an anonymous client, including delete_campaign (destructive), delete_campaign_chat (destructive), delete_target_profile (destructive), delete_contact (destructive), create_conversation_message (destructive) and 39 more

    What this check looks for

Findings

Matches of fixed checks, with the text they matched.

4 warn
  • Warnanalyze_campaign

    The server marks "analyze_campaign" as not read-only (readOnlyHint: false), and its words say it reads.

    Matched text

    annotations: {"readOnlyHint":false,"destructiveHint":false}; The name "analyze_campaign" says "analyze": a word for reading.

    What this check looks for
  • Warnanalyze_response

    The server marks "analyze_response" as not read-only (readOnlyHint: false), and its words say it reads.

    Matched text

    annotations: {"readOnlyHint":false,"destructiveHint":false}; The name "analyze_response" says "analyze": a word for reading.

    What this check looks for
  • Warnsearch_contacts

    The server marks "search_contacts" as not read-only (readOnlyHint: false), and its words say it reads.

    Matched text

    annotations: {"readOnlyHint":false,"destructiveHint":false}; The name "search_contacts" says "search": a word for reading.

    What this check looks for
  • Warnsearch_campaign_contacts

    The server marks "search_campaign_contacts" as not read-only (readOnlyHint: false), and its words say it reads.

    Matched text

    annotations: {"readOnlyHint":false,"destructiveHint":false}; The name "search_campaign_contacts" says "search": a word for reading.

    What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 0.25.3. Values in angle brackets are yours to fill in.

claude mcp add --transport http iris https://api.iris-ai.dev/mcp --header 'Authorization: <your-authorization>'
claude mcp add --transport http iris https://api.iris-ai.dev/mcp --header 'Authorization: <your-authorization>'

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__iris__list_campaigns",
      "mcp__iris__get_campaign",
      "mcp__iris__list_campaign_contacts",
      "mcp__iris__list_campaign_chats",
      "mcp__iris__get_campaign_chat_messages",
      "mcp__iris__get_campaign_usage",
      "mcp__iris__list_target_profiles",
      "mcp__iris__list_contacts",
      "mcp__iris__get_contact",
      "mcp__iris__get_contact_handles",
      "mcp__iris__get_contact_usage",
      "mcp__iris__list_contact_conversations",
      "mcp__iris__list_conversations",
      "mcp__iris__get_conversation",
      "mcp__iris__get_conversation_messages",
      "mcp__iris__get_engagement_metrics",
      "mcp__iris__list_pending_messages",
      "mcp__iris__get_ai_usage",
      "mcp__iris__get_discovery_job",
      "mcp__iris__list_discovery_sources",
      "mcp__iris__get_analytics_overview",
      "mcp__iris__get_campaign_analytics",
      "mcp__iris__get_performance_metrics",
      "mcp__iris__get_response_time",
      "mcp__iris__get_contact_types",
      "mcp__iris__get_billing_plans",
      "mcp__iris__list_connected_accounts",
      "mcp__iris__list_notifications",
      "mcp__iris__get_usage",
      "mcp__iris__get_changelog",
      "mcp__iris__get_autopilot_status",
      "mcp__iris__get_responder",
      "mcp__iris__list_responder_activity",
      "mcp__iris__get_conversation_responder",
      "mcp__iris__list_responder_comment_triggers",
      "mcp__iris__list_responder_posts",
      "mcp__iris__list_audiences"
    ],
    "ask": [
      "mcp__iris__create_campaign",
      "mcp__iris__update_campaign",
      "mcp__iris__add_campaign_contacts",
      "mcp__iris__rename_campaign_chat",
      "mcp__iris__analyze_campaign",
      "mcp__iris__create_target_profile",
      "mcp__iris__create_contact",
      "mcp__iris__update_contact",
      "mcp__iris__bulk_import_contacts",
      "mcp__iris__create_conversation",
      "mcp__iris__mark_conversation_read",
      "mcp__iris__update_conversation",
      "mcp__iris__mark_message_sent",
      "mcp__iris__submit_message_feedback",
      "mcp__iris__generate_content",
      "mcp__iris__generate_campaign_content",
      "mcp__iris__analyze_response",
      "mcp__iris__search_contacts",
      "mcp__iris__search_campaign_contacts",
      "mcp__iris__check_channel_availability",
      "mcp__iris__update_notification",
      "mcp__iris__mark_all_notifications_read",
      "mcp__iris__configure_autopilot",
      "mcp__iris__run_autopilot_now",
      "mcp__iris__create_audience",
      "mcp__iris__generate_audiences",
      "mcp__iris__attach_audience_to_campaign"
    ],
    "deny": [
      "mcp__iris__delete_campaign",
      "mcp__iris__delete_campaign_chat",
      "mcp__iris__delete_target_profile",
      "mcp__iris__delete_contact",
      "mcp__iris__create_conversation_message",
      "mcp__iris__approve_message",
      "mcp__iris__reject_message",
      "mcp__iris__retry_message",
      "mcp__iris__bulk_message_action",
      "mcp__iris__send_channel_message",
      "mcp__iris__delete_notification",
      "mcp__iris__configure_responder",
      "mcp__iris__set_conversation_responder",
      "mcp__iris__create_responder_comment_trigger",
      "mcp__iris__update_responder_comment_trigger",
      "mcp__iris__delete_responder_comment_trigger",
      "mcp__iris__delete_audience"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as iris. Review it before you use it.

Capability tags behind 37 rules
  • mcp__iris__list_campaign_contacts private-data
  • mcp__iris__list_campaign_chats private-data, untrusted-input
  • mcp__iris__get_campaign_chat_messages private-data, untrusted-input
  • mcp__iris__rename_campaign_chat outbound
  • mcp__iris__list_contacts private-data
  • mcp__iris__create_contact outbound
  • mcp__iris__get_contact private-data
  • mcp__iris__get_contact_handles private-data
  • mcp__iris__update_contact outbound
  • mcp__iris__get_contact_usage private-data
  • mcp__iris__list_contact_conversations private-data, untrusted-input
  • mcp__iris__list_conversations private-data, untrusted-input
  • mcp__iris__get_conversation private-data, untrusted-input
  • mcp__iris__create_conversation_message outbound
  • mcp__iris__get_conversation_messages private-data, untrusted-input
  • mcp__iris__get_engagement_metrics private-data, untrusted-input
  • mcp__iris__list_pending_messages private-data, untrusted-input
  • mcp__iris__approve_message outbound
  • mcp__iris__reject_message outbound
  • mcp__iris__mark_message_sent outbound
  • mcp__iris__submit_message_feedback outbound
  • mcp__iris__analyze_response private-data, untrusted-input
  • mcp__iris__search_contacts private-data
  • mcp__iris__search_campaign_contacts private-data
  • mcp__iris__get_discovery_job private-data
  • mcp__iris__get_performance_metrics private-data, untrusted-input
  • mcp__iris__get_contact_types private-data
  • mcp__iris__send_channel_message outbound
  • mcp__iris__get_changelog private-data
  • mcp__iris__get_autopilot_status untrusted-input
  • mcp__iris__list_responder_activity untrusted-input
  • mcp__iris__get_conversation_responder private-data, untrusted-input
  • mcp__iris__list_responder_comment_triggers untrusted-input
  • mcp__iris__create_responder_comment_trigger outbound
  • mcp__iris__update_responder_comment_trigger outbound
  • mcp__iris__list_responder_posts untrusted-input
  • mcp__iris__generate_audiences untrusted-input

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/io.github.JCLVSH/iris/verify?hash=181228cf83e321ada98f3c13ebd7cdadf78f04e1a7aa441e6b70b6003b256cbe" | jq -e '.changed == false'

Pinned hash 181228cf83e3, from Nov 13, 2026, 17:18 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/io.github.JCLVSH/iris/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for io.github.JCLVSH/iris
[![anlyon.dev](https://anlyon.dev/badge/io.github.JCLVSH/iris.svg)](https://anlyon.dev/servers/io.github.JCLVSH/iris)

Source: MCP Registry. Synced Nov 13, 2026, 17:18 UTC.

Iris MCP server: questions and answers

Answered from the scan above, not from the publisher's description.

Is the Iris MCP server safe?

No scan can promise that. What its definitions show: 81 tools, 44 of which can change, send or delete something, and 4 findings from fixed checks. Allow the reads, ask before each change, and deny the deletes; the permissions block on this page does that.

Can the Iris MCP server delete data?

Yes. 17 tools can delete, cancel or revoke something: delete_campaign, delete_campaign_chat, delete_target_profile, delete_contact, create_conversation_message, approve_message and 11 more.

Can the Iris MCP server do things that cannot be undone?

No tool is classed as irreversible: none of them sends, pays, publishes or merges, going by their definitions.

What tools does the Iris MCP server have?

81 tools: 17 destructive, 27 write, 37 read. delete_campaign, delete_campaign_chat, delete_target_profile, delete_contact, create_conversation_message, approve_message, reject_message, retry_message and 73 more.

Does the Iris MCP server need sign-in or OAuth?

Its remote endpoint listed its tools to an anonymous client, without sign-in.

Does the Iris MCP server send data to outside services?

11 tools can carry data out (it sends, posts or publishes, or takes a recipient, channel or URL): rename_campaign_chat, create_contact, update_contact, create_conversation_message, approve_message, reject_message and 5 more.

Has the Iris MCP server changed its tools?

Not since anlyon.dev started tracking it. Last scanned Nov 13, 2026.