Skip to content

Kirk — Unsupervised Structural Change Detection

by UlyssesModel · remote · no sign-in to list tools · v1.0.2 · published by GitHub user UlyssesModel

The Kalman filter for the non-Gaussian, non-stationary world. Unsupervised structural change.

Changes · 10

14 tools: 10 change things and 4 only read.

Scanned Oct 21, 2026

2 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http kirk https://kirk-mcp.kavara.ai/mcp --header 'CF-Access-Client-Id: <your-cf-access-client-id>' --header 'CF-Access-Client-Secret: <your-cf-access-client-secret>'

Findings

Matches of fixed checks, with the text they matched.

2 warn
  • The server marks "kirk_demo_trading" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":true}; The description's first verb is "run": a word for a change.

    What this check looks for
  • The server marks "kirk_demo_uav" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":true}; The description's first verb is "run": a word for a change.

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

14 tools

Changes things 10Claude Code: ask
  • kirk_billing_checkoutCreate a Stripe Checkout Session URL for buying a credit pack (starter / scale / enterprise).Reads text others writeNo findings

    Why it is in this group

    • The name "kirk_billing_checkout" says "checkout": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Create a Stripe Checkout Session URL for buying a credit pack (starter / scale / enterprise). Purpose: Hand the caller a self-serve URL to purchase IU credits. Use when: The caller's balance is low, or you want to route to a self-serve top-up flow before a larger validation batch. Do not use when: The caller is on an enterprise in-process deployment — those are invoiced directly, not via Checkout. Capability class(es): Meta (billing). Path fit: MCP only. Cost: 0 IU. Callable at balance=0.

    Annotations the server declares

    • title: Create Checkout Session
    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: true
  • kirk_demo_tradingRuns a curated demonstration of Kirk on a trading example.Reads text others write1 finding

    Why it is in this group

    • The description's first verb is "run": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "kirk_demo_trading" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":true}; The description's first verb is "run": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Runs a curated demonstration of Kirk on a trading example. Zero arguments. Returns real Kirk output against the same sealed engine that customer callers hit. Free, rate-limited. First-time users: call this to see what Kirk does before signing up. Purpose: Score n=30 jittered L2 snapshots per market regime (stationary vs stressed) through the sealed engine and surface the per-regime score-distribution statistics (mean, sd) plus the z-separation between the two distributions in pooled-sd units. Also carries a representative canonical book pair so callers see two concrete scores alongside the distributions. Use when: You are a first-time caller exploring what Kirk does. You want a zero-friction "what does the output look like" experience against real sealed-engine attestation. Do not use when: You are scoring your own data — use ``kirk_score_book`` or ``kirk_score_book_batch``. This tool's input is a fixed synthetic representative pair, not a market feed. Capability class(es): C2 (variable-universe cross-section entropy scoring) demonstrated end-to-end against the sealed engine. Path fit: MCP demonstration surface only. Cost: 0 IU. Rate-limited 3/hour per IP. Returns: Dict with per-regime ``stationary`` and ``stressed`` blocks (each: ``mean``, ``sd``, ``n``, ``kirk_version``), ``z_separation`` (pooled-sd distance between the two regime distributions), ``representative_pair`` (canonical un-jittered ``stationary_score`` / ``stressed_score`` plus ``book_summaries``), ``interpretation_hint``, ``provenance``, and ``synthetic_representative`` flag.

    Annotations the server declares

    • title: Kirk Trading Demo (Free)
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • kirk_demo_uavRuns a curated demonstration of Kirk on a UAV example.Reads text others write1 finding

    Why it is in this group

    • The description's first verb is "run": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "kirk_demo_uav" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":true}; The description's first verb is "run": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Runs a curated demonstration of Kirk on a UAV example. Zero arguments. Returns real Kirk output against the same sealed engine that customer callers hit. Free, rate-limited. First-time users: call this to see what Kirk does before signing up. Purpose: Score n=30 jittered 50-element spectra per acoustic class (drone / bird / helicopter) through the sealed engine and surface per-class score-distribution statistics plus z-separations for the three class pairs. Demonstrates that the same sealed engine sha handles market microstructure and acoustic spectra with the same primitive. Use when: You want to see Kirk's cross-domain generalization without needing your own audio dataset. Do not use when: You have real feature vectors to score — use ``kirk_infer_legacy`` directly (arg: list of 50 floats). This tool's inputs are fixed synthetic spectra baked into the demo. Capability class(es): Demonstrates domain-agnostic mathematical primitive — the same engine sha handles kirk_score_book (L2) and kirk_infer_legacy (arbitrary 50-vector). Path fit: MCP demonstration surface only. Cost: 0 IU. Rate-limited 3/hour per IP. Returns: Dict with per-class ``drone`` / ``bird`` / ``helicopter`` blocks (each: ``mean``, ``sd``, ``n``, ``kirk_version``), ``z_separation`` (dict of drone_vs_bird / drone_vs_helicopter / bird_vs_helicopter in pooled-sd units), ``representative_scores`` (the three single-sample scores from the canonical un-jittered spectra), ``interpretation_hint``, ``provenance``, and ``synthetic_spectral`` flag.

    Annotations the server declares

    • title: Kirk UAV Demo (Free)
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • kirk_infer_legacyScore a 50-value feature vector against the legacy /v1/infer route on the sealed engine.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Score a 50-value feature vector against the legacy /v1/infer route on the sealed engine. Purpose: Backwards-compatible scoring surface for callers that were already targeting the legacy path. Use when: You have an existing client wired to /v1/infer and need continued MCP access without refactoring. Do not use when: You are on a fresh integration — prefer kirk_score_book (single-layer, cascade-shaped path). Also do not use in a tight loop against a large corpus: the MCP round-trip is millisecond-scale, and the LLM tool-call cost accrues per book for agent-driven callers. For bulk work, call kirk_bulk_howto first. Capability class(es): C2 (cross-section entropy scoring), legacy interface. Path fit: Validation via MCP (this tool). Production integrations run in-process under sealed-engine attestation — same binary sha as this endpoint. Contact Kavara for deployment options. Cost: 1 IU per call. For agent-driven callers, per-call LLM tokens accrue on top; the response _cost envelope surfaces both.

    Annotations the server declares

    • title: Score Legacy Feature Vector
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • kirk_render_bookRender an L2 order-book snapshot into the 20×20 complex128 thermometer tensor WITHOUT invoking the sealed engine.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Render an L2 order-book snapshot into the 20×20 complex128 thermometer tensor WITHOUT invoking the sealed engine. Purpose: Local tensor prep and inspection — see what shape the sealed engine will receive without paying for a scoring call. Use when: You want to sanity-check bid/ask level convention against the model's canonical input convention, inspect the non-zero cell pattern for a snapshot, or debug an unexpected entropy value by first confirming the tensor is well-formed. Do not use when: You need an entropy score — this tool is prep-only. Call kirk_score_book to score. Capability class(es): Local prep for the C2 (variable-universe cross-section entropy) workflow. No sealed-engine interaction; no capability class is exercised beyond the input-shape convention. Path fit: Validation via MCP (this tool). The same tensor shape is what production in-process integrations consume under sealed-engine attestation. Cost: 0 IU. Free tool.

    Annotations the server declares

    • title: Render Order Book Tensor
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • kirk_score_bookScore one L2 order-book snapshot through the sealed single-layer path and return a scalar entropy plus engine attestation.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Score one L2 order-book snapshot through the sealed single-layer path and return a scalar entropy plus engine attestation. Purpose: Score one snapshot end-to-end through the sealed engine and surface the result plus the engine sha that produced it. Use when: You are validating Kirk on your own data before committing to a production path, or you are scoring a single snapshot inside an interactive workflow (rate-limited at 60 req/min per account). Do not use when: You need throughput above interactive scale, or you are in a per-book loop from an LLM. MCP round-trip is millisecond-scale and inappropriate for latency-critical work. For >200 books, call kirk_bulk_howto first — the returned stdlib Python client scores at zero LLM tokens per iteration. Capability class(es): - C2 (variable-universe cross-section entropy scoring — same model handles any N without retraining). - C5 (sealed engine sha stamped on every response). - C6 (bit-exact reproducibility across substrates; validated by the FY24 252-day reproduction, byte-identical on repeat runs). Path fit: Validation via MCP (this tool). Production integrations run in-process under sealed-engine attestation — same binary sha as this endpoint. Contact Kavara for deployment options. MCP is a validation and discovery surface, not a latency-critical production path. Cost: 1 IU per call. LLM tokens accrue on top for agent-driven callers.

    Annotations the server declares

    • title: Score Single Order Book
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • kirk_score_book_batchScore up to 500 L2 order-book snapshots in one MCP call — returns an entropies list plus engine attestation.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Score up to 500 L2 order-book snapshots in one MCP call — returns an entropies list plus engine attestation. Purpose: Batch-score up to 500 snapshots through the sealed engine in a single MCP dispatch. Use when: You are validating batch behaviour, comparing entropy distributions across small book sets, or running interactive experiments up to 500 books at a time. Do not use when: You have more than 500 books, or you are looping this tool from an LLM. Batches >500 raise a structured `batch_too_large` before any ledger debit. For sustained bulk work, call kirk_bulk_howto — the stdlib Python client scores at zero LLM tokens per iteration. Capability class(es): - C2 (variable-universe cross-section entropy — heterogeneous batch shapes are handled by one model without retraining). - C5 (sealed engine sha stamped on every response). - C6 (bit-exact reproducibility across substrates and runs). Path fit: Validation via MCP (this tool). Production bulk workloads run in-process under sealed-engine attestation — same binary sha as this endpoint. Contact Kavara for deployment options. The MCP round-trip is inappropriate for high-throughput consumption. Cost: 1 IU per 50 books (minimum 1 IU per call). n≤50 → 1 IU; n=51..100 → 2 IU; a full 500-book batch → 10 IU. Validation tier — validation-scale limits. LLM-agent-scoped cap at 500 books; use kirk_bulk_howto for anything larger.

    Annotations the server declares

    • title: Score Batch of Order Books
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • kirk_score_l2_bookScore a sequence of full L2 order books as one chain and return per-book entropies plus engine attestation.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Score a sequence of full L2 order books as one chain and return per-book entropies plus engine attestation. Purpose: Score complete books — prices, sizes and order counts — rather than prices alone. This is the v2 book contract; it carries information the price-only contract cannot. STATE POLICY, and it matters: the books are scored IN ORDER as a single fresh chain. The model starts from its locked initial state at the first book and carries state forward across the rest, so a book's value depends on the books before it. State is never carried between calls. Sending the same books in a different order is a different measurement and will return different values; scoring N books one-per-call is NOT equivalent to one call of N books. Use when: You are validating Kirk on full L2 snapshots. For the price-only v1 contract use kirk_score_book — the two are different envelopes and are not interchangeable. Do not use when: You are looping this tool from an LLM. Call kirk_bulk_howto for bulk work; its v2 mode wraps this same call. Cost: 1 IU per call.

    Annotations the server declares

    • title: Score L2 Order Books (v2 contract)
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • kirk_score_randomSynthesize N realistic-geometry L2 book snapshots and score them — convenience wrapper on kirk_score_book_batch.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Synthesize N realistic-geometry L2 book snapshots and score them — convenience wrapper on kirk_score_book_batch. Purpose: Produce a live entropy series with no external data — the fastest way to confirm a new integration is wired end-to-end. Use when: You want a wiring-check, a first-integration walk-through, or a quick reference for the response shape without needing to supply your own market data. Do not use when: You are scoring anything real — feed your own data through kirk_score_book_batch. Synthetic bids/asks are not benchmark input and should not appear in customer-visible results. Capability class(es): C2 (uses the same variable-universe cross- section entropy path as kirk_score_book_batch, on synthetic input). Path fit: Validation via MCP (this tool). Not a production surface. Cost: 1 IU per invocation. Internally routes through kirk_score_book_batch — one metered dispatch, no double-metering.

    Annotations the server declares

    • title: Score Random Synthetic Books
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • kirk_verify_engineVerify sealed engine identity — returns the sha256 of the running scoring binary.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Verify sealed engine identity — returns the sha256 of the running scoring binary. Also serves as a liveness probe against the sealed backend. Purpose: Attest which Kirk build is currently serving scoring calls. Response carries the HOST DEFAULT engine sha (kirk_version). That is the legacy default and is NOT necessarily the engine that will stamp a given kirk_score_* result: each model row in kirk_list_models identifies its own engine, and every scoring response restates it under engine.sha. For a model bound to a non-default engine (kirk-market-orderbook-v1) these differ. Record the per-model value for provenance, not this one. Secondary role: a cheap liveness probe when wiring up MCP. Use when: You want to record engine sha in your own provenance log before capturing scoring output, or you want a cheap liveness check ahead of a larger validation batch. Do not use when: You want a scoring result — this returns identity/liveness only, no entropies. Capability class(es): C5 (cryptographic attestation of engine identity). Path fit: Validation via MCP (this tool). Production integrations run in-process under sealed-engine attestation — same binary sha as this endpoint. Contact Kavara for deployment options. Cost: 0 IU. Free tool. For agent-driven callers, the _cost envelope still reports iu_this_call=0 and the running session totals. Returns: Dict with `status`, `engine`, `env`, and `kirk_version` (the sealed .so sha). A non-2xx response raises; caller sees a clean MCP tool error.

    Annotations the server declares

    • title: Verify Kirk Engine Identity
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
Only reads 4Claude Code: allow
  • kirk_billing_showReturn the caller's account_id, IU balance, USD equivalent at list, frozen flag, and recent ledger entries.Reads text others writeNo findings

    Why it is in this group

    • The name "kirk_billing_show" says "show": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Return the caller's account_id, IU balance, USD equivalent at list, frozen flag, and recent ledger entries. Purpose: Surface the caller's current billing state — what they can spend, whether the account is frozen, and how recent entries landed. Use when: The caller wants to check available credit before committing to a large batch, or you are debugging a "why-was-I-charged" question. Do not use when: You just need per-call cost — the `_cost` envelope on every agent-driven tool result carries that inline without a separate call. Capability class(es): Meta (account state), not a capability of the scoring engine. Path fit: MCP only. Enterprise in-process deployments have their own billing surface (invoiced separately). Cost: 0 IU. Callable at balance=0 so a customer with zero credit can still self-serve to top up.

    Annotations the server declares

    • title: Show Billing Balance
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • kirk_billing_usageReturn the caller's inference consumption over the last N days from the append-only Gate 2 events table.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The description's first verb is "return": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "return" and "table": it reads databases.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Return the caller's inference consumption over the last N days from the append-only Gate 2 events table. Purpose: Historical usage summary + per-tool breakdown for the caller's account. Use when: You need a usage report for the caller or an admin, or you are reconciling ledger debits against actual inference events. Do not use when: You need real-time cost — the `_cost` envelope on every agent-driven tool result covers that inline. Capability class(es): Meta (metering). Path fit: MCP only. Cost: 0 IU.

    Annotations the server declares

    • title: Get Usage Summary
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • kirk_bulk_howtoReturn a self-contained stdlib Python client for scoring at ZERO per-call LLM tokens.Reads text others writeNo findings

    Why it is in this group

    • The description's first verb is "return": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Return a self-contained stdlib Python client for scoring at ZERO per-call LLM tokens. Purpose: Hand the caller an HTTP consumer that runs locally so bulk scoring doesn't burn LLM tokens per book. Use when: You need to score more than ~200 books, or `kirk_score_book_batch` returned `batch_too_large`, or the caller is running an autonomous bulk workload that would otherwise pay per-tool-call LLM tokens for every book. Do not use when: You are running a one-off interactive call — a direct `kirk_score_book` invocation is simpler; don't route through the client for a single book. Capability class(es): Cost-steering / delivery-path tool. Hands the caller a runner that exercises the same C2 / C5 / C6 capabilities as the MCP scoring tools, but at zero per-call LLM token cost. Path fit: The returned client is an HTTP consumer of the same MCP endpoint. Production integrations run in-process under sealed-engine attestation — same binary sha as this endpoint. Contact Kavara for deployment options. Cost: 0 IU. Free tool. Once running locally, the returned client bills against the same tools it drives: single-book calls at 1 IU each, and batch calls at 1 IU per 50 books (minimum 1 IU per call). A full 500-book batch → 10 IU. No LLM tokens on top. Cost comparison (2.7M-book validation rerun via 500-book batches — ~5400 batches, 54000 IU billed either way): MCP via Sonnet 5: $1,968 LLM + $540 IU + ~15 days wall clock MCP via Haiku 4.5: $656 LLM + $540 IU + ~10 days Python client (this tool): $0 LLM + $540 IU + ~55 min Return structure: { "language": "python", "filename": "kirk_online_client.py", "requirements": str, "usage": str, "code": str (the client source, ~500 LOC), "example": str (2-line copy-paste demo) }

    Annotations the server declares

    • title: Get Bulk Scoring Client
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • kirk_list_modelsEnumerate the model_ids the sealed engine exposes, with the engine sha stamped in-response.Reads text others writeNo findings

    Why it is in this group

    • The name "kirk_list_models" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Enumerate the model_ids the sealed engine exposes, with the engine sha stamped in-response. Purpose: Discover the model catalog and record the sealed engine sha alongside your inference results. Use when: You are wiring a client for the first time and need model_id values for kirk_score_book / kirk_score_book_batch calls, or you want a machine-readable catalog with attestation. Do not use when: You need per-model hyperparameter detail — those are intentionally not exposed on the customer surface. Capability class(es): C5 (engine sha attested on every response). Path fit: Validation via MCP (this tool). Production integrations run in-process under sealed-engine attestation — same binary sha as this endpoint. Contact Kavara for deployment options. Cost: 0 IU. Free tool.

    Annotations the server declares

    • title: List Kirk Models
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged outbound.

Reads private data1
Reads files, mail, messages, databases, secrets, calendars or repositories.
Can send data out0
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Looked at Oct 22, 2026, 14:55 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable
yes
HTTP status of an anonymous initialize
200
tools/list served without credentials
yes
Tools that change things, listed without credentials
10
Protocol version
2025-06-18
WWW-Authenticate on 401
not observed
resource_metadata in WWW-Authenticate
none
RFC 9728 protected resource metadata
none
Authorization servers
none
Legacy HTTP+SSE transport
no
Dynamic client registration
not observed
Client ID metadata documents
not observed
  • WarnThe whole server

    The endpoint served tools/list without credentials, and the list has 10 tools that change things (10 write). Whether a call also works without credentials was not tested: tools are never called.

    Matched text

    https://kirk-mcp.kavara.ai/mcp: tools/list returned 14 tools to an anonymous client, including kirk_billing_checkout (write), kirk_demo_trading (write), kirk_demo_uav (write), kirk_verify_engine (write), kirk_infer_legacy (write) and 5 more

    What this check looks for

Install

Pinned to version 1.0.2. Values in angle brackets are yours to fill in.

claude mcp add --transport http kirk https://kirk-mcp.kavara.ai/mcp --header 'CF-Access-Client-Id: <your-cf-access-client-id>' --header 'CF-Access-Client-Secret: <your-cf-access-client-secret>'

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__kirk__kirk_billing_show",
      "mcp__kirk__kirk_billing_usage",
      "mcp__kirk__kirk_bulk_howto",
      "mcp__kirk__kirk_list_models"
    ],
    "ask": [
      "mcp__kirk__kirk_billing_checkout",
      "mcp__kirk__kirk_demo_trading",
      "mcp__kirk__kirk_demo_uav",
      "mcp__kirk__kirk_verify_engine",
      "mcp__kirk__kirk_infer_legacy",
      "mcp__kirk__kirk_score_book",
      "mcp__kirk__kirk_score_l2_book",
      "mcp__kirk__kirk_score_book_batch",
      "mcp__kirk__kirk_render_book",
      "mcp__kirk__kirk_score_random"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as kirk. Review it before you use it.

Capability tags behind 14 rules
  • mcp__kirk__kirk_billing_show untrusted-input
  • mcp__kirk__kirk_billing_checkout untrusted-input
  • mcp__kirk__kirk_billing_usage private-data, untrusted-input
  • mcp__kirk__kirk_bulk_howto untrusted-input
  • mcp__kirk__kirk_demo_trading untrusted-input
  • mcp__kirk__kirk_demo_uav untrusted-input
  • mcp__kirk__kirk_verify_engine untrusted-input
  • mcp__kirk__kirk_list_models untrusted-input
  • mcp__kirk__kirk_infer_legacy untrusted-input
  • mcp__kirk__kirk_score_book untrusted-input
  • mcp__kirk__kirk_score_l2_book untrusted-input
  • mcp__kirk__kirk_score_book_batch untrusted-input
  • mcp__kirk__kirk_render_book untrusted-input
  • mcp__kirk__kirk_score_random untrusted-input