Skip to content
anlyon.devby Anlyon

Vitro

io.github.kadirzarex/vitrokadirzarexstreamable-httpv1.0.0Scanned

Read Vitro markets on Robinhood Chain and prepare unsigned transactions. Unaudited, capped launch.

30 tools: 1 can delete or cancel things, 5 do something that can't be undone, 15 change things and 9 only read.

Tools: 1 delete, 5 irreversible, 15 write, 9 read.
  • Reads private data · 0
  • Reads text others write · 30
  • Can send data out · 0
  • 15 findings

Anlyon alternative

21 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →
Compare with similar serversMarkdownJSONReport this listing

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

30 tools

Deletes or cancels 1Claude Code: deny
  • prepare_mandate_revoke_sessionStop one session key, or all of them with all: true.Reads text others write2 findings

    Why it is in this group

    • The name "prepare_mandate_revoke_session" says "revoke": a word for removing or ending something.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    • The server marks it not destructive (destructiveHint: false), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "prepare_mandate_revoke_session" read-only (readOnlyHint: true), and its own name, description or input give the class "destructive".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "prepare_mandate_revoke_session" says "revoke": a word for removing or ending something.

      What this check looks for
    • Warn

      The server marks "prepare_mandate_revoke_session" not destructive (destructiveHint: false), and its own name, description or input give the class "destructive".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "prepare_mandate_revoke_session" says "revoke": a word for removing or ending something.

      What this check looks for
    Description, as the server wrote it
    Stop one session key, or all of them with all: true. Takes effect in the next transaction. Returns UNSIGNED transaction data for the owner's own wallet; simulated first and refused if it would revert. Never signs or sends.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • title: Prepare session revoke
Can't be undone 5Claude Code: ask
  • prepare_mandate_owner_withdraw_collateralMove collateral from the position to the account.Reads text others write1 finding

    Why it is in this group

    • The name "prepare_mandate_owner_withdraw_collateral" says "withdraw": a word that usually means money moves, which cannot be taken back.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "prepare_mandate_owner_withdraw_collateral" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "prepare_mandate_owner_withdraw_collateral" says "withdraw": a word that usually means money moves, which cannot be taken back.

      What this check looks for
    Description, as the server wrote it
    Move collateral from the position to the account. "max" is the most the market allows. For the owner only: works with every session key revoked, ignores session limits, and still follows the market's rules. It prepares exactly this one market call and nothing else. Returns UNSIGNED transaction data for the owner's own wallet; simulated first and refused if it would revert. Never signs or sends.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • title: Prepare owner collateral withdraw
  • prepare_mandate_owner_withdraw_residualAfter settlement: close the account's position and pay the residual to the account.Reads text others write1 finding

    Why it is in this group

    • The name "prepare_mandate_owner_withdraw_residual" says "withdraw": a word that usually means money moves, which cannot be taken back.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "prepare_mandate_owner_withdraw_residual" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "prepare_mandate_owner_withdraw_residual" says "withdraw": a word that usually means money moves, which cannot be taken back.

      What this check looks for
    Description, as the server wrote it
    After settlement: close the account's position and pay the residual to the account. For the owner only: works with every session key revoked, ignores session limits, and still follows the market's rules. It prepares exactly this one market call and nothing else. Returns UNSIGNED transaction data for the owner's own wallet; simulated first and refused if it would revert. Never signs or sends.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • title: Prepare owner residual withdraw
  • prepare_mandate_withdrawSend idle tokens from the account to its owner, the only address the contract can send them to.Reads text others write1 finding

    Why it is in this group

    • The name "prepare_mandate_withdraw" says "withdraw": a word that usually means money moves, which cannot be taken back.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "prepare_mandate_withdraw" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "prepare_mandate_withdraw" says "withdraw": a word that usually means money moves, which cannot be taken back.

      What this check looks for
    Description, as the server wrote it
    Send idle tokens from the account to its owner, the only address the contract can send them to. Collateral in a position is not idle. Returns UNSIGNED transaction data for the owner's own wallet; simulated first and refused if it would revert. Never signs or sends.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • title: Prepare owner withdraw
  • prepare_mandate_withdraw_collateralMove collateral from the position back to the account, never to any other address.Reads text others write1 finding

    Why it is in this group

    • The name "prepare_mandate_withdraw_collateral" says "withdraw": a word that usually means money moves, which cannot be taken back.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "prepare_mandate_withdraw_collateral" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "prepare_mandate_withdraw_collateral" says "withdraw": a word that usually means money moves, which cannot be taken back.

      What this check looks for
    Description, as the server wrote it
    Move collateral from the position back to the account, never to any other address. "max" stops at the account's minimum ratio. Checks the account's limits, then returns UNSIGNED transaction data for the session key, simulated first. Above the approval threshold it returns EIP-712 typed data for the owner instead, which only works when the owner is an ordinary wallet: it refuses when the owner is a contract, such as a Safe. Never signs or sends.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • title: Prepare mandate collateral withdraw
  • prepare_withdrawWithdraw collateral: withdraw(amount).Reads text others write1 finding

    Why it is in this group

    • The name "prepare_withdraw" says "withdraw": a word that usually means money moves, which cannot be taken back.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "prepare_withdraw" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "prepare_withdraw" says "withdraw": a word that usually means money moves, which cannot be taken back.

      What this check looks for
    Description, as the server wrote it
    Withdraw collateral: withdraw(amount). "max" withdraws the most the minimum ratio and 10 USDG floor allow. Needs a fresh price when the position has debt. Returns UNSIGNED transaction data (to, data, value, gas) for the user's own wallet; simulated against the latest block first and refused if it would revert. Never signs or sends.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • title: Prepare withdraw
Changes things 15Claude Code: ask
  • prepare_close_and_redeemAfter settlement: withdrawResidual (closes the sponsor position and pays the residual), redeem the wallet's synth if redemption is open, or claim a top-up.Reads text others write1 finding

    Why it is in this group

    • The name "prepare_close_and_redeem" says "close": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "prepare_close_and_redeem" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "prepare_close_and_redeem" says "close": a word for a change.

      What this check looks for
    Description, as the server wrote it
    After settlement: withdrawResidual (closes the sponsor position and pays the residual), redeem the wallet's synth if redemption is open, or claim a top-up. Returns UNSIGNED transaction data (to, data, value, gas) for the user's own wallet; simulated against the latest block first and refused if it would revert. Never signs or sends.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • title: Prepare close and redeem
  • prepare_create_positionOpen or add to a position: USDG approval (if needed) and create(collateral, tokens).Reads text others write1 finding

    Why it is in this group

    • The name "prepare_create_position" says "create": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "prepare_create_position" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "prepare_create_position" says "create": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Open or add to a position: USDG approval (if needed) and create(collateral, tokens). Enforces the 11 USDG minimum for a new position, both caps and a fresh price. Returns UNSIGNED transaction data (to, data, value, gas) for the user's own wallet; simulated against the latest block first and refused if it would revert. Never signs or sends.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • title: Prepare create position
  • prepare_depositAdd collateral to an existing position: approval (if needed) and deposit(amount).Reads text others write1 finding

    Why it is in this group

    • The description's first verb is "add": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "prepare_deposit" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The description's first verb is "add": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Add collateral to an existing position: approval (if needed) and deposit(amount). Checks both caps. Returns UNSIGNED transaction data (to, data, value, gas) for the user's own wallet; simulated against the latest block first and refused if it would revert. Never signs or sends.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • title: Prepare deposit
  • prepare_mandate_close_and_redeemAfter settlement: withdrawResidual, redeem and claim, paid to the account.Reads text others write1 finding

    Why it is in this group

    • The name "prepare_mandate_close_and_redeem" says "close": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "prepare_mandate_close_and_redeem" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "prepare_mandate_close_and_redeem" says "close": a word for a change.

      What this check looks for
    Description, as the server wrote it
    After settlement: withdrawResidual, redeem and claim, paid to the account. Checks the account's limits, then returns UNSIGNED transaction data for the session key, simulated first. Above the approval threshold it returns EIP-712 typed data for the owner instead, which only works when the owner is an ordinary wallet: it refuses when the owner is a contract, such as a Safe. Never signs or sends.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • title: Prepare mandate close and redeem
  • prepare_mandate_createCreate a mandate account: a smart account that is itself a sponsor, so limits can bind a session key.Reads text others write1 finding

    Why it is in this group

    • The name "prepare_mandate_create" says "create": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "prepare_mandate_create" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "prepare_mandate_create" says "create": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Create a mandate account: a smart account that is itself a sponsor, so limits can bind a session key. Existing positions can't be moved into it. The owner can never change: there is no owner recovery. Unaudited. Refused while mandates aren't enabled on this server. Returns UNSIGNED transaction data for the owner's own wallet; simulated first and refused if it would revert. Never signs or sends.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • title: Prepare mandate account
  • prepare_mandate_create_positionOpen or add to the account's position: create(collateral, tokens) through the account, which sets its own allowance.Reads text others write1 finding

    Why it is in this group

    • The name "prepare_mandate_create_position" says "create": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "prepare_mandate_create_position" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "prepare_mandate_create_position" says "create": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Open or add to the account's position: create(collateral, tokens) through the account, which sets its own allowance. Checks the account's limits, then returns UNSIGNED transaction data for the session key, simulated first. Above the approval threshold it returns EIP-712 typed data for the owner instead, which only works when the owner is an ordinary wallet: it refuses when the owner is a contract, such as a Safe. Never signs or sends.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • title: Prepare mandate position
  • prepare_mandate_depositAdd collateral to the account's position.Reads text others write1 finding

    Why it is in this group

    • The description's first verb is "add": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "prepare_mandate_deposit" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The description's first verb is "add": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Add collateral to the account's position. Checks the account's limits, then returns UNSIGNED transaction data for the session key, simulated first. Above the approval threshold it returns EIP-712 typed data for the owner instead, which only works when the owner is an ordinary wallet: it refuses when the owner is a contract, such as a Safe. Never signs or sends.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • title: Prepare mandate deposit
  • prepare_mandate_grant_sessionLet a session key act for the account, inside its limits, on the listed markets until it expires.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Let a session key act for the account, inside its limits, on the listed markets until it expires. Replacing a session restarts its mint budget. The key is never held by this server. Returns UNSIGNED transaction data for the owner's own wallet; simulated first and refused if it would revert. Never signs or sends.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • title: Prepare session grant
  • prepare_mandate_owner_repayBurn synth held by the account to reduce its debt.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Burn synth held by the account to reduce its debt. "all" repays the whole debt. For the owner only: works with every session key revoked, ignores session limits, and still follows the market's rules. It prepares exactly this one market call and nothing else. Returns UNSIGNED transaction data for the owner's own wallet; simulated first and refused if it would revert. Never signs or sends.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • title: Prepare owner repay
  • prepare_mandate_repayBurn synth held by the account to reduce its debt.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Burn synth held by the account to reduce its debt. "all" repays the whole debt. Works while the price is stale. Checks the account's limits, then returns UNSIGNED transaction data for the session key, simulated first. Above the approval threshold it returns EIP-712 typed data for the owner instead, which only works when the owner is an ordinary wallet: it refuses when the owner is a contract, such as a Safe. Never signs or sends.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • title: Prepare mandate repay
  • prepare_mandate_set_limitsSet an account's limits and, optionally, the markets it may use with a cap for each.Reads text others write1 finding

    Why it is in this group

    • The name "prepare_mandate_set_limits" says "set": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "prepare_mandate_set_limits" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "prepare_mandate_set_limits" says "set": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Set an account's limits and, optionally, the markets it may use with a cap for each. Refuses a minimum ratio at or below any market's own minimum. Binds session keys, not the owner. Returns UNSIGNED transaction data for the owner's own wallet; simulated first and refused if it would revert. Never signs or sends.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • title: Prepare mandate limits
  • prepare_mandate_settleAfter expiry: settle(proof) through the account, only while the first round landed inside the lag.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    After expiry: settle(proof) through the account, only while the first round landed inside the lag. Other settlement paths are not agent actions: use prepare_settle from an ordinary wallet. Checks the account's limits, then returns UNSIGNED transaction data for the session key, simulated first. Above the approval threshold it returns EIP-712 typed data for the owner instead, which only works when the owner is an ordinary wallet: it refuses when the owner is a contract, such as a Safe. Never signs or sends.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • title: Prepare mandate settle
  • prepare_repayBurn synth from the wallet to reduce debt: repay(tokens).Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Burn synth from the wallet to reduce debt: repay(tokens). "all" repays the whole debt. Returns UNSIGNED transaction data (to, data, value, gas) for the user's own wallet; simulated against the latest block first and refused if it would revert. Never signs or sends.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • title: Prepare repay
  • prepare_settleAfter expiry: finds the first Chainlink round at or after expiry, encodes the proof as abi.encode(uint80 roundId) and picks the path that applies now: settle(proof) if that round l…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    After expiry: finds the first Chainlink round at or after expiry, encodes the proof as abi.encode(uint80 roundId) and picks the path that applies now: settle(proof) if that round landed within expiry + maxSettleLag; otherwise guardianSettle(proof) for the guardian Safe, or settleBackstop(proof) for anyone from expiry + maxSettleLag + 7 days. Refused before expiry, once settled, and until the round has printed. Returns UNSIGNED transaction data (to, data, value, gas) for the user's own wallet; simulated against the latest block first and refused if it would revert. Never signs or sends.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • title: Prepare settle
  • quote_positionFee, collateral ratio, liquidation price and headroom for depositing collateral and minting, with the contracts' exact math at the current oracle price.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Fee, collateral ratio, liquidation price and headroom for depositing collateral and minting, with the contracts' exact math at the current oracle price. Warns when the price is stale or the market is closed. Read-only.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • title: Quote a position
Only reads 9Show 9 read-only tools
  • explain_riskPlain-language risk for a position: distance to liquidation, weekend gaps, expiry, settlement rules, USDG pause and freeze risk.Reads text others writeNo findings

    Why it is in this group

    • The name "explain_risk" says "explain": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Plain-language risk for a position: distance to liquidation, weekend gaps, expiry, settlement rules, USDG pause and freeze risk. Pass owner for a real position, or collateral and debtTokens for a hypothetical one.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • title: Explain risk
  • get_eventsIndexed events (mints, repays, withdrawals, liquidations, settlements, redemptions, ...), filterable and paginated.Reads text others writeNo findings

    Why it is in this group

    • The name "get_events" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Indexed events (mints, repays, withdrawals, liquidations, settlements, redemptions, ...), filterable and paginated.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • title: Get events
  • get_healthProof indexer progress and lag versus the chain head.Reads text others writeNo findings

    Why it is in this group

    • The name "get_health" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Proof indexer progress and lag versus the chain head.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • title: Get health
  • get_marketOne market in detail (Proof API) plus a live price and phase check from the chain.Reads text others writeNo findings

    Why it is in this group

    • The name "get_market" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    One market in detail (Proof API) plus a live price and phase check from the chain.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • title: Get market
  • get_positionA wallet's position: indexed history from Proof plus live collateral, debt, residual, claimable and synth balance from the chain.Reads text others writeNo findings

    Why it is in this group

    • The name "get_position" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    A wallet's position: indexed history from Proof plus live collateral, debt, residual, claimable and synth balance from the chain. Omit market for all markets.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • title: Get position
  • get_series_settlementHow a series settled (round id, price, path, caller), or which settlement window applies now and when the next opens.Reads text others writeNo findings

    Why it is in this group

    • The name "get_series_settlement" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    How a series settled (round id, price, path, caller), or which settlement window applies now and when the next opens.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • title: Series settlement
  • get_statsTVL, fees to the treasury, liquidations and per-market use of caps.Reads text others writeNo findings

    Why it is in this group

    • The name "get_stats" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    TVL, fees to the treasury, liquidations and per-market use of caps.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • title: Get stats
  • list_marketsAll Vitro markets with status, expiry, caps, totals and price (from the Proof API).Reads text others writeNo findings

    Why it is in this group

    • The name "list_markets" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    All Vitro markets with status, expiry, caps, totals and price (from the Proof API).

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • title: List markets
  • list_seriesCurrent and past series with settlement round, price and who settled.Reads text others writeNo findings

    Why it is in this group

    • The name "list_series" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Current and past series with settlement round, price and who settled.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • title: List series

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data or outbound.

Reads private data0
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write30
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out0
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

15 warn
  • Warnprepare_create_position

    The server marks "prepare_create_position" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "prepare_create_position" says "create": a word for a change.

    What this check looks for
  • Warnprepare_deposit

    The server marks "prepare_deposit" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The description's first verb is "add": a word for a change.

    What this check looks for
  • Warnprepare_withdraw

    The server marks "prepare_withdraw" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "prepare_withdraw" says "withdraw": a word that usually means money moves, which cannot be taken back.

    What this check looks for
  • Warnprepare_close_and_redeem

    The server marks "prepare_close_and_redeem" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "prepare_close_and_redeem" says "close": a word for a change.

    What this check looks for
  • Warnprepare_mandate_create

    The server marks "prepare_mandate_create" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "prepare_mandate_create" says "create": a word for a change.

    What this check looks for
  • Warnprepare_mandate_set_limits

    The server marks "prepare_mandate_set_limits" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "prepare_mandate_set_limits" says "set": a word for a change.

    What this check looks for
Show 9 more findings
  • Warnprepare_mandate_revoke_session

    The server marks "prepare_mandate_revoke_session" read-only (readOnlyHint: true), and its own name, description or input give the class "destructive".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "prepare_mandate_revoke_session" says "revoke": a word for removing or ending something.

    What this check looks for
  • Warnprepare_mandate_revoke_session

    The server marks "prepare_mandate_revoke_session" not destructive (destructiveHint: false), and its own name, description or input give the class "destructive".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "prepare_mandate_revoke_session" says "revoke": a word for removing or ending something.

    What this check looks for
  • Warnprepare_mandate_withdraw

    The server marks "prepare_mandate_withdraw" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "prepare_mandate_withdraw" says "withdraw": a word that usually means money moves, which cannot be taken back.

    What this check looks for
  • Warnprepare_mandate_create_position

    The server marks "prepare_mandate_create_position" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "prepare_mandate_create_position" says "create": a word for a change.

    What this check looks for
  • Warnprepare_mandate_deposit

    The server marks "prepare_mandate_deposit" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The description's first verb is "add": a word for a change.

    What this check looks for
  • Warnprepare_mandate_withdraw_collateral

    The server marks "prepare_mandate_withdraw_collateral" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "prepare_mandate_withdraw_collateral" says "withdraw": a word that usually means money moves, which cannot be taken back.

    What this check looks for
  • Warnprepare_mandate_close_and_redeem

    The server marks "prepare_mandate_close_and_redeem" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "prepare_mandate_close_and_redeem" says "close": a word for a change.

    What this check looks for
  • Warnprepare_mandate_owner_withdraw_collateral

    The server marks "prepare_mandate_owner_withdraw_collateral" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "prepare_mandate_owner_withdraw_collateral" says "withdraw": a word that usually means money moves, which cannot be taken back.

    What this check looks for
  • Warnprepare_mandate_owner_withdraw_residual

    The server marks "prepare_mandate_owner_withdraw_residual" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "prepare_mandate_owner_withdraw_residual" says "withdraw": a word that usually means money moves, which cannot be taken back.

    What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http vitro https://vitro-agent.fly.dev/mcp
claude mcp add --transport http vitro https://vitro-agent.fly.dev/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__vitro__list_markets",
      "mcp__vitro__get_market",
      "mcp__vitro__list_series",
      "mcp__vitro__get_series_settlement",
      "mcp__vitro__get_position",
      "mcp__vitro__get_events",
      "mcp__vitro__get_stats",
      "mcp__vitro__get_health",
      "mcp__vitro__explain_risk"
    ],
    "ask": [
      "mcp__vitro__quote_position",
      "mcp__vitro__prepare_create_position",
      "mcp__vitro__prepare_deposit",
      "mcp__vitro__prepare_repay",
      "mcp__vitro__prepare_withdraw",
      "mcp__vitro__prepare_close_and_redeem",
      "mcp__vitro__prepare_settle",
      "mcp__vitro__prepare_mandate_create",
      "mcp__vitro__prepare_mandate_set_limits",
      "mcp__vitro__prepare_mandate_grant_session",
      "mcp__vitro__prepare_mandate_withdraw",
      "mcp__vitro__prepare_mandate_create_position",
      "mcp__vitro__prepare_mandate_deposit",
      "mcp__vitro__prepare_mandate_repay",
      "mcp__vitro__prepare_mandate_withdraw_collateral",
      "mcp__vitro__prepare_mandate_close_and_redeem",
      "mcp__vitro__prepare_mandate_settle",
      "mcp__vitro__prepare_mandate_owner_repay",
      "mcp__vitro__prepare_mandate_owner_withdraw_collateral",
      "mcp__vitro__prepare_mandate_owner_withdraw_residual"
    ],
    "deny": [
      "mcp__vitro__prepare_mandate_revoke_session"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as vitro. Review it before you use it.

Capability tags behind 30 rules
  • mcp__vitro__list_markets untrusted-input
  • mcp__vitro__get_market untrusted-input
  • mcp__vitro__list_series untrusted-input
  • mcp__vitro__get_series_settlement untrusted-input
  • mcp__vitro__get_position untrusted-input
  • mcp__vitro__get_events untrusted-input
  • mcp__vitro__get_stats untrusted-input
  • mcp__vitro__get_health untrusted-input
  • mcp__vitro__quote_position untrusted-input
  • mcp__vitro__explain_risk untrusted-input
  • mcp__vitro__prepare_create_position untrusted-input
  • mcp__vitro__prepare_deposit untrusted-input
  • mcp__vitro__prepare_repay untrusted-input
  • mcp__vitro__prepare_withdraw untrusted-input
  • mcp__vitro__prepare_close_and_redeem untrusted-input
  • mcp__vitro__prepare_settle untrusted-input
  • mcp__vitro__prepare_mandate_create untrusted-input
  • mcp__vitro__prepare_mandate_set_limits untrusted-input
  • mcp__vitro__prepare_mandate_grant_session untrusted-input
  • mcp__vitro__prepare_mandate_revoke_session untrusted-input
  • mcp__vitro__prepare_mandate_withdraw untrusted-input
  • mcp__vitro__prepare_mandate_create_position untrusted-input
  • mcp__vitro__prepare_mandate_deposit untrusted-input
  • mcp__vitro__prepare_mandate_repay untrusted-input
  • mcp__vitro__prepare_mandate_withdraw_collateral untrusted-input
  • mcp__vitro__prepare_mandate_close_and_redeem untrusted-input
  • mcp__vitro__prepare_mandate_settle untrusted-input
  • mcp__vitro__prepare_mandate_owner_repay untrusted-input
  • mcp__vitro__prepare_mandate_owner_withdraw_collateral untrusted-input
  • mcp__vitro__prepare_mandate_owner_withdraw_residual untrusted-input

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/io.github.kadirzarex/vitro/verify?hash=cbdeba2dd1cabb7c1209732196a745623fad6165fb430217ee8de18fd3b1c228" | jq -e '.changed == false'

Pinned hash cbdeba2dd1ca, from Nov 1, 2026, 17:18 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/io.github.kadirzarex/vitro/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for io.github.kadirzarex/vitro
[![anlyon.dev](https://anlyon.dev/badge/io.github.kadirzarex/vitro.svg)](https://anlyon.dev/servers/io.github.kadirzarex/vitro)

Source: MCP Registry. Synced Nov 1, 2026, 17:17 UTC.