Skip to content
anlyon.devby Anlyon

Odyssey Loopr MCP server

io.github.odyssey-finance/looprodyssey-financestreamable-httpv0.2.0Scanned

Quote, build and simulate leveraged DeFi yield positions on Odyssey Loopr.

17 tools: 13 change things and 4 only read.

Tools: 0 delete, 0 irreversible, 13 write, 4 read.
  • Reads private data · 0
  • Reads text others write · 1
  • Can send data out · 0
  • 4 findings

With Anlyon

13 tools here change things. Govern them.

  • Anlyon lists the tools and adopts none.
  • Each tool you adopt gets approvals and receipts.
  • Your agent never holds the key.
Govern this server →

A tool your agent calls directly is not routed through Anlyon and is not governed by it. anlyon.dev only lists and labels, and these labels are the same either way.

Compare with similar serversMarkdownJSONReport this listing

What the Odyssey Loopr MCP server can do

The Odyssey Loopr MCP server is published by the GitHub account odyssey-finance. It has 17 tools. It can create or change data (13 tools: quote_open, quote_adjust, quote_borrow, quote_repay and 9 more), but cannot delete data. 4 tools only read.

1 tool brings in text other people can write (simulate).

The fixed checks matched 4 findings (annotation-conflict). Each one comes with the text it matched.

Last scanned Nov 5, 2026, version 0.2.0.

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

17 tools

Changes things 13Claude Code: ask
  • build_adjustBuild the steps that add collateral ('push': requires collateralToken, amount, borrowToken, leverage) or withdraw it ('pull': requires token, tokenOut, and exactly one of withdrawA…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Build the steps that add collateral ('push': requires collateralToken, amount, borrowToken, leverage) or withdraw it ('pull': requires token, tokenOut, and exactly one of withdrawAmount or withdrawAll). Fields of the other direction are refused, not ignored. Returns UNSIGNED transaction steps for the owner to sign in order; this server never holds keys or sends transactions. The build expires after 180 seconds (`expiresAt`, unix ms): build immediately before signing, not as a plan for later. Builds are single-use: rebuilding an open predicts a different position address, so never replay one. A successful build does not guarantee a successful transaction: pass `steps` to `simulate` and check `ok` before asking anyone to sign. `tokenIn` (zap-in) is build-only: quote in the collateral token, then set `tokenIn` here to add the swap. With `tokenIn` set, `amount` is in `tokenIn` decimals. A zap-in is simulated by the build itself, and a failure gets 422 `simulation_reverted`. Any build the owner funds (open, adjust push, manual repay), zap-in or not, gets 422 `insufficient_balance` (`token`, `required`, `available`) when the owner holds less than it pulls.

    Annotations the server declares

    • idempotentHint: false
    • readOnlyHint: true
  • build_borrowBuild the steps that borrow more against a position.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Build the steps that borrow more against a position. Returns UNSIGNED transaction steps for the owner to sign in order; this server never holds keys or sends transactions. The build expires after 180 seconds (`expiresAt`, unix ms): build immediately before signing, not as a plan for later. Builds are single-use: rebuilding an open predicts a different position address, so never replay one. A successful build does not guarantee a successful transaction: pass `steps` to `simulate` and check `ok` before asking anyone to sign.

    Annotations the server declares

    • idempotentHint: false
    • readOnlyHint: true
  • build_claimBuild the steps that claim rewards.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Build the steps that claim rewards. Pass `rewards` exactly as quote_claim returned them. 'compound' requires slippage. Returns UNSIGNED transaction steps for the owner to sign in order; this server never holds keys or sends transactions. The build expires after 180 seconds (`expiresAt`, unix ms): build immediately before signing, not as a plan for later. Builds are single-use: rebuilding an open predicts a different position address, so never replay one. A successful build does not guarantee a successful transaction: pass `steps` to `simulate` and check `ok` before asking anyone to sign.

    Annotations the server declares

    • idempotentHint: false
    • readOnlyHint: true
  • build_closeBuild the steps that close a position in full.1 finding

    Why it is in this group

    • The name "build_close" says "close": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "build_close" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"idempotentHint":false}; The name "build_close" says "close": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Build the steps that close a position in full. Returns UNSIGNED transaction steps for the owner to sign in order; this server never holds keys or sends transactions. The build expires after 180 seconds (`expiresAt`, unix ms): build immediately before signing, not as a plan for later. Builds are single-use: rebuilding an open predicts a different position address, so never replay one. A successful build does not guarantee a successful transaction: pass `steps` to `simulate` and check `ok` before asking anyone to sign.

    Annotations the server declares

    • idempotentHint: false
    • readOnlyHint: true
  • build_openBuild the steps that open a leveraged position.1 finding

    Why it is in this group

    • The name "build_open" says "open": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "build_open" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"idempotentHint":false}; The name "build_open" says "open": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Build the steps that open a leveraged position. Returns UNSIGNED transaction steps for the owner to sign in order; this server never holds keys or sends transactions. The build expires after 180 seconds (`expiresAt`, unix ms): build immediately before signing, not as a plan for later. Builds are single-use: rebuilding an open predicts a different position address, so never replay one. A successful build does not guarantee a successful transaction: pass `steps` to `simulate` and check `ok` before asking anyone to sign. `tokenIn` (zap-in) is build-only: quote in the collateral token, then set `tokenIn` here to add the swap. With `tokenIn` set, `amount` is in `tokenIn` decimals. A zap-in is simulated by the build itself, and a failure gets 422 `simulation_reverted`. Any build the owner funds (open, adjust push, manual repay), zap-in or not, gets 422 `insufficient_balance` (`token`, `required`, `available`) when the owner holds less than it pulls.

    Annotations the server declares

    • idempotentHint: false
    • readOnlyHint: true
  • build_repayBuild the steps that repay debt.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Build the steps that repay debt. 'auto' requires slippage; 'manual' repays from the owner's wallet. Returns UNSIGNED transaction steps for the owner to sign in order; this server never holds keys or sends transactions. The build expires after 180 seconds (`expiresAt`, unix ms): build immediately before signing, not as a plan for later. Builds are single-use: rebuilding an open predicts a different position address, so never replay one. A successful build does not guarantee a successful transaction: pass `steps` to `simulate` and check `ok` before asking anyone to sign. Any build the owner funds (open, adjust push, manual repay), zap-in or not, gets 422 `insufficient_balance` (`token`, `required`, `available`) when the owner holds less than it pulls.

    Annotations the server declares

    • idempotentHint: false
    • readOnlyHint: true
  • quote_adjustQuote adding collateral ('push', requires leverage) or withdrawing it ('pull').No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Quote adding collateral ('push', requires leverage) or withdrawing it ('pull'). Returns a quote envelope; `expiresAt` is unix ms and quotes expire after 180 seconds. Amounts are base-unit integer strings.

    Annotations the server declares

    • idempotentHint: false
    • readOnlyHint: true
  • quote_borrowQuote borrowing more against a position.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Quote borrowing more against a position. Returns a quote envelope; `expiresAt` is unix ms and quotes expire after 180 seconds. Amounts are base-unit integer strings.

    Annotations the server declares

    • idempotentHint: false
    • readOnlyHint: true
  • quote_claimQuote claiming rewards.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Quote claiming rewards. 'send' pays them to the owner; 'compound' swaps them into the position and requires slippage. The returned `rewards` feed build_claim. Returns a quote envelope; `expiresAt` is unix ms and quotes expire after 180 seconds. Amounts are base-unit integer strings.

    Annotations the server declares

    • idempotentHint: false
    • readOnlyHint: true
  • quote_closeQuote closing a position in full.1 finding

    Why it is in this group

    • The name "quote_close" says "close": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "quote_close" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"idempotentHint":false}; The name "quote_close" says "close": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Quote closing a position in full. Returns a quote envelope; `expiresAt` is unix ms and quotes expire after 180 seconds. Amounts are base-unit integer strings.

    Annotations the server declares

    • idempotentHint: false
    • readOnlyHint: true
  • quote_openQuote opening a leveraged position: expected collateral, debt, health factor and liquidation price.1 finding

    Why it is in this group

    • The name "quote_open" says "open": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "quote_open" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"idempotentHint":false}; The name "quote_open" says "open": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Quote opening a leveraged position: expected collateral, debt, health factor and liquidation price. Returns a quote envelope; `expiresAt` is unix ms and quotes expire after 180 seconds. Amounts are base-unit integer strings.

    Annotations the server declares

    • idempotentHint: false
    • readOnlyHint: true
  • quote_repayQuote repaying debt.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Quote repaying debt. 'auto' repays from collateral via a flash-loan swap and requires slippage; 'manual' repays from the wallet. Returns a quote envelope; `expiresAt` is unix ms and quotes expire after 180 seconds. Amounts are base-unit integer strings.

    Annotations the server declares

    • idempotentHint: false
    • readOnlyHint: true
  • simulateSimulate built steps on a fork (Tenderly) from the owner's address before anyone signs.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Simulate built steps on a fork (Tenderly) from the owner's address before anyone signs. Pass `steps` and `expiresAt` exactly as a build_* tool returned them. Check `ok`; on failure the failing step carries the revert reason; never ask anyone to sign a failing build. A swap-route failure can be retried by rebuilding with `forceSwapper: true` (build_open, build_adjust push, build_repay auto, build_close). `share` defaults to 'failure-only', so a passing simulation never publishes the owner's calldata as a public link.

    Annotations the server declares

    • idempotentHint: false
    • openWorldHint: true
    • readOnlyHint: true
Only reads 4Show 4 read-only tools
  • get_positionsList an owner EOA's Loopr positions with health, leverage and PnL.No findings

    Why it is in this group

    • The name "get_positions" says "get": a word for reading.
    Description, as the server wrote it
    List an owner EOA's Loopr positions with health, leverage and PnL. Requires chainId or chainIds. Pass positionAddress (with chainId, not chainIds) to fetch a single position: it returns `{ position, errors, catalogUnavailable }`, and a null `position` with `errors` rows means the chain could not be read, not that the position does not exist.

    Annotations the server declares

    • idempotentHint: true
    • readOnlyHint: true
  • get_sca_accountDerive the smart contract account (SCA) that holds Loopr positions for an EOA.No findings

    Why it is in this group

    • The name "get_sca_account" says "get": a word for reading.
    Description, as the server wrote it
    Derive the smart contract account (SCA) that holds Loopr positions for an EOA. Deterministic; the same on every chain.

    Annotations the server declares

    • idempotentHint: true
    • readOnlyHint: true
  • get_strategyGet one strategy.No findings

    Why it is in this group

    • The name "get_strategy" says "get": a word for reading.
    Description, as the server wrote it
    Get one strategy. Pass depositToken/borrowToken when several strategies share a strategyId on the same chain.

    Annotations the server declares

    • idempotentHint: true
    • readOnlyHint: true
  • list_strategiesList Loopr leveraged strategies with APY, leverage bounds, deposit/borrow tokens and TVL.No findings

    Why it is in this group

    • The name "list_strategies" says "list": a word for reading.
    Description, as the server wrote it
    List Loopr leveraged strategies with APY, leverage bounds, deposit/borrow tokens and TVL. Filter by chain, deposit asset or protocol.

    Annotations the server declares

    • idempotentHint: true
    • readOnlyHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data or outbound.

Reads private data0
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write1
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out0
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

4 warn
  • Warnquote_open

    The server marks "quote_open" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"idempotentHint":false}; The name "quote_open" says "open": a word for a change.

    What this check looks for
  • Warnquote_close

    The server marks "quote_close" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"idempotentHint":false}; The name "quote_close" says "close": a word for a change.

    What this check looks for
  • Warnbuild_open

    The server marks "build_open" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"idempotentHint":false}; The name "build_open" says "open": a word for a change.

    What this check looks for
  • Warnbuild_close

    The server marks "build_close" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"idempotentHint":false}; The name "build_close" says "close": a word for a change.

    What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 0.2.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http loopr https://app.odyssey.finance/api/mcp
claude mcp add --transport http loopr https://app.odyssey.finance/api/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__loopr__list_strategies",
      "mcp__loopr__get_strategy",
      "mcp__loopr__get_positions",
      "mcp__loopr__get_sca_account"
    ],
    "ask": [
      "mcp__loopr__quote_open",
      "mcp__loopr__quote_adjust",
      "mcp__loopr__quote_borrow",
      "mcp__loopr__quote_repay",
      "mcp__loopr__quote_claim",
      "mcp__loopr__quote_close",
      "mcp__loopr__build_open",
      "mcp__loopr__build_adjust",
      "mcp__loopr__build_borrow",
      "mcp__loopr__build_repay",
      "mcp__loopr__build_claim",
      "mcp__loopr__build_close",
      "mcp__loopr__simulate"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as loopr. Review it before you use it.

Capability tags behind 1 rule
  • mcp__loopr__simulate untrusted-input

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/io.github.odyssey-finance/loopr/verify?hash=6be300349b8ad66cac30f71e4c458ffaf33e68f62e653bcd4016192f7a2e3d5f" | jq -e '.changed == false'

Pinned hash 6be300349b8a, from Nov 5, 2026, 16:18 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/io.github.odyssey-finance/loopr/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for io.github.odyssey-finance/loopr
[![anlyon.dev](https://anlyon.dev/badge/io.github.odyssey-finance/loopr.svg)](https://anlyon.dev/servers/io.github.odyssey-finance/loopr)

Source: MCP Registry · repository. Synced Nov 5, 2026, 16:18 UTC.

Odyssey Loopr MCP server: questions and answers

Answered from the scan above, not from the publisher's description.

Is the Odyssey Loopr MCP server safe?

No scan can promise that. What its definitions show: 17 tools, 13 of which can change, send or delete something, and 4 findings from fixed checks. Allow the reads, ask before each change, and deny the deletes; the permissions block on this page does that.

Can the Odyssey Loopr MCP server delete data?

No tool is classed as destructive: going by their definitions, none of them deletes, cancels or revokes anything.

Can the Odyssey Loopr MCP server do things that cannot be undone?

No tool is classed as irreversible: none of them sends, pays, publishes or merges, going by their definitions.

What tools does the Odyssey Loopr MCP server have?

17 tools: 13 write, 4 read. quote_open, quote_adjust, quote_borrow, quote_repay, quote_claim, quote_close, build_open, build_adjust and 9 more.

Does the Odyssey Loopr MCP server send data to outside services?

None of its tools sends, posts or publishes, or takes a recipient, channel or URL.

Has the Odyssey Loopr MCP server changed its tools?

Not since anlyon.dev started tracking it. Last scanned Nov 5, 2026.