Skip to content

Diogenes Autonomous Microservice Gateway

by stand-out-of-my-sun · remote · no sign-in to list tools · v1.2.0 · published by GitHub user stand-out-of-my-sun

Autonomous AI microservices: 55 dynamic guardrails, contract audits & oracles via L402/x402/MPP.

Final · 2Changes · 55

71 tools: 2 do something that can't be undone, 55 change things and 14 only read.

Scanned Oct 21, 2026

30 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http diogenes-gateway https://diogenes-micro-gateway.corinth.workers.dev/mcp

Findings

Matches of fixed checks, with the text they matched.

27 warn3 info
  • The server marks "verify_agent_command_safety" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "evaluate": a word for a change.

    What this check looks for
  • The server marks "execute_python_sandbox" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "execute_python_sandbox" says "execute": a word for a change.

    What this check looks for
  • The server marks "evaluate_solana_token_risk" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "evaluate_solana_token_risk" says "evaluate": a word for a change.

    What this check looks for
  • The input schema at properties.mint.description contains a 44-character base64 string.

    Matched text

    inputSchema.properties.mint.description: "...mint address (e.g. 'EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v')."

    What this check looks for
  • The server marks "evaluate_dex_mev_risk" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "evaluate_dex_mev_risk" says "evaluate": a word for a change.

    What this check looks for
  • The server marks "verify_http402_payment_challenge" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "verify_http402_payment_challenge" says "payment": a word that usually means money moves, which cannot be taken back.

    What this check looks for
Show 24 more findings
  • The server marks "calculate_spot_swap_rate" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The input carries an amount (input.amount) and a currency, so it moves money.

    What this check looks for
  • The server marks "generate_gemini_completion" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "generate_gemini_completion" says "generate": a word for a change.

    What this check looks for
  • The server marks "execute_antigravity_agent" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "execute_antigravity_agent" says "execute": a word for a change.

    What this check looks for
  • The server marks "conduct_deep_research_investigation" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The description's first verb is "run": a word for a change.

    What this check looks for
  • The server marks "search_gemini_grounded_maps" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "search_gemini_grounded_maps" says "search": a word for reading.

    What this check looks for
  • The server marks "generate_gemini_embeddings" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "generate_gemini_embeddings" says "generate": a word for a change.

    What this check looks for
  • The server marks "generate_nano_banana_image" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "generate_nano_banana_image" says "generate": a word for a change.

    What this check looks for
  • The server marks "generate_veo_cinematic_video" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "generate_veo_cinematic_video" says "generate": a word for a change.

    What this check looks for
  • The server marks "synthesize_gemini_speech_audio" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "convert": a word for a change.

    What this check looks for
  • The server marks "apply_fuzzy_code_patch" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "apply_fuzzy_code_patch" says "apply": a word for a change.

    What this check looks for
  • The server marks "analyze_ast_symbol_graph" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "analyze_ast_symbol_graph" says "analyze": a word for reading.

    What this check looks for
  • The server marks "audit_module_dependency_cycles" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "run": a word for a change.

    What this check looks for
  • The server marks "compile_polyglot_type_schemas" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "compile_polyglot_type_schemas" says "type": a word for a change.

    What this check looks for
  • The server marks "evaluate_deterministic_math" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "evaluate_deterministic_math" says "evaluate": a word for a change.

    What this check looks for
  • The server marks "schedule_critical_path_tasks" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "schedule_critical_path_tasks" says "schedule": a word for a change.

    What this check looks for
  • The server marks "evaluate_ab_statistical_significance" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "evaluate_ab_statistical_significance" says "evaluate": a word for a change.

    What this check looks for
  • The server marks "generate_boundary_test_vectors" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "generate_boundary_test_vectors" says "generate": a word for a change.

    What this check looks for
  • The server marks "simulate_monte_carlo_risk" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "run": a word for a change.

    What this check looks for
  • The server marks "enforce_json_schema_types" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "enforce_json_schema_types" says "type": a word for a change.

    What this check looks for
  • The server marks "arbitrate_agent_deliverable_escrow" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "evaluate": a word for a change.

    What this check looks for
  • The server marks "generate_x402_vector_embeddings" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "generate_x402_vector_embeddings" says "generate": a word for a change.

    What this check looks for
  • The title mentions "Credential".

    Matched text

    title: "Zero-PII & Secret Credential Redaction Engine"

    What this check looks for
  • The annotations title mentions "Credential".

    Matched text

    annotations.title: "Zero-PII & Secret Credential Redaction Engine"

    What this check looks for
  • The description mentions "credentials".

    Matched text

    description: "...when stripping personal data or secret credentials from prompts, logs, or outbound message..."

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

71 tools

Can't be undone 2Claude Code: ask
  • calculate_spot_swap_rateCalculates instantaneous spot exchange rates and equivalent USD, BTC, and satoshi values across BTC, ETH, SOL, SUI, and USDC.1 finding

    Why it is in this group

    • The input carries an amount (input.amount) and a currency, so it moves money.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "calculate_spot_swap_rate" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The input carries an amount (input.amount) and a currency, so it moves money.

      What this check looks for
    Description, as the server wrote it
    Calculates instantaneous spot exchange rates and equivalent USD, BTC, and satoshi values across BTC, ETH, SOL, SUI, and USDC. Use when converting a token amount into USD or satoshis for invoice pricing or accounting; for quoting executable non-KYC cross-chain bridge routes with bridge fees and settlement times, use compare_crosschain_bridge_routes instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'currency' ('amount' defaults to 'standard'), supports '?demo=true' or L402 (100 sats), and returns HTTP 400 if invalid.

    Annotations the server declares

    • title: Cross-Asset Spot Exchange Rate & Satoshi Conversion Calculator
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • verify_http402_payment_challengeDecodes inbound HTTP 402 Payment Required challenges (L402 BOLT11 + Macaroon, x402 Solana USDC, MPP Base intents) to verify cryptographic payment-hash binding and block overcharge …1 finding

    Why it is in this group

    • The name "verify_http402_payment_challenge" says "payment": a word that usually means money moves, which cannot be taken back.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "verify_http402_payment_challenge" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "verify_http402_payment_challenge" says "payment": a word that usually means money moves, which cannot be taken back.

      What this check looks for
    Description, as the server wrote it
    Decodes inbound HTTP 402 Payment Required challenges (L402 BOLT11 + Macaroon, x402 Solana USDC, MPP Base intents) to verify cryptographic payment-hash binding and block overcharge fraud. Use when auditing a 402 challenge header before an autonomous agent pays a Lightning invoice or USDC transfer; for checking on-chain Bitcoin L1 mempool feerates, use estimate_bitcoin_mempool_fees instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'www_authenticate' ('protocol_hint' defaults to 'L402'), supports '?demo=true' or L402 (60 sats), and returns HTTP 400 if invalid.

    Annotations the server declares

    • title: Pre-Payment HTTP 402 (L402 / x402 / MPP) Invoice & Macaroon Fraud Verifier
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
Changes things 55Claude Code: ask
  • analyze_ast_symbol_graphStatic lexer and AST parser only (zero execution or evaluation): extracts imports, exports, classes, interfaces, and functions with line numbers, intra-file call edges, McCabe cycl…1 finding

    Why it is in this group

    • The name "analyze_ast_symbol_graph" says "analyze": a word for reading.
    • The input takes a statement or command to run (input.code), which can change anything it can reach.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "analyze_ast_symbol_graph" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "analyze_ast_symbol_graph" says "analyze": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Static lexer and AST parser only (zero execution or evaluation): extracts imports, exports, classes, interfaces, and functions with line numbers, intra-file call edges, McCabe cyclomatic complexity, and Halstead volume across TypeScript, Python, Rust, Go, and Move. Use when mapping internal functions, call graphs, and complexity hotspots of a source file before refactoring; for analyzing cross-file import DAGs and circular dependencies, use audit_module_dependency_cycles instead. Read-only call (32 KB, 60 RPM): accepts 'source_text' (with enum defaults), uses '?demo=true' or L402 (75 sats); HTTP 400 if invalid.

    Annotations the server declares

    • title: Polyglot AST Symbol Extractor, Call Graph & Complexity Analyzer
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • apply_fuzzy_code_patchApplies unified diffs (@@ ...1 finding

    Why it is in this group

    • The name "apply_fuzzy_code_patch" says "apply": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "apply_fuzzy_code_patch" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "apply_fuzzy_code_patch" says "apply": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Applies unified diffs (@@ ... @@) or SEARCH/REPLACE blocks to source code using sliding-window token similarity to resolve drifted line numbers, align indentation, and verify bracket balance. Use when healing and applying a code edit or diff that failed exact line matching due to line-number drift or whitespace differences; for inspecting function signatures, call trees, and cyclomatic complexity without modifying code, use analyze_ast_symbol_graph instead. Read-only call (32 KB, 60 RPM): accepts 'original_code' (with enum defaults), uses '?demo=true' or L402 (75 sats); HTTP 400 if invalid.

    Annotations the server declares

    • title: Self-Healing Fuzzy Unified Diff & Search/Replace Code Patcher
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • arbitrate_agent_deliverable_escrowEvaluates a worker agent's submitted task deliverable against agreed contract acceptance criteria to issue a deterministic escrow settlement verdict ('RELEASE_FUNDS_TO_WORKER_AGENT…1 finding

    Why it is in this group

    • The description's first verb is "evaluate": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "arbitrate_agent_deliverable_escrow" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "evaluate": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Evaluates a worker agent's submitted task deliverable against agreed contract acceptance criteria to issue a deterministic escrow settlement verdict ('RELEASE_FUNDS_TO_WORKER_AGENT', 'REQUEST_REVISION', or 'REFUND_CLIENT'). Use when settling multi-agent bounties or verifying subcontractor deliverables before releasing MPP/L402 escrow funds; for checking syntactic JSON Schema property types without evaluating semantic contract terms, use enforce_json_schema_types instead. Read-only call (32 KB, 60 RPM): accepts 'deliverable' (with enum defaults), uses '?demo=true' or MPP (150 sats); HTTP 400 if invalid.

    Annotations the server declares

    • title: Multi-Agent Task Deliverable & Contract Fulfillment Escrow Arbiter
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • audit_mcp_server_manifestScans an external MCP server's initial tools/list manifest to detect tool-name shadowing (read_file, bash) and hidden prompt-injection directives in descriptions.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Scans an external MCP server's initial tools/list manifest to detect tool-name shadowing (read_file, bash) and hidden prompt-injection directives in descriptions. Use when vetting a newly discovered third-party MCP server before mounting it into an agent session; for comparing a previously pinned MCP baseline against a live mid-session tools/list response, use detect_mcp_schema_rugpull instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'manifest_json' ('audit_profile' defaults to 'strict'), supports '?demo=true' or L402 (150 sats), and returns HTTP 400 if invalid.

    Annotations the server declares

    • title: External MCP Server Manifest & Tool-Poisoning Security Auditor
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • audit_module_dependency_cyclesRuns Tarjan's Strongly Connected Components (SCC) algorithm on a module import map to detect circular dependencies, compute parallel topological build waves, and trace downstream c…1 finding

    Why it is in this group

    • The description's first verb is "run": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "audit_module_dependency_cycles" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "run": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Runs Tarjan's Strongly Connected Components (SCC) algorithm on a module import map to detect circular dependencies, compute parallel topological build waves, and trace downstream change blast radius. Use when auditing multi-file import graphs for circular cycles or determining which downstream files must be re-tested after an edit; for extracting function-level symbols and cyclomatic complexity inside a single source file, use analyze_ast_symbol_graph instead. Read-only call (32 KB, 60 RPM): accepts 'modules_json' (with enum defaults), uses '?demo=true' or L402 (75 sats); HTTP 400 if invalid.

    Annotations the server declares

    • title: Tarjan SCC Circular Import Detector & Topological Blast-Radius Solver
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • audit_outbound_egress_urlStatic validation firewall for outbound network destination URIs against cloud metadata IP addresses (169.254.169.254), RFC 1918 private IP blocks, and query-string secret exfiltra…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Static validation firewall for outbound network destination URIs against cloud metadata IP addresses (169.254.169.254), RFC 1918 private IP blocks, and query-string secret exfiltration before agent dispatch. Use when validating a user-supplied or tool-supplied URI destination before network dispatch; for auditing local shell commands or general prompts, use verify_agent_command_safety instead. Read-only edge call (32 KB, 60 RPM): accepts 'destination_uri' ('egress_policy' defaults to 'block_private_and_metadata'), supports '?demo=true' or L402 (65 sats), and returns HTTP 400 if invalid.

    Annotations the server declares

    • title: Outbound Agent URL SSRF, Metadata & Secret Exfiltration Firewall
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • audit_response_factualityCross-references factual claims, numbers, and citations in a draft agent response against retrieved source passages to flag unsupported hallucinations before delivery.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Cross-references factual claims, numbers, and citations in a draft agent response against retrieved source passages to flag unsupported hallucinations before delivery. Use when verifying that a generated answer is 100% grounded in source evidence before returning it to the user; for scrubbing inbound tool outputs for prompt-injection and invisible Unicode, use sanitize_tool_output_stream instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'claim' ('context' defaults to 'standard'), supports '?demo=true' or L402 (150 sats), and returns HTTP 400 if invalid.

    Annotations the server declares

    • title: Draft Agent Response Groundedness & Hallucination Auditor
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • audit_smart_contract_codeStatically audits Solidity, Vyper, or Move smart contract source code for honeypot transfer taxes, hidden mint backdoors, proxy upgrade traps, and reentrancy.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Statically audits Solidity, Vyper, or Move smart contract source code for honeypot transfer taxes, hidden mint backdoors, proxy upgrade traps, and reentrancy. Use when auditing smart contract source code or bytecode before deploying or interacting with a protocol; for scanning Solana Anchor/Rust programs specifically for Cross-Program Invocation (CPI) signer/account vulnerabilities, use scan_solana_cpi_reentrancy instead. Read-only edge call (32 KB, 60 RPM): accepts 'code_or_address' ('chain' defaults to 'evm_solidity'), uses '?demo=true' or L402 (250 sats); HTTP 400 if invalid.

    Annotations the server declares

    • title: EVM & Move Smart Contract Honeypot, Tax & Reentrancy Auditor
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • clean_tabular_datasetDeduplicates repetitive lines or records, normalizes Unicode whitespace, strips HTML/control noise, and canonicalizes tabular text or JSON arrays.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Deduplicates repetitive lines or records, normalizes Unicode whitespace, strips HTML/control noise, and canonicalizes tabular text or JSON arrays. Use when cleaning noisy scraped lists, CSV rows, or duplicate log lines before indexing or analysis; for extracting typed JSON fields from free-form prose paragraphs, use extract_structured_json_entities instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'data' ('normalization_mode' defaults to 'exact_match'), supports '?demo=true' or L402 (100 sats), and returns HTTP 400 if invalid.

    Annotations the server declares

    • title: Tabular Dataset & Text Deduplication, Whitespace & Normalization Engine
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • compile_mpp_research_dossierCompiles a structured JSON research dossier ('key_findings', 'synthesis_quality_score', 'sources_cited') settled via Base EVM Machine Payments Protocol (MPP).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Compiles a structured JSON research dossier ('key_findings', 'synthesis_quality_score', 'sources_cited') settled via Base EVM Machine Payments Protocol (MPP). Use when generating a strict-JSON cited intelligence brief paid via Base USDC MPP session headers; for running long-form narrative research reports via L402 Lightning, use conduct_deep_research_investigation instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'research_topic' ('output_density' defaults to 'concise_5_points'), supports '?demo=true' or MPP (1000 sats), and returns HTTP 400 if invalid.

    Annotations the server declares

    • title: Base MPP Session-Metered Multi-Source Research Dossier Compiler
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • compile_polyglot_type_schemasInspects a sample JSON payload (inferring UUID, ISO-8601 datetime, email, integer vs float, and array item types) and compiles strict TypeScript interfaces, Zod schemas, Python Pyd…1 finding

    Why it is in this group

    • The name "compile_polyglot_type_schemas" says "type": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "compile_polyglot_type_schemas" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "compile_polyglot_type_schemas" says "type": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Inspects a sample JSON payload (inferring UUID, ISO-8601 datetime, email, integer vs float, and array item types) and compiles strict TypeScript interfaces, Zod schemas, Python Pydantic v2 models, and JSON Schema Draft 2020-12. Use when generating static type definitions and runtime validators in TypeScript and Python from a sample JSON response; for extracting existing function/class symbols and complexity metrics from source code, use analyze_ast_symbol_graph instead. Read-only call (32 KB, 60 RPM): accepts 'sample_json' (with enum defaults), uses '?demo=true' or L402 (60 sats); HTTP 400 if invalid.

    Annotations the server declares

    • title: Polyglot JSON -> TypeScript, Zod, Pydantic v2 & JSON Schema Compiler
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • compile_xml_agent_promptCompiles a raw task description into a structured XML system prompt (<role>, <context>, <objective>, <constraints>, <workflow>, <output_format>) engineered to prevent instruction d…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Compiles a raw task description into a structured XML system prompt (<role>, <context>, <objective>, <constraints>, <workflow>, <output_format>) engineered to prevent instruction drift. Use when authoring or upgrading a system prompt for an autonomous agent or sub-agent workflow; for mapping a task objective to a concrete sequence of MCP tool calls, use route_mcp_workflow_plan instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'task' ('prompt_style' defaults to 'anthropic_xml_tags'), supports '?demo=true' or L402 (100 sats), and returns HTTP 400 if invalid.

    Annotations the server declares

    • title: Production XML-Structured System Prompt & Guardrail Compiler
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • compose_lyria_music_trackComposes studio-grade instrumental music tracks, ambient loops, and multi-instrument arrangements from genre, tempo, and mood prompts using Google Lyria 3.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Composes studio-grade instrumental music tracks, ambient loops, and multi-instrument arrangements from genre, tempo, and mood prompts using Google Lyria 3. Use when generating musical scores, soundtrack stems, or rhythmic audio loops; for converting written text into spoken human voice narration (TTS), use synthesize_gemini_speech_audio instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'prompt' ('genre_preset' defaults to 'cinematic_synth'), supports '?demo=true' or L402 (500 sats), and returns HTTP 400 if invalid.

    Annotations the server declares

    • title: Google Lyria 3 Instrumental Music & Audio Stem Composer
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • conduct_deep_research_investigationRuns an iterative, multi-hop investigative research session via Gemini Deep Research Pro, cross-examining primary sources to produce a cited technical report.1 finding

    Why it is in this group

    • The description's first verb is "run": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "conduct_deep_research_investigation" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The description's first verb is "run": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Runs an iterative, multi-hop investigative research session via Gemini Deep Research Pro, cross-examining primary sources to produce a cited technical report. Use when investigating complex scientific, architectural, or market questions requiring deep multi-hop synthesis; for running a fast single-turn Google Search grounded fact lookup, use search_gemini_grounded_web instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'input' ('depth_tier' defaults to 'quick_synthesis'), supports '?demo=true' or L402 (1000 sats), and returns HTTP 400 if invalid.

    Annotations the server declares

    • title: Gemini Deep Research Pro Multi-Hop Investigative Analyst
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • decode_eip712_permit_signatureDecodes EIP-712 and Uniswap Permit2 off-chain typed-data payloads to verify spender identity, detect unlimited (uint256.max) token approvals, and flag expired deadlines.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Decodes EIP-712 and Uniswap Permit2 off-chain typed-data payloads to verify spender identity, detect unlimited (uint256.max) token approvals, and flag expired deadlines. Use when inspecting an off-chain eth_signTypedData_v4 or Permit2 payload before signing; for decoding raw on-chain hex transaction calldata (0x...) for eth_sendTransaction, use simulate_evm_transaction_calldata instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'typed_data_json' ('chain_id' defaults to '1'), supports '?demo=true' or L402 (100 sats), and returns HTTP 400 if invalid.

    Annotations the server declares

    • title: EIP-712 Typed Data & Uniswap Permit2 Phishing Signature Decoder
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • detect_mcp_schema_rugpullComputes structural diffs between a pinned baseline MCP tools/list snapshot and a live server response to catch mid-session description or schema tampering.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Computes structural diffs between a pinned baseline MCP tools/list snapshot and a live server response to catch mid-session description or schema tampering. Use when verifying that a connected MCP server has not mutated its tool definitions mid-session; for performing a first-time static security audit on a single MCP manifest, use audit_mcp_server_manifest instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'baseline_tools_json' ('current_tools_json' defaults to 'standard'), supports '?demo=true' or L402 (85 sats), and returns HTTP 400 if invalid.

    Annotations the server declares

    • title: Mid-Session MCP tools/list Rug-Pull & Schema Mutation Detector
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • enforce_json_schema_typesValidates a raw LLM output object against a target JSON Schema, automatically coercing mismatched scalar types (e.g.1 finding

    Why it is in this group

    • The name "enforce_json_schema_types" says "type": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "enforce_json_schema_types" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "enforce_json_schema_types" says "type": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Validates a raw LLM output object against a target JSON Schema, automatically coercing mismatched scalar types (e.g. string '42' to integer 42), injecting schema defaults, and pruning undeclared hallucinated fields. Use when enforcing schema compliance and type safety on structured LLM outputs before passing them to typed APIs; for healing unparseable raw JSON text with broken quotes or trailing commas, use heal_malformed_json instead. Read-only edge call (32 KB, 60 RPM): accepts 'raw_output' (with enum defaults), uses '?demo=true' or L402 (75 sats); HTTP 400 if invalid.

    Annotations the server declares

    • title: Strict JSON Schema Validator, Type Coercer & Field Pruner
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • estimate_solana_priority_feesCalculates optimal Solana compute-unit (CU) microlamport priority fees and Jito bundle tip lamports to achieve target block-inclusion probability.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Calculates optimal Solana compute-unit (CU) microlamport priority fees and Jito bundle tip lamports to achieve target block-inclusion probability. Use when setting SetComputeUnitPrice and Jito tips before broadcasting a Solana transaction; for querying Bitcoin L1 sat/vB mempool fee rates, use estimate_bitcoin_mempool_fees instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'priority_level' ('tx_type' defaults to 'simple_transfer'), supports '?demo=true' or x402 (50 sats), and returns HTTP 400 if invalid.

    Annotations the server declares

    • title: Solana Compute-Unit Priority Fee & Jito MEV Tip Estimator
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • evaluate_ab_statistical_significanceComputes Welch's two-sample t-test or two-proportion z-test, returning two-tailed p-values, Cohen's d effect size, relative lift %, and Bayesian P(Treatment > Control).1 finding

    Why it is in this group

    • The name "evaluate_ab_statistical_significance" says "evaluate": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "evaluate_ab_statistical_significance" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "evaluate_ab_statistical_significance" says "evaluate": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Computes Welch's two-sample t-test or two-proportion z-test, returning two-tailed p-values, Cohen's d effect size, relative lift %, and Bayesian P(Treatment > Control). Use when determining whether a prompt change, model benchmark, or A/B experiment produced a statistically significant improvement; for evaluating single algebraic formulas or NPV/IRR cashflows, use evaluate_deterministic_math instead. Read-only edge call (32 KB, 60 RPM): accepts 'control_json' ('treatment_json' defaults to 'standard'), supports '?demo=true' or L402 (60 sats), and returns HTTP 400 if invalid.

    Annotations the server declares

    • title: Welch's t-Test, Two-Proportion z-Test & Bayesian A/B Eval Judge
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • evaluate_deterministic_mathStrict Shunting-Yard AST arithmetic parser with zero eval() or dynamic code execution: evaluates algebraic formulas and computes exact financial NPV, Newton-Raphson IRR, Kelly crit…1 finding

    Why it is in this group

    • The name "evaluate_deterministic_math" says "evaluate": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "evaluate_deterministic_math" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "evaluate_deterministic_math" says "evaluate": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Strict Shunting-Yard AST arithmetic parser with zero eval() or dynamic code execution: evaluates algebraic formulas and computes exact financial NPV, Newton-Raphson IRR, Kelly criterion, and dataset stats. Use when computing exact arithmetic formulas, cashflow NPV/IRR, or descriptive statistics without LLM floating-point guesswork; for running two-sample A/B hypothesis tests, use evaluate_ab_statistical_significance instead. Read-only edge call (32 KB, 60 RPM): accepts 'math_formula' ('precision_digits' defaults to '2_decimals'), uses '?demo=true' or L402 (40 sats); HTTP 400 if invalid.

    Annotations the server declares

    • title: Shunting-Yard Algebraic Math, Financial IRR/NPV & Descriptive Stats Solver
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • evaluate_dex_mev_riskEvaluates decentralized exchange (DEX) swap parameters against pool depth and mempool visibility to quantify MEV sandwich risk and compute optimal slippage tolerance in basis point…1 finding

    Why it is in this group

    • The name "evaluate_dex_mev_risk" says "evaluate": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "evaluate_dex_mev_risk" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "evaluate_dex_mev_risk" says "evaluate": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Evaluates decentralized exchange (DEX) swap parameters against pool depth and mempool visibility to quantify MEV sandwich risk and compute optimal slippage tolerance in basis points. Use when configuring slippage tolerance and private-RPC routing before executing an on-chain DEX token swap; for comparing cross-chain bridge settlement routes across different L1 blockchains, use compare_crosschain_bridge_routes instead. Read-only edge call (32 KB, 60 RPM): accepts 'pair' ('execution_venue' defaults to 'uniswap_v3_public'), uses '?demo=true' or L402 (150 sats); HTTP 400 if invalid.

    Annotations the server declares

    • title: Pre-Swap DEX MEV Sandwich & Frontrunning Risk Evaluator
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • evaluate_solana_token_riskEvaluates a Solana SPL token's rug-pull probability by checking active mint authority, freeze authority, mutable metadata, and top-holder concentration.1 finding

    Why it is in this group

    • The name "evaluate_solana_token_risk" says "evaluate": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "evaluate_solana_token_risk" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "evaluate_solana_token_risk" says "evaluate": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Evaluates a Solana SPL token's rug-pull probability by checking active mint authority, freeze authority, mutable metadata, and top-holder concentration. Use when making a pre-trade security decision on whether a Solana SPL token is safe to buy; for retrieving SPL token symbol, decimals, and DEX liquidity pool metadata via x402, use inspect_solana_token_liquidity instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'token_address' ('risk_profile' defaults to 'strict_decentralized'), supports '?demo=true' or L402 (100 sats), and returns HTTP 400 if invalid.

    Annotations the server declares

    • title: Solana SPL Token Mint/Freeze Authority & Rug-Pull Risk Evaluator
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • execute_antigravity_agentDispatches a complex engineering or operational task to Google's Antigravity autonomous agent for multi-step planning, tool orchestration, and verified execution.1 finding

    Why it is in this group

    • The name "execute_antigravity_agent" says "execute": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "execute_antigravity_agent" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "execute_antigravity_agent" says "execute": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Dispatches a complex engineering or operational task to Google's Antigravity autonomous agent for multi-step planning, tool orchestration, and verified execution. Use when solving multi-stage software engineering or workflow tasks that require autonomous planning; for compiling exhaustive multi-source literature and market research dossiers, use conduct_deep_research_investigation instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'input' ('execution_mode' defaults to 'autonomous_verified'), supports '?demo=true' or L402 (500 sats), and returns HTTP 400 if invalid.

    Annotations the server declares

    • title: Google Antigravity Multi-Step Autonomous Coding & Workflow Agent
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • execute_python_sandboxAudits Python source code for forbidden syscalls (os, subprocess, socket, open, eval) inside an AST-governed WebAssembly sandbox with no host filesystem access.1 finding

    Why it is in this group

    • The name "execute_python_sandbox" says "execute": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "execute_python_sandbox" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "execute_python_sandbox" says "execute": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Audits Python source code for forbidden syscalls (os, subprocess, socket, open, eval) inside an AST-governed WebAssembly sandbox with no host filesystem access. Use when executing LLM-generated Python snippets safely; for checking shell commands without executing code, use verify_agent_command_safety instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'python_script' ('timeout_profile' defaults to 'fast_1s'), supports '?demo=true' or MPP (1500 sats), and returns HTTP 400 if invalid.

    Annotations the server declares

    • title: AST-Audited Ephemeral Python Code Execution Sandbox
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • extract_structured_json_entitiesExtracts structured JSON records, named entities, dates, and financial figures from unstructured prose, emails, or HTML/Markdown dumps.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Extracts structured JSON records, named entities, dates, and financial figures from unstructured prose, emails, or HTML/Markdown dumps. Use when converting unstructured natural-language text into a structured JSON array of entities; for validating and coercing an existing JSON payload against a formal JSON Schema, use enforce_json_schema_types instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'text' ('extraction_target' defaults to 'general_entities_and_metrics'), supports '?demo=true' or L402 (150 sats), and returns HTTP 400 if invalid.

    Annotations the server declares

    • title: Unstructured Text to Typed JSON Entity & Record Extractor
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • generate_boundary_test_vectorsSynthesizes deterministic unit-test vectors from a JSON Schema or function signature covering valid equivalence partitions, numeric/length boundaries, and adversarial Unicode/null …1 finding

    Why it is in this group

    • The name "generate_boundary_test_vectors" says "generate": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "generate_boundary_test_vectors" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "generate_boundary_test_vectors" says "generate": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Synthesizes deterministic unit-test vectors from a JSON Schema or function signature covering valid equivalence partitions, numeric/length boundaries, and adversarial Unicode/null inputs. Use when generating exhaustive edge-case unit test payloads and fuzz vectors for an API endpoint or function; for healing and applying unified diffs or search/replace edits to source code, use apply_fuzzy_code_patch instead. Read-only edge call (32 KB, 60 RPM): accepts 'schema_or_signature_json' (with enum defaults), uses '?demo=true' or L402 (65 sats); HTTP 400 if invalid.

    Annotations the server declares

    • title: JSON Schema & Function Signature Boundary-Value Test Vector Generator
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • generate_gemini_completionGenerates text completions and structured reasoning across all 45 Google Gemini foundation models (Gemini 4 Argon, 3.1 Pro, 3.8 Flash) with zero Google account or API key required.1 finding

    Why it is in this group

    • The name "generate_gemini_completion" says "generate": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "generate_gemini_completion" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "generate_gemini_completion" says "generate": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Generates text completions and structured reasoning across all 45 Google Gemini foundation models (Gemini 4 Argon, 3.1 Pro, 3.8 Flash) with zero Google account or API key required. Use when running single-turn reasoning, coding, or analytical prompts on a specific Gemini model; for delegating multi-step autonomous tasks that require remote tool execution, use execute_antigravity_agent instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'prompt' ('model' defaults to 'gemini-4-argon'), supports '?demo=true' or L402 (250 sats), and returns HTTP 400 if invalid.

    Annotations the server declares

    • title: Account-Less Google Gemini 4 Argon & 3.1 Pro Universal Text Generator
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • generate_gemini_embeddingsGenerates normalized 3,072-dimensional or 768-dimensional semantic vector embeddings via Google Gemini Embedding 2 for RAG indexing and cosine-similarity search.1 finding

    Why it is in this group

    • The name "generate_gemini_embeddings" says "generate": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "generate_gemini_embeddings" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "generate_gemini_embeddings" says "generate": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Generates normalized 3,072-dimensional or 768-dimensional semantic vector embeddings via Google Gemini Embedding 2 for RAG indexing and cosine-similarity search. Use when embedding text passages or queries via L402 Lightning with configurable Matryoshka dimensions; for running live Google Search grounded factual queries, use search_gemini_grounded_web instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'text' ('model' defaults to 'gemini-embedding-2'), supports '?demo=true' or L402 (50 sats), and returns HTTP 400 if invalid.

    Annotations the server declares

    • title: Gemini Embedding 2 High-Dimensional (3,072-D) Vector Generator
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • generate_nano_banana_imageGenerates photorealistic illustrations, UI mockups, and technical diagrams from text prompts using the Nano Banana Pro (Gemini 2.5 Flash Image) model family.1 finding

    Why it is in this group

    • The name "generate_nano_banana_image" says "generate": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "generate_nano_banana_image" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "generate_nano_banana_image" says "generate": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Generates photorealistic illustrations, UI mockups, and technical diagrams from text prompts using the Nano Banana Pro (Gemini 2.5 Flash Image) model family. Use when creating static visual assets, icons, or architecture diagrams from text descriptions; for synthesizing animated multi-second video clips with motion, use generate_veo_cinematic_video instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'prompt' ('aspect_ratio' defaults to '1:1'), supports '?demo=true' or L402 (350 sats), and returns HTTP 400 if invalid.

    Annotations the server declares

    • title: Nano Banana Pro (Gemini Image) Visual Asset & Diagram Generator
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • generate_veo_cinematic_videoSynthesizes high-definition cinematic video sequences with temporally coherent camera motion and physics using Google Veo 3.1 finding

    Why it is in this group

    • The name "generate_veo_cinematic_video" says "generate": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "generate_veo_cinematic_video" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "generate_veo_cinematic_video" says "generate": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Synthesizes high-definition cinematic video sequences with temporally coherent camera motion and physics using Google Veo 3. Use when generating moving video clips, product B-roll, or animated scene renders from text prompts; for rendering static single-frame images or diagrams at lower cost, use generate_nano_banana_image instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'prompt' ('motion_style' defaults to 'static_tripod'), supports '?demo=true' or L402 (1500 sats), and returns HTTP 400 if invalid.

    Annotations the server declares

    • title: Google Veo 3 High-Definition Cinematic Video Generator
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • generate_x402_vector_embeddingsGenerates normalized high-dimensional semantic vector embeddings settled via Solana SPL USDC ('x402' protocol headers) for decentralized RAG pipelines.1 finding

    Why it is in this group

    • The name "generate_x402_vector_embeddings" says "generate": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "generate_x402_vector_embeddings" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "generate_x402_vector_embeddings" says "generate": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Generates normalized high-dimensional semantic vector embeddings settled via Solana SPL USDC ('x402' protocol headers) for decentralized RAG pipelines. Use when computing text embeddings paid via Solana USDC x402 signatures rather than Bitcoin Lightning; for extracting discrete JSON entities from unstructured text, use extract_structured_json_entities instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'text' ('encoding_format' defaults to 'float_array'), supports '?demo=true' or x402 (100 sats), and returns HTTP 400 if invalid.

    Annotations the server declares

    • title: Solana x402 USDC-Settled Semantic Vector Embedding Generator
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • heal_malformed_jsonDeterministic JSON syntax repair: normalizes quotes, unclosed brackets, and boolean literals into compliant RFC 8259 JSON structure without data deletion.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Deterministic JSON syntax repair: normalizes quotes, unclosed brackets, and boolean literals into compliant RFC 8259 JSON structure without data deletion. Use when fixing syntax-broken JSON strings that fail JSON.parse(); for coercing field types and verifying properties on already-parseable JSON objects against a target JSON Schema, use enforce_json_schema_types instead. Read-only edge call (32 KB, 60 RPM): accepts 'malformed_json' (with enum defaults), uses '?demo=true' or L402 (50 sats); HTTP 400 if invalid.

    Annotations the server declares

    • title: Deterministic Malformed JSON Syntax & Truncation Healer
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • infer_mpp_streaming_sessionInitializes a Base USDC Machine Payments Protocol (MPP) metered inference session, allocating a streaming token quota and returning a step-by-step execution plan.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Initializes a Base USDC Machine Payments Protocol (MPP) metered inference session, allocating a streaming token quota and returning a step-by-step execution plan. Use when running session-metered agent planning settled via Base EVM MPP 'Payment-Challenge' headers; for mapping a task goal to L402 MCP tool calls without opening an MPP streaming session, use route_mcp_workflow_plan instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'task' ('token_quota_tier' defaults to 'compact_1024'), supports '?demo=true' or MPP (500 sats), and returns HTTP 400 if invalid.

    Annotations the server declares

    • title: Base EVM Machine Payments Protocol (MPP) Streaming Session Planner
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • isolate_stacktrace_root_causeParses noisy CI/terminal logs and multi-language stack traces (Node/TS, Python, Rust, Go), strips node_modules/stdlib frames to isolate the innermost failing user-code frame, and c…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Parses noisy CI/terminal logs and multi-language stack traces (Node/TS, Python, Rust, Go), strips node_modules/stdlib frames to isolate the innermost failing user-code frame, and clusters repetitive logs into Drain templates. Use when triage-debugging test failures, crash dumps, or repetitive server error logs; for compressing general source code files or prose transcripts, use prune_context_skeleton instead. Read-only edge call (32 KB, 60 RPM): accepts 'raw_log' ('runtime_hint' defaults to 'auto_detect'), supports '?demo=true' or L402 (50 sats), and returns HTTP 400 if invalid.

    Annotations the server declares

    • title: Stack-Trace Root-Cause Frame Isolator & Drain Log Deduplicator
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • operate_computer_use_agentPlans and executes OS-level desktop, browser DOM, and GUI coordinate actions (click, type, scroll, wait) using the Gemini Computer Use agent.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Plans and executes OS-level desktop, browser DOM, and GUI coordinate actions (click, type, scroll, wait) using the Gemini Computer Use agent. Use when automating interactive web UIs or desktop workflows that lack a direct REST API; for running code-first API and terminal automation tasks, use execute_antigravity_agent instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'input' ('viewport_preset' defaults to 'desktop_1080p'), supports '?demo=true' or L402 (800 sats), and returns HTTP 400 if invalid.

    Annotations the server declares

    • title: Gemini Computer Use GUI & Browser Action Planner
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • plan_robotics_spatial_trajectoryComputes 3D spatial affordances, obstacle-avoidance waypoints, and manipulator grasp sequences using Gemini Robotics ER 2 embodied reasoning.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Computes 3D spatial affordances, obstacle-avoidance waypoints, and manipulator grasp sequences using Gemini Robotics ER 2 embodied reasoning. Use when planning physical robot arm kinematics, mobile navigation waypoints, or spatial scene task orders; for interacting with 2D desktop or browser GUI screens, use operate_computer_use_agent instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'prompt' ('coordinate_frame' defaults to 'cartesian_xyz_meters'), supports '?demo=true' or L402 (450 sats), and returns HTTP 400 if invalid.

    Annotations the server declares

    • title: Gemini Robotics ER 2 Embodied Spatial & Kinematics Trajectory Planner
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • process_live_audio_dialogueProcesses real-time conversational dialog turns with native acoustic emotion, interruption handling, and paralinguistic cue comprehension via Gemini 3.8 Live.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Processes real-time conversational dialog turns with native acoustic emotion, interruption handling, and paralinguistic cue comprehension via Gemini 3.8 Live. Use when handling interactive voice-agent dialog turns that require tone and turn-taking awareness; for performing one-way text-to-speech readout of a static text string, use synthesize_gemini_speech_audio instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'input' ('response_tone' defaults to 'direct_peer'), supports '?demo=true' or L402 (300 sats), and returns HTTP 400 if invalid.

    Annotations the server declares

    • title: Gemini 3.8 Live Native Audio-to-Audio Conversational Processor
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • prune_context_skeletonCompresses large source files, logs, or transcripts by 50–80% to fit an LLM context budget while preserving 100% of function/class/type signatures, imports, error frames, and query…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Compresses large source files, logs, or transcripts by 50–80% to fit an LLM context budget while preserving 100% of function/class/type signatures, imports, error frames, and query-matched lines. Use when shrinking oversized source files or logs before feeding them into an LLM prompt; for counting BPE tokens across prompt segments and calculating multi-model inference costs without altering text, use plan_context_token_budget instead. Read-only edge call (32 KB, 60 RPM): accepts 'content' (with enum defaults), uses '?demo=true' or L402 (50 sats); HTTP 400 if invalid.

    Annotations the server declares

    • title: AST-Aware Context Window & Source Code Skeleton Pruner
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • redact_sensitive_piiRedacts emails, phone numbers, SSNs, credit cards, API keys, and crypto private keys from text before logging or external transmission.3 findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Info

      The title mentions "Credential".

      Matched text

      title: "Zero-PII & Secret Credential Redaction Engine"

      What this check looks for
    • Info

      The annotations title mentions "Credential".

      Matched text

      annotations.title: "Zero-PII & Secret Credential Redaction Engine"

      What this check looks for
    • Info

      The description mentions "credentials".

      Matched text

      description: "...when stripping personal data or secret credentials from prompts, logs, or outbound message..."

      What this check looks for
    Description, as the server wrote it
    Redacts emails, phone numbers, SSNs, credit cards, API keys, and crypto private keys from text before logging or external transmission. Use when stripping personal data or secret credentials from prompts, logs, or outbound messages; for neutralizing indirect prompt injections and invisible Unicode in inbound tool responses, use sanitize_tool_output_stream instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'text' ('redaction_style' defaults to 'typed_token'), supports '?demo=true' or L402 (150 sats), and returns HTTP 400 if invalid.

    Annotations the server declares

    • title: Zero-PII & Secret Credential Redaction Engine
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • rerank_hybrid_rag_chunksReranks and deduplicates candidate RAG or retrieval passages against a search prompt using Okapi BM25 (k1=1.5, b=0.75), Reciprocal Rank Fusion (RRF), and Maximal Marginal Relevance…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Reranks and deduplicates candidate RAG or retrieval passages against a search prompt using Okapi BM25 (k1=1.5, b=0.75), Reciprocal Rank Fusion (RRF), and Maximal Marginal Relevance (MMR) Jaccard diversity filtering. Use when selecting the top-K highest-signal, non-redundant passages from vector search or grep results; for compressing a single contiguous source file while keeping its original line order, use prune_context_skeleton instead. Read-only edge call (32 KB, 60 RPM): accepts 'search_prompt' ('documents_json' defaults to 'standard'), uses '?demo=true' or L402 (50 sats); HTTP 400 if invalid.

    Annotations the server declares

    • title: Okapi BM25 + Reciprocal Rank Fusion (RRF) + MMR Chunk Reranker
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • route_mcp_workflow_planMaps a natural-language agent goal to an ordered sequence of Diogenes MCP tool calls with exact endpoint paths, JSON-RPC 2.0 payloads, and cumulative satoshi cost estimates.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Maps a natural-language agent goal to an ordered sequence of Diogenes MCP tool calls with exact endpoint paths, JSON-RPC 2.0 payloads, and cumulative satoshi cost estimates. Use when planning which MCP tools to chain together to solve a multi-step objective within a satoshi budget; for compiling a static XML system prompt rather than an executable MCP tool call sequence, use compile_xml_agent_prompt instead. Read-only edge call (32 KB, 60 RPM): accepts 'objective' ('budget_preference' defaults to 'lowest_sats_deterministic'), uses '?demo=true' or L402 (100 sats); HTTP 400 if invalid.

    Annotations the server declares

    • title: Autonomous Goal-to-MCP Tool Sequence Router & Cost Planner
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • sanitize_tool_output_streamSanitizes untrusted external tool or web-scrape outputs by stripping invisible Unicode Tag characters (U+E0000), neutralizing Markdown tracking image beacons, and defusing indirect…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Sanitizes untrusted external tool or web-scrape outputs by stripping invisible Unicode Tag characters (U+E0000), neutralizing Markdown tracking image beacons, and defusing indirect prompt overrides. Use when cleaning raw third-party tool outputs or scraped web text before inserting it into the LLM context window; for redacting personal identifiable information (emails, SSNs, keys) from outbound text, use redact_sensitive_pii instead. Read-only edge call (32 KB, 60 RPM): accepts 'raw_tool_output' (with enum defaults), uses '?demo=true' or L402 (75 sats); HTTP 400 if invalid.

    Annotations the server declares

    • title: Indirect Prompt-Injection, Invisible Unicode & Beacon Output Scrubber
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • scan_solana_cpi_reentrancyScans Solana Anchor and native Rust program instructions for unverified Cross-Program Invocation (CPI) program IDs, missing signer checks, and PDA bump seed canonicalization bugs.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Scans Solana Anchor and native Rust program instructions for unverified Cross-Program Invocation (CPI) program IDs, missing signer checks, and PDA bump seed canonicalization bugs. Use when auditing Solana Rust/Anchor source code or instruction account structs for CPI privilege escalation; for checking live SPL token mint/freeze authorities and rug-pull risk by mint address, use evaluate_solana_token_risk instead. Read-only edge call (32 KB, 60 RPM): accepts 'rust_source_or_idl' ('framework' defaults to 'anchor'), uses '?demo=true' or L402 (160 sats); HTTP 400 if invalid.

    Annotations the server declares

    • title: Solana Anchor & Rust Cross-Program Invocation (CPI) Vulnerability Scanner
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • schedule_critical_path_tasksSolves a task dependency DAG via the Critical Path Method (CPM) to compute ES/EF/LS/LF, Total Float/Slack, optimal makespan, and the Critical Path.1 finding

    Why it is in this group

    • The name "schedule_critical_path_tasks" says "schedule": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "schedule_critical_path_tasks" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "schedule_critical_path_tasks" says "schedule": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Solves a task dependency DAG via the Critical Path Method (CPM) to compute ES/EF/LS/LF, Total Float/Slack, optimal makespan, and the Critical Path. Use when scheduling dependent engineering milestones or workflow steps to find the minimum project duration and zero-slack bottleneck path; for detecting circular code imports and file blast radius without task durations, use audit_module_dependency_cycles instead. Read-only edge call (32 KB, 60 RPM): accepts 'tasks_json' ('time_unit' defaults to 'minutes'), supports '?demo=true' or L402 (80 sats), and returns HTTP 400 if invalid.

    Annotations the server declares

    • title: Critical Path Method (CPM) DAG & Resource Constraint Scheduler
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • search_gemini_grounded_mapsExecutes geospatial and point-of-interest queries grounded in live Google Maps data, returning verified addresses, coordinates, operating hours, and spatial context.1 finding

    Why it is in this group

    • The name "search_gemini_grounded_maps" says "search": a word for reading.
    • The description's first verb is "execute": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "search_gemini_grounded_maps" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "search_gemini_grounded_maps" says "search": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Executes geospatial and point-of-interest queries grounded in live Google Maps data, returning verified addresses, coordinates, operating hours, and spatial context. Use when resolving physical locations, venues, transit distances, or regional infrastructure data; for searching general web articles, documentation, and news, use search_gemini_grounded_web instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'prompt' ('distance_units' defaults to 'metric_km'), supports '?demo=true' or L402 (250 sats), and returns HTTP 400 if invalid.

    Annotations the server declares

    • title: Google Maps Grounded Geospatial & Place Intelligence Engine
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • simulate_evm_transaction_calldataDecodes raw EVM hexadecimal transaction calldata (0x...) by 4-byte function selector to expose hidden ERC-20 approve/transferFrom calls, setApprovalForAll drains, and multicall bun…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Decodes raw EVM hexadecimal transaction calldata (0x...) by 4-byte function selector to expose hidden ERC-20 approve/transferFrom calls, setApprovalForAll drains, and multicall bundles. Use when auditing raw hex transaction data (to, value, data) before broadcasting an on-chain EVM transaction; for inspecting off-chain EIP-712 JSON typed-data signatures, use decode_eip712_permit_signature instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'calldata_hex' ('network' defaults to 'base_mainnet'), supports '?demo=true' or L402 (90 sats), and returns HTTP 400 if invalid.

    Annotations the server declares

    • title: Pre-Sign EVM Hex Calldata Selector Decoder & Drain Simulator
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • simulate_monte_carlo_riskRuns a reproducible seeded Mulberry32 Monte Carlo simulation over uncertain cost, latency, or duration variables to compute P10/P50/P90/P95 percentiles, Value-at-Risk (VaR), and CV…1 finding

    Why it is in this group

    • The description's first verb is "run": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "simulate_monte_carlo_risk" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "run": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Runs a reproducible seeded Mulberry32 Monte Carlo simulation over uncertain cost, latency, or duration variables to compute P10/P50/P90/P95 percentiles, Value-at-Risk (VaR), and CVaR. Use when modeling stochastic uncertainty, tail risk (VaR/CVaR), and probability of meeting a budget or SLA target; for evaluating deterministic single-point algebraic formulas or exact NPV/IRR cashflows, use evaluate_deterministic_math instead. Read-only edge call (32 KB, 60 RPM): accepts 'variables_json' (with enum defaults), uses '?demo=true' or L402 (70 sats); HTTP 400 if invalid.

    Annotations the server declares

    • title: Seeded Mulberry32 Monte Carlo Percentile, VaR & Tail-Risk Simulator
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • synthesize_gemini_speech_audioConverts written text into natural, prosody-controlled spoken voice audio using Gemini 3.8 Flash Neural Text-to-Speech.1 finding

    Why it is in this group

    • The description's first verb is "convert": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "synthesize_gemini_speech_audio" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "convert": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Converts written text into natural, prosody-controlled spoken voice audio using Gemini 3.8 Flash Neural Text-to-Speech. Use when rendering voiceover narration or spoken agent replies from a deterministic text script; for conducting bidirectional conversational audio dialog comprehension, use process_live_audio_dialogue instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'text' ('voice_persona' defaults to 'neutral_broadcast'), supports '?demo=true' or L402 (200 sats), and returns HTTP 400 if invalid.

    Annotations the server declares

    • title: Gemini Neural Text-to-Speech (TTS) Expressive Voice Synthesizer
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • synthesize_python_automation_codeSynthesizes PEP 8 compliant, self-contained Python 3 scripts, data parsers, and CLI utilities complete with type hints, docstrings, and inline assertion tests.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Synthesizes PEP 8 compliant, self-contained Python 3 scripts, data parsers, and CLI utilities complete with type hints, docstrings, and inline assertion tests. Use when generating a standalone Python automation script or parser from a functional specification; for summarizing existing documentation or codebases into executive bullet points, use summarize_technical_document instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'prompt' ('dependency_policy' defaults to 'stdlib_only'), supports '?demo=true' or L402 (300 sats), and returns HTTP 400 if invalid.

    Annotations the server declares

    • title: Self-Contained Python Script, CLI & Parser Code Synthesizer
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • synthesize_safe_regexSynthesizes linear-time O(n) regular expressions free of catastrophic backtracking (ReDoS) and validates them against positive and negative test strings.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Synthesizes linear-time O(n) regular expressions free of catastrophic backtracking (ReDoS) and validates them against positive and negative test strings. Use when generating and verifying a regular expression pattern for input validation or lexical parsing; for repairing broken JSON syntax directly without writing custom regexes, use heal_malformed_json instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'description' ('flavor' defaults to 'ecmascript_js'), supports '?demo=true' or L402 (50 sats), and returns HTTP 400 if invalid.

    Annotations the server declares

    • title: Linear-Time O(n) ReDoS-Safe Regular Expression Synthesizer & Tester
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • synthesize_web_intelligence_briefSynthesizes a real-time market or technical intelligence brief grounded in live Google Search, returning strict JSON ('executive_summary', 'key_developments', 'sentiment', 'sources…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Synthesizes a real-time market or technical intelligence brief grounded in live Google Search, returning strict JSON ('executive_summary', 'key_developments', 'sentiment', 'sources'). Use when fetching a structured JSON market/news brief with live web citations and sentiment classification; for summarizing caller-supplied text offline without live web search, use summarize_technical_document instead. Read-only edge call (32 KB, 60 RPM): accepts 'topic' ('focus' defaults to 'technical_and_market_catalysts'), supports '?demo=true' or L402 (200 sats), and returns HTTP 400 if invalid.

    Annotations the server declares

    • title: Real-Time Google Search Grounded JSON Market Intelligence Brief
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • track_solana_whale_flowsTracks 24-hour net accumulation or distribution flows across top Solana whale wallets and flags coordinated insider wallet clusters for a given SPL token.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Tracks 24-hour net accumulation or distribution flows across top Solana whale wallets and flags coordinated insider wallet clusters for a given SPL token. Use when analyzing on-chain smart-money order flow and holder clustering on Solana; for checking static SPL contract mint/freeze authority permissions, use evaluate_solana_token_risk instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'token' ('window' defaults to '1h'), supports '?demo=true' or x402 (500 sats), and returns HTTP 400 if invalid.

    Annotations the server declares

    • title: Solana Whale Wallet Net-Flow & Insider Cluster Tracker
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • verify_a2a_agent_cardVerifies a remote agent's A2A /.well-known/agent.json discovery card, checking JWS/DID signature binding, endpoint HTTPS enforcement, and capability spoofing.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Verifies a remote agent's A2A /.well-known/agent.json discovery card, checking JWS/DID signature binding, endpoint HTTPS enforcement, and capability spoofing. Use when authenticating a peer autonomous agent before delegating subtasks or exchanging payments over A2A; for auditing an MCP tool server's tools/list manifest rather than a peer agent's A2A card, use audit_mcp_server_manifest instead. Read-only edge call (32 KB, 60 RPM): accepts 'agent_card_json' ('trust_policy' defaults to 'require_https_and_did'), supports '?demo=true' or L402 (90 sats), and returns HTTP 400 if invalid.

    Annotations the server declares

    • title: A2A /.well-known/agent.json Identity & Capability Card Verifier
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • verify_agent_command_safetyEvaluates untrusted agent prompts, bash commands, and tool arguments to block prompt injection, destructive shell commands, and private-key exfiltration.1 finding

    Why it is in this group

    • The description's first verb is "evaluate": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "verify_agent_command_safety" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "evaluate": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Evaluates untrusted agent prompts, bash commands, and tool arguments to block prompt injection, destructive shell commands, and private-key exfiltration. Use when screening a general shell command or user prompt before agent execution; for statically validating SQL database queries at the AST level, use validate_sql_query_ast instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'payload' ('action_type' defaults to 'bash_command'), supports '?demo=true' or L402 (100 sats), and returns HTTP 400 if invalid.

    Annotations the server declares

    • title: Autonomous Agent Pre-Execution Command & Prompt Injection Gate
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • verify_context_compaction_fidelityAudits a compacted conversation summary against the original full context to detect dropped user constraints, lost file paths, altered numbers, or missing pending tasks.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Audits a compacted conversation summary against the original full context to detect dropped user constraints, lost file paths, altered numbers, or missing pending tasks. Use when verifying that an LLM context-compaction summary retained all task-critical facts before truncating history; for generating a new executive summary from a raw technical document, use summarize_technical_document instead. Read-only edge call (32 KB, 60 RPM): accepts 'original_context' ('compacted_summary' defaults to 'standard'), supports '?demo=true' or L402 (90 sats), and returns HTTP 400 if invalid.

    Annotations the server declares

    • title: Pre/Post Context Compaction Information Retention Verifier
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
Only reads 14Claude Code: allow
  • analyze_omni_multimodal_inputAnalyzes combined multimodal prompts spanning text, image descriptors, audio transcripts, and video temporal events using Gemini Omni Flash.No findings

    Why it is in this group

    • The name "analyze_omni_multimodal_input" says "analyze": a word for reading.
    Description, as the server wrote it
    Analyzes combined multimodal prompts spanning text, image descriptors, audio transcripts, and video temporal events using Gemini Omni Flash. Use when correlating information across multiple media modalities in a single reasoning pass; for running pure text-only reasoning or coding prompts, use generate_gemini_completion instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'input' ('modality_focus' defaults to 'cross_modal_synthesis'), supports '?demo=true' or L402 (300 sats), and returns HTTP 400 if invalid.

    Annotations the server declares

    • title: Gemini Omni Unified Text, Audio & Video Multimodal Analyzer
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • compare_crosschain_bridge_routesCompares non-custodial, non-KYC cross-chain swap routes (THORChain native L1 swaps, Maya Protocol, Blockstream Liquid) by basis-point fee, net output sats, and settlement time.No findings

    Why it is in this group

    • The name "compare_crosschain_bridge_routes" says "compare": a word for reading.
    Description, as the server wrote it
    Compares non-custodial, non-KYC cross-chain swap routes (THORChain native L1 swaps, Maya Protocol, Blockstream Liquid) by basis-point fee, net output sats, and settlement time. Use when routing cross-chain treasury settlements (e.g. Solana USDC or Base ETH into native Bitcoin); for calculating mid-market spot exchange rates without bridge routing fees, use calculate_spot_swap_rate instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'from_asset' ('to_asset' defaults to 'BTC_NATIVE'), supports '?demo=true' or L402 (100 sats), and returns HTTP 400 if invalid.

    Annotations the server declares

    • title: Non-KYC Cross-Chain Bridge Route & Settlement Fee Comparator
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • detect_address_poisoning_scamCompares a target recipient wallet address against recent transaction history to detect vanity prefix/suffix lookalike spoofing and zero-value dusting attacks.No findings

    Why it is in this group

    • The description's first verb is "compare": a word for reading.
    Description, as the server wrote it
    Compares a target recipient wallet address against recent transaction history to detect vanity prefix/suffix lookalike spoofing and zero-value dusting attacks. Use when verifying a recipient EVM or Solana wallet address before sending funds; for decoding hex smart contract calldata payloads, use simulate_evm_transaction_calldata instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'target_address' ('address_standard' defaults to 'auto_detect'), supports '?demo=true' or L402 (100 sats), and returns HTTP 400 if invalid.

    Annotations the server declares

    • title: Counterparty Address Poisoning & Vanity Prefix/Suffix Spoof Detector
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • detect_agent_action_loopAnalyzes an agent's recent tool-call trace to detect identical retry spins, A/B state oscillation, and runaway token burn.No findings

    Why it is in this group

    • The description's first verb is "analyze": a word for reading.
    Description, as the server wrote it
    Analyzes an agent's recent tool-call trace to detect identical retry spins, A/B state oscillation, and runaway token burn. Use when monitoring multi-step agent execution loops to decide whether to continue or halt and escalate; for inspecting a single command payload for security threats before execution, use verify_agent_command_safety instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'action_trace_json' ('sensitivity' defaults to 'strict_2_repeats'), supports '?demo=true' or L402 (70 sats), and returns HTTP 400 if invalid.

    Annotations the server declares

    • title: Autonomous Agent Action-Trace Loop & Token-Burn Circuit Breaker
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • detect_openapi_breaking_changesCompares baseline and candidate OpenAPI 3.1 specs, JSON Schemas, or MCP tool manifests to detect breaking changes (removed fields, new required inputs, narrowed enums, type mutatio…No findings

    Why it is in this group

    • The description's first verb is "compare": a word for reading.
    Description, as the server wrote it
    Compares baseline and candidate OpenAPI 3.1 specs, JSON Schemas, or MCP tool manifests to detect breaking changes (removed fields, new required inputs, narrowed enums, type mutations). Use when auditing API, JSON Schema, or MCP contract revisions for backward compatibility before deployment; for compiling new TypeScript, Zod, and Pydantic schemas from a single sample JSON payload, use compile_polyglot_type_schemas instead. Read-only edge call (32 KB, 60 RPM): accepts 'baseline_schema_json' (with enum defaults), uses '?demo=true' or L402 (75 sats); HTTP 400 if invalid.

    Annotations the server declares

    • title: OpenAPI 3.1, JSON Schema & MCP Contract Breaking-Change Detector
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • diff_agent_memory_checkpointComputes structural diffs between two agent state snapshots ('added_keys', 'mutated_keys', 'removed_keys'), flags boolean belief contradictions, generates an RFC 7396 JSON Merge Pa…No findings

    Why it is in this group

    • The name "diff_agent_memory_checkpoint" says "diff": a word for reading.
    Description, as the server wrote it
    Computes structural diffs between two agent state snapshots ('added_keys', 'mutated_keys', 'removed_keys'), flags boolean belief contradictions, generates an RFC 7396 JSON Merge Patch delta, and computes a canonical checkpoint hash. Use when checkpointing agent state or transmitting minimal RFC 7396 state deltas across multi-agent handoffs; for counting BPE tokens and auditing Lost-in-the-Middle prompt attention, use plan_context_token_budget instead. Read-only call (32 KB, 60 RPM): accepts 'previous_state_json' (with enum defaults), uses '?demo=true' or L402 (50 sats); HTTP 400 if invalid.

    Annotations the server declares

    • title: Agent State Graph Differ, Belief Conflict Resolver & SHA-256 Hasher
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • estimate_bitcoin_mempool_feesFetches real-time Bitcoin mainnet mempool feerate recommendations in satoshis per virtual byte (sat/vB) across fastest, half-hour, hour, and economy confirmation tiers.No findings

    Why it is in this group

    • The description's first verb is "fetch": a word for reading.
    Description, as the server wrote it
    Fetches real-time Bitcoin mainnet mempool feerate recommendations in satoshis per virtual byte (sat/vB) across fastest, half-hour, hour, and economy confirmation tiers. Use when checking current Bitcoin L1 network congestion before broadcasting an on-chain BTC transaction; for calculating exact SegWit/Taproot UTXO batch consolidation vByte weights and dust thresholds, use plan_bitcoin_utxo_consolidation instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'confirmation_target', supports '?demo=true' or L402 (50 sats), and returns HTTP 400 if invalid.

    Annotations the server declares

    • title: Bitcoin Mainnet Mempool Feerate Estimator (sat/vB)
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • inspect_solana_token_liquidityRetrieves canonical Solana SPL token metadata including name, ticker symbol, decimal precision, and current mint/freeze authority addresses.1 finding

    Why it is in this group

    • The name "inspect_solana_token_liquidity" says "inspect": a word for reading.

    Findings

    • Warn

      The input schema at properties.mint.description contains a 44-character base64 string.

      Matched text

      inputSchema.properties.mint.description: "...mint address (e.g. 'EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v')."

      What this check looks for
    Description, as the server wrote it
    Retrieves canonical Solana SPL token metadata including name, ticker symbol, decimal precision, and current mint/freeze authority addresses. Use when resolving SPL token decimals, ticker symbols, and registry metadata for portfolio or swap formatting; for computing a composite security risk score and binary should_transact verdict, use evaluate_solana_token_risk instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'mint' ('network' defaults to 'mainnet-beta'), supports '?demo=true' or x402 (200 sats), and returns HTTP 400 if invalid.

    Annotations the server declares

    • title: Solana SPL Token Metadata, Decimals & Authority Registry Lookup
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • plan_bitcoin_utxo_consolidationAnalyzes a set of Bitcoin UTXO balances in satoshis to compute exact vByte transaction weight, identify uneconomical dust inputs, and recommend whether to consolidate now or hold.No findings

    Why it is in this group

    • The description's first verb is "analyze": a word for reading.
    Description, as the server wrote it
    Analyzes a set of Bitcoin UTXO balances in satoshis to compute exact vByte transaction weight, identify uneconomical dust inputs, and recommend whether to consolidate now or hold. Use when optimizing on-chain Bitcoin treasury UTXO sets to minimize long-term miner fee drag; for fetching current live Bitcoin mempool sat/vB feerates alone, use estimate_bitcoin_mempool_fees instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'utxos_sats_json' ('script_type' defaults to 'p2wpkh_segwit'), supports '?demo=true' or L402 (80 sats), and returns HTTP 400 if invalid.

    Annotations the server declares

    • title: Bitcoin SegWit/Taproot UTXO Dust Consolidation & Fee-Window Planner
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • plan_context_token_budgetCounts subword BPE tokens across prompt segments, detects high-priority instructions trapped in the 35%–72% Lost-in-the-Middle attention trough, and calculates USD/satoshi costs ac…No findings

    Why it is in this group

    • The description's first verb is "count": a word for reading.
    Description, as the server wrote it
    Counts subword BPE tokens across prompt segments, detects high-priority instructions trapped in the 35%–72% Lost-in-the-Middle attention trough, and calculates USD/satoshi costs across frontier LLMs. Use when auditing prompt token budgets, reordering prompt sections for primacy/recency attention, or comparing model API costs; for actively compressing and stripping low-salience lines from a single large file, use prune_context_skeleton instead. Read-only edge call (32 KB, 60 RPM): accepts 'segments_json' (with enum defaults), uses '?demo=true' or L402 (30 sats); HTTP 400 if invalid.

    Annotations the server declares

    • title: BPE Token Budget, Attention Trough & Multi-Model Cost Planner
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • search_gemini_grounded_webAnswers factual queries with live Google Search grounding, returning verified up-to-date answers accompanied by source URLs and grounding metadata.No findings

    Why it is in this group

    • The name "search_gemini_grounded_web" says "search": a word for reading.
    Description, as the server wrote it
    Answers factual queries with live Google Search grounding, returning verified up-to-date answers accompanied by source URLs and grounding metadata. Use when verifying live web facts, documentation updates, or current events in a single low-latency call; for querying geographic places, coordinates, directions, and local business data via Google Maps grounding, use search_gemini_grounded_maps instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'prompt' ('recency_bias' defaults to 'past_24h'), supports '?demo=true' or L402 (200 sats), and returns HTTP 400 if invalid.

    Annotations the server declares

    • title: Google Search Grounded Real-Time Fact & Citation Engine
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • summarize_technical_documentCondenses long technical specifications, RFCs, research papers, or meeting transcripts into high-density executive bullet points preserving exact figures and decisions.No findings

    Why it is in this group

    • The name "summarize_technical_document" says "summarize": a word for reading.
    Description, as the server wrote it
    Condenses long technical specifications, RFCs, research papers, or meeting transcripts into high-density executive bullet points preserving exact figures and decisions. Use when producing a human-readable executive summary of a single provided document; for researching a topic across the live web with Google Search citations, use synthesize_web_intelligence_brief instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'text' ('summary_format' defaults to 'executive_bullets'), supports '?demo=true' or L402 (100 sats), and returns HTTP 400 if invalid.

    Annotations the server declares

    • title: High-Density Technical Document & RFC Executive Summarizer
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • validate_mcp_sampling_requestAudits inbound MCP sampling/createMessage callbacks from connected servers to block cross-server context snooping (includeContext='allServers') and token quota hijacking.No findings

    Why it is in this group

    • The name "validate_mcp_sampling_request" says "validate": a word for reading.
    Description, as the server wrote it
    Audits inbound MCP sampling/createMessage callbacks from connected servers to block cross-server context snooping (includeContext='allServers') and token quota hijacking. Use when filtering a connected MCP server's request to sample the host LLM; for scrubbing text returned from a standard synchronous tools/call response, use sanitize_tool_output_stream instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'sampling_request_json' ('max_tokens_ceiling' defaults to '512'), supports '?demo=true' or L402 (100 sats), and returns HTTP 400 if invalid.

    Annotations the server declares

    • title: Inbound MCP sampling/createMessage Reverse-Injection Firewall
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • validate_sql_query_astPerforms static AST syntax tree parsing on SQL statements to verify strictly read-only SELECT clauses and reject mutations, stacked queries, or comment bypasses.No findings

    Why it is in this group

    • The name "validate_sql_query_ast" says "validate": a word for reading.
    Description, as the server wrote it
    Performs static AST syntax tree parsing on SQL statements to verify strictly read-only SELECT clauses and reject mutations, stacked queries, or comment bypasses. Use when verifying that an agent-authored SQL statement is strictly read-only before running it on a database; for screening non-SQL bash commands or general agent prompts, use verify_agent_command_safety instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'sql_statement' ('dialect' defaults to 'postgres'), supports '?demo=true' or L402 (75 sats), and returns HTTP 400 if invalid.

    Annotations the server declares

    • title: AST-Level Read-Only SQL Query & Injection Safety Validator
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.2.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http diogenes-gateway https://diogenes-micro-gateway.corinth.workers.dev/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__diogenes-gateway__validate_sql_query_ast",
      "mcp__diogenes-gateway__validate_mcp_sampling_request",
      "mcp__diogenes-gateway__detect_agent_action_loop",
      "mcp__diogenes-gateway__inspect_solana_token_liquidity",
      "mcp__diogenes-gateway__detect_address_poisoning_scam",
      "mcp__diogenes-gateway__estimate_bitcoin_mempool_fees",
      "mcp__diogenes-gateway__plan_bitcoin_utxo_consolidation",
      "mcp__diogenes-gateway__compare_crosschain_bridge_routes",
      "mcp__diogenes-gateway__search_gemini_grounded_web",
      "mcp__diogenes-gateway__analyze_omni_multimodal_input",
      "mcp__diogenes-gateway__plan_context_token_budget",
      "mcp__diogenes-gateway__detect_openapi_breaking_changes",
      "mcp__diogenes-gateway__diff_agent_memory_checkpoint",
      "mcp__diogenes-gateway__summarize_technical_document"
    ],
    "ask": [
      "mcp__diogenes-gateway__verify_agent_command_safety",
      "mcp__diogenes-gateway__execute_python_sandbox",
      "mcp__diogenes-gateway__audit_mcp_server_manifest",
      "mcp__diogenes-gateway__detect_mcp_schema_rugpull",
      "mcp__diogenes-gateway__sanitize_tool_output_stream",
      "mcp__diogenes-gateway__redact_sensitive_pii",
      "mcp__diogenes-gateway__verify_a2a_agent_card",
      "mcp__diogenes-gateway__audit_outbound_egress_url",
      "mcp__diogenes-gateway__audit_response_factuality",
      "mcp__diogenes-gateway__audit_smart_contract_code",
      "mcp__diogenes-gateway__scan_solana_cpi_reentrancy",
      "mcp__diogenes-gateway__evaluate_solana_token_risk",
      "mcp__diogenes-gateway__track_solana_whale_flows",
      "mcp__diogenes-gateway__estimate_solana_priority_fees",
      "mcp__diogenes-gateway__decode_eip712_permit_signature",
      "mcp__diogenes-gateway__simulate_evm_transaction_calldata",
      "mcp__diogenes-gateway__evaluate_dex_mev_risk",
      "mcp__diogenes-gateway__verify_http402_payment_challenge",
      "mcp__diogenes-gateway__calculate_spot_swap_rate",
      "mcp__diogenes-gateway__generate_gemini_completion",
      "mcp__diogenes-gateway__execute_antigravity_agent",
      "mcp__diogenes-gateway__conduct_deep_research_investigation",
      "mcp__diogenes-gateway__operate_computer_use_agent",
      "mcp__diogenes-gateway__search_gemini_grounded_maps",
      "mcp__diogenes-gateway__compile_mpp_research_dossier",
      "mcp__diogenes-gateway__generate_gemini_embeddings",
      "mcp__diogenes-gateway__plan_robotics_spatial_trajectory",
      "mcp__diogenes-gateway__generate_nano_banana_image",
      "mcp__diogenes-gateway__generate_veo_cinematic_video",
      "mcp__diogenes-gateway__compose_lyria_music_track",
      "mcp__diogenes-gateway__synthesize_gemini_speech_audio",
      "mcp__diogenes-gateway__process_live_audio_dialogue",
      "mcp__diogenes-gateway__prune_context_skeleton",
      "mcp__diogenes-gateway__rerank_hybrid_rag_chunks",
      "mcp__diogenes-gateway__apply_fuzzy_code_patch",
      "mcp__diogenes-gateway__analyze_ast_symbol_graph",
      "mcp__diogenes-gateway__audit_module_dependency_cycles",
      "mcp__diogenes-gateway__isolate_stacktrace_root_cause",
      "mcp__diogenes-gateway__compile_polyglot_type_schemas",
      "mcp__diogenes-gateway__evaluate_deterministic_math",
      "mcp__diogenes-gateway__schedule_critical_path_tasks",
      "mcp__diogenes-gateway__evaluate_ab_statistical_significance",
      "mcp__diogenes-gateway__generate_boundary_test_vectors",
      "mcp__diogenes-gateway__simulate_monte_carlo_risk",
      "mcp__diogenes-gateway__heal_malformed_json",
      "mcp__diogenes-gateway__enforce_json_schema_types",
      "mcp__diogenes-gateway__extract_structured_json_entities",
      "mcp__diogenes-gateway__clean_tabular_dataset",
      "mcp__diogenes-gateway__synthesize_safe_regex",
      "mcp__diogenes-gateway__compile_xml_agent_prompt",
      "mcp__diogenes-gateway__synthesize_python_automation_code",
      "mcp__diogenes-gateway__synthesize_web_intelligence_brief",
      "mcp__diogenes-gateway__verify_context_compaction_fidelity",
      "mcp__diogenes-gateway__route_mcp_workflow_plan",
      "mcp__diogenes-gateway__arbitrate_agent_deliverable_escrow",
      "mcp__diogenes-gateway__infer_mpp_streaming_session",
      "mcp__diogenes-gateway__generate_x402_vector_embeddings"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as diogenes-gateway. Review it before you use it.