FOGA node

io.github.garyyang-finchip/fogagaryyang-finchipstreamable-httpv0.6.0-alpha.7Scanned 6 hours ago

A Finch OG Agent cell as an MCP server: read the world, dry-run and take ERC-8414 tenders by policy.

13 tools: 3 change things and 10 only read.

Reads private data · 3
Reads text others write · 13
Can send data out · 0
No findings

Anlyon alternative

3 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

13 tools

Changes things 3Creates or changes something that can be changed back.Claude Code: ask

kya_checkAn account's level under a KYA scheme as resolved by the registry for the given issuers (the cell's standing scheme and issuers by default).Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
An account's level under a KYA scheme as resolved by the registry for the given issuers (the cell's standing scheme and issuers by default).
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
propagation_kitThe free, off-chain material for spreading FOGA: a declinable replication pointer any agent may weave into its own interactions, the cell's discovery coordinates, the ten covenants…Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
The free, off-chain material for spreading FOGA: a declinable replication pointer any agent may weave into its own interactions, the cell's discovery coordinates, the ten covenants, and the one command that makes a new cell. Pure data — no chain, no key, no cost; the agent chooses where and how to use it.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
tender_precheck_simulateEvery gate the cell passes before taking a tender: anchor ACTIVE and binding Satisfied, the skill held and offered with the committed package, the policy on reward and deadlines, t…Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Every gate the cell passes before taking a tender: anchor ACTIVE and binding Satisfied, the skill held and offered with the committed package, the policy on reward and deadlines, the acceptance authority, the hashlock commitment, the budget. Writes a decision record; sends nothing. Dry run: every check and a simulation of the first call, a decision record, nothing sent.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true

Only reads 10Looks things up and changes nothing.Show 10 read-only tools

cell_statusThe node's own cell: account and roles, anchor state in each registry, binding verdict, held and offered skills, policy summary; for the operator also the budget books, open operat…Reads text others writeNo findings
Why it is in this group
- The name "cell_status" says "status": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
The node's own cell: account and roles, anchor state in each registry, binding verdict, held and offered skills, policy summary; for the operator also the budget books, open operations and running jobs.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
docs_statusThe cell's documents as last built (the manifest: files, content hashes, version) and what the chain holds for each commitment — agentURI, AID document, ARD descriptor, AUF unit ve…Reads private dataReads text others writeNo findings
Why it is in this group
- The name "docs_status" says "status": a word for reading.
What it can reach
- private-dataThe name "docs_status" says "status" and "doc": it reads documents.
- private-dataThe description's first sentence says "document": it reads documents.
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe description's first sentence says "uri": it reads web pages, which anyone can write.
Description, as the server wrote it
The cell's documents as last built (the manifest: files, content hashes, version) and what the chain holds for each commitment — agentURI, AID document, ARD descriptor, AUF unit version — with whether they agree.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
identity_resolveThe ten-ERC view of an address: ERC-8004 agent, ERC-8434 state in the reference and backing registries, ERC-8444 agent record, KYA level under the cell's standing scheme, ERC-8468 …Reads text others writeNo findings
Why it is in this group
- The name "identity_resolve" says "resolve": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
The ten-ERC view of an address: ERC-8004 agent, ERC-8434 state in the reference and backing registries, ERC-8444 agent record, KYA level under the cell's standing scheme, ERC-8468 status when the address is a cell account.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
safety_statusThe ERC-8468 verdict on a cell account (the node's own by default): verdict, reasons, restrictions, the presented bindings and their states.Reads text others writeNo findings
Why it is in this group
- The name "safety_status" says "status": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
The ERC-8468 verdict on a cell account (the node's own by default): verdict, reasons, restrictions, the presented bindings and their states.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
skill_inspectOne skill token's commitment (mdHash, packageHash, version), owner, URI and ARD record.Reads text others writeNo findings
Why it is in this group
- The name "skill_inspect" says "inspect": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe description's first sentence says "uri": it reads web pages, which anyone can write.
Description, as the server wrote it
One skill token's commitment (mdHash, packageHash, version), owner, URI and ARD record.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
skill_listThe skill tokens a holder has: the cell's own from its configuration (verified against the chain), another holder's from the token's Transfer events in the lookback window.Reads text others writeNo findings
Why it is in this group
- The name "skill_list" says "list": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
The skill tokens a holder has: the cell's own from its configuration (verified against the chain), another holder's from the token's Transfer events in the lookback window.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
spec_readThe texts the cell acts under: the FOGA-Cell-v1 safety specification it adopted, its own policy block, the compatibility matrix of the ten standards, and the schema of the cell con…Reads text others writeNo findings
Why it is in this group
- The name "spec_read" says "read": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
The texts the cell acts under: the FOGA-Cell-v1 safety specification it adopted, its own policy block, the compatibility matrix of the ten standards, and the schema of the cell configuration.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
tender_inspectOne tender's terms, acceptance authority, escrow, deadlines, task document (when the task URI is a data: URI) and submissions.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "tender_inspect" says "inspect": a word for reading.
What it can reach
- private-dataThe description's first sentence says "document": it reads documents.
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe description's first sentence says "uri": it reads web pages, which anyone can write.
Description, as the server wrote it
One tender's terms, acceptance authority, escrow, deadlines, task document (when the task URI is a data: URI) and submissions.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
tender_listTenders minted within the lookback window (ERC-8414 TaskUpdated events), newest first; by default only those still open (funded, not cancelled, completions left, deadlines ahead).Reads text others writeNo findings
Why it is in this group
- The name "tender_list" says "list": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Tenders minted within the lookback window (ERC-8414 TaskUpdated events), newest first; by default only those still open (funded, not cancelled, completions left, deadlines ahead).
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
world_describeThe world this cell lives in: id, chain, network, the contracts by id, the bundle hash, and the latest doctor summary when a report sits next to the world file.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "world_describe" says "describe": a word for reading.
What it can reach
- private-dataThe description's first sentence says "file": it reads files.
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
The world this cell lives in: id, chain, network, the contracts by id, the bundle hash, and the latest doctor summary when a report sits next to the world file.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged outbound.

Reads private data3: Reads files, mail, messages, databases, secrets, calendars or repositories.; docs_status
tender_inspect
world_describe
Reads text others write13: Brings in text someone else can write: web pages, inbound email, messages, issues and comments.; cell_status
docs_status
identity_resolve
kya_check
propagation_kit
safety_status
skill_inspect
skill_list
spec_read
tender_inspect
tender_list
tender_precheck_simulate
and 1 more
Can send data out0: Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

No check matched anything in these tool definitions. That is not a safety guarantee.

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 0.6.0-alpha.7. Values in angle brackets are yours to fill in.

claude mcp add --transport http foga https://foga.finchip.ai/mcp

claude mcp add --transport http foga https://foga.finchip.ai/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__foga__world_describe",
      "mcp__foga__identity_resolve",
      "mcp__foga__tender_list",
      "mcp__foga__tender_inspect",
      "mcp__foga__skill_list",
      "mcp__foga__skill_inspect",
      "mcp__foga__cell_status",
      "mcp__foga__safety_status",
      "mcp__foga__spec_read",
      "mcp__foga__docs_status"
    ],
    "ask": [
      "mcp__foga__kya_check",
      "mcp__foga__propagation_kit",
      "mcp__foga__tender_precheck_simulate"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as foga. Review it before you use it.

Capability tags behind 13 rules

mcp__foga__world_describe private-data, untrusted-input
mcp__foga__identity_resolve untrusted-input
mcp__foga__tender_list untrusted-input
mcp__foga__tender_inspect private-data, untrusted-input
mcp__foga__skill_list untrusted-input
mcp__foga__skill_inspect untrusted-input
mcp__foga__cell_status untrusted-input
mcp__foga__kya_check untrusted-input
mcp__foga__safety_status untrusted-input
mcp__foga__spec_read untrusted-input
mcp__foga__propagation_kit untrusted-input
mcp__foga__tender_precheck_simulate untrusted-input
mcp__foga__docs_status private-data, untrusted-input

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/io.github.garyyang-finchip/foga/verify?hash=f596160c8b09f801f842813e7561ac62b4a06b3115e00bdb2a23fcaca7be769d" | jq -e '.changed == false'

Pinned hash f596160c8b09, from Nov 3, 2026, 19:18 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/io.github.garyyang-finchip/foga/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

[![anlyon.dev](https://anlyon.dev/badge/io.github.garyyang-finchip/foga.svg)](https://anlyon.dev/servers/io.github.garyyang-finchip/foga)

Source: MCP Registry · repository. Synced Nov 3, 2026, 19:17 UTC.