Skip to content
anlyon.devby Anlyon

Daylily Catalog

io.github.makoncline/daylily-catalogmakonclinestreamable-httpv1.2.2Scanned

Search daylily catalogs and cultivar traits. Manage your grower catalog with scoped OAuth.

26 tools: 6 can delete or cancel things, 4 change things and 16 only read.

Tools: 6 delete, 0 irreversible, 4 write, 16 read.
  • Reads private data · 1
  • Reads text others write · 20
  • Can send data out · 0
  • 1 finding

Anlyon alternative

10 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →
Compare with similar serversMarkdownJSONReport this listing

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

26 tools

Deletes or cancels 6Claude Code: deny
  • daylily.reorder_imagesPlace selected images first in the given order on one owned listing or profile.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Place selected images first in the given order on one owned listing or profile. Other images keep their relative order. Requires a connected account and the catalog:write OAuth scope. Account tier limits apply.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • openWorldHint: true
    • idempotentHint: true
  • daylily.sync_listing_cultivar_nameSet one owned listing's title and URL slug to the name of its linked cultivar reference.Reads text others writeNo findings

    Why it is in this group

    • The name "daylily.sync_listing_cultivar_name" says "sync": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Set one owned listing's title and URL slug to the name of its linked cultivar reference. Read the listing again if the link changes. Requires a connected account and the catalog:write OAuth scope. Account tier limits apply.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • openWorldHint: true
    • idempotentHint: true
  • daylily.update_listEdit the title or description of one owned list.Reads text others writeNo findings

    Why it is in this group

    • The name "daylily.update_list" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Edit the title or description of one owned list. Supply the updatedAt value from the list read. Requires a connected account and the catalog:write OAuth scope. Account tier limits apply.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • openWorldHint: true
    • idempotentHint: true
  • daylily.update_listingEdit one owned listing.Reads text others writeNo findings

    Why it is in this group

    • The name "daylily.update_listing" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Edit one owned listing. Supply the updatedAt value from the listing read. Omitted fields remain unchanged; null clears an optional field. Requires a connected account and the catalog:write OAuth scope. Account tier limits apply.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • openWorldHint: true
    • idempotentHint: true
  • daylily.update_profileEdit the title, description, or location of the member's public profile.Reads text others writeNo findings

    Why it is in this group

    • The name "daylily.update_profile" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Edit the title, description, or location of the member's public profile. Supply updatedAt from the profile read, or null if no profile exists. Open manage_profile_images to add profile photos. Use reorder_images to change their order. Open the dashboard for profile URL or story changes. Requires a connected account and the catalog:write OAuth scope. Account tier limits apply.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • openWorldHint: true
    • idempotentHint: true
Changes things 4Claude Code: ask
  • daylily.add_listing_to_listAdd one owned listing to one owned list.Reads text others writeNo findings

    Why it is in this group

    • The name "daylily.add_listing_to_list" says "add": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Add one owned listing to one owned list. Repeating this call leaves the membership in place. Requires a connected account and the catalog:write OAuth scope. Account tier limits apply.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: true
    • idempotentHint: true
  • daylily.create_listCreate one list.Reads text others writeNo findings

    Why it is in this group

    • The name "daylily.create_list" says "create": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Create one list. Non-Pro accounts can have up to 1 list. Supply a unique requestId and reuse it when retrying the same creation. Requires a connected account and the catalog:write OAuth scope. Account tier limits apply.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: true
    • idempotentHint: true
  • daylily.create_listingCreate one listing.Reads text others writeNo findings

    Why it is in this group

    • The name "daylily.create_listing" says "create": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Create one listing. Non-Pro accounts can have up to 25 listings, including hidden listings. Set hidden=true to keep it private or hidden=false to publish it. Supply a unique requestId and reuse it when retrying the same creation. Requires a connected account and the catalog:write OAuth scope. Account tier limits apply.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: true
    • idempotentHint: true
  • daylily.open_dashboardUse this when the signed-in member needs a precise dashboard screen to add listing or profile photos, edit a profile story or URL, or review deletion, image removal, story block re…Reads text others write1 finding

    Why it is in this group

    • The name "daylily.open_dashboard" says "open": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe description's first sentence says "url": it reads web pages, which anyone can write.

    Findings

    • Warn

      The server marks "daylily.open_dashboard" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":false}; The name "daylily.open_dashboard" says "open": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Use this when the signed-in member needs a precise dashboard screen to add listing or profile photos, edit a profile story or URL, or review deletion, image removal, story block removal, cultivar unlinking, or list member removal. Use manage_listing_images with the owned listing id or manage_profile_images to add photos through the browser cropper. For story block removal, pass its current blockId from get_profile. A link never performs the change on navigation. Requires OAuth.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
    • destructiveHint: false
Only reads 16Show 16 read-only tools
  • daylily.get_cultivarUse this when the user has a Daylily Catalog cultivarReferenceId or normalizedName and needs the exact public cultivar record.Reads text others writeNo findings

    Why it is in this group

    • The name "daylily.get_cultivar" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Use this when the user has a Daylily Catalog cultivarReferenceId or normalizedName and needs the exact public cultivar record. Do not use it for fuzzy search; call daylily.search_cultivars first.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
    • destructiveHint: false
  • daylily.get_imageGet one owned listing or profile image by ID, including its resolved dashboard image URL.Reads text others writeNo findings

    Why it is in this group

    • The name "daylily.get_image" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe description's first sentence says "get" and "url": it reads web pages, which anyone can write.
    Description, as the server wrote it
    Get one owned listing or profile image by ID, including its resolved dashboard image URL. Use get_listing, get_profile, or list_images to find image IDs first. Requires OAuth.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
    • destructiveHint: false
  • daylily.get_listUse this when the signed-in user asks to inspect one list by id, including its description, status, and dashboard link.No findings

    Why it is in this group

    • The name "daylily.get_list" says "get": a word for reading.
    Description, as the server wrote it
    Use this when the signed-in user asks to inspect one list by id, including its description, status, and dashboard link. Call daylily.list_listings with listId for paged members. Requires OAuth.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
    • destructiveHint: false
  • daylily.get_listingUse this when the signed-in user asks to inspect one exact listing by id, including private notes, images, linked cultivar data, and up to 100 list memberships.Reads private dataNo findings

    Why it is in this group

    • The name "daylily.get_listing" says "get": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "note": it reads notes.
    Description, as the server wrote it
    Use this when the signed-in user asks to inspect one exact listing by id, including private notes, images, linked cultivar data, and up to 100 list memberships. If listsNextCursor is present, call daylily.list_lists with listingId and that cursor for the remaining memberships. If imagesHasMore is true, call daylily.list_images for the full image set. Do not use this for search or list expansion when daylily.list_listings can return the needed records in one paginated call. Requires OAuth.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
    • destructiveHint: false
  • daylily.get_profileUse this when the signed-in user asks about their own Daylily Catalog profile, storefront copy, slug, location, images, or public profile content.No findings

    Why it is in this group

    • The name "daylily.get_profile" says "get": a word for reading.
    Description, as the server wrote it
    Use this when the signed-in user asks about their own Daylily Catalog profile, storefront copy, slug, location, images, or public profile content. Story content is read-only through remote MCP; use open_dashboard with edit_profile_content to edit it. The image IDs support reorder and dashboard removal review. If imagesHasMore is true, call daylily.list_images to discover the full image set. Requires OAuth.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
    • destructiveHint: false
  • daylily.get_public_listingUse this when a buyer asks for one public listing by listing id, or by sellerSlug plus listingSlug.Reads text others writeNo findings

    Why it is in this group

    • The name "daylily.get_public_listing" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Use this when a buyer asks for one public listing by listing id, or by sellerSlug plus listingSlug. Returns public listing details only; hidden listings and private notes are excluded.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
    • destructiveHint: false
  • daylily.get_public_profileUse this when a buyer asks about a public grower or catalog profile by seller slug.Reads text others writeNo findings

    Why it is in this group

    • The name "daylily.get_public_profile" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Use this when a buyer asks about a public grower or catalog profile by seller slug. Returns public seller profile, public lists, profile images, and public listing/list counts.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
    • destructiveHint: false
  • daylily.list_imagesPage every image ID for one owned listing or profile.No findings

    Why it is in this group

    • The name "daylily.list_images" says "list": a word for reading.
    Description, as the server wrote it
    Page every image ID for one owned listing or profile. Pages are ordered by image ID; use each image's order field for display order. Follow nextCursor until null before reordering or preparing removal review for a large legacy image set. Requires OAuth.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
    • destructiveHint: false
  • daylily.list_listingsUse this when the signed-in user asks to search, filter, or page through their own listings.No findings

    Why it is in this group

    • The name "daylily.list_listings" says "list": a word for reading.
    Description, as the server wrote it
    Use this when the signed-in user asks to search, filter, or page through their own listings. Returns compact rows. Follow nextCursor until null; a filtered page can be empty and still have a nextCursor. For cultivar details, first call daylily.search_cultivars on the public index, then filter owned listings by cultivarReferenceId. Search unlinked or legacy listing titles with q or title. Use daylily.get_listing for private notes, images, and full detail. Requires OAuth.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
    • destructiveHint: false
  • daylily.list_listsUse this when the signed-in user asks to browse their catalog lists or resolve a list name to an id.Reads text others writeNo findings

    Why it is in this group

    • The name "daylily.list_lists" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe description's first sentence says "browse": it reads web pages, which anyone can write.
    Description, as the server wrote it
    Use this when the signed-in user asks to browse their catalog lists or resolve a list name to an id. Set listingId to page the lists containing one owned listing. Returns each list's title, description, status, and id. Use daylily.list_listings with listId to page a list's members. Requires OAuth.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
    • destructiveHint: false
  • daylily.list_public_listingsUse this when a buyer asks to browse one seller's public catalog or one public list.Reads text others writeNo findings

    Why it is in this group

    • The name "daylily.list_public_listings" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe description's first sentence says "browse": it reads web pages, which anyone can write.
    Description, as the server wrote it
    Use this when a buyer asks to browse one seller's public catalog or one public list. Requires sellerSlug, and can filter by listId, listTitle, cultivar, color, price, photos, hybridizer, parentage, or year. Returns only public listings.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
    • destructiveHint: false
  • daylily.list_public_profile_listsUse this when a buyer asks what public lists or collections a seller has.Reads text others writeNo findings

    Why it is in this group

    • The name "daylily.list_public_profile_lists" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Use this when a buyer asks what public lists or collections a seller has. Use the returned list ids with daylily.list_public_listings.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
    • destructiveHint: false
  • daylily.list_public_profilesBrowse active public grower catalogs with listings.Reads text others writeNo findings

    Why it is in this group

    • The name "daylily.list_public_profiles" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe description's first sentence says "browse": it reads web pages, which anyone can write.
    Description, as the server wrote it
    Browse active public grower catalogs with listings. Returns a bounded page of seller summaries ordered by seller id; follow nextCursor for more. Use get_public_profile for one grower's full profile.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
    • destructiveHint: false
  • daylily.search_cultivarsUse this when the user wants to find public daylily cultivar reference records by name, hybridizer, color, parentage, or general search text.Reads text others writeNo findings

    Why it is in this group

    • The name "daylily.search_cultivars" says "search": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Use this when the user wants to find public daylily cultivar reference records by name, hybridizer, color, parentage, or general search text. Do not use it to answer questions about a signed-in user's own inventory; use daylily.list_listings for that. Prefer specific fields over q when the user asks for a known facet.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
    • destructiveHint: false
  • daylily.search_helpUse this for short, sourced help with public cultivar search or member dashboard workflows, such as listing status, lists, photos, profile content, import, and billing.No findings

    Why it is in this group

    • The name "daylily.search_help" says "search": a word for reading.
    Description, as the server wrote it
    Use this for short, sourced help with public cultivar search or member dashboard workflows, such as listing status, lists, photos, profile content, import, and billing. It does not read member records.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
    • destructiveHint: false
  • daylily.search_public_listingsUse this when a buyer asks for public Daylily Catalog inventory, growers, prices, photos, or availability-style searches.Reads text others writeNo findings

    Why it is in this group

    • The name "daylily.search_public_listings" says "search": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Use this when a buyer asks for public Daylily Catalog inventory, growers, prices, photos, or availability-style searches. Returns only public listings from active catalogs and never includes private notes or hidden listings. Prefer specific filters over q and follow nextCursor until null for complete result sets.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
    • destructiveHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged outbound.

Reads private data1
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write20
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out0
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

1 warn
  • Warndaylily.open_dashboard

    The server marks "daylily.open_dashboard" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":false}; The name "daylily.open_dashboard" says "open": a word for a change.

    What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 1.2.2. Values in angle brackets are yours to fill in.

claude mcp add --transport http daylily-catalog https://daylilycatalog.com/api/mcp/server
claude mcp add --transport http daylily-catalog https://daylilycatalog.com/api/mcp/server

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__daylily-catalog__daylily_search_cultivars",
      "mcp__daylily-catalog__daylily_get_cultivar",
      "mcp__daylily-catalog__daylily_search_public_listings",
      "mcp__daylily-catalog__daylily_get_public_listing",
      "mcp__daylily-catalog__daylily_list_public_profiles",
      "mcp__daylily-catalog__daylily_get_public_profile",
      "mcp__daylily-catalog__daylily_list_public_profile_lists",
      "mcp__daylily-catalog__daylily_list_public_listings",
      "mcp__daylily-catalog__daylily_search_help",
      "mcp__daylily-catalog__daylily_get_profile",
      "mcp__daylily-catalog__daylily_list_lists",
      "mcp__daylily-catalog__daylily_get_list",
      "mcp__daylily-catalog__daylily_list_listings",
      "mcp__daylily-catalog__daylily_get_listing",
      "mcp__daylily-catalog__daylily_list_images",
      "mcp__daylily-catalog__daylily_get_image"
    ],
    "ask": [
      "mcp__daylily-catalog__daylily_open_dashboard",
      "mcp__daylily-catalog__daylily_create_listing",
      "mcp__daylily-catalog__daylily_create_list",
      "mcp__daylily-catalog__daylily_add_listing_to_list"
    ],
    "deny": [
      "mcp__daylily-catalog__daylily_update_listing",
      "mcp__daylily-catalog__daylily_update_list",
      "mcp__daylily-catalog__daylily_link_listing_to_cultivar",
      "mcp__daylily-catalog__daylily_sync_listing_cultivar_name",
      "mcp__daylily-catalog__daylily_update_profile",
      "mcp__daylily-catalog__daylily_reorder_images"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as daylily-catalog. Review it before you use it.

Capability tags behind 21 rules
  • mcp__daylily-catalog__daylily_search_cultivars untrusted-input
  • mcp__daylily-catalog__daylily_get_cultivar untrusted-input
  • mcp__daylily-catalog__daylily_search_public_listings untrusted-input
  • mcp__daylily-catalog__daylily_get_public_listing untrusted-input
  • mcp__daylily-catalog__daylily_list_public_profiles untrusted-input
  • mcp__daylily-catalog__daylily_get_public_profile untrusted-input
  • mcp__daylily-catalog__daylily_list_public_profile_lists untrusted-input
  • mcp__daylily-catalog__daylily_list_public_listings untrusted-input
  • mcp__daylily-catalog__daylily_list_lists untrusted-input
  • mcp__daylily-catalog__daylily_get_listing private-data
  • mcp__daylily-catalog__daylily_get_image untrusted-input
  • mcp__daylily-catalog__daylily_open_dashboard untrusted-input
  • mcp__daylily-catalog__daylily_create_listing untrusted-input
  • mcp__daylily-catalog__daylily_update_listing untrusted-input
  • mcp__daylily-catalog__daylily_create_list untrusted-input
  • mcp__daylily-catalog__daylily_update_list untrusted-input
  • mcp__daylily-catalog__daylily_add_listing_to_list untrusted-input
  • mcp__daylily-catalog__daylily_link_listing_to_cultivar untrusted-input
  • mcp__daylily-catalog__daylily_sync_listing_cultivar_name untrusted-input
  • mcp__daylily-catalog__daylily_update_profile untrusted-input
  • mcp__daylily-catalog__daylily_reorder_images untrusted-input

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/io.github.makoncline/daylily-catalog/verify?hash=caa1f8f7f18b123c44452303abf84c2ac0eb938cc11d2186ef026b7ccdc5d8f6" | jq -e '.changed == false'

Pinned hash caa1f8f7f18b, from Nov 3, 2026, 00:18 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/io.github.makoncline/daylily-catalog/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for io.github.makoncline/daylily-catalog
[![anlyon.dev](https://anlyon.dev/badge/io.github.makoncline/daylily-catalog.svg)](https://anlyon.dev/servers/io.github.makoncline/daylily-catalog)

Source: MCP Registry · repository. Synced Nov 3, 2026, 00:17 UTC.