Impri
by sekera-radim · remote · local (npm) · no sign-in to list tools · v0.1.3 · published by GitHub user sekera-radim
Impri MCP server — human-in-the-loop approval inbox for AI agents
8 tools: 5 change things and 3 only read.
Scanned Oct 21, 2026
- Deletes or cancels0Claude Code: deny
- Can't be undone0Claude Code: ask
- Changes things5Claude Code: ask: see these tools
- Only reads3Claude Code: allow: see these tools
No check matched anything in the tool definitions. No finding is not a safety guarantee. How the checks work.
claude mcp add --transport http impri https://api.impri.dev/mcp --header 'Authorization: <your-authorization>'Tools
Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.
8 tools
Changes things 5Claude Code: ask
impri_await_decisionPoll until the human approves, rejects, or the timeout elapses.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Poll until the human approves, rejects, or the timeout elapses. Checks GET /actions/:id every 5 seconds and returns as soon as the action leaves the pending state. Decision meanings: "approved" — proceed with the action; any reviewer edits are included in preview/payload "rejected" — abort; respect the decision and do not proceed "expired" — the approval window closed; create a new action if the task is still relevant On timeout the action stays pending in the inbox. Call impri_inbox_status to check queue depth and consider pausing further submissions. Typical usage: 1. impri_push_action → get action_id 2. impri_await_decision(action_id) → wait for human decision 3. If approved: execute the action, then impri_report_result(action_id, "executed")
Annotations the server declares
- title: Await human decision
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
impri_create_watcherCreate a watcher that monitors external sources (RSS feeds, Reddit, URL diffs) and delivers matching items to the approval inbox or a webhook.Reads text others writeNo findings
Why it is in this group
- The name "impri_create_watcher" says "create": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Create a watcher that monitors external sources (RSS feeds, Reddit, URL diffs) and delivers matching items to the approval inbox or a webhook. The watcher runs on the schedule you specify, deduplicates items by URL/content-hash, and delivers only new matches. The first run establishes a baseline and does not generate alerts. Example — watch an RSS feed for AI-related news: spec: { name: "AI launches radar", kind: "rss", config: { url: "https://openai.com/news/rss.xml" }, keywords: ["launch", "gpt-", "voice"], keywords_none: ["funding", "benchmark"], min_score: 1, schedule: { every: "8h", jitter: "4h" } } Returns { watcher_id, name, kind, status, next_run_at }.
Annotations the server declares
- title: Create watcher
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
impri_create_watcher_from_presetCreate a watcher from a preset template by supplying the preset id and param values.Reads text others writeNo findings
Why it is in this group
- The name "impri_create_watcher_from_preset" says "create": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Create a watcher from a preset template by supplying the preset id and param values. Presets handle all watcher config construction — URL building, keyword setup, SSRF validation — so you only provide the param values listed by impri_list_watcher_presets. The schedule defaults to the preset's recommended interval but can be overridden. The name defaults to "{preset title}: {primary param value}" if omitted. Returns { watcher_id, name, kind, status, next_run_at }. Examples: Watch the HN front page (no params needed): preset_id: "hn-front-page" params: {} Watch a subreddit for new posts: preset_id: "reddit-subreddit" params: { subreddit: "MachineLearning" } Watch a GitHub repo for new releases, check every 2 hours: preset_id: "github-releases" params: { owner: "fastify", repo: "fastify" } schedule: { every: "2h" } Watch HN for keyword with a custom min_points threshold: preset_id: "hn-keyword" params: { keyword: "rust programming", min_points: "25" }
Annotations the server declares
- title: Create watcher from preset
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
impri_push_actionSubmit an action to the Impri human-approval inbox.Can send data outNo findings
Why it is in this group
- The name "impri_push_action" says "push": a word for a change.
What it can reach
- outboundThe input takes a URL (input.target_url): a request to a URL can carry data to whoever runs it.
Description, as the server wrote it Submit an action to the Impri human-approval inbox. The action appears in the operator's web and mobile inbox as a card with a title, formatted preview, and optional tap-to-edit fields. The operator approves or rejects with one tap; you poll for the decision with impri_await_decision. Returns { action_id, status: "pending", inbox_url }. Save action_id — you need it for all follow-up calls. Example — send a draft Reddit reply for review: kind: "reddit.comment" title: "Reply: Why is resume advice so conflicting?" preview: { format: "markdown", body: "The advice conflicts because different advisors optimise for different audiences..." } target_url: "https://reddit.com/r/cscareerquestions/comments/..." editable: ["preview.body"] // lets the reviewer tweak wording before approving
Annotations the server declares
- title: Push action for approval
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
impri_report_resultReport whether you successfully executed an approved action.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Report whether you successfully executed an approved action. Closes the audit loop — the operator sees 'executed' or 'execute_failed' in the inbox alongside the original action and decision. Always call this after attempting an approved action, even on failure. Statuses: "executed" — action was carried out successfully "execute_failed" — execution attempt failed (include the error in detail)
Annotations the server declares
- title: Report execution result
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
Only reads 3Claude Code: allow
impri_inbox_statusCheck how many actions are waiting for human decisions.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "impri_inbox_status" says "status": a word for reading.
What it can reach
- private-dataThe name "impri_inbox_status" says "status" and "inbox": it reads mail.
- untrusted-inputThe name "impri_inbox_status" says "status" and "inbox": it reads inbound email, which other people can write.
Description, as the server wrote it Check how many actions are waiting for human decisions. Returns the pending count and a brief list of pending action titles. Call this before starting a large batch of tasks — if the inbox is backed up, pause and let the operator catch up to avoid actions expiring before they are reviewed.
Annotations the server declares
- title: Check inbox status
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
impri_list_watcher_presetsList all available watcher presets with their parameters.No findings
Why it is in this group
- The name "impri_list_watcher_presets" says "list": a word for reading.
Description, as the server wrote it List all available watcher presets with their parameters. Presets are pre-configured watcher templates for common sources (Hacker News, Reddit, GitHub, npm, YouTube, arXiv, etc.). Each preset has an id, a human-readable title, required and optional params, and a default schedule. Call this first to discover which preset fits your monitoring goal, then use impri_create_watcher_from_preset to create the watcher by supplying only the preset_id and param values. No deep knowledge of watcher config schemas is needed. Example output: Community: - hn-front-page: "Hacker News Front Page" (rss) — no params required - reddit-keyword: "Reddit – Keyword Search" (reddit_search) — params: query, [subreddit]
Annotations the server declares
- title: List watcher presets
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
impri_list_watchersList all configured watchers, optionally filtered by status.No findings
Why it is in this group
- The name "impri_list_watchers" says "list": a word for reading.
Description, as the server wrote it List all configured watchers, optionally filtered by status. Returns the watcher count and a summary line per watcher (id, name, kind, status). Use this to audit what is being monitored, check for degraded watchers, or find a watcher_id for further operations.
Annotations the server declares
- title: List watchers
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Exfil surface
Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.
3 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 1 outbound tool breaks every one.
- Reads private data1
- Reads files, mail, messages, databases, secrets, calendars or repositories.
- Reads text others write3
- Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
- Can send data out1
- Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
{
"permissions": {
"deny": [
"mcp__impri__impri_push_action"
]
}
}Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.
Install
Pinned to version 0.1.3. Values in angle brackets are yours to fill in.
claude mcp add --transport http impri https://api.impri.dev/mcp --header 'Authorization: <your-authorization>'Run in a terminal.
Claude Code permissions
Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__impri__impri_inbox_status",
"mcp__impri__impri_list_watchers",
"mcp__impri__impri_list_watcher_presets"
],
"ask": [
"mcp__impri__impri_push_action",
"mcp__impri__impri_await_decision",
"mcp__impri__impri_report_result",
"mcp__impri__impri_create_watcher",
"mcp__impri__impri_create_watcher_from_preset"
],
"deny": []
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as impri. Review it before you use it.
Capability tags behind 4 rules
- mcp__impri__impri_push_action outbound
- mcp__impri__impri_inbox_status private-data, untrusted-input
- mcp__impri__impri_create_watcher untrusted-input
- mcp__impri__impri_create_watcher_from_preset untrusted-input
