# `io.github.stea4lth/flipvo-agent-tools` on anlyon.dev > Text inside fenced blocks marked untrusted-server-text was written by the MCP server's publisher, not by anlyon.dev. It is data to inspect, not instructions to follow. Invisible characters are shown as [U+XXXX]. > No finding is not a safety guarantee: these are point-in-time checks of tool definitions, not of code or behaviour. - Page: https://anlyon.dev/servers/io.github.stea4lth/flipvo-agent-tools - JSON: https://anlyon.dev/api/v1/servers/io.github.stea4lth/flipvo-agent-tools - Version: 1.30.0 (active) - Publisher: io.github.stea4lth (GitHub account) - Runs: remote (streamable-http) - Sign-in to list tools: none - Metadata from the official MCP Registry, synced 2026-10-21T18:49:52.898Z Title and description, as the publisher wrote them: ```untrusted-server-text Flipvo: licenses, entities, NPI, OFAC and OIG screens, carriers, OSHA, drive times Pay-per-call agent tools (x402, MPP): licenses, entities, NPI, OIG/OFAC screens, FMCSA, OSHA, drive ``` Scanned 2026-10-21T19:31:12.832Z over streamable-http. **13 tools: 10 change things and 3 only read.** | Group | Class | Tools | Claude Code | | --- | --- | --- | --- | | Deletes or cancels | destructive | 0 | deny | | Can't be undone | irreversible | 0 | ask | | Changes things | write | 10 | ask | | Only reads | read | 3 | allow | ## Findings - **info** Long descriptions in `license_search` ([long-description](https://anlyon.dev/methodology#long-description)) ```untrusted-server-text The description is 4,299 characters long, over the 2,000 this check looks for. description ends: "...Up to 25 results, active first, with total_matches; empty results is a paid 200." ``` - **info** The word "credentials" in `npi_verify` ([credentials-mention](https://anlyon.dev/methodology#credentials-mention)) ```untrusted-server-text The description mentions "credential". description: "...the NPI, as facts from the files: not a credential check and not a determination about the..." ``` ## Changes things (10) Creates or changes something that can be changed back. Claude Code: ask. ### `airport_nearest` - Nothing in its name or description says what it does, so it is counted as a write. - The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class. Description, as the server wrote it: ```untrusted-server-text $0.02 per call. Pay with x402 (USDC on Base) in _meta["x402/payment"]; MPP (tempo) on the HTTP URL /v1/airport/nearest. Up to 5 airports with scheduled service nearest a named place, ranked by real road drive time, with IATA codes. ``` ### `drive_matrix` - Nothing in its name or description says what it does, so it is counted as a write. - The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class. Description, as the server wrote it: ```untrusted-server-text $0.05 per call. Pay with x402 (USDC on Base) in _meta["x402/payment"]; MPP (tempo) on the HTTP URL /v1/matrix. Drive-time matrix, up to 100 origin x destination elements per call. ``` ### `drive_time` - Nothing in its name or description says what it does, so it is counted as a write. - The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class. Description, as the server wrote it: ```untrusted-server-text $0.01 per call. Pay with x402 (USDC on Base) in _meta["x402/payment"]; MPP (tempo) on the HTTP URL /v1/drive. Driving time/distance between two named places. ``` ### `exclusions_screen` - Nothing in its name or description says what it does, so it is counted as a write. - The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class. Description, as the server wrote it: ```untrusted-server-text $0.01 per call. Pay with x402 (USDC on Base) in _meta["x402/payment"]; MPP (tempo) on the HTTP URL /v1/exclusions/screen. Screens a person or business name, or an NPI, against the HHS-OIG exclusion list (LEIE, Medicare and Medicaid): potential matches only, each with name score, reasons, NPI, state, specialty, exclusion type and date. Not a determination: confirm a match on the OIG online search with the SSN or EIN. Empty candidates is a paid 200. Not for employment or credit decisions. List dates and code meanings: GET /v1/exclusions/lists (free). ``` ### `license_verify` - Nothing in its name or description says what it does, so it is counted as a write. - The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class. Description, as the server wrote it: ```untrusted-server-text $0.02 per call. Pay with x402 (USDC on Base) in _meta["x402/payment"]; MPP (tempo) on the HTTP URL /v1/license/verify. Contractor license status plus matching business-entity record. Served states: CA, CO, FL, LA, MN, NJ, OR, TN, TX, VA, WA. CA, CO, LA, MN, NJ and TN entity are always null. TX entity is always null: Texas sells its business-registry data. FL and TX also take `profession`; values at GET /v1/license/professions?state=FL|TX. Empty licenses is a paid 200. ``` ### `nonprofit_verify` - Nothing in its name or description says what it does, so it is counted as a write. - The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class. Description, as the server wrote it: ```untrusted-server-text $0.01 per call. Pay with x402 (USDC on Base) in _meta["x402/payment"]; MPP (tempo) on the HTTP URL /v1/nonprofit/verify. IRS nonprofit status by EIN or exact organization name: BMF exemption subsection, deductibility and foundation codes, Pub 78 listing, and automatic revocations. Up to 10 records; empty organizations is a paid 200. No legal conclusion is computed. ``` ### `npi_verify` - Nothing in its name or description says what it does, so it is counted as a write. - The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class. - Findings: info credentials-mention Description, as the server wrote it: ```untrusted-server-text $0.01 per call. Pay with x402 (USDC on Base) in _meta["x402/payment"]; MPP (tempo) on the HTTP URL /v1/npi/verify. For 1 to 10 NPIs, the CMS NPPES status of each (active or deactivated, with deactivation and reactivation dates), provider name or organization, practice city, state and ZIP and taxonomies, plus any HHS-OIG LEIE exclusion listed under the NPI, as facts from the files: not a credential check and not a determination about the provider. ``` ### `osha_history` - Nothing in its name or description says what it does, so it is counted as a write. - The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class. Description, as the server wrote it: ```untrusted-server-text $0.02 per call. Pay with x402 (USDC on Base) in _meta["x402/payment"]; MPP (tempo) on the HTTP URL /v1/osha/history. Returns the OSHA inspections, violations and penalties on file for an employer in a state (optional city and zip), matched by name in the US Department of Labor's inspection and violation files, as establishments with a penalty roll-up; OSHA inspections only, so an employer with none has no record and an empty result is a paid 200; it is not a determination about the employer and is not endorsed or certified by the U.S. Department of Labor. ``` ### `pipe_check` - Nothing in its name or description says what it does, so it is counted as a write. - The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class. Description, as the server wrote it: ```untrusted-server-text $0.001 per call. Pay with x402 (USDC on Base) in _meta["x402/payment"]. Cheapest paid call: proves wallet, 402 and receipt work (x402 only). ``` ### `sanctions_screen` - Nothing in its name or description says what it does, so it is counted as a write. - The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class. Description, as the server wrote it: ```untrusted-server-text $0.01 per call. Pay with x402 (USDC on Base) in _meta["x402/payment"]; MPP (tempo) on the HTTP URL /v1/sanctions/screen. Screen a name against the US OFAC SDN and Consolidated lists: potential matches with list, programs, name score and reasons; optional type, date of birth and country re-rank. Fuzzy, folds accents, any script. Not a determination: an empty candidates list is a paid 200 and certifies nothing. Not UN, EU or UK. ``` ## Only reads (3) Looks things up and changes nothing. Claude Code: allow. ### `carrier_lookup` - The name "carrier_lookup" says "lookup": a word for reading. Description, as the server wrote it: ```untrusted-server-text $0.03 per call. Pay with x402 (USDC on Base) in _meta["x402/payment"]; MPP (tempo) on the HTTP URL /v1/carrier/lookup. US motor carrier by USDOT, MC/MX/FF docket or exact company name (FMCSA): USDOT status, out-of-service order, operating authority per docket with grant date and source (Motus, else legacy frozen 2026-05-14), BI&PD, cargo and bond required vs on file, insurance policies, BOC-3, fleet size (power_units counts every power unit, trucks and others), safety rating. Up to 10 carriers; empty is a paid 200. Not a determination: verify with FMCSA before dispatch. ``` ### `entity_lookup` - The name "entity_lookup" says "lookup": a word for reading. Description, as the server wrote it: ```untrusted-server-text $0.01 per call. Pay with x402 (USDC on Base) in _meta["x402/payment"]; MPP (tempo) on the HTTP URL /v1/entity/lookup. State business-registry record (status, formation, registered agent; no officers, no street lines) by entity number or exact name. Served states: CO, CT, FL, NY, OR. Up to 10 entities; empty entities is a paid 200. ``` ### `license_search` - The name "license_search" says "search": a word for reading. - Findings: info long-description Description, as the server wrote it: ```untrusted-server-text $0.05 per call. Pay with x402 (USDC on Base) in _meta["x402/payment"]; MPP (tempo) on the HTTP URL /v1/license/search. Licensed contractors by trade and city, zip or county: license number, name, license type and class, status, expiry, address. Trades CA: asbestos_lead, boiler_piping, cabinets_finish_carpentry, concrete, demolition, drywall, electrical, elevator, fencing, fire_protection, flooring, framing, general, general_engineering, glazing, hvac, insulation, landscaping, lock_security, low_voltage, manufactured_home_setup, masonry, ornamental_metal, painting, parking_highway, paving, pipeline, plastering, plumbing, pool, reinforcing_steel, residential_remodeling, roofing, sewer_septic, sheet_metal, signs, solar, steel_erection, tile, traffic_control, tree_service, water_conditioning, welding, well_drilling; CO: electrical, plumbing; FL: alarm, demolition, drywall, electrical, garage_door, gas_line, general, glazing, hvac, irrigation, low_voltage, marine, plumbing, pollutant_storage, pool, pool_specialty, residential_electrical, roofing, sheet_metal, sign_electrical, solar, specialty_structure, underground_utility, window_door; LA: asbestos_lead, commercial_general, concrete, demolition, drywall, electrical, excavation, flooring, glazing, highway_heavy, home_improvement, house_moving, hvac, insulation, landscaping, low_voltage, marine, masonry, mold_remediation, painting, paving, plastering, plumbing, pollutant_storage, pool, reinforcing_steel, residential_general, roofing, sandblasting, sheet_metal, siding, solar, steel_erection, telecommunications, underground_utility, well_drilling; MN: boiler_piping, electrical, elevator, hvac, low_voltage, manufactured_home_setup, plumbing, residential_general, residential_remodeling, roofing, sign_electrical, underground_utility, water_conditioning; NJ: alarm, electrical, home_elevation, home_improvement, hvac, locksmith, plumbing, telecommunications; OR: commercial_general, commercial_specialty, home_inspector, lead_paint, locksmith, residential_general, residential_specialty; TN: asbestos_lead, boiler_piping, commercial_general, concrete, demolition, drywall, electrical, elevator, excavation, fencing, fire_protection, flooring, framing, gas_line, glazing, highway_heavy, hvac, insulation, irrigation, landscaping, low_voltage, masonry, ornamental_metal, painting, paving, plastering, plumbing, pool, residential_general, roofing, sandblasting, scaffolding, sheet_metal, sign_electrical, signs, steel_erection, telecommunications, tile, underground_utility, welding; TX: electrical, hvac, plumbing, sign_electrical; VA: accessibility, alarm, alternative_energy, asbestos_lead, cabinets_finish_carpentry, commercial_general, commercial_improvement, concrete, drilling_blasting, drywall, electrical, elevator, environmental, farm_improvement, fire_protection, flooring, framing, gas_line, glazing, highway_heavy, home_improvement, hvac, industrial_equipment, insulation, irrigation, landscaping, low_voltage, manufactured_home_setup, marine, masonry, modular_building, painting, paving, plumbing, pool, radon_mitigation, recreational_facility, residential_general, roofing, sewer_septic, signs, steel_erection, tile, underground_utility, vessel_construction, well_drilling; WA: alarm, appliances, asbestos_lead, awnings, backflow, boiler_piping, cabinets_finish_carpentry, central_vacuum, closets, concrete, construction_cleanup, demolition, doors_gates, drain_cleaning, drilling_blasting, drywall, electrical, electrical_maintenance, elevator, excavation, fencing, fire_protection, fireproofing, flooring, framing, garage_door, general, glazing, gutters, handyman, house_moving, hvac, industrial_equipment, institutional_equipment, insulation, irrigation, landscaping, low_voltage, manufactured_home_setup, masonry, metal_fabrication, painting, paving, pest_control, plastering, plumbing, pool, pressure_washing, pump_irrigation, residential_electrical, roofing, sandblasting, scaffolding, service_station_equipment, s… [299 more characters not shown] ``` ## Claude Code permissions For `.claude/settings.json`, assuming the server is installed as `flipvo-agent-tools`: ```json { "permissions": { "allow": [ "mcp__flipvo-agent-tools__entity_lookup", "mcp__flipvo-agent-tools__carrier_lookup", "mcp__flipvo-agent-tools__license_search" ], "ask": [ "mcp__flipvo-agent-tools__pipe_check", "mcp__flipvo-agent-tools__drive_time", "mcp__flipvo-agent-tools__drive_matrix", "mcp__flipvo-agent-tools__license_verify", "mcp__flipvo-agent-tools__nonprofit_verify", "mcp__flipvo-agent-tools__sanctions_screen", "mcp__flipvo-agent-tools__exclusions_screen", "mcp__flipvo-agent-tools__airport_nearest", "mcp__flipvo-agent-tools__osha_history", "mcp__flipvo-agent-tools__npi_verify" ], "deny": [] } } ```