Pushary

by Pushary · remote · no sign-in to list tools · v1.5.0 · published by GitHub user Pushary

The decision layer for AI agents. Your agent asks, a person approves or denies on their phone.

Deletes · 51 high finding

Compare Registry entry

6 tools: 5 can delete or cancel things and 1 only read.

Scanned Oct 21, 2026

Deletes or cancels5Claude Code: deny: see these tools
Can't be undone0Claude Code: ask
Changes things0Claude Code: ask
Only reads1Claude Code: allow: see these tools

1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http pushary https://pushary.com/api/mcp/mcp --header 'Authorization: <your-authorization>'

Findings

Matches of fixed checks, with the text they matched.

1 high

Highpropose_scope
The input schema at properties.offLimitsPaths.description refers to "**/.env*" and ".env".
Matched text
inputSchema.properties.offLimitsPaths.description: "..."**/" needs a directory before it, so "**/.env*" is expanded for you to also cover a ro..."
What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

6 tools

Deletes or cancels 5Removes, cancels or revokes something.Claude Code: deny

ask_userRequest an unresolved decision or missing input from the user through Pushary.No findings
Why it is in this group
- The description's first verb is "request": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Request an unresolved decision or missing input from the user through Pushary. Supports confirm, select and input questions. Delivery and waiting follow the account policy; a call waits at most 55 seconds and may return immediately. Returns the question state, answer when available, delivery information and handoff fields. answerUrl is optional. Use wait_for_answer to read a pending result and cancel_question to retract it. Not for reporting finished work or asking what to do next once the requested work is complete, unless the user asked you to; report finished work with send_notification and no question. A choice that blocks unfinished work is a decision to ask. Sends a real question; it does not grant permission for other actions.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: false
- openWorldHint: true
cancel_questionRetract a pending question that is no longer needed or is moving to the current client.No findings
Why it is in this group
- The name "cancel_question" says "cancel": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Retract a pending question that is no longer needed or is moving to the current client. Returns cancelled:true only when a pending question was removed. False may mean it was already answered, expired, missing or unavailable. An unavailable state includes handoffAction:stop because cancellation could not safely inspect or fence the question. Does not retract an answer already recorded.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
propose_scopeRequest agreement on an unresolved or user-requested boundary for this session.1 finding
Why it is in this group
- The description's first verb is "request": a word for a change.
- The server marks it destructive (destructiveHint: true).
Findings
- High
  The input schema at properties.offLimitsPaths.description refers to "**/.env*" and ".env".
  Matched text
  inputSchema.properties.offLimitsPaths.description: "..."**/" needs a directory before it, so "**/.env*" is expanded for you to also cover a ro..."
  What this check looks for
Description, as the server wrote it
Request agreement on an unresolved or user-requested boundary for this session. Sends a real scope question and returns ratified, answered, contract and enforcement information. Only supported hooks can enforce file paths on path-bearing tool calls; promises are recorded but not enforced. Empty enforces means no automatic boundary checking. A contract never overrides host permissions or authorizes a separate action. The call waits at most 55 seconds; a pending proposal can be read with wait_for_answer.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: false
- openWorldHint: true
schedule_reminderRemind the authenticated user later: a timer, alarm, ping, or reminder delivered by Pushary even after the agent exits.No findings
Why it is in this group
- The name "schedule_reminder" says "schedule": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Remind the authenticated user later: a timer, alarm, ping, or reminder delivered by Pushary even after the agent exits. One-time only; up to 30 days away, 25 pending per user/site. Provide body plus inMinutes or at with an explicit UTC offset. Use a unique requestId for each schedule and reuse it unchanged on retries. Use reminderId to retrieve the final outcome. Confirm the returned time and report any warning. Omit arguments to list pending reminders; use cancelReminderId to cancel a scheduled one. Never use ask_user for a reminder. Does not schedule agent work or customer campaigns. Respects stop/mute and active membership at delivery.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: false
- openWorldHint: true
send_notificationSend a one-way notification to connected devices for a requested update or a meaningful unattended result, such as a finished task.No findings
Why it is in this group
- The name "send_notification" says "send": a word for sending, and what is sent cannot be taken back.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Send a one-way notification to connected devices for a requested update or a meaningful unattended result, such as a finished task. Use ask_user only when an answer is needed to continue. Delivery follows the account policy and optional recipient filters. context adds a detail page; context.askQuestion creates a linked decision. Returns web/mobile delivery counts and a warning when no delivery channel is connected. Sends real notifications.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: false
- openWorldHint: true

Only reads 1Looks things up and changes nothing.Claude Code: allow

wait_for_answerRead the answer or current state of an existing question from ask_user or send_notification.No findings
Why it is in this group
- The name "wait_for_answer" says "wait": a word for reading.
Description, as the server wrote it
Read the answer or current state of an existing question from ask_user or send_notification. Waits up to timeoutMs, capped at 55 seconds. Returns answered, the answer when available, status and handoff information. Only pending is a live unanswered question; cancelled, expired, missing and unavailable are terminal states. Does not send another question.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.5.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http pushary https://pushary.com/api/mcp/mcp --header 'Authorization: <your-authorization>'

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__pushary__wait_for_answer"
    ],
    "ask": [],
    "deny": [
      "mcp__pushary__schedule_reminder",
      "mcp__pushary__send_notification",
      "mcp__pushary__ask_user",
      "mcp__pushary__propose_scope",
      "mcp__pushary__cancel_question"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as pushary. Review it before you use it.

Keep track

Get told when this server's tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/io.github.Pushary/pushary/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Anlyon alternative

5 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Compare with other servers for the same product.

Source: MCP Registry · repository. Synced Oct 21, 2026, 18:18 UTC.

For agents: Markdown · JSON · report this listing