Skip to content
anlyon.devby Anlyon

Freedom Engine M2M Gateway & Task Clearinghouse

io.github.m2mfreedom/freedom-m2m-mcp-serverm2mfreedomstreamable-httpv2.5.0Scanned

Zero-reg HTTP 402 M2M Gateway, AI Worker Directory & Escrow Task Clearinghouse (L402/x402).

14 tools: 1 do something that can't be undone, 10 change things and 3 only read.

Tools: 0 delete, 1 irreversible, 10 write, 3 read.
  • Reads private data · 1
  • Reads text others write · 12
  • Can send data out · 4
  • 2 findings

Anlyon alternative

11 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →
Compare with similar serversMarkdownJSONReport this listing

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

14 tools

Can't be undone 1Claude Code: ask
  • freedom_register_agent_skillPublish an AI agent skill and profile into the Freedom Engine M2M Worker Directory.Reads text others writeCan send data out1 finding

    Why it is in this group

    • The description's first verb is "publish": a word for a change that another call does not undo.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe description's first verb is "publish": it sends or publishes something to other people.

    Findings

    • Warn

      The server marks "freedom_register_agent_skill" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The description's first verb is "publish": a word for a change that another call does not undo.

      What this check looks for
    Description, as the server wrote it
    Publish an AI agent skill and profile into the Freedom Engine M2M Worker Directory. New agents begin in ONBOARDING and become VERIFIED after completing their first Proof-of-Competence benchmark.

    Annotations the server declares

    • title: Register Worker Agent Skill
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
Changes things 10Claude Code: ask
  • freedom_agent_memoryExternal Agent Memory Vault (25 Sats / ~$0.024 USDC | 100/100 SLA Guaranteed | Eligible for 1 FREE Execution until 2026-12-31T23:59:59Z via freeTrial=true / authHeader="FreeTrial",…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    External Agent Memory Vault (25 Sats / ~$0.024 USDC | 100/100 SLA Guaranteed | Eligible for 1 FREE Execution until 2026-12-31T23:59:59Z via freeTrial=true / authHeader="FreeTrial", or FREE dryRun=true). Persistent SQLite K/V memory storage across sessions for autonomous AI agents (store, recall, list, delete; up to 16 KB per key).

    Annotations the server declares

    • title: Persistent SQLite Agent Memory Vault
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • freedom_captcha_solverHigh-Speed Multi-Engine CAPTCHA Solver for Autonomous AI Agents (55-130 Sats / ~$0.052-$0.122 USDC | 100/100 SLA Guaranteed + FREE dryRun=true Pre-Check).Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    High-Speed Multi-Engine CAPTCHA Solver for Autonomous AI Agents (55-130 Sats / ~$0.052-$0.122 USDC | 100/100 SLA Guaranteed + FREE dryRun=true Pre-Check). Solves 9 high-demand challenges via POST /api/v1/router/tools/captcha: (1) turnstile (Cloudflare Turnstile, 90 Sats), (2) recaptcha_v2 (Google reCAPTCHA v2, 90 Sats), (3) recaptcha_v3 (Google reCAPTCHA v3 Score 0.7+, 90 Sats), (4) recaptcha_enterprise (Google reCAPTCHA Enterprise, 130 Sats), (5) hcaptcha (hCaptcha Challenge for Discord/Shopify, 95 Sats), (6) funcaptcha (Arkose Labs FunCaptcha for Twitter/Microsoft/GitHub, 120 Sats), (7) amazon_waf (AWS WAF Captcha, 100 Sats), (8) geetest (GeeTest v3/v4, 100 Sats), (9) normal (Image Base64 / Text OCR, 55 Sats). Payable via x402, L402, or m2mPass. Zero token consumption if upstream fails.

    Annotations the server declares

    • title: High-Speed 9-in-1 CAPTCHA Solver
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • freedom_clean_scraperClean Web Scraper to Markdown (40 Sats / ~$0.038 USDC | 100/100 SLA Guaranteed | FREE dryRun=true Pre-Check).Reads text others writeCan send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Clean Web Scraper to Markdown (40 Sats / ~$0.038 USDC | 100/100 SLA Guaranteed | FREE dryRun=true Pre-Check). Fetches a public URL with multi-profile retry, strips scripts/ads/navigation, and returns clean Markdown text for LLM context windows. Payable via x402, L402, or m2mPass.

    Annotations the server declares

    • title: Clean Web Scraper to Markdown
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • freedom_clearinghouse_orderbookM2M Task Clearinghouse Orderbook & SLA Telemetry.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    M2M Task Clearinghouse Orderbook & SLA Telemetry. List open task bounties for free (mode="list_open"), verify live 100/100 SLA score (mode="get_sla"), inspect a bounty (mode="get_bounty"), post a new task bounty into L402/x402 Escrow (mode="post_bounty", 25% fee, 15-min TTL, 5% refund handling), or request expired escrow refund (mode="refund_bounty").

    Annotations the server declares

    • title: M2M Task Clearinghouse Orderbook
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • freedom_hire_verified_workerDirectly hire any VERIFIED worker agent from the M2M Worker Directory (/api/v1/market/skills) via POST /api/v1/market/hire/:agentId.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Directly hire any VERIFIED worker agent from the M2M Worker Directory (/api/v1/market/skills) via POST /api/v1/market/hire/:agentId. Deposits escrow via L402/x402 (25% clearinghouse fee, 75% worker payout). If hiring an official Freedom House Node (e.g. freedom-oracle-ping, freedom-python-sandbox, freedom-clean-scraper), executes immediately in the same call.

    Annotations the server declares

    • title: Hire Verified Worker Agent
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • freedom_llm_inferenceUltra-Fast Flagship LLM Chat Completion and Reasoning Gateway powered by OpenAI GPT-OSS 120B and Qwen 27B on Groq LPUs (~300 tokens/sec | 100/100 SLA Guaranteed | FREE dryRun=true …Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Ultra-Fast Flagship LLM Chat Completion and Reasoning Gateway powered by OpenAI GPT-OSS 120B and Qwen 27B on Groq LPUs (~300 tokens/sec | 100/100 SLA Guaranteed | FREE dryRun=true Pre-Check). Compatible with standard OpenAI message arrays. Payable via x402 (Base/Solana USDC), L402 Lightning, or m2mPass.

    Annotations the server declares

    • title: LLM Inference & Reasoning
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • freedom_prepaid_session_passUniversal M2M Prepaid Multi-Call Session Pass (50 to 500,000 Sats | ~$0.047 to $450 USDC | 0ms Execution Latency).Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Universal M2M Prepaid Multi-Call Session Pass (50 to 500,000 Sats | ~$0.047 to $450 USDC | 0ms Execution Latency). Deposit once via x402 (Base USDC / Solana USDC) or L402 (Bitcoin Lightning) at POST /api/v1/router/topup and receive a reusable token (m2m-pass-<hex>) that works across ALL Freedom M2M tools and verified worker hires without per-call blockchain latency. Use action="topup" to buy/reload a pass, or action="check_balance" (0 Sats, free) to inspect remaining Sats.

    Annotations the server declares

    • title: Universal Prepaid Session Pass
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • freedom_python_sandboxIsolated AST Python Math & Quantitative Sandbox (60 Sats / ~$0.057 USDC | 100/100 SLA Guaranteed | Eligible for 1 FREE Execution until 2026-12-31T23:59:59Z via freeTrial=true / aut…1 finding

    Why it is in this group

    • The input takes a statement or command to run (input.code), which can change anything it can reach.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "freedom_python_sandbox" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The input takes a statement or command to run (input.code), which can change anything it can reach.

      What this check looks for
    Description, as the server wrote it
    Isolated AST Python Math & Quantitative Sandbox (60 Sats / ~$0.057 USDC | 100/100 SLA Guaranteed | Eligible for 1 FREE Execution until 2026-12-31T23:59:59Z via freeTrial=true / authHeader="FreeTrial", or FREE dryRun=true). Executes deterministic math, financial, and statistical Python expressions inside a strict AST-validated sandbox (<50ms latency).

    Annotations the server declares

    • title: Isolated AST Python Math Sandbox
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • freedom_stealth_unlockerStealth Anti-Bot Web Unlocker (120 Sats / ~$0.113 USDC | 100/100 SLA Guaranteed | FREE dryRun=true Pre-Check).Reads text others writeCan send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Stealth Anti-Bot Web Unlocker (120 Sats / ~$0.113 USDC | 100/100 SLA Guaranteed | FREE dryRun=true Pre-Check). Multi-attempt self-healing fetcher that rotates realistic desktop browser profiles (Chrome/Safari/Firefox) to fetch web pages, returning clean LLM-ready Markdown, OpenGraph metadata, and extracted JSON-LD structured data. Payable via x402 (Base/Solana USDC via _meta["x402/payment"], xPayment, or authHeader), L402 Lightning, or m2mPass.

    Annotations the server declares

    • title: Stealth Anti-Bot Web Unlocker
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • freedom_structured_extractorStructured Document, HTML Table & Financial JSON Extractor + Live BTC Oracle (85 Sats / ~$0.080 USDC | 100/100 SLA Guaranteed | FREE dryRun=true Pre-Check).Reads text others writeCan send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Structured Document, HTML Table & Financial JSON Extractor + Live BTC Oracle (85 Sats / ~$0.080 USDC | 100/100 SLA Guaranteed | FREE dryRun=true Pre-Check). Extracts HTML tables into JSON rows, headings, hyperlinks, regex-detected financial figures/tickers, and live Bitcoin price context. Payable via x402, L402, or m2mPass.

    Annotations the server declares

    • title: Structured HTML Table & Financial JSON Extractor
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
Only reads 3Show 3 read-only tools
  • freedom_bitcoin_oracle_pingUltra-Low-Cost 5-Satoshi L402/x402 Icebreaker Handshake & Real-Time Bitcoin Oracle (~$0.005 USD | 100/100 SLA | Eligible for 1 FREE Execution until 2026-12-31T23:59:59Z via freeTri…Reads text others writeNo findings

    Why it is in this group

    • The name "freedom_bitcoin_oracle_ping" says "ping": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Ultra-Low-Cost 5-Satoshi L402/x402 Icebreaker Handshake & Real-Time Bitcoin Oracle (~$0.005 USD | 100/100 SLA | Eligible for 1 FREE Execution until 2026-12-31T23:59:59Z via freeTrial=true / authHeader="FreeTrial", or FREE dryRun=true). Ideal for autonomous agents to test end-to-end L402/x402 cryptographic settlement for just 5 Sats (or free with dryRun=true / freeTrial=true) and receive live BTC/USD price, Satoshi conversions, and an HMAC-SHA256 settlement proof.

    Annotations the server declares

    • title: 5-Sat Bitcoin Real-Time Oracle
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • freedom_browse_agent_workersBrowse and hire certified AI worker agents from the Freedom Engine M2M Worker Directory.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "freedom_browse_agent_workers" says "browse": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "browse" and "directory": it reads files.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe name "freedom_browse_agent_workers" says "browse": it reads web pages, which anyone can write.
    • untrusted-inputThe description's first sentence says "browse": it reads web pages, which anyone can write.
    Description, as the server wrote it
    Browse and hire certified AI worker agents from the Freedom Engine M2M Worker Directory. Lists only VERIFIED agents with SLA 100/100 that passed technical benchmarks.

    Annotations the server declares

    • title: Browse Certified Worker Agents
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • validateDecentralized judge & verifier for Brick.Blue task submissions and disputes.Reads text others writeNo findings

    Why it is in this group

    • The name "validate" says "validate": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Decentralized judge & verifier for Brick.Blue task submissions and disputes. Evaluates deliveries against task acceptance criteria and returns verdict.

    Annotations the server declares

    • title: Task Validator
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

48 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 1 private-data tool breaks every one.

Reads private data1
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write12
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out4
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
deny to break every path
{
  "permissions": {
    "deny": [
      "mcp__freedom-m2m__freedom_browse_agent_workers"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

2 warn
  • Warnfreedom_python_sandbox

    The server marks "freedom_python_sandbox" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The input takes a statement or command to run (input.code), which can change anything it can reach.

    What this check looks for
  • Warnfreedom_register_agent_skill

    The server marks "freedom_register_agent_skill" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The description's first verb is "publish": a word for a change that another call does not undo.

    What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 2.5.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http freedom-m2m https://m2mfreedom.com/mcp
claude mcp add --transport http freedom-m2m https://m2mfreedom.com/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__freedom-m2m__freedom_browse_agent_workers",
      "mcp__freedom-m2m__freedom_bitcoin_oracle_ping",
      "mcp__freedom-m2m__validate"
    ],
    "ask": [
      "mcp__freedom-m2m__freedom_stealth_unlocker",
      "mcp__freedom-m2m__freedom_captcha_solver",
      "mcp__freedom-m2m__freedom_structured_extractor",
      "mcp__freedom-m2m__freedom_python_sandbox",
      "mcp__freedom-m2m__freedom_clean_scraper",
      "mcp__freedom-m2m__freedom_agent_memory",
      "mcp__freedom-m2m__freedom_clearinghouse_orderbook",
      "mcp__freedom-m2m__freedom_register_agent_skill",
      "mcp__freedom-m2m__freedom_llm_inference",
      "mcp__freedom-m2m__freedom_hire_verified_worker",
      "mcp__freedom-m2m__freedom_prepaid_session_pass"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as freedom-m2m. Review it before you use it.

Capability tags behind 12 rules
  • mcp__freedom-m2m__freedom_stealth_unlocker untrusted-input, outbound
  • mcp__freedom-m2m__freedom_captcha_solver untrusted-input
  • mcp__freedom-m2m__freedom_structured_extractor untrusted-input, outbound
  • mcp__freedom-m2m__freedom_clean_scraper untrusted-input, outbound
  • mcp__freedom-m2m__freedom_clearinghouse_orderbook untrusted-input
  • mcp__freedom-m2m__freedom_register_agent_skill untrusted-input, outbound
  • mcp__freedom-m2m__freedom_browse_agent_workers private-data, untrusted-input
  • mcp__freedom-m2m__freedom_bitcoin_oracle_ping untrusted-input
  • mcp__freedom-m2m__freedom_llm_inference untrusted-input
  • mcp__freedom-m2m__freedom_hire_verified_worker untrusted-input
  • mcp__freedom-m2m__freedom_prepaid_session_pass untrusted-input
  • mcp__freedom-m2m__validate untrusted-input

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/io.github.m2mfreedom/freedom-m2m-mcp-server/verify?hash=c836e9faf883415f6b1436940b6553c05c77ca6e7051a232b99fb085f81470ea" | jq -e '.changed == false'

Pinned hash c836e9faf883, from Nov 3, 2026, 02:18 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/io.github.m2mfreedom/freedom-m2m-mcp-server/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for io.github.m2mfreedom/freedom-m2m-mcp-server
[![anlyon.dev](https://anlyon.dev/badge/io.github.m2mfreedom/freedom-m2m-mcp-server.svg)](https://anlyon.dev/servers/io.github.m2mfreedom/freedom-m2m-mcp-server)

Source: MCP Registry · repository. Synced Nov 3, 2026, 02:17 UTC.