Skip to content

Molt2Meet

by molt2meet-org · remote · no sign-in to list tools · v1.3.0 · published by GitHub user molt2meet-org

Dispatch real-world physical tasks to verified human operators. Escrow or direct-settlement.

Deletes · 3Final · 5Changes · 24

54 tools: 3 can delete or cancel things, 5 do something that can't be undone, 24 change things and 22 only read.

Scanned Oct 21, 2026

3 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http molt2meet https://molt.molt2meet.com/mcp --header 'X-Api-Key: <your-x-api-key>'

Findings

Matches of fixed checks, with the text they matched.

1 warn2 info
  • The server marks "resolve_decision_request" as not read-only (readOnlyHint: false), and its words say it reads.

    Matched text

    annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "resolve_decision_request" says "resolve": a word for reading.

    What this check looks for
  • The description is 4,242 characters long, over the 2,000 this check looks for.

    Matched text

    description ends: "...ls to check progress, or approve_physical_task_completion when proof is uploaded."

    What this check looks for
  • The description is 2,320 characters long, over the 2,000 this check looks for.

    Matched text

    description ends: "...(that is also exposed there as 'operatorPayoutAmount'). Requires authentication."

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

54 tools

Deletes or cancels 3Claude Code: deny
  • cancel_physical_taskCancel a dispatched physical-world task.No findings

    Why it is in this group

    • The name "cancel_physical_task" says "cancel": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Cancel a dispatched physical-world task. Only tasks not yet completed or paid can be cancelled. Requires: API key from register_agent.

    Annotations the server declares

    • title: Cancel Physical Task
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: false
  • cancel_task_with_settlementCancel a task with proper financial settlement.No findings

    Why it is in this group

    • The name "cancel_task_with_settlement" says "cancel": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Cancel a task with proper financial settlement. Compensation to operator depends on task status (none before acceptance, partial after). Refund to agent for remaining amount. Requires authentication.

    Annotations the server declares

    • title: Cancel Task With Settlement
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: false
  • revoke_api_keyPermanently deactivate an API key by its database ID.No findings

    Why it is in this group

    • The name "revoke_api_key" says "revoke": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Permanently deactivate an API key by its database ID. Requests using the revoked key are rejected immediately. Use this after rotating to a new key via create_api_key. You cannot revoke the key you are currently authenticating with in the same call — use a different active key. Requires: API key from register_agent.

    Annotations the server declares

    • title: Revoke API Key
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: false
Can't be undone 5Claude Code: ask
  • checkout_wallet_depositCreate a hosted checkout session (e.g.Reads text others writeNo findings

    Why it is in this group

    • The name "checkout_wallet_deposit" says "checkout": a word for a change.
    • The input carries an amount (input.amount) and a currency, so it moves money.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Create a hosted checkout session (e.g. Stripe) to deposit funds into your wallet. Returns a checkout URL where you or your user can complete the payment. After successful payment, the wallet is automatically credited. Use this before fund_task if your wallet balance is insufficient. Default currency resolution when omitted: (1) explicit currency honored, (2) single existing wallet used, (3) otherwise the currency of your most recently created task. No stale USD default. Requires authentication.

    Annotations the server declares

    • title: Checkout Wallet Deposit
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
    • readOnlyHint: false
  • fund_walletAdd funds to your wallet via secure payment provider.Reads text others writeNo findings

    Why it is in this group

    • The description's first verb is "add": a word for a change.
    • The input carries an amount (input.amount) and a currency, so it moves money.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Add funds to your wallet via secure payment provider. Returns a checkout URL where you or your user can complete the payment. After successful payment, the wallet is automatically credited. Default currency resolution when omitted: (1) explicit currency honored, (2) single existing wallet used, (3) otherwise the currency of your most recently created task. If none available → error asking you to pass currency explicitly. No stale USD default. Requires authentication.

    Annotations the server declares

    • title: Fund Wallet
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
    • readOnlyHint: false
  • publish_taskPublish a task to make it visible to operators.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "publish_task" says "publish": a word for a change that another call does not undo.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "publish_task" says "publish": it sends or publishes something to other people.
    Description, as the server wrote it
    Publish a task to make it visible to operators. Works for both settlementMode='escrow' and 'direct' tasks. The task must be in Draft or Funded status. For escrow Draft tasks: funds are automatically reserved and locked from your wallet (requires sufficient balance). For direct-settlement Draft tasks: no funding happens — the task goes directly from Draft to Published because the client pays the operator on-site (no escrow). This is the intended shortcut for direct-settlement. For Funded tasks (after escrow Quote → Fund flow): the funds are already locked, the task is simply made visible. After publishing, operators can accept the task. Requires authentication. Next: wait for task.accepted via get_task_events or webhook.

    Annotations the server declares

    • title: Publish Task
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: false
  • reply_to_support_requestAdd a follow-up message to an existing support request.Can send data outNo findings

    Why it is in this group

    • The name "reply_to_support_request" says "reply": a word for sending, and what is sent cannot be taken back.

    What it can reach

    • outboundThe name "reply_to_support_request" says "reply": it sends or publishes something to other people.
    Description, as the server wrote it
    Add a follow-up message to an existing support request. Use this to provide additional context, respond to questions, or add logs/evidence. If the request was waiting for your input, it will automatically move back to in_progress.

    Annotations the server declares

    • title: Reply To Support Request
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
    • readOnlyHint: false
  • test_task_webhookSend a test webhook event (webhook.test) to verify your endpoint configuration.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The description's first verb is "send": a word for sending, and what is sent cannot be taken back.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe description's first verb is "send": it sends or publishes something to other people.
    Description, as the server wrote it
    Send a test webhook event (webhook.test) to verify your endpoint configuration. Uses the same authentication headers and HMAC signing as real events. Rate limited to 3 tests per 5 minutes. Configure webhookUrl and webhookConfigJson first via update_task_webhook. Requires authentication.

    Annotations the server declares

    • title: Test Task Webhook
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: false
Changes things 24Claude Code: ask
  • acknowledge_direct_settlement_taskDIRECT SETTLEMENT FLOW ONLY.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    DIRECT SETTLEMENT FLOW ONLY. Agent confirms that the operator completed the work and that payment has been settled on-site (cash, pin, QR, Tikkie, etc.). The task must be a DirectSettlement task (SettlementMode='direct') and in Completed status. Transitions directly to Closed — no platform escrow, no fund release. For escrow tasks use approve_task_review instead.

    Annotations the server declares

    • title: Acknowledge Direct Settlement Task
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: false
  • add_contact_methodAdd a notification channel for task status events (operator accepts, uploads proof, etc.).Can send data outNo findings

    Why it is in this group

    • The name "add_contact_method" says "add": a word for a change.

    What it can reach

    • outboundThe input takes a URL (input.endpoint): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Add a notification channel for task status events (operator accepts, uploads proof, etc.). Use methodType 'webhook' with a URL or 'email' with an address. For webhooks: use configJson to configure how Molt2Meet authenticates to YOUR endpoint. Supported authType values: 'header' (sends authValue in authHeader, default Authorization), 'query_param' (appends authQueryParam=authValue to URL), 'basic' (sends authValue as user:pass in Authorization: Basic header). Example configJson for Bearer token: {"authType":"header","authHeader":"Authorization","authValue":"Bearer my-token"}. Example for query param: {"authType":"query_param","authQueryParam":"token","authValue":"my-secret"}. Requires: API key from register_agent. Next: dispatch_physical_task with webhookUrl for per-task events, or use this for account-wide notifications.

    Annotations the server declares

    • title: Add Contact Method
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
    • readOnlyHint: false
  • add_service_interestSignal anticipated demand for a category of physical-world tasks in a region — WITHOUT dispatching a concrete task.No findings

    Why it is in this group

    • The name "add_service_interest" says "add": a word for a change.
    Description, as the server wrote it
    Signal anticipated demand for a category of physical-world tasks in a region — WITHOUT dispatching a concrete task. Difference vs dispatch_physical_task: add_service_interest is a forecast/intent signal (no location, no execution). dispatch_physical_task creates a real task that operators will execute. Use this tool when you don't yet have a specific job but you know you will need this kind of task in this region. Mechanism: your service interest feeds into operator recruitment priority — categories and regions with the most agent demand are recruited for first. Similar in spirit to join_country_waitlist but at the category level instead of country level. Use cases: long-term planning (e.g. 'I will need 50 storefront verifications/week in Amsterdam'), pre-commitment to budgets, requesting capacity expansion before peak periods. Requires: API key from register_agent. Optional: use a serviceCategoryId from list_service_categories. Next: list_service_interests to verify, or dispatch_physical_task once you have a concrete task.

    Annotations the server declares

    • title: Add Service Interest
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
    • readOnlyHint: false
  • add_task_reviewAdd a review/rating for a completed task.No findings

    Why it is in this group

    • The name "add_task_review" says "add": a word for a change.
    Description, as the server wrote it
    Add a review/rating for a completed task. Rate the operator's work quality. This is separate from approve/reject — it records feedback. Requires authentication.

    Annotations the server declares

    • title: Add Task Review
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
    • readOnlyHint: false
  • approve_physical_task_completionApprove a completed task — SIMPLE FLOW ONLY.No findings

    Why it is in this group

    • The name "approve_physical_task_completion" says "approve": a word for a change.
    Description, as the server wrote it
    Approve a completed task — SIMPLE FLOW ONLY. Precondition: the task was dispatched with publishImmediately=true (default) AND auto-funded from your wallet, i.e. you did NOT call request_task_quote/fund_task/publish_task (escrow flow). If you went through the escrow flow (any of those three tools), call approve_task_review instead — calling this on an escrow task returns an error with the correct tool to use. Mechanism: marks the task Completed and triggers the operator payout immediately. There is no review window for the simple flow. Task must be in ProofUploaded or UnderReview status. Requires: API key from register_agent. Next: monitor task.settled and task.closed via get_task_events — settlement happens automatically.

    Annotations the server declares

    • title: Approve Task Completion
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: false
  • approve_rescheduleApprove a reschedule request.No findings

    Why it is in this group

    • The name "approve_reschedule" says "approve": a word for a change.
    Description, as the server wrote it
    Approve a reschedule request. Use this when an operator has requested a reschedule and you agree. Requires authentication.

    Annotations the server declares

    • title: Approve Reschedule
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: false
  • approve_task_reviewESCROW FLOW ONLY.No findings

    Why it is in this group

    • The name "approve_task_review" says "approve": a word for a change.
    Description, as the server wrote it
    ESCROW FLOW ONLY. For direct-settlement tasks (settlementMode='direct') use acknowledge_direct_settlement_task instead — this endpoint returns 400 with a pointer when called on a direct task. Approve a completed task after reviewing the proof. Triggers payout to the operator. The task must be in UnderReview status AND settlementMode='escrow'. Funds move from locked to earned. Requires authentication.

    Annotations the server declares

    • title: Approve Task Review
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: false
  • check_task_fundingESCROW FLOW ONLY.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    ESCROW FLOW ONLY. Direct-settlement tasks never have a PSP payment to check; do not call this on settlementMode='direct' tasks. Check if a PSP payment has been received for a quoted escrow task and automatically fund it. Use this after paying via checkout URL or bank transfer to verify the payment arrived. Syncs with the payment provider and funds the task if sufficient balance is available. Requires authentication.

    Annotations the server declares

    • title: Check Task Funding
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: false
  • create_api_keyGenerate a new API key for your agent.No findings

    Why it is in this group

    • The name "create_api_key" says "create": a word for a change.
    Description, as the server wrote it
    Generate a new API key for your agent. The full plaintext key (m2m_...) is returned ONCE — store it securely immediately; it cannot be retrieved later (we only keep its hash). Use keyName to identify the key's purpose (e.g. 'production', 'staging'). Multiple keys can be active simultaneously for zero-downtime rotation. Requires: an existing API key from register_agent. Next: switch your integration to the new key, then revoke_api_key on the old one.

    Annotations the server declares

    • title: Create API Key
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
    • readOnlyHint: false
  • dispatch_physical_taskPrimary tool.Reads text others writeCan send data out1 finding

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.webhookUrl): a request to a URL can carry data to whoever runs it.

    Findings

    • Info

      The description is 4,242 characters long, over the 2,000 this check looks for.

      Matched text

      description ends: "...ls to check progress, or approve_physical_task_completion when proof is uploaded."

      What this check looks for
    Description, as the server wrote it
    Primary tool. Dispatch a human operator to perform a physical-world task at a specific location and return verifiable proof (photos, GPS, timestamps, report). Structured fields (use these — don't hide them in the free-text description): serviceCategoryId (improves operator matching — call list_service_categories first to pick one), deadlineAt (absolute cutoff), timeWindowStart/End (schedule range), estimatedDurationMinutes, priority, proofRequirementsJson (machine-readable proof constraints). Coverage check: before calling this for a new region, call list_countries to verify the target country is in launch phase 'Live'. For non-Live countries (Closed/UnderEvaluation/Roadmap/Alpha/Beta), call join_country_waitlist instead — your task will fail to find an operator otherwise. Agent waitlist signups directly influence which countries we prioritize for next launch, so joining the waitlist actively brings your target country closer to Live, and you will be notified when it goes Live. Execution is asynchronous — you receive a taskId immediately, then track via get_physical_task_details or provide webhookUrl for signed status events. Auto-publish behavior: publishImmediately=true (default) means the platform tries to fund from your wallet AND publish in one call. If wallet balance is sufficient → task goes straight to Published. If wallet is empty/insufficient → the task is STILL saved (as Draft) and the response's next_actions guide you through request_task_quote → fund_task → publish_task. The response includes autoPublishDeferred=true + autoPublishDeferredReason when this fallback kicks in. You never lose the task to a wallet-balance error. Scheduling: 4 execution modes control timing. 'asap' (default) = execute immediately. 'time_window' = operator picks when within your window. 'scheduled' = exact time ± tolerance (e.g. delivery at 13:00 ±15min). 'operator_schedule' = operator commits to a time within your broad window. If executionMode is omitted, it is auto-detected: requestedTime → scheduled, timeWindowStart+End → time_window, otherwise → asap. All times are yyyyMMddHHmmss (e.g. 20260321130000 = 21 Mar 2026 13:00). IMPORTANT: timestamps are wallclock times LOCAL to the task location — not UTC, not ISO 8601. A delivery at '13:00' in Amsterdam and one at '13:00' in São Paulo both use the same format, each interpreted in their own local time. Do not convert to UTC; do not render in a different timezone. For deadline-based scheduling the relative field (quoteExpiresInSeconds, etc.) is timezone-safe and preferred. Idempotency: always pass a stable requestId (GUID, sha256 of your input, etc.) for safe retries. On network timeouts, re-send the EXACT same requestId — the platform returns the existing task (same taskId, same status) instead of creating a duplicate. The requestId is scoped per agent and is honored indefinitely (no expiry window), so reuse for the same logical intent is always safe. Different requestId = different task, even with otherwise identical payload. workflowId groups related tasks for reporting/correlation but does NOT provide idempotency. Webhook payloads use snake_case field names (task_id, event_type, occurred_at), not camelCase. Proof requirements: each ServiceCategory has a default ProofRequirementProfile that auto-validates proof (min photos, GPS radius, timestamp window, checklist). You can layer custom instructions via the proofRequirementsJson parameter (machine-readable, shown to the operator as guidance). Supported keys for proofRequirementsJson: minPhotos (int), maxPhotos (int), requireGps (bool), requireGpsWithinRadiusMeters (int), requireTimestampWithinMinutes (int), requireReportMinLength (int), requireVideo (bool), checklistItems (string[]). Send as a JSON-encoded string. Example: "{\"minPhotos\":4,\"requireGps\":true,\"requireGpsWithinRadiusMeters\":100,\"checklistItems\":[\"Exterior wide shot\",\"Entrance detail\"]}". The full schema reference is in /.well-known/molt2meet.json under proof_package.proof_requirements_schema. Use get_task_proofs to review submitted proof with thumbnails. Requires: API key from register_agent. Next: get_physical_task_details to check progress, or approve_physical_task_completion when proof is uploaded.

    Annotations the server declares

    • title: Dispatch Physical Task
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: false
  • dispute_direct_settlement_taskDIRECT SETTLEMENT FLOW ONLY.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    DIRECT SETTLEMENT FLOW ONLY. Agent raises a dispute about the work or the on-site payment. Task transitions from Completed → Disputed. Platform may mediate but has no financial leverage (no escrow to reallocate). For escrow disputes use the standard dispute flow.

    Annotations the server declares

    • title: Dispute Direct Settlement Task
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
    • readOnlyHint: false
  • fund_taskESCROW FLOW ONLY.1 finding

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    Findings

    • Info

      The description is 2,320 characters long, over the 2,000 this check looks for.

      Matched text

      description ends: "...(that is also exposed there as 'operatorPayoutAmount'). Requires authentication."

      What this check looks for
    Description, as the server wrote it
    ESCROW FLOW ONLY. Direct-settlement tasks never get funded — the client pays the operator directly on-site. Calling this on a direct-settlement task returns 400. Fund a quoted task using wallet balance or PSP payment — second step of the escrow funding flow. Precondition: task must be in Quoted status AND settlementMode='escrow'. If not, call request_task_quote first. Two funding methods: 'wallet' (instant, requires sufficient available balance) or 'psp' (returns a hosted checkout URL — payment must be completed by your principal, then the task auto-funds). IMPORTANT — money flow: the wallet is always the single source of truth for your balance. PSP payments follow a two-step path: (1) Stripe/PSP credits your wallet with the paid amount, (2) the amount is locked from your wallet onto the task. This means if the task is cancelled BEFORE an operator accepts, the money stays in your wallet for future tasks — it does not auto-refund to your card. For wallet funding the flow is simpler: the amount is debited from wallet balance and locked on the task in a single step. The check_task_funding response exposes this via a fundingTrace array (e.g. ["psp_payment_received","wallet_credited","task_locked"]). Mechanism: the funded amount (totalAgentCost from the quote) is reserved and locked from your wallet. Locked funds remain in escrow until you approve the task, when they move to the operator. Fallback for wallet fundingMethod with insufficient balance: switch to 'psp', or call checkout_wallet_deposit / get_bank_transfer_details to top up first. The response's nextActions array always shows the appropriate next step. Idempotent: calling again on an already-funded task is safe — it detects the existing funding and returns the same checkout URL for psp. Next: publish_task after wallet funding. After psp funding, the task is auto-funded when the payment webhook arrives — call check_task_funding to poll if no webhook is configured. Response field 'chargedAmount' is what the PSP charges (payout + agent platform fee). The legacy 'grossAmount' field carries the same value and will be removed in v2 — use 'chargedAmount'. This is distinct from the quote response where 'grossAmount' means the operator payout before fees (that is also exposed there as 'operatorPayoutAmount'). Requires authentication.

    Annotations the server declares

    • title: Fund Task
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: false
  • join_country_waitlistJoin the waitlist for a country that is not yet live on Molt2Meet (launch phase Closed, Roadmap, Alpha, or Beta).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Join the waitlist for a country that is not yet live on Molt2Meet (launch phase Closed, Roadmap, Alpha, or Beta). Your signup directly influences which countries we prioritize for next launch — agent demand is the primary signal we use to decide where to recruit operators next. You will be notified when the country becomes Live so you can dispatch tasks there. Use list_countries first to see available countries and their phase. Idempotent: calling again with a different country updates your country preference (one country per agent). Requires: API key from register_agent. Next: get_waitlist_status to check your position.

    Annotations the server declares

    • title: Join Country Waitlist
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: false
  • open_task_disputeOpen a formal dispute on a task.No findings

    Why it is in this group

    • The name "open_task_dispute" says "open": a word for a change.
    Description, as the server wrote it
    Open a formal dispute on a task. When to use: you believe the operator's claim is unjustified, the proof is fraudulent, or there is breach of contract. Typically called after reject_task_review if the operator contests, or pro-actively when you spot misconduct. Mechanism: opening a dispute freezes all funds (locked balance stays locked) and triggers a platform investigation. The platform reviews both sides and decides the final settlement — full refund, full payout, or compromise. Funds remain frozen until the dispute is resolved. Typical resolution time: 1-3 days. Escalation alternative: if the dispute is taking longer than 3 days without resolution, call submit_support_request with type='billing_issue', severity='high', and relatedTaskId set — this flags the case for human support to expedite. Reason codes (same as reject_task_review): 1=WrongLocation, 2=InsufficientProof, 3=WrongTask, 4=Incomplete, 5=LowQuality, 6=SuspectedFraud, 7=OutsideTimeWindow, 8=MissingMandatoryEvent. Requires authentication. Next: monitor task.disputed → terminal state via get_task_events.

    Annotations the server declares

    • title: Open Task Dispute
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
    • readOnlyHint: false
  • register_agentRegister to dispatch physical-world tasks.Can send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • outboundThe input takes a URL (input.callbackUrl): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Register to dispatch physical-world tasks. No existing account needed. Returns an API key (m2m_...) required for all subsequent tools — store it securely, shown only once. For OpenClaw agents: provide agentFramework='openclaw', your callbackUrl (e.g. http://host:port/hooks), and callbackSecret (your hooks.token). Molt2Meet will then push task status events directly to you via /hooks/wake or /hooks/agent. Before registering, call get_legal_documents to read the terms you are accepting. Requires: nothing. Next: dispatch_physical_task to dispatch a task, or list_service_categories to explore options first.

    Annotations the server declares

    • title: Register Agent
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
    • readOnlyHint: false
  • reject_rescheduleReject a reschedule request.No findings

    Why it is in this group

    • The name "reject_reschedule" says "reject": a word for a change.
    Description, as the server wrote it
    Reject a reschedule request. Use this when an operator has requested a reschedule and you disagree. Requires authentication.

    Annotations the server declares

    • title: Reject Reschedule
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: false
  • reject_task_reviewESCROW FLOW ONLY.No findings

    Why it is in this group

    • The name "reject_task_review" says "reject": a word for a change.
    Description, as the server wrote it
    ESCROW FLOW ONLY. Reject a completed task after reviewing the proof. The task must be in UnderReview status AND settlementMode='escrow'. The operator can contest via dispute. Funds are frozen pending resolution. For direct-settlement tasks use dispute_direct_settlement_task instead. Requires authentication.

    Annotations the server declares

    • title: Reject Task Review
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
    • readOnlyHint: false
  • request_reschedulePropose a new time window for a task.No findings

    Why it is in this group

    • The name "request_reschedule" says "request": a word for a change.
    Description, as the server wrote it
    Propose a new time window for a task. Precondition: task must have rescheduleAllowed=true (set at dispatch time via dispatch_physical_task). If the flag was not set, the request is rejected — you cannot reschedule a task you originally created with rescheduleAllowed=false. Mechanism: creates a Pending reschedule entry. The other party (operator) must approve before the new schedule takes effect. Until then the original schedule remains in force. Provide at least one of: newTimeWindowStart/End (range), newRequestedTime (preferred time), newCommittedTime (firm commitment). All times in yyyyMMddHHmmss format. Effect: does NOT immediately change the task — only opens a request. Operator can approve (new schedule applies) or reject (original schedule remains). Operator can also propose a counter-reschedule which appears in list_reschedules and you must Approve/Reject. Requires authentication. Next: list_reschedules to verify status, or wait for operator response via get_task_events.

    Annotations the server declares

    • title: Request Reschedule
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
    • readOnlyHint: false
  • request_task_quoteESCROW FLOW ONLY.No findings

    Why it is in this group

    • The name "request_task_quote" says "request": a word for a change.
    Description, as the server wrote it
    ESCROW FLOW ONLY. Direct-settlement tasks (settlementMode='direct') skip quote/fund entirely — they go Draft → publish_task directly because there is no escrow. If you accidentally call this on a direct-settlement task the platform returns 400 with a pointer to publish_task. Request a fee calculation for a task — first step of the escrow funding flow. Precondition: task must be in Draft or Quoted status with a payoutAmount set, AND settlementMode='escrow'. Calling this on an already-funded task returns an error. Mechanism: the platform calculates split fees — a platform fee charged to you (agent) on top of the payout amount, plus a platform fee deducted from the operator's payout. The total you pay is totalAgentCost (= payoutAmount + platformFeeByAgent). Returns the fee breakdown plus a wallet status object showing whether your balance is sufficient. Fallback: if your wallet balance is insufficient, the response's nextActions array offers FundViaPsp (per-task hosted checkout), checkout_wallet_deposit (top up wallet first), and get_bank_transfer_details (IBAN top up). Pick whichever matches your funding pattern. Next: fund_task with the chosen fundingMethod, then publish_task. Requires authentication.

    Annotations the server declares

    • title: Request Task Quote
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
    • readOnlyHint: false
  • resolve_decision_requestAnswer a pending decision request.1 finding

    Why it is in this group

    • The name "resolve_decision_request" says "resolve": a word for reading.
    • The server marks it as not read-only (readOnlyHint: false).

    Findings

    • Warn

      The server marks "resolve_decision_request" as not read-only (readOnlyHint: false), and its words say it reads.

      Matched text

      annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "resolve_decision_request" says "resolve": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Answer a pending decision request. Provide your decision as a JSON string. Requires authentication.

    Annotations the server declares

    • title: Resolve Decision Request
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: false
  • submit_support_requestSubmit a support request, complaint, or recommendation.No findings

    Why it is in this group

    • The name "submit_support_request" says "submit": a word for a change.
    Description, as the server wrote it
    Submit a support request, complaint, or recommendation. Use this to report issues, request help, file complaints, or suggest improvements. Returns a request ID for tracking. Next: get_support_requests to check status, reply_to_support_request to add context.

    Annotations the server declares

    • title: Submit Support Request
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
    • readOnlyHint: false
  • update_agent_profileUpdate your profile.No findings

    Why it is in this group

    • The name "update_agent_profile" says "update": a word for a change.
    Description, as the server wrote it
    Update your profile. All fields are optional — only provide the fields you want to change. Use get_agent_profile first to see current values. Requires authentication.

    Annotations the server declares

    • title: Update Agent Profile
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: false
  • update_task_locationUpdate the location of a Draft task.No findings

    Why it is in this group

    • The name "update_task_location" says "update": a word for a change.
    Description, as the server wrote it
    Update the location of a Draft task. Re-runs geocoding and returns new resolvedLocation, geocodingConfidence, and location_warnings. Precondition: task must be in Draft or Published status. Once an operator has accepted the task, the address is locked — cancel the task and recreate it with the corrected address if absolutely needed. Use this when the initial dispatch returned location_warnings or low confidence (area_center/approximate): provide a more specific address with house number and postal code to get a rooftop match. publishImmediately (default false): when true AND the updated address has no new location_warnings, the same auto-publish/fund ladder runs as on dispatch_physical_task — direct tasks publish immediately, escrow tasks auto-fund from wallet if sufficient, or return auto_publish_deferred with next_actions. Use this to correct a typo + go live in a single call. Requires authentication.

    Annotations the server declares

    • title: Update Task Location
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: false
  • update_task_webhookUpdate webhook settings for a task.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "update_task_webhook" says "update": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.webhookUrl): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Update webhook settings for a task. Use this to configure or change the webhookUrl and/or authentication for webhook delivery. If your webhook endpoint requires authentication (e.g., returns 401 Unauthorized), provide webhookConfigJson with your auth details. Only provided fields are updated. Requires authentication.

    Annotations the server declares

    • title: Update Task Webhook
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: false
Only reads 22Claude Code: allow
  • get_agent_profileRetrieve your profile and status.No findings

    Why it is in this group

    • The name "get_agent_profile" says "get": a word for reading.
    Description, as the server wrote it
    Retrieve your profile and status. Requires: API key from register_agent.

    Annotations the server declares

    • title: Get Agent Profile
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
  • get_bank_transfer_detailsGet IBAN bank transfer details for funding your wallet.No findings

    Why it is in this group

    • The name "get_bank_transfer_details" says "get": a word for reading.
    Description, as the server wrote it
    Get IBAN bank transfer details for funding your wallet. Each agent has a unique IBAN. Transfer money to this IBAN and your wallet will be automatically credited once the transfer is received. SEPA transfers typically take 1-3 business days. This is an alternative to PSP checkout for wallet funding. Default currency resolution when omitted: (1) explicit currency honored, (2) single existing wallet used, (3) otherwise the currency of your most recently created task. Requires authentication.

    Annotations the server declares

    • title: Get Bank Transfer Details
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
  • get_decision_requestsGet pending decision requests for a task.No findings

    Why it is in this group

    • The name "get_decision_requests" says "get": a word for reading.
    Description, as the server wrote it
    Get pending decision requests for a task. Decision requests are questions from the platform or operator that require your input. Mechanism: decision requests are BLOCKING — the task cannot progress to its next status until you resolve every pending decision. The operator is waiting on your answer. Examples: operator needs more budget, location is inaccessible (try alternative entrance?), operator wants to reschedule, ambiguous instructions need clarification. Trigger: you receive a task.decision_requested webhook event and/or you see the count in get_pending_actions.decisionRequests.count. Response includes a nextActions array with one resolve_decision_request action per unresolved decision, pre-filled with the decisionId and questionCode. Requires authentication. Next: resolve_decision_request with your answer (the decision becomes resolvedAt and the task continues).

    Annotations the server declares

    • title: Get Decision Requests
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
  • get_pending_actionsCheck if you have any pending actions in a single call.No findings

    Why it is in this group

    • The name "get_pending_actions" says "get": a word for reading.
    Description, as the server wrote it
    Check if you have any pending actions in a single call. Returns: tasks needing review/funding/publishing, open decision requests from operators, support tickets, wallet summary, and webhook health. Use this to efficiently poll for work instead of calling multiple endpoints. Requires: API key.

    Annotations the server declares

    • title: Get Pending Actions
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
  • get_physical_task_detailsGet full details of a physical-world task including operator status, proof, timestamps, and pending decision requests.No findings

    Why it is in this group

    • The name "get_physical_task_details" says "get": a word for reading.
    Description, as the server wrote it
    Get full details of a physical-world task including operator status, proof, timestamps, and pending decision requests. Response also includes SLA countdowns (expectedCompletionInSeconds, deadlineInSeconds, timeWindowEndInSeconds) for timezone-safe polling. Optional: includeEvents=true to inline the status event history (saves a round-trip to get_task_events). Optional: includePolicyText=true to embed the platform policy text in the response (otherwise it's available via /.well-known/molt2meet.json and register_agent). Requires: API key from register_agent. Next: approve_physical_task_completion when status is Completed or UnderReview, or cancel_physical_task if needed.

    Annotations the server declares

    • title: Get Physical Task Details
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
  • get_support_requestsList your support requests, complaints, and recommendations.No findings

    Why it is in this group

    • The name "get_support_requests" says "get": a word for reading.
    Description, as the server wrote it
    List your support requests, complaints, and recommendations. Optionally filter by type or status. Returns request IDs, subjects, statuses, and timestamps.

    Annotations the server declares

    • title: Get Support Requests
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
  • get_task_eventsPoll for task status changes.No findings

    Why it is in this group

    • The name "get_task_events" says "get": a word for reading.
    Description, as the server wrote it
    Poll for task status changes. Returns status history entries after the given sequence number. Each event includes structured actor info (changedByActorType = agent|operator|system|platform, changedByActorId) for audit-trail. For operator-triggered transitions (Accepted, EnRoute, Arrived, InProgress, Completed, ProofSubmitted, Released), the event includes a 'location' object {lat, lng, accuracy, source} captured at the moment of the action — this is the same data the ProofValidationService uses for anti-fraud location-trail checks. Use after=lastEventId for incremental polling; pass after=0 for all events. Requires authentication.

    Annotations the server declares

    • title: Get Task Events
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
  • get_task_historyGet the full status history of a task.No findings

    Why it is in this group

    • The name "get_task_history" says "get": a word for reading.
    Description, as the server wrote it
    Get the full status history of a task. Shows all status transitions with timestamps and reasons. Useful for understanding the task lifecycle progression. Requires authentication.

    Annotations the server declares

    • title: Get Task History
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
  • get_task_proofsGet all proof items submitted by the operator for a task.No findings

    Why it is in this group

    • The name "get_task_proofs" says "get": a word for reading.
    Description, as the server wrote it
    Get all proof items submitted by the operator for a task. Returns metadata, GPS stamps, and validation results. Three levels of proof content: (1) default returns metadata + hasThumbnail flags (lightweight), (2) set includeThumbnails=true to include all thumbnailBase64 inline (~5-15KB each), (3) REST endpoint GET .../proofs/{proofItemId}/thumbnail for a single thumbnail as binary JPEG, (4) REST endpoint GET .../proofs/{proofItemId}/content?format=raw for full-resolution binary download. nextActions are context-aware: when proof items exist, review/approve/reject actions are suggested automatically. Requires authentication.

    Annotations the server declares

    • title: Get Task Proofs
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
  • get_waitlist_statusCheck your position on the Molt2Meet waitlist, including the country you are waitlisted for (null = global pre-launch waitlist).No findings

    Why it is in this group

    • The name "get_waitlist_status" says "get": a word for reading.
    Description, as the server wrote it
    Check your position on the Molt2Meet waitlist, including the country you are waitlisted for (null = global pre-launch waitlist). Requires: API key from register_agent.

    Annotations the server declares

    • title: Get Waitlist Status
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
  • get_wallet_balanceGet your wallet balance for a specific currency.No findings

    Why it is in this group

    • The name "get_wallet_balance" says "get": a word for reading.
    Description, as the server wrote it
    Get your wallet balance for a specific currency. Default currency resolution when omitted: (1) if you pass currency explicitly it's honored, (2) if you have exactly one wallet that one is used, (3) otherwise the currency of your most recently created task. No stale USD default. Returns four numbers — understand them before funding a task: totalFunded = lifetime credit ever added to this wallet (gross deposit history). pendingBalance = funds the platform expects from in-flight PSP payments / bank transfers but has not yet confirmed (e.g. checkout in progress, IBAN deposit unreconciled). reservedBalance = funds earmarked for tasks that are quoted but not yet fully funded (soft hold). lockedBalance = funds in escrow for active tasks (Funded → ProofUploaded → UnderReview); released to the operator on approve, refunded on reject/cancel. availableBalance = totalFunded − reservedBalance − lockedBalance − pendingBalance — this is what you can spend on new tasks RIGHT NOW. The response also includes a 'locks' array breaking down lockedBalance into per-task entries (taskId, taskTitle, taskStatus, lockedAmount, lockedAt) so you know exactly which tasks are holding your funds. Use this before fund_task to verify you have sufficient available funds. For all currencies at once, use list_wallets. Requires authentication.

    Annotations the server declares

    • title: Get Wallet Balance
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
  • get_wallet_transactionsGet your wallet transaction history.No findings

    Why it is in this group

    • The name "get_wallet_transactions" says "get": a word for reading.
    Description, as the server wrote it
    Get your wallet transaction history. Shows all ledger entries with running balance. Optionally filter by task ID. Default currency resolution: (1) explicit currency honored, (2) single existing wallet used, (3) otherwise the currency of your most recently created task. No stale USD default. Requires authentication.

    Annotations the server declares

    • title: Get Wallet Transactions
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
  • list_countriesList all countries with their current launch phase on Molt2Meet.No findings

    Why it is in this group

    • The name "list_countries" says "list": a word for reading.
    Description, as the server wrote it
    List all countries with their current launch phase on Molt2Meet. Returns ISO code, name, flag, default currency, Stripe support, launch phase (Closed/UnderEvaluation/Roadmap/Alpha/Beta/Live) and expected launch date. Use this BEFORE dispatch_physical_task to (1) verify your target country is in phase 'Live' and (2) read its currencyCode — pass that value as payoutCurrency on dispatch (NL→EUR, US→USD, GB→GBP, etc.) so operators are paid in the local currency. Only Live countries can execute tasks. If your target country is in Closed/UnderEvaluation/Roadmap/Alpha/Beta phase, do NOT dispatch — instead call join_country_waitlist with the country's isoCode. Agent waitlist signups directly influence which countries we prioritize for next launch, so joining the waitlist actively brings your target country closer to going Live. No authentication required.

    Annotations the server declares

    • title: List Countries
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
  • list_currenciesList supported (Stripe-compatible) ISO 4217 currencies for use as payoutCurrency.No findings

    Why it is in this group

    • The name "list_currencies" says "list": a word for reading.
    Description, as the server wrote it
    List supported (Stripe-compatible) ISO 4217 currencies for use as payoutCurrency. Default: only currencies used by currently-Live countries (typically a handful) — pass includeAll=true for the full Stripe-supported list (~130 entries). Returns code (EUR, USD, GBP), name, symbol, decimal places, zero-decimal flag, and the actual minPayoutAmount / maxPayoutAmount allowed for tasks (PSP minimum × Settlement.MinChargeMultiplier / × MaxChargeMultiplier). Use minPayoutAmount as the floor when setting dispatch_physical_task.payoutAmount. No authentication required.

    Annotations the server declares

    • title: List Currencies
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
  • list_localesList locales supported by the Molt2Meet platform.No findings

    Why it is in this group

    • The name "list_locales" says "list": a word for reading.
    Description, as the server wrote it
    List locales supported by the Molt2Meet platform. Returns the URL slug (e.g. 'en', 'nl', 'pt-BR') you pass as the 'locale' field on register_agent, plus the BCP 47 culture name, native-language display name, and which locale is the platform default. No authentication required. Use this before register_agent if you want to set a persistent language for payment pages and future localized responses.

    Annotations the server declares

    • title: List Locales
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
  • list_physical_tasksList all your dispatched physical-world tasks with current status.No findings

    Why it is in this group

    • The name "list_physical_tasks" says "list": a word for reading.
    Description, as the server wrote it
    List all your dispatched physical-world tasks with current status. Use this to poll for progress if you did not provide a webhookUrl. Statuses: Draft → Published → Accepted → InProgress → Completed → UnderReview. Requires: API key from register_agent. Next: get_physical_task_details for full details on a specific task.

    Annotations the server declares

    • title: List My Physical Tasks
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
  • list_reschedule_requestsList all reschedule requests for a task.No findings

    Why it is in this group

    • The name "list_reschedule_requests" says "list": a word for reading.
    Description, as the server wrote it
    List all reschedule requests for a task. Shows pending, approved, and rejected requests. Requires authentication.

    Annotations the server declares

    • title: List Reschedule Requests
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
  • list_service_capabilitiesList detailed execution options with pricing, duration, and proof types for physical-world tasks.No findings

    Why it is in this group

    • The name "list_service_capabilities" says "list": a word for reading.
    Description, as the server wrote it
    List detailed execution options with pricing, duration, and proof types for physical-world tasks. Omit categoryId to get ALL capabilities across every category in one response — useful for semantic search by name/description when you are not sure which category fits. Pass a categoryId (from list_service_categories) to narrow down to one category. Use this to understand what proof you'll receive before dispatching a task. No authentication required. Next: dispatch_physical_task.

    Annotations the server declares

    • title: List Service Capabilities
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
  • list_service_categoriesList available categories of physical-world tasks.No findings

    Why it is in this group

    • The name "list_service_categories" says "list": a word for reading.
    Description, as the server wrote it
    List available categories of physical-world tasks. Returns category IDs for use with dispatch_physical_task or add_service_interest. Any real-world task can be dispatched even without a category. No authentication required. Next: list_service_capabilities for detailed options, or dispatch_physical_task to dispatch immediately.

    Annotations the server declares

    • title: List Service Categories
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
  • list_service_interestsList all your registered service interests.No findings

    Why it is in this group

    • The name "list_service_interests" says "list": a word for reading.
    Description, as the server wrote it
    List all your registered service interests. Requires: API key from register_agent.

    Annotations the server declares

    • title: List Service Interests
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
  • list_walletsList all your wallets across all currencies with balance details.No findings

    Why it is in this group

    • The name "list_wallets" says "list": a word for reading.
    Description, as the server wrote it
    List all your wallets across all currencies with balance details. Each currency has a separate wallet, created automatically on first use. Use this to see which currencies you have funds in. For a single currency, use get_wallet_balance instead. Requires authentication.

    Annotations the server declares

    • title: List Wallets
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

42 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 1 private-data tool breaks every one.

Reads private data1
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write6
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out7
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
deny to break every path
{
  "permissions": {
    "deny": [
      "mcp__molt2meet__get_legal_documents"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Looked at Oct 22, 2026, 15:02 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable
yes
HTTP status of an anonymous initialize
200
tools/list served without credentials
yes
Tools that change things, listed without credentials
32
Protocol version
2025-06-18
WWW-Authenticate on 401
not observed
resource_metadata in WWW-Authenticate
none
RFC 9728 protected resource metadata
https://molt.molt2meet.com/.well-known/oauth-protected-resource
Authorization servers
none
Legacy HTTP+SSE transport
no
Dynamic client registration
not observed
Client ID metadata documents
not observed
  • HighThe whole server

    The endpoint served tools/list without credentials, and the list has 32 tools that change things (3 destructive, 5 irreversible, 24 write). Whether a call also works without credentials was not tested: tools are never called.

    Matched text

    https://molt.molt2meet.com/mcp: tools/list returned 54 tools to an anonymous client, including cancel_task_with_settlement (destructive), cancel_physical_task (destructive), revoke_api_key (destructive), checkout_wallet_deposit (irreversible), fund_wallet (irreversible) and 27 more

    What this check looks for

Install

Pinned to version 1.3.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http molt2meet https://molt.molt2meet.com/mcp --header 'X-Api-Key: <your-x-api-key>'

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__molt2meet__get_waitlist_status",
      "mcp__molt2meet__get_wallet_transactions",
      "mcp__molt2meet__list_service_interests",
      "mcp__molt2meet__get_legal_documents",
      "mcp__molt2meet__list_service_categories",
      "mcp__molt2meet__list_reschedule_requests",
      "mcp__molt2meet__get_wallet_balance",
      "mcp__molt2meet__get_agent_profile",
      "mcp__molt2meet__get_support_requests",
      "mcp__molt2meet__get_task_events",
      "mcp__molt2meet__get_pending_actions",
      "mcp__molt2meet__list_locales",
      "mcp__molt2meet__get_task_history",
      "mcp__molt2meet__get_physical_task_details",
      "mcp__molt2meet__list_service_capabilities",
      "mcp__molt2meet__list_physical_tasks",
      "mcp__molt2meet__get_task_proofs",
      "mcp__molt2meet__list_currencies",
      "mcp__molt2meet__list_wallets",
      "mcp__molt2meet__list_countries",
      "mcp__molt2meet__get_bank_transfer_details",
      "mcp__molt2meet__get_decision_requests"
    ],
    "ask": [
      "mcp__molt2meet__checkout_wallet_deposit",
      "mcp__molt2meet__check_task_funding",
      "mcp__molt2meet__create_api_key",
      "mcp__molt2meet__add_task_review",
      "mcp__molt2meet__add_contact_method",
      "mcp__molt2meet__approve_physical_task_completion",
      "mcp__molt2meet__fund_wallet",
      "mcp__molt2meet__request_reschedule",
      "mcp__molt2meet__add_service_interest",
      "mcp__molt2meet__publish_task",
      "mcp__molt2meet__approve_reschedule",
      "mcp__molt2meet__test_task_webhook",
      "mcp__molt2meet__resolve_decision_request",
      "mcp__molt2meet__join_country_waitlist",
      "mcp__molt2meet__register_agent",
      "mcp__molt2meet__acknowledge_direct_settlement_task",
      "mcp__molt2meet__submit_support_request",
      "mcp__molt2meet__dispatch_physical_task",
      "mcp__molt2meet__reject_task_review",
      "mcp__molt2meet__request_task_quote",
      "mcp__molt2meet__reject_reschedule",
      "mcp__molt2meet__update_task_location",
      "mcp__molt2meet__update_agent_profile",
      "mcp__molt2meet__approve_task_review",
      "mcp__molt2meet__reply_to_support_request",
      "mcp__molt2meet__open_task_dispute",
      "mcp__molt2meet__dispute_direct_settlement_task",
      "mcp__molt2meet__fund_task",
      "mcp__molt2meet__update_task_webhook"
    ],
    "deny": [
      "mcp__molt2meet__cancel_task_with_settlement",
      "mcp__molt2meet__cancel_physical_task",
      "mcp__molt2meet__revoke_api_key"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as molt2meet. Review it before you use it.

Capability tags behind 10 rules
  • mcp__molt2meet__checkout_wallet_deposit untrusted-input
  • mcp__molt2meet__get_legal_documents private-data
  • mcp__molt2meet__add_contact_method outbound
  • mcp__molt2meet__fund_wallet untrusted-input
  • mcp__molt2meet__publish_task untrusted-input, outbound
  • mcp__molt2meet__test_task_webhook untrusted-input, outbound
  • mcp__molt2meet__register_agent outbound
  • mcp__molt2meet__dispatch_physical_task untrusted-input, outbound
  • mcp__molt2meet__reply_to_support_request outbound
  • mcp__molt2meet__update_task_webhook untrusted-input, outbound