Skip to content
anlyon.devby Anlyon

Gumlet

io.github.gumlet/mcpgumletstreamable-httpv2.3.7Scanned

Manage Gumlet video, live streams, analytics, and workspaces from an MCP client.

94 tools: 19 can delete or cancel things, 2 do something that can't be undone, 38 change things and 35 only read.

Tools: 19 delete, 2 irreversible, 38 write, 35 read.
  • Reads private data · 4
  • Reads text others write · 9
  • Can send data out · 12
  • 1 finding

Anlyon alternative

59 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →
Compare with similar serversMarkdownJSONReport this listing

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

94 tools

Deletes or cancels 19Claude Code: deny
  • assets_delete_manyDelete multiple VOD assets at once.No findings

    Why it is in this group

    • The name "assets_delete_many" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Delete multiple VOD assets at once.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • assets_tag_manyAdd / remove tags from multiple assets at once.No findings

    Why it is in this group

    • The description's first verb is "add": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Add / remove tags from multiple assets at once.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • complete_live_streamThis endpoint allows marking live assets complete.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    This endpoint allows marking live assets complete. Once the live asset is marked complete, it can no longer be used to ingest the live stream on Gumlet.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • delete_assetThis endpoint removes an asset given its unique asset id.No findings

    Why it is in this group

    • The name "delete_asset" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    This endpoint removes an asset given its unique asset id. The asset will be removed from storage as well, associated URLs will be inaccessible.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • delete_folderDelete a folder.No findings

    Why it is in this group

    • The name "delete_folder" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Delete a folder. Descendant folders and assets inside them are deleted by the backend workflow.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • delete_live_assetThis endpoint removes a live asset given its unique live asset id.No findings

    Why it is in this group

    • The name "delete_live_asset" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    This endpoint removes a live asset given its unique live asset id. The live asset will be removed from storage as well, associated URLs will be inaccessible.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • delete_playlistDeletes a playlist by plalist ID.No findings

    Why it is in this group

    • The name "delete_playlist" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Deletes a playlist by plalist ID.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • delete_profileThis endpoint removes a profile given its unique `profile_id`.No findings

    Why it is in this group

    • The name "delete_profile" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    This endpoint removes a profile given its unique `profile_id`. The profile will be removed but video assets created using the profile will remain as it is.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • delete_sourceThis endpoint removes a image source.No findings

    Why it is in this group

    • The name "delete_source" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    This endpoint removes a image source. All image delivery using this subdomain will be stopped.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • delete_webhookDelete webhook listener endpoint.No findings

    Why it is in this group

    • The name "delete_webhook" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Delete webhook listener endpoint.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • delete_workspaceThis endpoint removes a video workspace given its unique asset id.No findings

    Why it is in this group

    • The name "delete_workspace" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    This endpoint removes a video workspace given its unique asset id. All the asset in workspace will be removed from storage as well, associated URLs will be inaccessible.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • image_purgeYou can purge the cache for any image path by using this cache purge API.No findings

    Why it is in this group

    • The name "image_purge" says "purge": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    You can purge the cache for any image path by using this cache purge API.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • live_workspace_deleteDelete the live stream workspace.No findings

    Why it is in this group

    • The name "live_workspace_delete" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Delete the live stream workspace.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • multipart_upload_abortThis call aborts multi-part upload and deletes the already uploaded parts from the storage.No findings

    Why it is in this group

    • The name "multipart_upload_abort" says "upload": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    This call aborts multi-part upload and deletes the already uploaded parts from the storage.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • purge_image_cacheYou can purge cache for any image by using our cache purge API.No findings

    Why it is in this group

    • The name "purge_image_cache" says "purge": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    You can purge cache for any image by using our cache purge API.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • remove_asset_playlistRemoved an asset or list of assets from a given playlist.No findings

    Why it is in this group

    • The name "remove_asset_playlist" says "remove": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Removed an asset or list of assets from a given playlist.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • remove_assets_folderRemove one or more assets from their current folder assignment inside the workspace.No findings

    Why it is in this group

    • The name "remove_assets_folder" says "remove": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Remove one or more assets from their current folder assignment inside the workspace.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • remove_channel_viewersRemove one or more viewers from a channel by email address.No findings

    Why it is in this group

    • The name "remove_channel_viewers" says "remove": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Remove one or more viewers from a channel by email address.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • update_assetThis endpoint allows users to update video asset that has previously been created.No findings

    Why it is in this group

    • The name "update_asset" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    This endpoint allows users to update video asset that has previously been created.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
Can't be undone 2Claude Code: ask
  • invite_channel_viewersInvite one or more viewers to a members-only channel.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "invite_channel_viewers" says "invite": a word for sending, and what is sent cannot be taken back.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "invite_channel_viewers" says "invite": it sends or publishes something to other people.
    Description, as the server wrote it
    Invite one or more viewers to a members-only channel.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • invite_channel_viewers_csvInvite viewers to a channel by uploading a CSV file.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "invite_channel_viewers_csv" says "invite": a word for sending, and what is sent cannot be taken back.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "invite_channel_viewers_csv" says "invite": it sends or publishes something to other people.
    Description, as the server wrote it
    Invite viewers to a channel by uploading a CSV file.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
Changes things 38Claude Code: ask
  • add_asset_playlistThis operation adds a single asset or a list of assets to a playlist.No findings

    Why it is in this group

    • The name "add_asset_playlist" says "add": a word for a change.
    Description, as the server wrote it
    This operation adds a single asset or a list of assets to a playlist.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • analytics_aggregated_dataThis endpoint retrieves aggregated data of the given metrics.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    This endpoint retrieves aggregated data of the given metrics.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • asset_audio_uploadAdd any audio file to the video asset.No findings

    Why it is in this group

    • The name "asset_audio_upload" says "upload": a word for a change.
    Description, as the server wrote it
    Add any audio file to the video asset. The response of this API call gives `upload_url` for each language specified. You need to send a `PUT` request of the audio files to those URLs. Once that's done, you need to call the audio upload complete API. Only after that will Gumlet add audio to the asset.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • complete_audio_uploadFinish adding audio tracks to an existing video asset.No findings

    Why it is in this group

    • The name "complete_audio_upload" says "upload": a word for a change.
    Description, as the server wrote it
    Finish adding audio tracks to an existing video asset. Call this only after the audio files have been PUT to the upload URLs from the add-audio call. This attaches those tracks to the asset.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • complete_multipart_uploadOnce you upload all parts to S3 bucket via pre-signed URL, use this endpoint to complete the multipart upload.No findings

    Why it is in this group

    • The name "complete_multipart_upload" says "upload": a word for a change.
    Description, as the server wrote it
    Once you upload all parts to S3 bucket via pre-signed URL, use this endpoint to complete the multipart upload.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • complete_subtitle_uploadThis API must be called after adding subtitles; the add subtitle call gives you URLs to upload, and you complete a `PUT` request to those URLs.No findings

    Why it is in this group

    • The name "complete_subtitle_upload" says "upload": a word for a change.
    Description, as the server wrote it
    This API must be called after adding subtitles; the add subtitle call gives you URLs to upload, and you complete a `PUT` request to those URLs. Once that is done, calling this initiates the process to actually add the subtitle to the video.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • create_assetAn asset refers to media content/video that is processed, stored, and delivered through Gumlet.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "create_asset" says "create": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.image_overlay.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    An asset refers to media content/video that is processed, stored, and delivered through Gumlet. This endpoint creates an asset allowing users to ingest media content into the Gumlet system for processing and delivery.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • create_asset_direct_uploadThis endpoint creates a video asset allowing upload of a video from the local file system and ingest media content into the Gumlet system for processing and delivery.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "create_asset_direct_upload" says "create": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.image_overlay.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    This endpoint creates a video asset allowing upload of a video from the local file system and ingest media content into the Gumlet system for processing and delivery. Body parameters are the same as the Create Asset body parameters except for the `input` parameter, which this endpoint does not take. A successful response will be returned with `upload_url` field. You can make `PUT` request to that URL to upload video. To upload video using `upload_url` refer to [this](https://docs.gumlet.com/docs/direct-upload#2-use-the-url-to-upload-a-file).

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • create_folderCreate a folder inside a video workspace.No findings

    Why it is in this group

    • The name "create_folder" says "create": a word for a change.
    Description, as the server wrote it
    Create a folder inside a video workspace. Optionally provide `parent_id` to create a nested folder.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • create_image_sourceThis endpoint allows users to create image source.Can send data outNo findings

    Why it is in this group

    • The name "create_image_source" says "create": a word for a change.

    What it can reach

    • outboundThe input takes a URL (input.aws.endpoint): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    This endpoint allows users to create image source.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • create_live_assetA live asset refers to media content/video that is live-streamed through Gumlet.No findings

    Why it is in this group

    • The name "create_live_asset" says "create": a word for a change.
    Description, as the server wrote it
    A live asset refers to media content/video that is live-streamed through Gumlet. This endpoint creates a live streaming asset allowing users to live stream a video that will be pushed to Gumlet.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • create_playlistCreate new playlist inside video wprkspaceNo findings

    Why it is in this group

    • The name "create_playlist" says "create": a word for a change.
    Description, as the server wrote it
    Create new playlist inside video wprkspace

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • create_profileGumlet provides the functionality of creating multiple video assets using the same set of parameters.Can send data outNo findings

    Why it is in this group

    • The name "create_profile" says "create": a word for a change.

    What it can reach

    • outboundThe input takes a URL (input.image_overlay.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Gumlet provides the functionality of creating multiple video assets using the same set of parameters. A Video profile is a set of parameters that can be referenced/used while creating a video as a single parameter.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • create_update_chapterThis endpoint will create/update video asset chapters.No findings

    Why it is in this group

    • The name "create_update_chapter" says "create": a word for a change.
    Description, as the server wrote it
    This endpoint will create/update video asset chapters.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • create_webhookCreates a new webhook listener.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "create_webhook" says "create": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Creates a new webhook listener. Gumlet POSTs JSON to `url` for each matching event and sends `secret_token` in the `x-gumlet-token` header. Payload schemas are documented in the webhooks section.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • create_workspaceVideo workspaces are top-level entities in Gumlet.Can send data outNo findings

    Why it is in this group

    • The name "create_workspace" says "create": a word for a change.

    What it can reach

    • outboundThe input takes a URL (input.aws.endpoint): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Video workspaces are top-level entities in Gumlet. You can use them to organize videos for different teams/departments or use cases.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • filter_live_assetsThis endpoint lists live assets on the basis of `status` for the given `live_source_id`.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    This endpoint lists live assets on the basis of `status` for the given `live_source_id`.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • insights_aggregated_dataThis endpoint retrieves aggregated data of the given metrics.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    This endpoint retrieves aggregated data of the given metrics.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • live_workspace_createCreate live stream workspace.No findings

    Why it is in this group

    • The name "live_workspace_create" says "create": a word for a change.
    Description, as the server wrote it
    Create live stream workspace.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • live_workspace_updateUpdate live stream workspace.No findings

    Why it is in this group

    • The name "live_workspace_update" says "update": a word for a change.
    Description, as the server wrote it
    Update live stream workspace.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • multipart_upload_listLists all parts uploaded so far.1 finding

    Why it is in this group

    • The name "multipart_upload_list" says "upload": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "multipart_upload_list" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "multipart_upload_list" says "upload": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Lists all parts uploaded so far.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • recoverRecovers a deleted asset from the recycle bin.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Recovers a deleted asset from the recycle bin.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • reorder_asset_playlistReorder videos inside a playlist either by moving a single asset to a position or by sorting the playlist by title or created date.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Reorder videos inside a playlist either by moving a single asset to a position or by sorting the playlist by title or created date.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • start_liveStart a live stream.Reads text others writeNo findings

    Why it is in this group

    • The name "start_live" says "start": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Start a live stream.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • thumbnail_selectSelect frame from video to use as thumbnail.No findings

    Why it is in this group

    • The name "thumbnail_select" says "select": a word for a change.
    Description, as the server wrote it
    Select frame from video to use as thumbnail.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • thumbnail_uploadUse any image file to use as thumbnail.No findings

    Why it is in this group

    • The name "thumbnail_upload" says "upload": a word for a change.
    Description, as the server wrote it
    Use any image file to use as thumbnail. Once you use the API, you will get `upload_url` in the response, and that can be used to upload the image file. Here is the sample curl request. ```bash curl --location --request PUT '<upload_url>' \ --data '<YOUR_FILE_PATH>' ```

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • thumbnail_upload_liveGenerate presigned upload URLs for live stream thumbnails.No findings

    Why it is in this group

    • The name "thumbnail_upload_live" says "upload": a word for a change.
    Description, as the server wrote it
    Generate presigned upload URLs for live stream thumbnails. Supported thumbnail states are `preparing`, `disconnected`, and `end`.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • top_assetsThis endpoint lists top streamed assets in a video collectionNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    This endpoint lists top streamed assets in a video collection

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • update_billing_detailsUpdate billing detailsNo findings

    Why it is in this group

    • The name "update_billing_details" says "update": a word for a change.
    Description, as the server wrote it
    Update billing details

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • update_folderRename a folder, move it to another parent folder, or move assets into the folder by sending `asset_ids`.No findings

    Why it is in this group

    • The name "update_folder" says "update": a word for a change.
    Description, as the server wrote it
    Rename a folder, move it to another parent folder, or move assets into the folder by sending `asset_ids`.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • update_image_sourceUpdate settings on an image source that already exists.Can send data outNo findings

    Why it is in this group

    • The name "update_image_source" says "update": a word for a change.

    What it can reach

    • outboundThe input takes a URL (input.aws.endpoint): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Update settings on an image source that already exists. This does not create a source or purge cached images.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • update_live_assetA live asset refers to media content/video that is live-streamed through Gumlet.No findings

    Why it is in this group

    • The name "update_live_asset" says "update": a word for a change.
    Description, as the server wrote it
    A live asset refers to media content/video that is live-streamed through Gumlet. This endpoint allows users to update a live streaming asset.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • update_playlistThis endpoint allows you to update playlist name, channel visibility, or playlist order on a channel page.Reads text others writeNo findings

    Why it is in this group

    • The name "update_playlist" says "update": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    This endpoint allows you to update playlist name, channel visibility, or playlist order on a channel page.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • update_profileUpdate an existing profile.Can send data outNo findings

    Why it is in this group

    • The name "update_profile" says "update": a word for a change.

    What it can reach

    • outboundThe input takes a URL (input.image_overlay.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Update an existing profile. Settings provided in body parameters will only be updated in the existing profile.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • update_webhookUpdate a webhook listener.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "update_webhook" says "update": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Update a webhook listener.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • update_workspaceThis endpoint allows users to update video workspace that has previously been created.Can send data outNo findings

    Why it is in this group

    • The name "update_workspace" says "update": a word for a change.

    What it can reach

    • outboundThe input takes a URL (input.aws.endpoint): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    This endpoint allows users to update video workspace that has previously been created.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • upload_subtitlesUpload `.srt` or `.vtt` file to the video asset.No findings

    Why it is in this group

    • The name "upload_subtitles" says "upload": a word for a change.
    Description, as the server wrote it
    Upload `.srt` or `.vtt` file to the video asset. The response of this API call gives `upload_url` for each language specified. You need to send a `PUT` request of the subtitle files to those URLs. Once that's done, you need to call the subtitle upload complete API. Only after that, Gumlet will add subtitles to asset.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • viewer_analytics_dataThis endpoint retrieves viewer analytics data.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    This endpoint retrieves viewer analytics data. This endpoint is use for deep insights on the analytics data.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
Only reads 35Show 35 read-only tools
  • analytics_breakdown_dataRead viewer metrics for one workspace, grouped by a breakdown field, for a date range of at most 60 days.No findings

    Why it is in this group

    • The description's first verb is "read": a word for reading.
    Description, as the server wrote it
    Read viewer metrics for one workspace, grouped by a breakdown field, for a date range of at most 60 days. This does not change assets or delivery.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • asset_analyticsGet video analytics for a single asset.No findings

    Why it is in this group

    • The description's first verb is "get": a word for reading.
    Description, as the server wrote it
    Get video analytics for a single asset.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • asset_status_historyThis endpoint retrieves the history of a live video asset that has previously been created.No findings

    Why it is in this group

    • The name "asset_status_history" says "status": a word for reading.
    Description, as the server wrote it
    This endpoint retrieves the history of a live video asset that has previously been created.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • fetch_audit_logsGet audit logs for the user activity in your organisation.No findings

    Why it is in this group

    • The name "fetch_audit_logs" says "fetch": a word for reading.
    Description, as the server wrote it
    Get audit logs for the user activity in your organisation. Please note that this endpoint can only be accessed by `owner` and `admin` role users.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • fetch_billing_detailsGet billing details for this organization.No findings

    Why it is in this group

    • The name "fetch_billing_details" says "fetch": a word for reading.
    Description, as the server wrote it
    Get billing details for this organization.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • fetch_orgYou can get organization data using this API.No findings

    Why it is in this group

    • The name "fetch_org" says "fetch": a word for reading.
    Description, as the server wrote it
    You can get organization data using this API.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • fetch_upcoming_invoiceGet details about upcoming invoice.No findings

    Why it is in this group

    • The name "fetch_upcoming_invoice" says "fetch": a word for reading.
    Description, as the server wrote it
    Get details about upcoming invoice.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • fetch_userThis endpoint gives information about the user account.No findings

    Why it is in this group

    • The name "fetch_user" says "fetch": a word for reading.
    Description, as the server wrote it
    This endpoint gives information about the user account.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_all_playlistsGet all playlists for given workspaceNo findings

    Why it is in this group

    • The name "get_all_playlists" says "get": a word for reading.
    Description, as the server wrote it
    Get all playlists for given workspace

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_asset_detailsThis endpoint retrieves the details of an asset that has previously been created.No findings

    Why it is in this group

    • The name "get_asset_details" says "get": a word for reading.
    Description, as the server wrote it
    This endpoint retrieves the details of an asset that has previously been created.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_folderGet a single folder by id.Reads private dataNo findings

    Why it is in this group

    • The name "get_folder" says "get": a word for reading.

    What it can reach

    • private-dataThe name "get_folder" says "get" and "folder": it reads files.
    • private-dataThe description's first sentence says "get" and "folder": it reads files.
    • private-dataThe input names a folder (input.folder_id), and the tool reads: it reads files.
    Description, as the server wrote it
    Get a single folder by id.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_image_sources_source_idGet all details about image source.No findings

    Why it is in this group

    • The name "get_image_sources_source_id" says "get": a word for reading.
    Description, as the server wrote it
    Get all details about image source.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_live_asset_statusThis endpoint retrieves the details of a live video asset that has previously been created.No findings

    Why it is in this group

    • The name "get_live_asset_status" says "get": a word for reading.
    Description, as the server wrote it
    This endpoint retrieves the details of a live video asset that has previously been created.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_playlist_assetsGet a list of all assets inside playlist.No findings

    Why it is in this group

    • The name "get_playlist_assets" says "get": a word for reading.
    Description, as the server wrote it
    Get a list of all assets inside playlist. You can choose in which order are assets returned.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_profileThis endpoint retrieves the details of a video profile that has previously been created.No findings

    Why it is in this group

    • The name "get_profile" says "get": a word for reading.
    Description, as the server wrote it
    This endpoint retrieves the details of a video profile that has previously been created.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_sdkGet install commands and a usage snippet for an official Gumlet SDK.No findings

    Why it is in this group

    • The name "get_sdk" says "get": a word for reading.
    Description, as the server wrote it
    Get install commands and a usage snippet for an official Gumlet SDK. language=python returns pip install gumlet (https://pypi.org/project/gumlet/). language=nodejs returns npm install @gumlet/nodejs-sdk (https://www.npmjs.com/package/@gumlet/nodejs-sdk). Aliases: py, node, js, ts, javascript, typescript, npm, pypi.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_workspaceThis endpoint get all the data of video workspace that has previously been created.No findings

    Why it is in this group

    • The name "get_workspace" says "get": a word for reading.
    Description, as the server wrote it
    This endpoint get all the data of video workspace that has previously been created.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • insights_breakdown_dataRead viewer metrics for one workspace, grouped by a breakdown field, for a date range of at most 60 days.No findings

    Why it is in this group

    • The description's first verb is "read": a word for reading.
    Description, as the server wrote it
    Read viewer metrics for one workspace, grouped by a breakdown field, for a date range of at most 60 days. This does not change assets or delivery.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_assetsList folders and assets for a workspace in a single response.Reads private dataNo findings

    Why it is in this group

    • The name "list_assets" says "list": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "list" and "folder": it reads files.
    Description, as the server wrote it
    List folders and assets for a workspace in a single response. Use `parent_id` to browse a specific folder, or filters like `title`, `status`, and `playlist_id` to search assets.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_channel_subscribersList all channel subscribers.No findings

    Why it is in this group

    • The name "list_channel_subscribers" says "list": a word for reading.
    Description, as the server wrote it
    List all channel subscribers.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_foldersList folders for a video workspace.Reads private dataNo findings

    Why it is in this group

    • The name "list_folders" says "list": a word for reading.

    What it can reach

    • private-dataThe name "list_folders" says "list" and "folder": it reads files.
    • private-dataThe description's first sentence says "list" and "folder": it reads files.
    Description, as the server wrote it
    List folders for a video workspace. Use `parent_id` to list only folders inside a specific parent folder.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_invoicesLiost all invoices that are generated so far.No findings

    Why it is in this group

    • The name "list_invoices" says "list": a word for reading.
    Description, as the server wrote it
    Liost all invoices that are generated so far.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_live_workspacesList all live stream workspaces.No findings

    Why it is in this group

    • The name "list_live_workspaces" says "list": a word for reading.
    Description, as the server wrote it
    List all live stream workspaces.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_profilesThis endpoint retrieves the details of all profiles that have previously been created.No findings

    Why it is in this group

    • The name "list_profiles" says "list": a word for reading.
    Description, as the server wrote it
    This endpoint retrieves the details of all profiles that have previously been created.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_recycle_binList all assets in a recycle bin for a given workspace.No findings

    Why it is in this group

    • The name "list_recycle_bin" says "list": a word for reading.
    Description, as the server wrote it
    List all assets in a recycle bin for a given workspace. The deleted assets are available for 30 days. After that, assets are permanently deleted.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_sdksList official Gumlet client SDKs so agents can discover them.No findings

    Why it is in this group

    • The name "list_sdks" says "list": a word for reading.
    Description, as the server wrote it
    List official Gumlet client SDKs so agents can discover them. Python: pip install gumlet (https://pypi.org/project/gumlet/). Node.js: npm install @gumlet/nodejs-sdk (https://www.npmjs.com/package/@gumlet/nodejs-sdk). Use this when the user wants to integrate Gumlet in application code. Do not use this to call the live Gumlet API; use the API tools instead.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_sourcesThis endpoint list image sources which are assigned to the user or token.No findings

    Why it is in this group

    • The name "list_sources" says "list": a word for reading.
    Description, as the server wrote it
    This endpoint list image sources which are assigned to the user or token.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_webhooksList all webhooks.No findings

    Why it is in this group

    • The name "list_webhooks" says "list": a word for reading.
    Description, as the server wrote it
    List all webhooks.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_workspacesThis endpoint list video workspace which are assigned to the user or token.No findings

    Why it is in this group

    • The name "list_workspaces" says "list": a word for reading.
    Description, as the server wrote it
    This endpoint list video workspace which are assigned to the user or token.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • live_usage_analyticsGet usage analytics for your live streams.No findings

    Why it is in this group

    • The description's first verb is "get": a word for reading.
    Description, as the server wrote it
    Get usage analytics for your live streams.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • retrieve_analyticsThis endpoint gives usage analytics data of your videos.No findings

    Why it is in this group

    • The name "retrieve_analytics" says "retrieve": a word for reading.
    Description, as the server wrote it
    This endpoint gives usage analytics data of your videos. Ex - top assets, bandwidth consumption

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • retrieve_image_analyticsThis endpoint helps you get image analytics data like bandwidth consumption, request count, CDN hit ratio, etc.No findings

    Why it is in this group

    • The name "retrieve_image_analytics" says "retrieve": a word for reading.
    Description, as the server wrote it
    This endpoint helps you get image analytics data like bandwidth consumption, request count, CDN hit ratio, etc.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • retrieve_part_urlUse this endpoint to retrieve a pre-signed upload URL for the given part number.Reads text others writeNo findings

    Why it is in this group

    • The name "retrieve_part_url" says "retrieve": a word for reading.

    What it can reach

    • untrusted-inputThe name "retrieve_part_url" says "retrieve" and "url": it reads web pages, which anyone can write.
    • untrusted-inputThe description's first sentence says "url": it reads web pages, which anyone can write.
    Description, as the server wrote it
    Use this endpoint to retrieve a pre-signed upload URL for the given part number.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • webhook_historyGet logs history for a given webhook.No findings

    Why it is in this group

    • The description's first verb is "get": a word for reading.
    Description, as the server wrote it
    Get logs history for a given webhook.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

432 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 4 private-data tools breaks every one.

Reads private data4
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write9
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out12
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
deny to break every path
{
  "permissions": {
    "deny": [
      "mcp__gumlet__get_folder",
      "mcp__gumlet__global_search",
      "mcp__gumlet__list_assets",
      "mcp__gumlet__list_folders"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

1 warn
  • Warnmultipart_upload_list

    The server marks "multipart_upload_list" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "multipart_upload_list" says "upload": a word for a change.

    What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 2.3.7. Values in angle brackets are yours to fill in.

claude mcp add --transport http gumlet https://mcp.gumlet.com/mcp/v1 --header 'GUMLET_API_KEY: <your-gumlet-api-key>'
claude mcp add --transport http gumlet https://mcp.gumlet.com/mcp/v1 --header 'GUMLET_API_KEY: <your-gumlet-api-key>'

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__gumlet__insights_breakdown_data",
      "mcp__gumlet__list_sdks",
      "mcp__gumlet__get_sdk",
      "mcp__gumlet__get_asset_details",
      "mcp__gumlet__retrieve_analytics",
      "mcp__gumlet__retrieve_part_url",
      "mcp__gumlet__list_profiles",
      "mcp__gumlet__get_profile",
      "mcp__gumlet__get_all_playlists",
      "mcp__gumlet__get_playlist_assets",
      "mcp__gumlet__list_webhooks",
      "mcp__gumlet__list_sources",
      "mcp__gumlet__get_image_sources_source_id",
      "mcp__gumlet__retrieve_image_analytics",
      "mcp__gumlet__get_live_asset_status",
      "mcp__gumlet__list_workspaces",
      "mcp__gumlet__get_workspace",
      "mcp__gumlet__list_folders",
      "mcp__gumlet__get_folder",
      "mcp__gumlet__list_assets",
      "mcp__gumlet__asset_status_history",
      "mcp__gumlet__analytics_breakdown_data",
      "mcp__gumlet__fetch_org",
      "mcp__gumlet__fetch_user",
      "mcp__gumlet__fetch_audit_logs",
      "mcp__gumlet__list_recycle_bin",
      "mcp__gumlet__asset_analytics",
      "mcp__gumlet__list_channel_subscribers",
      "mcp__gumlet__webhook_history",
      "mcp__gumlet__list_invoices",
      "mcp__gumlet__fetch_billing_details",
      "mcp__gumlet__fetch_upcoming_invoice",
      "mcp__gumlet__list_live_workspaces",
      "mcp__gumlet__live_usage_analytics",
      "mcp__gumlet__global_search"
    ],
    "ask": [
      "mcp__gumlet__insights_aggregated_data",
      "mcp__gumlet__create_asset",
      "mcp__gumlet__create_asset_direct_upload",
      "mcp__gumlet__thumbnail_select",
      "mcp__gumlet__thumbnail_upload",
      "mcp__gumlet__upload_subtitles",
      "mcp__gumlet__complete_subtitle_upload",
      "mcp__gumlet__asset_audio_upload",
      "mcp__gumlet__complete_audio_upload",
      "mcp__gumlet__create_update_chapter",
      "mcp__gumlet__top_assets",
      "mcp__gumlet__complete_multipart_upload",
      "mcp__gumlet__create_profile",
      "mcp__gumlet__update_profile",
      "mcp__gumlet__create_playlist",
      "mcp__gumlet__add_asset_playlist",
      "mcp__gumlet__update_playlist",
      "mcp__gumlet__reorder_asset_playlist",
      "mcp__gumlet__create_webhook",
      "mcp__gumlet__update_webhook",
      "mcp__gumlet__create_image_source",
      "mcp__gumlet__update_image_source",
      "mcp__gumlet__create_live_asset",
      "mcp__gumlet__update_live_asset",
      "mcp__gumlet__filter_live_assets",
      "mcp__gumlet__recover",
      "mcp__gumlet__start_live",
      "mcp__gumlet__thumbnail_upload_live",
      "mcp__gumlet__create_workspace",
      "mcp__gumlet__update_workspace",
      "mcp__gumlet__create_folder",
      "mcp__gumlet__update_folder",
      "mcp__gumlet__invite_channel_viewers",
      "mcp__gumlet__invite_channel_viewers_csv",
      "mcp__gumlet__viewer_analytics_data",
      "mcp__gumlet__analytics_aggregated_data",
      "mcp__gumlet__update_billing_details",
      "mcp__gumlet__live_workspace_create",
      "mcp__gumlet__live_workspace_update",
      "mcp__gumlet__multipart_upload_list"
    ],
    "deny": [
      "mcp__gumlet__delete_asset",
      "mcp__gumlet__update_asset",
      "mcp__gumlet__delete_profile",
      "mcp__gumlet__remove_asset_playlist",
      "mcp__gumlet__delete_playlist",
      "mcp__gumlet__delete_webhook",
      "mcp__gumlet__delete_source",
      "mcp__gumlet__purge_image_cache",
      "mcp__gumlet__delete_live_asset",
      "mcp__gumlet__complete_live_stream",
      "mcp__gumlet__delete_workspace",
      "mcp__gumlet__delete_folder",
      "mcp__gumlet__remove_assets_folder",
      "mcp__gumlet__remove_channel_viewers",
      "mcp__gumlet__image_purge",
      "mcp__gumlet__assets_delete_many",
      "mcp__gumlet__assets_tag_many",
      "mcp__gumlet__live_workspace_delete",
      "mcp__gumlet__multipart_upload_abort"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as gumlet. Review it before you use it.

Capability tags behind 19 rules
  • mcp__gumlet__create_asset untrusted-input, outbound
  • mcp__gumlet__create_asset_direct_upload untrusted-input, outbound
  • mcp__gumlet__retrieve_part_url untrusted-input
  • mcp__gumlet__create_profile outbound
  • mcp__gumlet__update_profile outbound
  • mcp__gumlet__update_playlist untrusted-input
  • mcp__gumlet__create_webhook untrusted-input, outbound
  • mcp__gumlet__update_webhook untrusted-input, outbound
  • mcp__gumlet__create_image_source outbound
  • mcp__gumlet__update_image_source outbound
  • mcp__gumlet__start_live untrusted-input
  • mcp__gumlet__create_workspace outbound
  • mcp__gumlet__update_workspace outbound
  • mcp__gumlet__list_folders private-data
  • mcp__gumlet__get_folder private-data
  • mcp__gumlet__list_assets private-data
  • mcp__gumlet__invite_channel_viewers untrusted-input, outbound
  • mcp__gumlet__invite_channel_viewers_csv untrusted-input, outbound
  • mcp__gumlet__global_search private-data

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/io.github.gumlet/mcp/verify?hash=a42d63154bbf1b4d843cc2d7528da1f28246965c74e052773817cc759eb91480" | jq -e '.changed == false'

Pinned hash a42d63154bbf, from Nov 4, 2026, 13:18 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/io.github.gumlet/mcp/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for io.github.gumlet/mcp
[![anlyon.dev](https://anlyon.dev/badge/io.github.gumlet/mcp.svg)](https://anlyon.dev/servers/io.github.gumlet/mcp)

Source: MCP Registry. Synced Nov 4, 2026, 13:17 UTC.