Agentry — The Trust Layer for the Agent Economy

io.github.cthulhutoo/agentrycthulhutoostreamable-httpv0.4.0Scanned 22 hours ago

Agent registry with Nostr identity, reputation, escrow, observability, and Lightning payments.

36 tools: 7 do something that can't be undone, 9 change things and 20 only read.

Reads private data · 0
Reads text others write · 0
Can send data out · 10
No findings

Tools listed without sign-in. Remote posture

Anlyon alternative

16 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

36 tools

Can't be undone 7Sends, pays, publishes or merges: once done, it cannot be taken back.Claude Code: ask

agent_payment_summary_api_payments_ecash_summary__agent_id__getAgent Payment Summary Get payment summary for an agent — totals, balance, tx count.No findings
Why it is in this group
- The name "agent_payment_summary_api_payments_ecash_summary__agent_id__get" says "payment": a word that usually means money moves, which cannot be taken back.
Description, as the server wrote it
Agent Payment Summary Get payment summary for an agent — totals, balance, tx count. ### Responses: **200**: Successful Response (Success Response) Content-Type: application/json
check_quote_api_payments_ecash_mint_quote__quote_id__getCheck Quote Check the payment status of a mint quote.No findings
Why it is in this group
- The name "check_quote_api_payments_ecash_mint_quote__quote_id__get" says "payment": a word that usually means money moves, which cannot be taken back.
Description, as the server wrote it
Check Quote Check the payment status of a mint quote. ### Responses: **200**: Successful Response (Success Response) Content-Type: application/json
payment_required_api_payments_ecash_402__agent_id__getPayment Required Return a 402 Payment Required response with X-Cashu headers.No findings
Why it is in this group
- The name "payment_required_api_payments_ecash_402__agent_id__get" says "payment": a word that usually means money moves, which cannot be taken back.
Description, as the server wrote it
Payment Required Return a 402 Payment Required response with X-Cashu headers. This endpoint lets agents advertise that they charge for services. Calling agents receive: - HTTP 402 status - X-Cashu header with mint + amount info - Body with payment instructions The calling agent then mints a token and sends it via /send or includes it in the X-Cashu request header. ### Responses: **200**: Successful Response (Success Response) Content-Type: application/json
receive_ecash_api_payments_ecash_receive_postReceive Ecash Receive/redeem a Cashu ecash token.No findings
Why it is in this group
- The name "receive_ecash_api_payments_ecash_receive_post" says "payment": a word that usually means money moves, which cannot be taken back.
Description, as the server wrote it
Receive Ecash Receive/redeem a Cashu ecash token. The agent swaps the received proofs for new ones at the mint, ensuring the sender can't double-spend. This is the standard Cashu receive flow (NUT-03 swap). ### Responses: **200**: Successful Response (Success Response) Content-Type: application/json
send_ecash_api_payments_ecash_send_postSend Ecash Send ecash tokens from one agent to another.Can send data outNo findings
Why it is in this group
- The name "send_ecash_api_payments_ecash_send_post" says "send": a word for sending, and what is sent cannot be taken back.
What it can reach
- outboundThe name "send_ecash_api_payments_ecash_send_post" says "send": it sends or publishes something to other people.
Description, as the server wrote it
Send Ecash Send ecash tokens from one agent to another. Two modes: 1. Provide a pre-minted `token` (cashuA...) — we verify and record the transfer 2. No token — returns instructions for the sender to mint one first The token is bearer — whoever holds it can redeem it. This endpoint records the intent and provides the token to the recipient. ### Responses: **200**: Successful Response (Success Response) Content-Type: application/json
send_outreach_api_admin_outreach_postSend Outreach Admin endpoint to send trust score outreach to a specific agent contact.Can send data outNo findings
Why it is in this group
- The name "send_outreach_api_admin_outreach_post" says "send": a word for sending, and what is sent cannot be taken back.
What it can reach
- outboundThe name "send_outreach_api_admin_outreach_post" says "send": it sends or publishes something to other people.
Description, as the server wrote it
Send Outreach Admin endpoint to send trust score outreach to a specific agent contact. ### Responses: **200**: Successful Response (Success Response) Content-Type: application/json
verify_token_api_payments_ecash_verify_postVerify Token Verify a Cashu ecash token — check format, amount, and spent status.No findings
Why it is in this group
- The name "verify_token_api_payments_ecash_verify_post" says "payment": a word that usually means money moves, which cannot be taken back.
Description, as the server wrote it
Verify Token Verify a Cashu ecash token — check format, amount, and spent status. ### Responses: **200**: Successful Response (Success Response) Content-Type: application/json

Changes things 9Creates or changes something that can be changed back.Claude Code: ask

claim_agent_api_agents_claim_postClaim Agent Developer claims ownership of an existing agent listing.Can send data outNo findings
Why it is in this group
- The name "claim_agent_api_agents_claim_post" says "post": a word for a change.
What it can reach
- outboundThe name "claim_agent_api_agents_claim_post" says "post": it sends or publishes something to other people.
Description, as the server wrote it
Claim Agent Developer claims ownership of an existing agent listing. ### Responses: **200**: Successful Response (Success Response) Content-Type: application/json
create_melt_quote_api_payments_ecash_melt_quote_postCreate Melt Quote Get a quote to melt ecash into a Lightning payment (NUT-05).Can send data outNo findings
Why it is in this group
- The name "create_melt_quote_api_payments_ecash_melt_quote_post" says "create": a word for a change.
What it can reach
- outboundThe name "create_melt_quote_api_payments_ecash_melt_quote_post" says "create" and "post": it writes something other people read.
Description, as the server wrote it
Create Melt Quote Get a quote to melt ecash into a Lightning payment (NUT-05). Used when an agent wants to pay a Lightning invoice using their ecash. ### Responses: **200**: Successful Response (Success Response) Content-Type: application/json
create_quote_api_payments_ecash_mint_quote_postCreate Quote Create a Lightning invoice to fund ecash minting (NUT-04).Can send data outNo findings
Why it is in this group
- The name "create_quote_api_payments_ecash_mint_quote_post" says "create": a word for a change.
What it can reach
- outboundThe name "create_quote_api_payments_ecash_mint_quote_post" says "create" and "post": it writes something other people read.
Description, as the server wrote it
Create Quote Create a Lightning invoice to fund ecash minting (NUT-04). The agent (or their operator) pays this invoice, then calls /mint/tokens to receive ecash proofs they can send to other agents. ### Responses: **200**: Successful Response (Success Response) Content-Type: application/json
discover_single_agent_api_registry_discover__agent_id__postDiscover Single Agent Discover / re-check a single agent's A2A Agent Card.Can send data outNo findings
Why it is in this group
- The name "discover_single_agent_api_registry_discover__agent_id__post" says "post": a word for a change.
What it can reach
- outboundThe name "discover_single_agent_api_registry_discover__agent_id__post" says "post": it sends or publishes something to other people.
Description, as the server wrote it
Discover Single Agent Discover / re-check a single agent's A2A Agent Card. ### Responses: **200**: Successful Response (Success Response) Content-Type: application/json
register_agent_api_agents_register_postRegister Agent Register a new AI agent in the Agentry directory.Can send data outNo findings
Why it is in this group
- The name "register_agent_api_agents_register_post" says "post": a word for a change.
What it can reach
- outboundThe name "register_agent_api_agents_register_post" says "post": it sends or publishes something to other people.
- outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
Description, as the server wrote it
Register Agent Register a new AI agent in the Agentry directory. Submit an AI agent for listing. The agent will be added immediately and appear in search results. Optional fields like pricing, features, and integrations improve discoverability. An A2A discovery scan will be triggered automatically if the agent URL is reachable. ### Responses: **201**: Successful Response (Success Response) Content-Type: application/json
submit_intake_api_broker_intake_postSubmit Intake Submit a broker intake request to find the right AI agent for your needs.Can send data outNo findings
Why it is in this group
- The name "submit_intake_api_broker_intake_post" says "submit": a word for a change.
What it can reach
- outboundThe name "submit_intake_api_broker_intake_post" says "submit" and "post": it writes something other people read.
Description, as the server wrote it
Submit Intake Submit a broker intake request to find the right AI agent for your needs. Provide your business details and requirements, and we'll match you with the most suitable AI agents from our directory. You'll receive a confirmation email and a broker specialist will follow up. ### Responses: **201**: Successful Response (Success Response) Content-Type: application/json
trigger_discovery_cycle_api_registry_discover_postTrigger Discovery Cycle Run a full discovery cycle across all agents in the registry.Can send data outNo findings
Why it is in this group
- The name "trigger_discovery_cycle_api_registry_discover_post" says "trigger": a word for a change.
What it can reach
- outboundThe name "trigger_discovery_cycle_api_registry_discover_post" says "trigger" and "post": it writes something other people read.
Description, as the server wrote it
Trigger Discovery Cycle Run a full discovery cycle across all agents in the registry. ### Responses: **200**: Successful Response (Success Response) Content-Type: application/json
trigger_scan_api_scanner_scan_postTrigger Scan Scan domains for A2A Agent Card discovery.Can send data outNo findings
Why it is in this group
- The name "trigger_scan_api_scanner_scan_post" says "trigger": a word for a change.
What it can reach
- outboundThe name "trigger_scan_api_scanner_scan_post" says "trigger" and "post": it writes something other people read.
Description, as the server wrote it
Trigger Scan Scan domains for A2A Agent Card discovery. Checks the given domains for /.well-known/agent.json endpoints and extracts agent capability metadata. Results are stored and can be retrieved via the scan results endpoint. ### Responses: **202**: Successful Response (Success Response) Content-Type: application/json
update_payment_profile_api_payments_ecash_profile__agent_id__putUpdate Payment Profile Update an agent's ecash payment profile.No findings
Why it is in this group
- The name "update_payment_profile_api_payments_ecash_profile__agent_id__put" says "update": a word for a change.
Description, as the server wrote it
Update Payment Profile Update an agent's ecash payment profile. Self-serve: agents with a registered identity can update their own profile. Admin key still works for platform operations. ### Responses: **200**: Successful Response (Success Response) Content-Type: application/json

Only reads 20Looks things up and changes nothing.Show 20 read-only tools

a2a_public_agent_card_api_agents_public__agent_id__getA2A Public Agent Card Return a single agent's A2A card by ID.No findings
Why it is in this group
- The name "a2a_public_agent_card_api_agents_public__agent_id__get" says "get": a word for reading.
Description, as the server wrote it
A2A Public Agent Card Return a single agent's A2A card by ID. ### Responses: **200**: Successful Response (Success Response) Content-Type: application/json
a2a_public_discovery_api_agents_public_getA2A Public Discovery A2A-compatible open discovery endpoint.No findings
Why it is in this group
- The name "a2a_public_discovery_api_agents_public_get" says "get": a word for reading.
Description, as the server wrote it
A2A Public Discovery A2A-compatible open discovery endpoint. Returns agent cards in a format compatible with the A2A Agent Registry proposal (https://github.com/a2aproject/A2A/discussions/741). ### Responses: **200**: Successful Response (Success Response) Content-Type: application/json
get_agent_api_agents__agent_id__getGet Agent Get full details for a specific AI agent by ID.No findings
Why it is in this group
- The name "get_agent_api_agents__agent_id__get" says "get": a word for reading.
Description, as the server wrote it
Get Agent Get full details for a specific AI agent by ID. Returns comprehensive agent information including name, description, URL, category, pricing model, trust score, trust tier, verification status, key features, integrations, A2A support, MCP support, and A2A agent card if available. ### Responses: **200**: Successful Response (Success Response) Content-Type: application/json
get_agent_trust_api_agents__agent_id__trust_getGet Agent Trust Get the trust report for an agent.No findings
Why it is in this group
- The name "get_agent_trust_api_agents__agent_id__trust_get" says "get": a word for reading.
Description, as the server wrote it
Get Agent Trust Get the trust report for an agent. ### Responses: **200**: Successful Response (Success Response) Content-Type: application/json
get_badge_embed_code_api_badges__agent_id__embed_getGet Badge Embed Code Return embed code snippets for an agent's badge.No findings
Why it is in this group
- The name "get_badge_embed_code_api_badges__agent_id__embed_get" says "get": a word for reading.
Description, as the server wrote it
Get Badge Embed Code Return embed code snippets for an agent's badge. ### Responses: **200**: Successful Response (Success Response) Content-Type: application/json
get_badge_json_api_badges__agent_id__json_getGet Badge Json Return badge metadata in shields.io endpoint format.No findings
Why it is in this group
- The name "get_badge_json_api_badges__agent_id__json_get" says "get": a word for reading.
Description, as the server wrote it
Get Badge Json Return badge metadata in shields.io endpoint format. Can be used with: https://img.shields.io/endpoint?url=... ### Responses: **200**: Successful Response (Success Response) Content-Type: application/json
get_badge_svg_api_badges__agent_id__svg_getGet Badge Svg Return an SVG badge for an agent listing.No findings
Why it is in this group
- The name "get_badge_svg_api_badges__agent_id__svg_get" says "get": a word for reading.
Description, as the server wrote it
Get Badge Svg Return an SVG badge for an agent listing. ### Responses: **200**: Successful Response (Success Response) Content-Type: application/json
get_card_history_api_agents__agent_id__card_history_getGet Card History Get AgentCard snapshot history for an agent.No findings
Why it is in this group
- The name "get_card_history_api_agents__agent_id__card_history_get" says "get": a word for reading.
Description, as the server wrote it
Get Card History Get AgentCard snapshot history for an agent. ### Responses: **200**: Successful Response (Success Response) Content-Type: application/json
get_intake_api_broker_intake__intake_id__getGet Intake Check the status of a previously submitted broker intake request.No findings
Why it is in this group
- The name "get_intake_api_broker_intake__intake_id__get" says "get": a word for reading.
Description, as the server wrote it
Get Intake Check the status of a previously submitted broker intake request. Returns the current status, any matched agents, and timestamps. ### Responses: **200**: Successful Response (Success Response) Content-Type: application/json
get_mint_info_api_payments_ecash_mint_info_getGet Mint Info Get info about a Cashu mint (NUT-06).No findings
Why it is in this group
- The name "get_mint_info_api_payments_ecash_mint_info_get" says "get": a word for reading.
Description, as the server wrote it
Get Mint Info Get info about a Cashu mint (NUT-06). ### Responses: **200**: Successful Response (Success Response) Content-Type: application/json
get_mint_keys_api_payments_ecash_mint_keys_getGet Mint Keys Get active public keys from a Cashu mint (NUT-01).No findings
Why it is in this group
- The name "get_mint_keys_api_payments_ecash_mint_keys_get" says "get": a word for reading.
Description, as the server wrote it
Get Mint Keys Get active public keys from a Cashu mint (NUT-01). ### Responses: **200**: Successful Response (Success Response) Content-Type: application/json
get_mint_keysets_api_payments_ecash_mint_keysets_getGet Mint Keysets Get all keysets from a Cashu mint (NUT-02).No findings
Why it is in this group
- The name "get_mint_keysets_api_payments_ecash_mint_keysets_get" says "get": a word for reading.
Description, as the server wrote it
Get Mint Keysets Get all keysets from a Cashu mint (NUT-02). ### Responses: **200**: Successful Response (Success Response) Content-Type: application/json
get_payment_profile_api_payments_ecash_profile__agent_id__getGet Payment Profile Get an agent's ecash payment profile.No findings
Why it is in this group
- The name "get_payment_profile_api_payments_ecash_profile__agent_id__get" says "get": a word for reading.
Description, as the server wrote it
Get Payment Profile Get an agent's ecash payment profile. ### Responses: **200**: Successful Response (Success Response) Content-Type: application/json
get_registry_stats_api_registry_stats_getGet Registry Stats Get registry-wide statistics.No findings
Why it is in this group
- The name "get_registry_stats_api_registry_stats_get" says "get": a word for reading.
Description, as the server wrote it
Get Registry Stats Get registry-wide statistics. ### Responses: **200**: Successful Response (Success Response) Content-Type: application/json
get_scan_results_api_scanner_results_getGet Scan Results Get recent A2A Agent Card scan results.No findings
Why it is in this group
- The name "get_scan_results_api_scanner_results_get" says "get": a word for reading.
Description, as the server wrote it
Get Scan Results Get recent A2A Agent Card scan results. Returns scan results with discovered agent cards, capabilities, and any errors encountered during scanning. ### Responses: **200**: Successful Response (Success Response) Content-Type: application/json
list_agents_api_agents_getList Agents List AI agents in the Agentry directory with optional filtering and pagination.No findings
Why it is in this group
- The name "list_agents_api_agents_get" says "list": a word for reading.
Description, as the server wrote it
List Agents List AI agents in the Agentry directory with optional filtering and pagination. Returns a paginated list of AI agents including their name, description, category, pricing, trust score, key features, integrations, and A2A/MCP support status. The directory contains 122+ agents across 11 categories. ### Responses: **200**: Successful Response (Success Response) Content-Type: application/json
list_categories_api_agents_categories_getList Categories List all agent categories with counts.No findings
Why it is in this group
- The name "list_categories_api_agents_categories_get" says "list": a word for reading.
Description, as the server wrote it
List Categories List all agent categories with counts. Returns every category in the directory along with the number of agents in each. Useful for building category filters or understanding the directory's coverage areas. ### Responses: **200**: Successful Response (Success Response) Content-Type: application/json **Example Response:** ```json [ { "category": "Category", "count": 1 } ] ```
list_ecash_agents_api_payments_ecash_agents_getList Ecash Agents List all agents that have ecash payments enabled.No findings
Why it is in this group
- The name "list_ecash_agents_api_payments_ecash_agents_get" says "list": a word for reading.
Description, as the server wrote it
List Ecash Agents List all agents that have ecash payments enabled. ### Responses: **200**: Successful Response (Success Response) Content-Type: application/json
list_transactions_api_payments_ecash_transactions_getList Transactions List ecash transactions, optionally filtered by agent or type.No findings
Why it is in this group
- The name "list_transactions_api_payments_ecash_transactions_get" says "list": a word for reading.
Description, as the server wrote it
List Transactions List ecash transactions, optionally filtered by agent or type. ### Responses: **200**: Successful Response (Success Response) Content-Type: application/json
search_agents_api_agents_search_getSearch Agents Search the Agentry AI agent directory by keyword.No findings
Why it is in this group
- The name "search_agents_api_agents_search_get" says "search": a word for reading.
Description, as the server wrote it
Search Agents Search the Agentry AI agent directory by keyword. Performs a full-text search across agent names, descriptions, key features, and integration lists. Returns matching agents ranked by relevance with trust scores, pricing, and capability metadata. ### Responses: **200**: Successful Response (Success Response) Content-Type: application/json

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data or untrusted-input.

Reads private data0: Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write0: Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out10: Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.; claim_agent_api_agents_claim_post
create_melt_quote_api_payments_ecash_melt_quote_post
create_quote_api_payments_ecash_mint_quote_post
discover_single_agent_api_registry_discover__agent_id__post
register_agent_api_agents_register_post
send_ecash_api_payments_ecash_send_post
send_outreach_api_admin_outreach_post
submit_intake_api_broker_intake_post
trigger_discovery_cycle_api_registry_discover_post
trigger_scan_api_scanner_scan_post

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Tools listed without sign-in

Looked at Oct 22, 2026, 14:58 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable: yes
HTTP status of an anonymous initialize: 200
tools/list served without credentials: yes
Tools that change things, listed without credentials: 16
Protocol version: 2025-06-18
WWW-Authenticate on 401: not observed
resource_metadata in WWW-Authenticate: not observed
RFC 9728 protected resource metadata: not observed
Authorization servers: not observed
Legacy HTTP+SSE transport: no
Dynamic client registration: not observed
Client ID metadata documents: not observed

HighThe whole server
The endpoint served tools/list without credentials, and the list has 16 tools that change things (7 irreversible, 9 write). Whether a call also works without credentials was not tested: tools are never called.
Matched text
https://api.agentry.com/mcp: tools/list returned 36 tools to an anonymous client, including check_quote_api_payments_ecash_mint_quote__quote_id__get (irreversible), send_ecash_api_payments_ecash_send_post (irreversible), receive_ecash_api_payments_ecash_receive_post (irreversible), verify_token_api_payments_ecash_verify_post (irreversible), agent_payment_summary_api_payments_ecash_summary__agent_id__get (irreversible) and 11 more
What this check looks for

Findings

Matches of fixed checks, with the text they matched.

No check matched anything in these tool definitions. That is not a safety guarantee.

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 0.4.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http agentry https://api.agentry.com/mcp

claude mcp add --transport http agentry https://api.agentry.com/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__agentry__a2a_public_discovery_api_agents_public_get",
      "mcp__agentry__a2a_public_agent_card_api_agents_public__agent_id__get",
      "mcp__agentry__list_agents_api_agents_get",
      "mcp__agentry__search_agents_api_agents_search_get",
      "mcp__agentry__list_categories_api_agents_categories_get",
      "mcp__agentry__get_agent_api_agents__agent_id__get",
      "mcp__agentry__get_intake_api_broker_intake__intake_id__get",
      "mcp__agentry__get_scan_results_api_scanner_results_get",
      "mcp__agentry__get_mint_info_api_payments_ecash_mint_info_get",
      "mcp__agentry__get_mint_keys_api_payments_ecash_mint_keys_get",
      "mcp__agentry__get_mint_keysets_api_payments_ecash_mint_keysets_get",
      "mcp__agentry__get_payment_profile_api_payments_ecash_profile__agent_id__get",
      "mcp__agentry__list_transactions_api_payments_ecash_transactions_get",
      "mcp__agentry__list_ecash_agents_api_payments_ecash_agents_get",
      "mcp__agentry__get_agent_trust_api_agents__agent_id__trust_get",
      "mcp__agentry__get_card_history_api_agents__agent_id__card_history_get",
      "mcp__agentry__get_registry_stats_api_registry_stats_get",
      "mcp__agentry__get_badge_svg_api_badges__agent_id__svg_get",
      "mcp__agentry__get_badge_json_api_badges__agent_id__json_get",
      "mcp__agentry__get_badge_embed_code_api_badges__agent_id__embed_get"
    ],
    "ask": [
      "mcp__agentry__register_agent_api_agents_register_post",
      "mcp__agentry__submit_intake_api_broker_intake_post",
      "mcp__agentry__trigger_scan_api_scanner_scan_post",
      "mcp__agentry__create_quote_api_payments_ecash_mint_quote_post",
      "mcp__agentry__check_quote_api_payments_ecash_mint_quote__quote_id__get",
      "mcp__agentry__create_melt_quote_api_payments_ecash_melt_quote_post",
      "mcp__agentry__send_ecash_api_payments_ecash_send_post",
      "mcp__agentry__receive_ecash_api_payments_ecash_receive_post",
      "mcp__agentry__verify_token_api_payments_ecash_verify_post",
      "mcp__agentry__update_payment_profile_api_payments_ecash_profile__agent_id__put",
      "mcp__agentry__agent_payment_summary_api_payments_ecash_summary__agent_id__get",
      "mcp__agentry__payment_required_api_payments_ecash_402__agent_id__get",
      "mcp__agentry__trigger_discovery_cycle_api_registry_discover_post",
      "mcp__agentry__discover_single_agent_api_registry_discover__agent_id__post",
      "mcp__agentry__claim_agent_api_agents_claim_post",
      "mcp__agentry__send_outreach_api_admin_outreach_post"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as agentry. Review it before you use it.

Capability tags behind 10 rules

mcp__agentry__register_agent_api_agents_register_post outbound
mcp__agentry__submit_intake_api_broker_intake_post outbound
mcp__agentry__trigger_scan_api_scanner_scan_post outbound
mcp__agentry__create_quote_api_payments_ecash_mint_quote_post outbound
mcp__agentry__create_melt_quote_api_payments_ecash_melt_quote_post outbound
mcp__agentry__send_ecash_api_payments_ecash_send_post outbound
mcp__agentry__trigger_discovery_cycle_api_registry_discover_post outbound
mcp__agentry__discover_single_agent_api_registry_discover__agent_id__post outbound
mcp__agentry__claim_agent_api_agents_claim_post outbound
mcp__agentry__send_outreach_api_admin_outreach_post outbound

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/io.github.cthulhutoo/agentry/verify?hash=9f8f1af395de184690508eaeceb953f1070eaf99cca7d5033167acf7e394e971" | jq -e '.changed == false'

Pinned hash 9f8f1af395de, from Oct 21, 2026, 19:07 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/io.github.cthulhutoo/agentry/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

[![anlyon.dev](https://anlyon.dev/badge/io.github.cthulhutoo/agentry.svg)](https://anlyon.dev/servers/io.github.cthulhutoo/agentry)

Source: MCP Registry · repository. Synced Oct 21, 2026, 18:28 UTC.