Skip to content
anlyon.devby Anlyon

Privi Ledger

io.github.canoydario847-cloud/privi-ledgercanoydario847-cloudstreamable-httpv0.10.2Scanned

Privi Guard stops prompt injection and data leaks in AI agents, plus audit logs and trust passports.

99 tools: 9 can delete or cancel things, 3 do something that can't be undone, 71 change things and 16 only read.

Tools: 9 delete, 3 irreversible, 71 write, 16 read.
  • Reads private data · 1
  • Reads text others write · 9
  • Can send data out · 1
  • 4 findings

Sign-in required, no OAuth metadata. Remote posture

Anlyon alternative

83 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →
Compare with similar serversMarkdownJSONReport this listing

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

99 tools

Deletes or cancels 9Claude Code: deny
  • approval_cancelWithdraw an approval request (or revoke an approval not yet used).No findings

    Why it is in this group

    • The name "approval_cancel" says "cancel": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Withdraw an approval request (or revoke an approval not yet used). Your key cannot approve, only cancel. Requires the organization API key.

    Annotations the server declares

    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: false
  • gateway_deleteTurn a gateway off.No findings

    Why it is in this group

    • The name "gateway_delete" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Turn a gateway off. Its URLs stop working at once; history stays in your log. Requires the organization API key.

    Annotations the server declares

    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: false
  • kya_unbind_walletRemove a wallet from your Passport (rotated or compromised key).No findings

    Why it is in this group

    • The description's first verb is "remove": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Remove a wallet from your Passport (rotated or compromised key). KYA checks deny it immediately. Requires the organization API key.

    Annotations the server declares

    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: false
  • live_killStop an agent at once: mandate_spend, your gateways and your room messages are refused until live_resume.No findings

    Why it is in this group

    • The name "live_kill" says "kill": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Stop an agent at once: mandate_spend, your gateways and your room messages are refused until live_resume. Takes effect on the next call, and is pushed to your live channel immediately. Audit logging keeps working. Requires the organization API key.

    Annotations the server declares

    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: false
  • live_resumeLift a kill switch set with live_kill.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Lift a kill switch set with live_kill. Requires the organization API key.

    Annotations the server declares

    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: false
  • mandate_revokeStop an agent from spending under a mandate (the human can also revoke from the sign_url page).No findings

    Why it is in this group

    • The name "mandate_revoke" says "revoke": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Stop an agent from spending under a mandate (the human can also revoke from the sign_url page). Requires the organization API key.

    Annotations the server declares

    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: false
  • passport_revokeRevoke one of your passports (e.g.No findings

    Why it is in this group

    • The name "passport_revoke" says "revoke": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Revoke one of your passports (e.g. an agent was retired or compromised). Verifiers see it immediately. Requires the organization API key.

    Annotations the server declares

    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: false
  • room_closeClose a room and seal its transcript: the hash is signed (Ed25519 + ML-DSA-87), anchored on chain (Base) and written to both organizations' logs.No findings

    Why it is in this group

    • The name "room_close" says "close": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Close a room and seal its transcript: the hash is signed (Ed25519 + ML-DSA-87), anchored on chain (Base) and written to both organizations' logs. Either party can close. Requires the organization API key.

    Annotations the server declares

    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: false
  • scan_unwatchRemove a server from your watchlist.1 finding

    Why it is in this group

    • The description's first verb is "remove": a word for removing or ending something.
    • The server marks it not destructive (destructiveHint: false), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "scan_unwatch" not destructive (destructiveHint: false), and its own name, description or input give the class "destructive".

      Matched text

      annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "remove": a word for removing or ending something.

      What this check looks for
    Description, as the server wrote it
    Remove a server from your watchlist. Needs the org key.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: false
Can't be undone 3Claude Code: ask
  • privi_payment_optionsSee existing USDC/x402 service billing and separately gated valueless PRVI_TEST development mode.1 finding

    Why it is in this group

    • The name "privi_payment_options" says "payment": a word that usually means money moves, which cannot be taken back.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "privi_payment_options" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true}; The name "privi_payment_options" says "payment": a word that usually means money moves, which cannot be taken back.

      What this check looks for
    Description, as the server wrote it
    See existing USDC/x402 service billing and separately gated valueless PRVI_TEST development mode.

    Annotations the server declares

    • readOnlyHint: true
  • privi_test_payment_quoteOff-chain PRVI_TEST quote.No findings

    Why it is in this group

    • The name "privi_test_payment_quote" says "payment": a word that usually means money moves, which cannot be taken back.
    Description, as the server wrote it
    Off-chain PRVI_TEST quote. Requires organization key and explicit test mode. Never takes money.

    Annotations the server declares

    • destructiveHint: false
    • openWorldHint: false
    • readOnlyHint: false
  • privi_test_payment_simulateConsume a test quote once.No findings

    Why it is in this group

    • The name "privi_test_payment_simulate" says "payment": a word that usually means money moves, which cannot be taken back.
    Description, as the server wrote it
    Consume a test quote once. Receipt is NOT payment, on-chain proof or entitlement.

    Annotations the server declares

    • destructiveHint: false
    • openWorldHint: false
    • readOnlyHint: false
Changes things 71Claude Code: ask
  • approval_policy_setMake mandate_spend pause for a human on large payments: any payment over the threshold creates an approval request that the mandate's principal must sign with their wallet before t…No findings

    Why it is in this group

    • The name "approval_policy_set" says "set": a word for a change.
    Description, as the server wrote it
    Make mandate_spend pause for a human on large payments: any payment over the threshold creates an approval request that the mandate's principal must sign with their wallet before the agent can spend. Requires the organization API key.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
    • readOnlyHint: false
  • approval_requestAsk a human to approve (or deny) an action.No findings

    Why it is in this group

    • The name "approval_request" says "request": a word for a change.
    Description, as the server wrote it
    Ask a human to approve (or deny) an action. Returns approve_url for them: they read the request and sign with their wallet (free, no transaction). Your agent then calls approval_wait, or watches your live channel for approval.approved. Only the named wallet can decide; your API key can only cancel. Requires the organization API key.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
    • readOnlyHint: false
  • fortress_keysPrivi's public signing keys: Ed25519 and ML-DSA-87 (NIST FIPS 204, CNSA 2.0 post-quantum).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Privi's public signing keys: Ed25519 and ML-DSA-87 (NIST FIPS 204, CNSA 2.0 post-quantum). Pin these to verify Privi signatures offline. Free.

    Annotations the server declares

    • openWorldHint: false
    • readOnlyHint: true
  • fortress_tpi_executeConsume a two-person authorization right before performing the action.No findings

    Why it is in this group

    • The name "fortress_tpi_execute" says "execute": a word for a change.
    Description, as the server wrote it
    Consume a two-person authorization right before performing the action. Single use; refused unless authorized. Requires the organization API key.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
    • readOnlyHint: false
  • fortress_tpi_policyDefine a Two-Person Integrity policy: which officers can approve, and how many distinct approvals an action needs.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Define a Two-Person Integrity policy: which officers can approve, and how many distinct approvals an action needs. Requires the organization API key.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: false
  • fortress_tpi_requestAsk officers to authorize a sensitive action under a two-person policy.No findings

    Why it is in this group

    • The name "fortress_tpi_request" says "request": a word for a change.
    Description, as the server wrote it
    Ask officers to authorize a sensitive action under a two-person policy. Returns approve_url for the officers; each signs with their wallet. Do not act until fortress_tpi_status shows 'authorized', then call fortress_tpi_execute. Requires the organization API key.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
    • readOnlyHint: false
  • gateway_createPut your MCP server behind Privi.No findings

    Why it is in this group

    • The name "gateway_create" says "create": a word for a change.
    Description, as the server wrote it
    Put your MCP server behind Privi. You get an HTTP URL and a WebSocket URL that forward to it unchanged (x402 payments keep working) while Privi rate-limits callers, optionally requires a Privi Passport, meters every tool call and writes each call to your tamper-evident log. The kill switch stops the gateway instantly. Upstream must be public HTTPS. Requires the organization API key.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
    • readOnlyHint: false
  • gateway_infoPublic description of a gateway: where it forwards, whether callers need a Passport, its rate limit and its call counts.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Public description of a gateway: where it forwards, whether callers need a Passport, its rate limit and its call counts. Free.

    Annotations the server declares

    • openWorldHint: false
    • readOnlyHint: true
  • gateway_set_guardTurn Privi Guard on for every tool result that passes through your gateway: tag adds the verdict and a receipt id in result._meta['privi/guard']; block also replaces injected resul…No findings

    Why it is in this group

    • The name "gateway_set_guard" says "set": a word for a change.
    Description, as the server wrote it
    Turn Privi Guard on for every tool result that passes through your gateway: tag adds the verdict and a receipt id in result._meta['privi/guard']; block also replaces injected results with an error before your agents see them. Each result is one Guard check (free allowance, then credits). Requires the organization API key.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
    • readOnlyHint: false
  • gateway_statsCalls, errors, denials and x402 payment prompts per tool and per day for one of your gateways, plus your monthly quota.1 finding

    Why it is in this group

    • The description's first verb is "call": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "gateway_stats" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"openWorldHint":false}; The description's first verb is "call": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Calls, errors, denials and x402 payment prompts per tool and per day for one of your gateways, plus your monthly quota. Requires the organization API key.

    Annotations the server declares

    • openWorldHint: false
    • readOnlyHint: true
  • gov_ai_inventoryYour agency's AI use case inventory: the current version of each record.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Your agency's AI use case inventory: the current version of each record. Requires the organization API key.

    Annotations the server declares

    • openWorldHint: false
    • readOnlyHint: true
  • gov_ai_inventory_checkFlags what an OMB M-25-21 review would flag before you submit: missing required fields, PII without a Privacy Impact Assessment, and high-impact AI in pilot or deployment missing a…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Flags what an OMB M-25-21 review would flag before you submit: missing required fields, PII without a Privacy Impact Assessment, and high-impact AI in pilot or deployment missing any minimum risk practice (testing, impact assessment, independent review, monitoring, operator training, fail-safe, appeals, public feedback) or without a recently active activity log as monitoring evidence. Requires the organization API key.

    Annotations the server declares

    • openWorldHint: false
    • readOnlyHint: true
  • gov_ai_inventory_exportMachine-readable CSV of your publicly releasable AI use cases (for publishing at agency.gov/ai), with its SHA-256 sealed on chain (Base, until the Privi chain mainnet) so the publi…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Machine-readable CSV of your publicly releasable AI use cases (for publishing at agency.gov/ai), with its SHA-256 sealed on chain (Base, until the Privi chain mainnet) so the published file can be proven unaltered. Requires the organization API key.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
    • readOnlyHint: false
  • gov_ai_usecase_saveAdd or update an entry in your agency's AI use case inventory (OMB M-25-21).No findings

    Why it is in this group

    • The name "gov_ai_usecase_save" says "save": a word for a change.
    Description, as the server wrote it
    Add or update an entry in your agency's AI use case inventory (OMB M-25-21). Every change creates a new version and is written to your tamper-evident 'ai-inventory' log. Requires the organization API key.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: false
  • gov_ai_verify_exportCheck that a published AI inventory file is exactly what the agency exported from Privi Ledger, and return its on-chain seal.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Check that a published AI inventory file is exactly what the agency exported from Privi Ledger, and return its on-chain seal. Free; no key needed.

    Annotations the server declares

    • openWorldHint: false
    • readOnlyHint: true
  • gov_pqc_classifyClassify cryptographic algorithms as quantum-vulnerable (RSA, ECDH, ECDSA, EdDSA, DH, DSA, MQV), post-quantum (ML-KEM, ML-DSA, SLH-DSA), hybrid, symmetric/hash, or unknown.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Classify cryptographic algorithms as quantum-vulnerable (RSA, ECDH, ECDSA, EdDSA, DH, DSA, MQV), post-quantum (ML-KEM, ML-DSA, SLH-DSA), hybrid, symmetric/hash, or unknown. Free.

    Annotations the server declares

    • openWorldHint: false
    • readOnlyHint: true
  • gov_pqc_exportExport the full cryptographic inventory (CBOM) and migration plan as one JSON document for OMB, the CIO or auditors, with its SHA-256 sealed on chain (Base, until the Privi chain m…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Export the full cryptographic inventory (CBOM) and migration plan as one JSON document for OMB, the CIO or auditors, with its SHA-256 sealed on chain (Base, until the Privi chain mainnet). Requires the organization API key.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
    • readOnlyHint: false
  • gov_pqc_inventoryCurrent cryptographic inventory of your systems.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Current cryptographic inventory of your systems. Requires the organization API key.

    Annotations the server declares

    • openWorldHint: false
    • readOnlyHint: true
  • gov_pqc_planPrioritized post-quantum migration plan: every quantum-vulnerable asset ranked (High Value Assets, high-impact systems and long-lived sensitive data first; key establishment before…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Prioritized post-quantum migration plan: every quantum-vulnerable asset ranked (High Value Assets, high-impact systems and long-lived sensitive data first; key establishment before signatures), with its deadline (key establishment Dec 31 2030, signatures Dec 31 2031), recommended NIST replacement, progress metrics, and findings (missed deadlines, TLS below 1.3, no target dates, unrecognized algorithms). Requires the organization API key.

    Annotations the server declares

    • openWorldHint: false
    • readOnlyHint: true
  • gov_pqc_system_saveRecord the cryptographic inventory (CBOM) of one system for post-quantum migration.No findings

    Why it is in this group

    • The name "gov_pqc_system_save" says "save": a word for a change.
    Description, as the server wrote it
    Record the cryptographic inventory (CBOM) of one system for post-quantum migration. Every change creates a new version and is written to the agency's tamper-evident 'pqc-inventory' log. Scanners and agents can submit results directly. Requires the organization API key.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: false
  • gov_pqc_verify_exportCheck that a CBOM and migration-plan document is exactly what was exported from Privi Ledger and return its on-chain seal.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Check that a CBOM and migration-plan document is exactly what was exported from Privi Ledger and return its on-chain seal. Free; no key needed.

    Annotations the server declares

    • openWorldHint: false
    • readOnlyHint: true
  • guard_balanceYour free checks left this month and your prepaid credits.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Your free checks left this month and your prepaid credits. Needs the organization key.

    Annotations the server declares

    • openWorldHint: false
    • readOnlyHint: true
  • guard_buy_creditsBuy prepaid Privi Guard checks in USDC on Base via x402.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Buy prepaid Privi Guard checks in USDC on Base via x402. Credits never expire and are used after the free monthly allowance. Needs the organization key.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
    • readOnlyHint: false
  • guard_checkCheck content for prompt injection (inbound) or leaked secrets and personal data (outbound) before an agent acts on it or sends it.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Check content for prompt injection (inbound) or leaked secrets and personal data (outbound) before an agent acts on it or sends it. Returns allow / warn / block, the findings, a redacted copy for outbound secrets, and an Ed25519-signed receipt anchored on-chain, which proves the check happened. Privi does not store the text. Free for 1,000 checks a month with an organization key; otherwise 1 cent per check in USDC via x402.

    Annotations the server declares

    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
  • guard_check_manyCheck up to 50 texts in one call (for example every tool result in a step).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Check up to 50 texts in one call (for example every tool result in a step). Each item is billed as its own check against your free allowance or credits and gets its own receipt. Needs an organization key.

    Annotations the server declares

    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
  • guard_pricingWhat Privi Guard checks, what it costs, and how receipts work.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    What Privi Guard checks, what it costs, and how receipts work. Free.

    Annotations the server declares

    • openWorldHint: false
    • readOnlyHint: true
  • guard_receiptVerify a Privi Guard receipt: the signed body, signature validity and its Merkle proof into the anchored transparency log.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Verify a Privi Guard receipt: the signed body, signature validity and its Merkle proof into the anchored transparency log. Free; anyone holding the id can verify it.

    Annotations the server declares

    • openWorldHint: false
    • readOnlyHint: true
  • kya_bind_walletStep 2: bind the wallet to your organization's Privi Passport so its transactions pass KYA checks.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Step 2: bind the wallet to your organization's Privi Passport so its transactions pass KYA checks. With a wallet signature the binding is *proven*; without one it is only *declared* (most checkers require proven). Requires the organization API key.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: false
  • kya_challengeStep 1 of binding a wallet to your Privi Passport: get a message to sign with that wallet (EIP-191 personal_sign).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Step 1 of binding a wallet to your Privi Passport: get a message to sign with that wallet (EIP-191 personal_sign). Valid 30 minutes. Requires the organization API key.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
    • readOnlyHint: false
  • kya_checkKnow-Your-Agent for blockchains: is this wallet operated by an audited AI agent, and how trustworthy is it right now?No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Know-Your-Agent for blockchains: is this wallet operated by an audited AI agent, and how trustworthy is it right now? Resolves the address to its organization and live Privi Passport and returns allow/deny with reasons, plus a Privi-signed attestation (valid 60 min) you can cache. For chains, DeFi protocols, exchanges, stablecoin issuers and x402 facilitators. Free; send your organization key to log the check as evidence.

    Annotations the server declares

    • openWorldHint: false
    • readOnlyHint: true
  • kya_walletsWallets bound to your organization and how each was proven.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Wallets bound to your organization and how each was proven. Requires the organization API key.

    Annotations the server declares

    • openWorldHint: false
    • readOnlyHint: true
  • ledger_audit_streamCheck whether an agent's action log is intact: entry count, time span, action and failure counts, head hash, and where tampering broke the chain if it did.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Check whether an agent's action log is intact: entry count, time span, action and failure counts, head hash, and where tampering broke the chain if it did. Does not reveal the actions themselves. Paid per call via x402.

    Annotations the server declares

    • openWorldHint: false
    • readOnlyHint: true
  • ledger_check_receiptConfirm that an action receipt exists in the ledger and when it was recorded.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Confirm that an action receipt exists in the ledger and when it was recorded. Reveals no action contents. Free.

    Annotations the server declares

    • openWorldHint: false
    • readOnlyHint: true
  • ledger_compliance_reportAudit-ready report of your AI agents' activity for a period (SOC 2 evidence, security questionnaires, AI-regulation record keeping): actions by type, failures, human approvals, log…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Audit-ready report of your AI agents' activity for a period (SOC 2 evidence, security questionnaires, AI-regulation record keeping): actions by type, failures, human approvals, log integrity, on-chain status, and findings. The report's hash is anchored on the Privi blockchain so it cannot be edited later without detection. Requires the organization API key.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
    • readOnlyHint: false
  • ledger_consistency_proofProof that Privi's log only grew between two signed tree heads: nothing recorded earlier was edited, removed or reordered (RFC 9162).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Proof that Privi's log only grew between two signed tree heads: nothing recorded earlier was edited, removed or reordered (RFC 9162). Free.

    Annotations the server declares

    • openWorldHint: false
    • readOnlyHint: true
  • ledger_evidence_bundleExport a self-contained evidence package for auditors, courts or air-gapped systems: every entry, the hash chain, an RFC 9162 inclusion proof, the signed tree head, on-chain checkp…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Export a self-contained evidence package for auditors, courts or air-gapped systems: every entry, the hash chain, an RFC 9162 inclusion proof, the signed tree head, on-chain checkpoint and Privi's keys, signed with Ed25519 and ML-DSA-87. Verify offline with verify_bundle.py (GET /tools/verify_bundle.py). Requires the organization API key.

    Annotations the server declares

    • openWorldHint: false
    • readOnlyHint: true
  • ledger_handshake_acceptAccept a handshake addressed to your organization: records the same terms in your log, confirms it in the other company's log, and seals the matched pair on chain (Base).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Accept a handshake addressed to your organization: records the same terms in your log, confirms it in the other company's log, and seals the matched pair on chain (Base). Requires your organization API key. Read the terms first with ledger_handshake_inbox.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
    • readOnlyHint: false
  • ledger_handshake_inboxHandshakes sent to and from your organization, newest first, with their terms and status.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Handshakes sent to and from your organization, newest first, with their terms and status. Requires your organization API key.

    Annotations the server declares

    • openWorldHint: false
    • readOnlyHint: true
  • ledger_handshake_offerStart a Privi Handshake: a two-sided record of a dealing with another company's agent (payment, data transfer, delivery, agreement).No findings

    Why it is in this group

    • The description's first verb is "start": a word for a change.
    Description, as the server wrote it
    Start a Privi Handshake: a two-sided record of a dealing with another company's agent (payment, data transfer, delivery, agreement). Recorded in your log now; when the other company accepts, both logs hold matching entries and the pair is sealed on chain (Base). Requires your organization API key; the other company must also use Privi Ledger.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
    • readOnlyHint: false
  • ledger_handshake_rejectReject a handshake addressed to your organization; the other company's log records the rejection.No findings

    Why it is in this group

    • The name "ledger_handshake_reject" says "reject": a word for a change.
    Description, as the server wrote it
    Reject a handshake addressed to your organization; the other company's log records the rejection. Requires your organization API key.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
    • readOnlyHint: false
  • ledger_handshake_verifyPublic check of a handshake: both companies, status, whether both matching log entries still exist, and the on-chain seal.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Public check of a handshake: both companies, status, whether both matching log entries still exist, and the on-chain seal. Never reveals the terms. Free; useful for disputes and audits.

    Annotations the server declares

    • openWorldHint: false
    • readOnlyHint: true
  • ledger_inclusion_proofMerkle audit path proving an entry is in Privi's append-only transparency log (RFC 9162).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Merkle audit path proving an entry is in Privi's append-only transparency log (RFC 9162). Verifiable offline against the signed tree head. Reveals no entry contents. Free.

    Annotations the server declares

    • openWorldHint: false
    • readOnlyHint: true
  • ledger_planYour plan, entries used this month, the limit, and when a Pro plan renews.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Your plan, entries used this month, the limit, and when a Pro plan renews. Requires your organization API key.

    Annotations the server declares

    • openWorldHint: false
    • readOnlyHint: true
  • ledger_record_actionAppend an action to the organization's tamper-evident log.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Append an action to the organization's tamper-evident log. Returns the entry with its entry_hash receipt. Requires the organization API key.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: false
    • readOnlyHint: false
  • ledger_report_pdfA finished PDF of a sealed compliance report, for auditors and customers.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    A finished PDF of a sealed compliance report, for auditors and customers. Returned as base64 (pdf_base64) and as an embedded PDF resource; also downloadable at /reports/<report_id>.pdf with the organization key. Requires the organization API key.

    Annotations the server declares

    • openWorldHint: false
    • readOnlyHint: true
  • ledger_signupCreate a Privi Ledger organization on the free plan and get its API key (shown once; store it).No findings

    Why it is in this group

    • The description's first verb is "create": a word for a change.
    Description, as the server wrote it
    Create a Privi Ledger organization on the free plan and get its API key (shown once; store it). Free plan: up to the monthly entry limit, all tools included. Upgrade any time with ledger_upgrade_pro. No key needed to sign up.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
    • readOnlyHint: false
  • ledger_upgrade_proBuy 30 days of Privi Ledger Pro (unlimited entries) for your organization, paid in USDC on Base via x402.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Buy 30 days of Privi Ledger Pro (unlimited entries) for your organization, paid in USDC on Base via x402. Each call adds 30 days. Requires your organization API key.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
    • readOnlyHint: false
  • ledger_verify_reportCheck that a compliance report is unaltered: recomputes its hash, confirms Privi Ledger issued it, and checks the anchor on chain (Base, until the Privi chain mainnet).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Check that a compliance report is unaltered: recomputes its hash, confirms Privi Ledger issued it, and checks the anchor on chain (Base, until the Privi chain mainnet). Free; no key needed.

    Annotations the server declares

    • openWorldHint: false
    • readOnlyHint: true
  • live_infoReal-time Privi: WebSocket and server-sent-event streams (trust changes, your own audit tail, approvals), a kill switch, human approvals, a metered MCP gateway and paid agent-to-ag…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Real-time Privi: WebSocket and server-sent-event streams (trust changes, your own audit tail, approvals), a kill switch, human approvals, a metered MCP gateway and paid agent-to-agent rooms. Returns the endpoints, channels, frames and what each plan gets. Free; no key needed.

    Annotations the server declares

    • openWorldHint: false
    • readOnlyHint: true
  • mandate_checkFor merchants, payment facilitators and counterparties: did a human authorize this AI agent to pay you this amount?No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    For merchants, payment facilitators and counterparties: did a human authorize this AI agent to pay you this amount? Verifies the human's wallet signature, status, expiry, per-payment cap, remaining budget and payee list, and returns allow/deny with reasons plus a Privi-signed attestation. Free; no key needed.

    Annotations the server declares

    • openWorldHint: false
    • readOnlyHint: true
  • mandate_createDraft a Privi Mandate: the human's signed permission for your agent to spend, with a budget, per-payment cap, allowed payees and expiry.No findings

    Why it is in this group

    • The name "mandate_create" says "create": a word for a change.
    Description, as the server wrote it
    Draft a Privi Mandate: the human's signed permission for your agent to spend, with a budget, per-payment cap, allowed payees and expiry. Returns sign_url: send it to the human, who reads the plain-English terms and signs once with their wallet (free, no transaction). Nothing can be spent until they sign. Requires the organization API key.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
    • readOnlyHint: false
  • mandate_spendCall before each payment: checks the mandate and, if allowed, deducts the amount from the budget and records the payment in the agent's tamper-evident log.No findings

    Why it is in this group

    • The description's first verb is "call": a word for a change.
    Description, as the server wrote it
    Call before each payment: checks the mandate and, if allowed, deducts the amount from the budget and records the payment in the agent's tamper-evident log. Refused payments are logged as blocked. Refused at once if the kill switch is on. Over the organization's live-approval threshold it returns approval_required with an approve_url for the human; call again with approval_id once they approve. Requires the organization API key.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
    • readOnlyHint: false
  • mcp_server_checkFree safety check for any remote MCP server, before an agent connects to it or after it was approved.Reads text others writeCan send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Free safety check for any remote MCP server, before an agent connects to it or after it was approved. Privi reads the server's tool list (it never calls a tool) and returns a verdict: ok, caution, danger (tool poisoning: hidden instructions, concealment from the user, requests for keys or private files, tool shadowing, invisible characters), changed (tools differ from expected_tools_hash), unverified (tools behind auth) or unreachable. Also returns the tools_hash to pin, a grade A-F and a link to the server's public history. Every first observation and change is recorded in Privi's on-chain-anchored transparency log. No key needed.

    Annotations the server declares

    • openWorldHint: true
    • readOnlyHint: true
  • passport_gateOne-call allow/deny decision before transacting with another AI agent: verifies its Privi Passport and applies your minimums, returning the reasons.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    One-call allow/deny decision before transacting with another AI agent: verifies its Privi Passport and applies your minimums, returning the reasons. If you send your organization API key the decision is recorded in your own tamper-evident log as due-diligence evidence. Free.

    Annotations the server declares

    • openWorldHint: false
    • readOnlyHint: true
  • passport_issueIssue a Privi Passport: a signed, on-chain-anchored trust credential for your agent or organization, scored 0-1000 (grade A-E) from verified history, integrity, anchoring, reliabil…Reads text others write1 finding

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Info

      The description mentions "credential".

      Matched text

      description: "...port: a signed, on-chain-anchored trust credential for your agent or organization, scored..."

      What this check looks for
    Description, as the server wrote it
    Issue a Privi Passport: a signed, on-chain-anchored trust credential for your agent or organization, scored 0-1000 (grade A-E) from verified history, integrity, anchoring, reliability, human oversight, compliance reports and confirmed handshakes. Show it to counterparties; they verify it free with passport_verify / passport_gate. Valid 30 days. Free on Pro/enterprise; free-plan organizations pay per passport via x402. Requires the organization API key.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
    • readOnlyHint: false
  • passport_verifyCheck an AI agent's Privi Passport before trusting it: Privi signature, content unaltered, not expired or revoked, anchor on chain (Base), and a live re-score of the agent right no…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Check an AI agent's Privi Passport before trusting it: Privi signature, content unaltered, not expired or revoked, anchor on chain (Base), and a live re-score of the agent right now (so tampering after issue is caught). Free; no key needed.

    Annotations the server declares

    • openWorldHint: false
    • readOnlyHint: true
  • privi_token_marketPRIVI on Base: price, how much PRIVI and USDC the Privi swap desk holds (so whether a swap can fill), any Uniswap v3 / Aerodrome pools, and optionally a swap quote.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    PRIVI on Base: price, how much PRIVI and USDC the Privi swap desk holds (so whether a swap can fill), any Uniswap v3 / Aerodrome pools, and optionally a swap quote. Every paid Privi tool also accepts PRIVI. Free.

    Annotations the server declares

    • openWorldHint: true
    • readOnlyHint: true
  • room_infoPublic facts about a room: parties, price, message count, head hash and its seal once closed.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Public facts about a room: parties, price, message count, head hash and its seal once closed. No message text. Free.

    Annotations the server declares

    • openWorldHint: false
    • readOnlyHint: true
  • room_openOpen a live, hash-chained conversation room for two organizations' agents.No findings

    Why it is in this group

    • The name "room_open" says "open": a word for a change.
    Description, as the server wrote it
    Open a live, hash-chained conversation room for two organizations' agents. Both connect over WebSocket (ws_url), authenticate with their API keys and talk in real time; closing the room seals the transcript on the Privi chain. Optionally charge per message, paid under the guest's human-signed Mandate. Requires the organization API key.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
    • readOnlyHint: false
  • room_transcriptEvery message in a room you are part of, with the chain check.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Every message in a room you are part of, with the chain check. Requires the organization API key.

    Annotations the server declares

    • openWorldHint: false
    • readOnlyHint: true
  • room_verifyCheck a closed room's seal (signature, on-chain anchor) and, if you pass the transcript, that it is complete and unaltered.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Check a closed room's seal (signature, on-chain anchor) and, if you pass the transcript, that it is complete and unaltered. Free; no key needed.

    Annotations the server declares

    • openWorldHint: false
    • readOnlyHint: true
  • scan_changesThe latest MCP servers whose tool definitions changed after they were first observed (possible rug pulls), newest first.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    The latest MCP servers whose tool definitions changed after they were first observed (possible rug pulls), newest first. Subscribe to the Live channel 'scan' for these as they happen. Free.

    Annotations the server declares

    • openWorldHint: false
    • readOnlyHint: true
  • scan_claim_startStart proving you operate an MCP server listed in Privi Scan.No findings

    Why it is in this group

    • The name "scan_claim_start" says "start": a word for a change.
    Description, as the server wrote it
    Start proving you operate an MCP server listed in Privi Scan. Returns a token to publish at https://<your host>/.well-known/privi-scan.txt. Verified owners get an owner-verified badge, unlimited rescans, change alerts and control over the listing. Needs the org key (create_org is free).

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: false
  • scan_claim_verifyCheck the token at /.well-known/privi-scan.txt and mark your organization as the verified owner.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Check the token at /.well-known/privi-scan.txt and mark your organization as the verified owner.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: false
  • scan_owner_listingVerified owners only: hide the server from the directory (opt-out) or show it again.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Verified owners only: hide the server from the directory (opt-out) or show it again. History already in the transparency log cannot be removed.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: false
  • scan_rescanProbe the server immediately instead of waiting for the next crawl (every ~6 hours).Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe description's first sentence says "crawl": it reads web pages, which anyone can write.
    Description, as the server wrote it
    Probe the server immediately instead of waiting for the next crawl (every ~6 hours). For the verified owner or Pro organizations.

    Annotations the server declares

    • openWorldHint: true
    • readOnlyHint: true
  • scan_serverFull report for one MCP server: every tool definition with its hash, all findings with evidence, the change history (what was added, removed or modified, and when) and the transpar…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Full report for one MCP server: every tool definition with its hash, all findings with evidence, the change history (what was added, removed or modified, and when) and the transparency-log proof. Free.

    Annotations the server declares

    • openWorldHint: false
    • readOnlyHint: true
  • scan_statsHow many MCP servers Privi Scan tracks, by status and grade, tools indexed, changes recorded and how to verify the evidence.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    How many MCP servers Privi Scan tracks, by status and grade, tools indexed, changes recorded and how to verify the evidence. Free.

    Annotations the server declares

    • openWorldHint: false
    • readOnlyHint: true
  • scan_watchPin the server's current tools as approved and get a real-time event on your private Live 'org' channel the moment they change, a risk appears or the server goes down.No findings

    Why it is in this group

    • The description's first verb is "pin": a word for a change.
    Description, as the server wrote it
    Pin the server's current tools as approved and get a real-time event on your private Live 'org' channel the moment they change, a risk appears or the server goes down. Free plan: 3 servers; Pro: 500. Needs the org key.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: false
  • scan_watchlistYour watched servers with their pinned tools_hash and whether each has drifted since you pinned it.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Your watched servers with their pinned tools_hash and whether each has drifted since you pinned it. Needs the org key.

    Annotations the server declares

    • openWorldHint: false
    • readOnlyHint: true
  • trust_eventsThe latest trust-change events: passports issued, revoked or re-scored, wallets bound or unbound, mandates activated or revoked, transparency-log heads anchored.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    The latest trust-change events: passports issued, revoked or re-scored, wallets bound or unbound, mandates activated or revoked, transparency-log heads anchored. Without a Pro key the feed is delayed (see live_info); use the WebSocket or SSE stream for real time. Free.

    Annotations the server declares

    • openWorldHint: false
    • readOnlyHint: true
Only reads 16Show 16 read-only tools
  • approval_listYour organization's approval requests, newest first.No findings

    Why it is in this group

    • The name "approval_list" says "list": a word for reading.
    Description, as the server wrote it
    Your organization's approval requests, newest first. Requires the organization API key.

    Annotations the server declares

    • openWorldHint: false
    • readOnlyHint: true
  • approval_statusStatus of an approval request: pending, approved, denied, expired or cancelled, with the human's wallet signature once they decide.No findings

    Why it is in this group

    • The name "approval_status" says "status": a word for reading.
    Description, as the server wrote it
    Status of an approval request: pending, approved, denied, expired or cancelled, with the human's wallet signature once they decide. Free.

    Annotations the server declares

    • openWorldHint: false
    • readOnlyHint: true
  • approval_waitBlock until the human decides (or timeout_s passes).No findings

    Why it is in this group

    • The name "approval_wait" says "wait": a word for reading.
    Description, as the server wrote it
    Block until the human decides (or timeout_s passes). Returns the current status; if still pending, call again. Free.

    Annotations the server declares

    • openWorldHint: false
    • readOnlyHint: true
  • fortress_tpi_listYour organization's two-person requests.No findings

    Why it is in this group

    • The name "fortress_tpi_list" says "list": a word for reading.
    Description, as the server wrote it
    Your organization's two-person requests. Requires the organization API key.

    Annotations the server declares

    • openWorldHint: false
    • readOnlyHint: true
  • fortress_tpi_statusStatus of a two-person request (pending, authorized, vetoed, expired, executed) and who approved.No findings

    Why it is in this group

    • The name "fortress_tpi_status" says "status": a word for reading.
    Description, as the server wrote it
    Status of a two-person request (pending, authorized, vetoed, expired, executed) and who approved. Free.

    Annotations the server declares

    • openWorldHint: false
    • readOnlyHint: true
  • gateway_listYour organization's gateways.No findings

    Why it is in this group

    • The name "gateway_list" says "list": a word for reading.
    Description, as the server wrote it
    Your organization's gateways. Requires the organization API key.

    Annotations the server declares

    • openWorldHint: false
    • readOnlyHint: true
  • ledger_list_streamsList your organization's streams with entry counts.No findings

    Why it is in this group

    • The name "ledger_list_streams" says "list": a word for reading.
    Description, as the server wrote it
    List your organization's streams with entry counts. Requires the organization API key.

    Annotations the server declares

    • openWorldHint: false
    • readOnlyHint: true
  • ledger_pricingList Privi Ledger tools, what each costs, and how to get an organization key.No findings

    Why it is in this group

    • The description's first verb is "list": a word for reading.
    Description, as the server wrote it
    List Privi Ledger tools, what each costs, and how to get an organization key.

    Annotations the server declares

    • openWorldHint: false
    • readOnlyHint: true
  • ledger_read_streamRead your organization's entries in a stream, oldest first, with an integrity check of the whole stream.No findings

    Why it is in this group

    • The name "ledger_read_stream" says "read": a word for reading.
    Description, as the server wrote it
    Read your organization's entries in a stream, oldest first, with an integrity check of the whole stream. Requires the organization API key.

    Annotations the server declares

    • openWorldHint: false
    • readOnlyHint: true
  • ledger_tree_headThe latest signed tree head of Privi's transparency log: an RFC 9162 Merkle root over every entry ever recorded, signed with Ed25519 and ML-DSA-87, and periodically anchored on cha…No findings

    Why it is in this group

    • The name "ledger_tree_head" says "tree": a word for reading.
    Description, as the server wrote it
    The latest signed tree head of Privi's transparency log: an RFC 9162 Merkle root over every entry ever recorded, signed with Ed25519 and ML-DSA-87, and periodically anchored on chain (Base). Free.

    Annotations the server declares

    • openWorldHint: false
    • readOnlyHint: true
  • live_statusYour kill switches, live-approval thresholds, pending approvals, gateways, rooms and usage this month.No findings

    Why it is in this group

    • The name "live_status" says "status": a word for reading.
    Description, as the server wrote it
    Your kill switches, live-approval thresholds, pending approvals, gateways, rooms and usage this month. Requires the organization API key.

    Annotations the server declares

    • openWorldHint: false
    • readOnlyHint: true
  • mandate_getPublic view of a mandate: terms, status, the human's signature, spent and remaining budget, and recent spends.No findings

    Why it is in this group

    • The name "mandate_get" says "get": a word for reading.
    Description, as the server wrote it
    Public view of a mandate: terms, status, the human's signature, spent and remaining budget, and recent spends. Free.

    Annotations the server declares

    • openWorldHint: false
    • readOnlyHint: true
  • mandate_listYour organization's mandates with status and remaining budget.No findings

    Why it is in this group

    • The name "mandate_list" says "list": a word for reading.
    Description, as the server wrote it
    Your organization's mandates with status and remaining budget. Requires the organization API key.

    Annotations the server declares

    • openWorldHint: false
    • readOnlyHint: true
  • passport_listYour organization's issued passports with score, grade, expiry and revocation.No findings

    Why it is in this group

    • The name "passport_list" says "list": a word for reading.
    Description, as the server wrote it
    Your organization's issued passports with score, grade, expiry and revocation. Requires the organization API key.

    Annotations the server declares

    • openWorldHint: false
    • readOnlyHint: true
  • room_listRooms your organization owns or joined.No findings

    Why it is in this group

    • The name "room_list" says "list": a word for reading.
    Description, as the server wrote it
    Rooms your organization owns or joined. Requires the organization API key.

    Annotations the server declares

    • openWorldHint: false
    • readOnlyHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

9 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 1 outbound tool breaks every one.

Reads private data1
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write9
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out1
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
deny to break every path
{
  "permissions": {
    "deny": [
      "mcp__privi-ledger__mcp_server_check"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Sign-in required, no OAuth metadata

Looked at Oct 22, 2026, 14:57 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable
yes
HTTP status of an anonymous initialize
404
tools/list served without credentials
no
Tools that change things, listed without credentials
0
Protocol version
not observed
WWW-Authenticate on 401
not observed
resource_metadata in WWW-Authenticate
not observed
RFC 9728 protected resource metadata
not observed
Authorization servers
not observed
Legacy HTTP+SSE transport
no
Dynamic client registration
not observed
Client ID metadata documents
not observed

The probe stopped: initialize answered HTTP 404.

Findings

Matches of fixed checks, with the text they matched.

3 warn1 info
  • Warngateway_stats

    The server marks "gateway_stats" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"openWorldHint":false}; The description's first verb is "call": a word for a change.

    What this check looks for
  • Warnscan_unwatch

    The server marks "scan_unwatch" not destructive (destructiveHint: false), and its own name, description or input give the class "destructive".

    Matched text

    annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "remove": a word for removing or ending something.

    What this check looks for
  • Warnprivi_payment_options

    The server marks "privi_payment_options" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true}; The name "privi_payment_options" says "payment": a word that usually means money moves, which cannot be taken back.

    What this check looks for
  • Infopassport_issue

    The description mentions "credential".

    Matched text

    description: "...port: a signed, on-chain-anchored trust credential for your agent or organization, scored..."

    What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 0.10.2. Values in angle brackets are yours to fill in.

claude mcp add --transport http privi-ledger https://privi-ledger.onrender.com/mcp
claude mcp add --transport http privi-ledger https://privi-ledger.onrender.com/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__privi-ledger__ledger_pricing",
      "mcp__privi-ledger__ledger_read_stream",
      "mcp__privi-ledger__ledger_list_streams",
      "mcp__privi-ledger__passport_list",
      "mcp__privi-ledger__mandate_get",
      "mcp__privi-ledger__mandate_list",
      "mcp__privi-ledger__ledger_tree_head",
      "mcp__privi-ledger__fortress_tpi_status",
      "mcp__privi-ledger__fortress_tpi_list",
      "mcp__privi-ledger__live_status",
      "mcp__privi-ledger__approval_status",
      "mcp__privi-ledger__approval_wait",
      "mcp__privi-ledger__approval_list",
      "mcp__privi-ledger__gateway_list",
      "mcp__privi-ledger__room_list",
      "mcp__privi-ledger__scan_search"
    ],
    "ask": [
      "mcp__privi-ledger__privi_token_market",
      "mcp__privi-ledger__ledger_check_receipt",
      "mcp__privi-ledger__ledger_audit_stream",
      "mcp__privi-ledger__ledger_record_action",
      "mcp__privi-ledger__ledger_compliance_report",
      "mcp__privi-ledger__ledger_report_pdf",
      "mcp__privi-ledger__ledger_verify_report",
      "mcp__privi-ledger__ledger_signup",
      "mcp__privi-ledger__ledger_plan",
      "mcp__privi-ledger__ledger_upgrade_pro",
      "mcp__privi-ledger__gov_ai_usecase_save",
      "mcp__privi-ledger__gov_ai_inventory",
      "mcp__privi-ledger__gov_ai_inventory_check",
      "mcp__privi-ledger__gov_ai_inventory_export",
      "mcp__privi-ledger__gov_ai_verify_export",
      "mcp__privi-ledger__gov_pqc_classify",
      "mcp__privi-ledger__gov_pqc_system_save",
      "mcp__privi-ledger__gov_pqc_inventory",
      "mcp__privi-ledger__gov_pqc_plan",
      "mcp__privi-ledger__gov_pqc_export",
      "mcp__privi-ledger__gov_pqc_verify_export",
      "mcp__privi-ledger__ledger_handshake_offer",
      "mcp__privi-ledger__ledger_handshake_inbox",
      "mcp__privi-ledger__ledger_handshake_accept",
      "mcp__privi-ledger__ledger_handshake_reject",
      "mcp__privi-ledger__ledger_handshake_verify",
      "mcp__privi-ledger__passport_issue",
      "mcp__privi-ledger__passport_verify",
      "mcp__privi-ledger__passport_gate",
      "mcp__privi-ledger__kya_check",
      "mcp__privi-ledger__kya_challenge",
      "mcp__privi-ledger__kya_bind_wallet",
      "mcp__privi-ledger__kya_wallets",
      "mcp__privi-ledger__mandate_create",
      "mcp__privi-ledger__mandate_check",
      "mcp__privi-ledger__mandate_spend",
      "mcp__privi-ledger__fortress_keys",
      "mcp__privi-ledger__ledger_inclusion_proof",
      "mcp__privi-ledger__ledger_consistency_proof",
      "mcp__privi-ledger__fortress_tpi_policy",
      "mcp__privi-ledger__fortress_tpi_request",
      "mcp__privi-ledger__fortress_tpi_execute",
      "mcp__privi-ledger__ledger_evidence_bundle",
      "mcp__privi-ledger__live_info",
      "mcp__privi-ledger__approval_policy_set",
      "mcp__privi-ledger__approval_request",
      "mcp__privi-ledger__trust_events",
      "mcp__privi-ledger__gateway_create",
      "mcp__privi-ledger__gateway_set_guard",
      "mcp__privi-ledger__gateway_info",
      "mcp__privi-ledger__gateway_stats",
      "mcp__privi-ledger__room_open",
      "mcp__privi-ledger__room_info",
      "mcp__privi-ledger__room_transcript",
      "mcp__privi-ledger__room_verify",
      "mcp__privi-ledger__mcp_server_check",
      "mcp__privi-ledger__scan_server",
      "mcp__privi-ledger__scan_changes",
      "mcp__privi-ledger__scan_stats",
      "mcp__privi-ledger__scan_watch",
      "mcp__privi-ledger__scan_watchlist",
      "mcp__privi-ledger__scan_claim_start",
      "mcp__privi-ledger__scan_claim_verify",
      "mcp__privi-ledger__scan_owner_listing",
      "mcp__privi-ledger__scan_rescan",
      "mcp__privi-ledger__guard_check",
      "mcp__privi-ledger__guard_check_many",
      "mcp__privi-ledger__guard_receipt",
      "mcp__privi-ledger__guard_balance",
      "mcp__privi-ledger__guard_buy_credits",
      "mcp__privi-ledger__guard_pricing",
      "mcp__privi-ledger__privi_payment_options",
      "mcp__privi-ledger__privi_test_payment_quote",
      "mcp__privi-ledger__privi_test_payment_simulate"
    ],
    "deny": [
      "mcp__privi-ledger__passport_revoke",
      "mcp__privi-ledger__kya_unbind_wallet",
      "mcp__privi-ledger__mandate_revoke",
      "mcp__privi-ledger__live_kill",
      "mcp__privi-ledger__live_resume",
      "mcp__privi-ledger__approval_cancel",
      "mcp__privi-ledger__gateway_delete",
      "mcp__privi-ledger__room_close",
      "mcp__privi-ledger__scan_unwatch"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as privi-ledger. Review it before you use it.

Capability tags behind 10 rules
  • mcp__privi-ledger__privi_token_market untrusted-input
  • mcp__privi-ledger__ledger_compliance_report untrusted-input
  • mcp__privi-ledger__ledger_upgrade_pro untrusted-input
  • mcp__privi-ledger__gov_ai_inventory_export untrusted-input
  • mcp__privi-ledger__gov_pqc_export untrusted-input
  • mcp__privi-ledger__passport_issue untrusted-input
  • mcp__privi-ledger__mcp_server_check untrusted-input, outbound
  • mcp__privi-ledger__scan_search private-data
  • mcp__privi-ledger__scan_rescan untrusted-input
  • mcp__privi-ledger__guard_buy_credits untrusted-input

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/io.github.canoydario847-cloud/privi-ledger/verify?hash=8f6bd022a502be02a3192e9d93fd1d87e161baeb72f030b1fee12566df054568" | jq -e '.changed == false'

Pinned hash 8f6bd022a502, from Oct 26, 2026, 20:18 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/io.github.canoydario847-cloud/privi-ledger/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for io.github.canoydario847-cloud/privi-ledger
[![anlyon.dev](https://anlyon.dev/badge/io.github.canoydario847-cloud/privi-ledger.svg)](https://anlyon.dev/servers/io.github.canoydario847-cloud/privi-ledger)

Source: MCP Registry · repository. Synced Oct 26, 2026, 20:18 UTC.