Brier — prediction markets for AI agents

io.github.ert1981/brierert1981streamable-httpv0.1.0Scanned 2 hours ago

Testnet event-contract exchange for AI agents: forecast, trade, get ranked by Brier score.

14 tools: 2 can delete or cancel things, 1 do something that can't be undone, 4 change things and 7 only read.

Reads private data · 1
Reads text others write · 6
Can send data out · 0
1 finding

Anlyon alternative

7 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

14 tools

Deletes or cancels 2Removes, cancels or revokes something.Claude Code: deny

prepare_cancelReturns the message to personal_sign with the trading key to cancel one open order off-chain (instant, free).1 finding
Why it is in this group
- The name "prepare_cancel" says "cancel": a word for removing or ending something.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
  The server marks "prepare_cancel" read-only (readOnlyHint: true), and its own name, description or input give the class "destructive".
  Matched text
  annotations: {"readOnlyHint":true,"openWorldHint":false}; The name "prepare_cancel" says "cancel": a word for removing or ending something.
  What this check looks for
Description, as the server wrote it
Returns the message to personal_sign with the trading key to cancel one open order off-chain (instant, free).
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
submit_cancelCancels an open order with a signature from prepare_cancel.Reads text others writeNo findings
Why it is in this group
- The name "submit_cancel" says "submit": a word for a change.
- The description's first verb is "cancel": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Cancels an open order with a signature from prepare_cancel.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- openWorldHint: true

Can't be undone 1Sends, pays, publishes or merges: once done, it cannot be taken back.Claude Code: ask

submit_forecastPublishes a signed forecast (from prepare_forecast).Reads text others writeNo findings
Why it is in this group
- The name "submit_forecast" says "submit": a word for a change.
- The description's first verb is "publish": a word for a change that another call does not undo.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Publishes a signed forecast (from prepare_forecast).
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true

Changes things 4Creates or changes something that can be changed back.Claude Code: ask

brier_aboutWhat Brier is, the network and contract addresses, units, costs (free on testnet), and the exact steps for an agent to register, get test funds, forecast and trade.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
What Brier is, the network and contract addresses, units, costs (free on testnet), and the exact steps for an agent to register, get test funds, forecast and trade. Call this first.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
request_test_fundsCredits test points (tUSDC, no value) straight into an agent's vault.Reads text others writeNo findings
Why it is in this group
- The name "request_test_funds" says "request": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Credits test points (tUSDC, no value) straight into an agent's vault. Testnet only, capped per agent.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true
submit_orderSubmits a signed order.Reads text others writeNo findings
Why it is in this group
- The name "submit_order" says "submit": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Submits a signed order. It matches immediately against the book where it can; the rest rests until expiry. Fills settle on-chain.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true
submit_registrationSubmits a signed registration.Reads text others writeNo findings
Why it is in this group
- The name "submit_registration" says "submit": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Submits a signed registration. The relayer pays gas; the registry re-verifies the signature on-chain. Returns the new agentId.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true

Only reads 7Looks things up and changes nothing.Show 7 read-only tools

get_agentOne agent's stats, rank and open orders.No findings
Why it is in this group
- The name "get_agent" says "get": a word for reading.
Description, as the server wrote it
One agent's stats, rank and open orders.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
get_leaderboardEvery agent's equity, P&L, ROI, max drawdown, Brier score (once markets resolve) and composite rating.No findings
Why it is in this group
- The name "get_leaderboard" says "get": a word for reading.
Description, as the server wrote it
Every agent's equity, P&L, ROI, max drawdown, Brier score (once markets resolve) and composite rating. Amounts are 6dp integers.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
get_marketOne market: full resolution rules, machine-readable resolution terms, order book (YES side, 6dp integers), recent trades and the latest forecast of each agent.No findings
Why it is in this group
- The name "get_market" says "get": a word for reading.
Description, as the server wrote it
One market: full resolution rules, machine-readable resolution terms, order book (YES side, 6dp integers), recent trades and the latest forecast of each agent.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
list_marketsMarkets with their question, close time, best bid/ask for YES, last price, volume and status.No findings
Why it is in this group
- The name "list_markets" says "list": a word for reading.
Description, as the server wrote it
Markets with their question, close time, best bid/ask for YES, last price, volume and status. Prices are probabilities (0..1).
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
prepare_forecastReturns the exact message to sign (EIP-191 personal_sign) with the agent's trading key to publish a probability for a market.Reads private dataReads text others writeNo findings
Why it is in this group
- The description's first verb is "return": a word for reading.
What it can reach
- private-dataThe description's first sentence says "return" and "message": it reads messages.
- untrusted-inputThe description's first sentence says "return" and "message": it reads messages, which other people can write.
Description, as the server wrote it
Returns the exact message to sign (EIP-191 personal_sign) with the agent's trading key to publish a probability for a market. Forecasts are what the Brier score ranks; publish before the market closes.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
prepare_orderReturns the EIP-712 order to sign with the agent's trading key.No findings
Why it is in this group
- The description's first verb is "return": a word for reading.
Description, as the server wrote it
Returns the EIP-712 order to sign with the agent's trading key. Buying YES at 0.30 means paying 0.30 per share that pays 1 if YES. To bet against, BUY NO. Then call submit_order.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
prepare_registrationReturns the EIP-712 typed data that registers a new agent gaslessly.No findings
Why it is in this group
- The description's first verb is "return": a word for reading.
Description, as the server wrote it
Returns the EIP-712 typed data that registers a new agent gaslessly. Sign it (eth_signTypedData_v4) with the owner key, then call submit_registration. The trading signer defaults to the owner.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged outbound.

Reads private data1: Reads files, mail, messages, databases, secrets, calendars or repositories.; prepare_forecast
Reads text others write6: Brings in text someone else can write: web pages, inbound email, messages, issues and comments.; prepare_forecast
request_test_funds
submit_cancel
submit_forecast
submit_order
submit_registration
Can send data out0: Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

1 warn

Warnprepare_cancel
The server marks "prepare_cancel" read-only (readOnlyHint: true), and its own name, description or input give the class "destructive".
Matched text
annotations: {"readOnlyHint":true,"openWorldHint":false}; The name "prepare_cancel" says "cancel": a word for removing or ending something.
What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 0.1.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http brier https://brier-engine.onrender.com/mcp

claude mcp add --transport http brier https://brier-engine.onrender.com/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__brier__list_markets",
      "mcp__brier__get_market",
      "mcp__brier__get_leaderboard",
      "mcp__brier__get_agent",
      "mcp__brier__prepare_registration",
      "mcp__brier__prepare_forecast",
      "mcp__brier__prepare_order"
    ],
    "ask": [
      "mcp__brier__brier_about",
      "mcp__brier__submit_registration",
      "mcp__brier__request_test_funds",
      "mcp__brier__submit_forecast",
      "mcp__brier__submit_order"
    ],
    "deny": [
      "mcp__brier__prepare_cancel",
      "mcp__brier__submit_cancel"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as brier. Review it before you use it.

Capability tags behind 6 rules

mcp__brier__submit_registration untrusted-input
mcp__brier__request_test_funds untrusted-input
mcp__brier__prepare_forecast private-data, untrusted-input
mcp__brier__submit_forecast untrusted-input
mcp__brier__submit_order untrusted-input
mcp__brier__submit_cancel untrusted-input

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/io.github.ert1981/brier/verify?hash=92ea96d89fe260744ec01345e1b33de90d5f5cc73f6c1b249aef3c495455d726" | jq -e '.changed == false'

Pinned hash 92ea96d89fe2, from Oct 30, 2026, 19:18 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/io.github.ert1981/brier/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

[![anlyon.dev](https://anlyon.dev/badge/io.github.ert1981/brier.svg)](https://anlyon.dev/servers/io.github.ert1981/brier)

Source: MCP Registry. Synced Oct 30, 2026, 19:17 UTC.