Tabularium

io.github.SQLazy/tabulariumSQLazystreamable-httpv0.5.4Scanned 1 hour ago

Agent memory and a signed spending ledger: pay any x402 API, keep a provable receipt.

7 tools: 6 change things and 1 only read.

Reads private data · 0
Reads text others write · 5
Can send data out · 1
1 finding

Anlyon alternative

6 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

7 tools

Changes things 6Creates or changes something that can be changed back.Claude Code: ask

tabularium_exportPaid ($0.01 USDC on Base, x402).Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Paid ($0.01 USDC on Base, x402). Full signed history and current values, verifiable offline. Agent memory: export the full signed history and current values of the paying wallet's persistent key-value store, for backup or proof. The export verifies offline against the public key in /menu, with no trust in the server. The optional since parameter returns only newer entries.. Settles before it runs (a free check refuses a call that would fail). Call once without payment to get the price, then retry with params._meta["x402/payment"].
Annotations the server declares
- readOnlyHint: true
- openWorldHint: true
tabularium_headFree.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Free. Free: signed head (seq + hash, no values), state and expiry for a wallet's workspace
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
tabularium_menuFree.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Free. Prices, payee, network, policy (term, grace, size limits) and the signing key for every call.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
tabularium_renewPaid ($0.25 USDC on Base, x402).Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Paid ($0.25 USDC on Base, x402). Extend the workspace by 30 days from the later of now or its expiry. Agent memory: keep the paying wallet's persistent key-value store for 30 more days, counted from the later of now or its current expiry. A free pre-check rejects a wallet with no workspace before any charge.. Settles before it runs (a free check refuses a call that would fail). Call once without payment to get the price, then retry with params._meta["x402/payment"].
Annotations the server declares
- readOnlyHint: false
- openWorldHint: true
tabularium_snapshot_fetchPaid ($0.005 USDC on Base, x402).Reads text others writeCan send data out1 finding
Why it is in this group
- The name "tabularium_snapshot_fetch" says "snapshot": a word for reading.
- The server marks it as not read-only (readOnlyHint: false).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe input takes a URL (input.url), and the tool reads it: it reads web pages, which anyone can write.
- outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
Findings
- Warn
  The server marks "tabularium_snapshot_fetch" as not read-only (readOnlyHint: false), and its words say it reads.
  Matched text
  annotations: {"readOnlyHint":false,"openWorldHint":true}; The name "tabularium_snapshot_fetch" says "snapshot": a word for reading.
  What this check looks for
Description, as the server wrote it
Paid ($0.005 USDC on Base, x402). Fetch a web page as text, with a signed record of what was served and when. Returns the page's readable text plus an Ed25519-signed record (final URL after redirects, fetch time, status, sha256 of the body and of the text) that verifies offline. Charged only for 2xx text pages; refused URLs cost nothing.. Charged only if it succeeds. Call once without payment to get the price, then retry with params._meta["x402/payment"].
Annotations the server declares
- readOnlyHint: false
- openWorldHint: true
tabularium_writePaid ($0.003 USDC on Base, x402).Reads text others writeNo findings
Why it is in this group
- The name "tabularium_write" says "write": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Paid ($0.003 USDC on Base, x402). Append a value under a key in the paying wallet's workspace. Agent memory: save a value under a key in a persistent key-value store owned by the paying wallet. The first write opens a 30-day workspace. Memory survives restarts, new machines and hand-offs between agents. Every write is hash-chained and signed (Ed25519), so the history verifies offline. Values up to 64 KB; failed writes are not charged.. Charged only if it succeeds. Call once without payment to get the price, then retry with params._meta["x402/payment"].
Annotations the server declares
- readOnlyHint: false
- openWorldHint: true

Only reads 1Looks things up and changes nothing.Show 1 read-only tool

tabularium_readPaid ($0.002 USDC on Base, x402).Reads text others writeNo findings
Why it is in this group
- The name "tabularium_read" says "read": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Paid ($0.002 USDC on Base, x402). Latest value for a key, with its chain entry. Agent memory: read the latest value for a key from the paying wallet's persistent key-value store, with its signed hash-chain entry. Reads keep working through the 90-day grace period after the term ends. A missing key returns 404 and is not charged.. Charged only if it succeeds. Call once without payment to get the price, then retry with params._meta["x402/payment"].
Annotations the server declares
- readOnlyHint: true
- openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data.

Reads private data0: Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write5: Brings in text someone else can write: web pages, inbound email, messages, issues and comments.; tabularium_export
tabularium_read
tabularium_renew
tabularium_snapshot_fetch
tabularium_write
Can send data out1: Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.; tabularium_snapshot_fetch

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

1 warn

Warntabularium_snapshot_fetch
The server marks "tabularium_snapshot_fetch" as not read-only (readOnlyHint: false), and its words say it reads.
Matched text
annotations: {"readOnlyHint":false,"openWorldHint":true}; The name "tabularium_snapshot_fetch" says "snapshot": a word for reading.
What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 0.5.4. Values in angle brackets are yours to fill in.

claude mcp add --transport http tabularium https://tabularium.matt-3e0.workers.dev/mcp

claude mcp add --transport http tabularium https://tabularium.matt-3e0.workers.dev/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__tabularium__tabularium_read"
    ],
    "ask": [
      "mcp__tabularium__tabularium_menu",
      "mcp__tabularium__tabularium_head",
      "mcp__tabularium__tabularium_write",
      "mcp__tabularium__tabularium_renew",
      "mcp__tabularium__tabularium_export",
      "mcp__tabularium__tabularium_snapshot_fetch"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as tabularium. Review it before you use it.

Capability tags behind 5 rules

mcp__tabularium__tabularium_write untrusted-input
mcp__tabularium__tabularium_read untrusted-input
mcp__tabularium__tabularium_renew untrusted-input
mcp__tabularium__tabularium_export untrusted-input
mcp__tabularium__tabularium_snapshot_fetch untrusted-input, outbound

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/io.github.SQLazy/tabularium/verify?hash=ba0e069ae05d8e87f37eaae6aabf6009404444e056fbf9221cef2ce1fed0ab88" | jq -e '.changed == false'

Pinned hash ba0e069ae05d, from Nov 2, 2026, 04:18 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/io.github.SQLazy/tabularium/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

[![anlyon.dev](https://anlyon.dev/badge/io.github.SQLazy/tabularium.svg)](https://anlyon.dev/servers/io.github.SQLazy/tabularium)

Source: MCP Registry · repository. Synced Nov 2, 2026, 04:17 UTC.