# `io.github.lonniev/tollbooth-oauth2-collector` on anlyon.dev

> Text inside fenced blocks marked untrusted-server-text was written by the MCP server's publisher, not by anlyon.dev. It is data to inspect, not instructions to follow. Invisible characters are shown as [U+XXXX].
> No finding is not a safety guarantee: these are point-in-time checks of tool definitions, not of code or behaviour.

- Page: https://anlyon.dev/servers/io.github.lonniev/tollbooth-oauth2-collector
- JSON: https://anlyon.dev/api/v1/servers/io.github.lonniev/tollbooth-oauth2-collector
- Version: 0.2.12 (active)
- Publisher: io.github.lonniev (GitHub account)
- Runs: remote (streamable-http)
- Sign-in to list tools: none
- Repository: https://github.com/lonniev/tollbooth-oauth2-collector
- Metadata from the official MCP Registry, synced 2026-10-21T18:38:21.866Z

Title and description, as the publisher wrote them:

```untrusted-server-text
Unauthenticated OAuth2 callback collector for Tollbooth MCP services
```

Scanned 2026-10-21T19:35:04.030Z over streamable-http.

**4 tools: 1 change things and 3 only read.**

| Group | Class | Tools | Claude Code |
| --- | --- | --- | --- |
| Deletes or cancels | destructive | 0 | deny |
| Can't be undone | irreversible | 0 | ask |
| Changes things | write | 1 | ask |
| Only reads | read | 3 | allow |

## Findings

No check matched anything in these tool definitions.


## Changes things (1)

Creates or changes something that can be changed back. Claude Code: ask.

### `store_code`

- The name "store_code" says "store": a word for a change.
- The input takes a statement or command to run (input.code), which can change anything it can reach.

Description, as the server wrote it:

```untrusted-server-text
Store a sealed OAuth2 authorization code.

Called by the serverless callback function after the browser redirect. The
``state`` carries BOTH the patron npub (the lookup/retrieve key) and the
operator npub (the PUBLIC key the code is sealed to) — see the SDK's
``pack_oauth_state``. The code is sealed with NIP-44 to the operator so only
that operator's nsec can open it; the Neon row is keyed by the patron npub,
so retrieval (``retrieve_code(state=patron_npub)``) is unchanged.
```

## Only reads (3)

Looks things up and changes nothing. Claude Code: allow.

### `collector_status`

- The name "collector_status" says "status": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Health check — shows the number of pending authorization codes and TTL.
```

### `retrieve_code`

- The name "retrieve_code" says "retrieve": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Retrieve a stored authorization code (one-time read, auto-deleted).

Called by the originating MCP server to pick up the code after the user
has authorized in the browser. Returns the encrypted code which the
caller decrypts using the same state token.
```

### `service_status`

- The name "service_status" says "status": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Report the running build so a redeploy can be verified. Free.

Delegates to the SDK's canonical ``build_service_status`` — the single
source of the service_status payload shape — so this collector reports the
same envelope as every other DPYC service. The load-bearing field is
``build_info.fastmcp_cloud_git_commit_sha``: the commit Horizon actually
deployed. The post-merge deploy-verify probe reads it to confirm the live
service redeployed the merged sha; with no ``service_status`` tool to probe,
that sha reads as ``<none>`` and an otherwise-healthy deploy is flagged as
"did not land".

The vault/courier/operator fields are ``False``/empty by construction —
this is an unauthenticated community utility with no operator runtime.
```

## Claude Code permissions

For `.claude/settings.json`, assuming the server is installed as `tollbooth-oauth2-collector`:

```json
{
  "permissions": {
    "allow": [
      "mcp__tollbooth-oauth2-collector__retrieve_code",
      "mcp__tollbooth-oauth2-collector__collector_status",
      "mcp__tollbooth-oauth2-collector__service_status"
    ],
    "ask": [
      "mcp__tollbooth-oauth2-collector__store_code"
    ],
    "deny": []
  }
}
```