Skip to content

io.github.tacticalnoot/agent-embassy

by tacticalnoot · remote · no sign-in to list tools · v1.0.1 · published by GitHub user tacticalnoot

Agents pay for work and prove it. Verified checks $0.15, recovery $1.00. USDC on Base via x402.

Deletes · 2Changes · 23
CompareRegistry entry

25 tools: 2 can delete or cancel things and 23 change things.

Scanned Oct 21, 2026

4 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http agent-embassy https://agent-embassy.fly.dev/mcp

Findings

Matches of fixed checks, with the text they matched.

4 info
  • Infocheck_url_custom

    The input schema at properties.url.description mentions "credentials".

    Matched text

    inputSchema.properties.url.description: "HTTPS URL to check (max 2000 chars; no credentials in URL). Fetched once; up to 3 redirect..."

    What this check looks for
  • Infocheck_url_sealed

    The input schema at properties.url.description mentions "credentials".

    Matched text

    inputSchema.properties.url.description: "...S URL to prove live (max 2000 chars; no credentials in URL). Fetched once; up to 3 redirect..."

    What this check looks for
  • Infotrust_report

    The input schema at properties.url.description mentions "credentials".

    Matched text

    inputSchema.properties.url.description: "...2 endpoint to probe (max 2000 chars; no credentials in URL). Probed unpaid via GET, falling..."

    What this check looks for
  • Infotrust_assurance

    The input schema at properties.provider_endpoint.description mentions "credentials".

    Matched text

    inputSchema.properties.provider_endpoint.description: "...provider to assess (max 2000 chars; no credentials in URL)"

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

25 tools

Deletes or cancels 2Claude Code: deny
  • agentid_renewRenew an Agent ID: fresh ID, same chain; the old retires.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Renew an Agent ID: fresh ID, same chain; the old retires. Sign like a revocation. validity_days defaults to standard. Retire outright: agentid_revoke. POST the tool inputs as JSON to paid_url with an x402 v2 PAYMENT-SIGNATURE header. See https://docs.cdp.coinbase.com/x402 Paid tool — $0.25, USDC on Base or Arbitrum One. Paid URL: https://aemb.pro/v1/agent-id/renew.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • agentid_revokeRetire an Agent ID instantly, with no successor: sign as the revocation_signature field specifies — who signs, and how.No findings

    Why it is in this group

    • The name "agentid_revoke" says "revoke": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Retire an Agent ID instantly, with no successor: sign as the revocation_signature field specifies — who signs, and how. Fresh ID, same chain: agentid_renew. POST the tool inputs as JSON to paid_url with an x402 v2 PAYMENT-SIGNATURE header. See https://docs.cdp.coinbase.com/x402 Paid tool — $0.25, USDC on Base or Arbitrum One. Paid URL: https://aemb.pro/v1/agent-id/revoke.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
Changes things 23Claude Code: ask
  • agentid_issueIssue an Agent ID: attestation binding a pubkey to a verified principal — unverifiable are refused.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Issue an Agent ID: attestation binding a pubkey to a verified principal — unverifiable are refused. validity_days defaults to standard. Verify: agentid_verify. POST the tool inputs as JSON to paid_url with an x402 v2 PAYMENT-SIGNATURE header. See https://docs.cdp.coinbase.com/x402 Paid tool — $0.25, USDC on Base or Arbitrum One. Paid URL: https://aemb.pro/v1/agent-id/issue.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • agentid_verifyAgent ID state — valid, revoked, expired, or unknown — chain + envelope included.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Agent ID state — valid, revoked, expired, or unknown — chain + envelope included. Unknown IDs: unknown, never error. Issue: agentid_issue; extend: agentid_renew. POST the tool inputs as JSON to paid_url with an x402 v2 PAYMENT-SIGNATURE header. See https://docs.cdp.coinbase.com/x402 Paid tool — $0.25, USDC on Base or Arbitrum One. Paid URL: https://aemb.pro/v1/agent-id/verify.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • attest_documentProve a document existed: send its SHA256 hash — we never see it — for a signed, hash-chained attestation.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Prove a document existed: send its SHA256 hash — we never see it — for a signed, hash-chained attestation. document_name is an optional label. Live URLs: check_url_custom. POST the tool inputs as JSON to paid_url with an x402 v2 PAYMENT-SIGNATURE header. See https://docs.cdp.coinbase.com/x402 Paid tool — $0.25, USDC on Base or Arbitrum One. Paid URL: https://aemb.pro/v1/cert.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • attest_workNotarize work done anywhere: submit evidence; we verify it and mint a signed receipt.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Notarize work done anywhere: submit evidence; we verify it and mint a signed receipt. evidence_urls + evidence_hash optional. Document's existence: attest_document. POST the tool inputs as JSON to paid_url with an x402 v2 PAYMENT-SIGNATURE header. See https://docs.cdp.coinbase.com/x402 Paid tool — $222.00, USDC on Base or Arbitrum One. Paid URL: https://aemb.pro/v1/attest.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • check_url_changes'Tell me when it changes': a standing URL check — receipt and charge only on change.Reads text others writeCan send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    'Tell me when it changes': a standing URL check — receipt and charge only on change. check_interval_hours defaults to 24. One-time check: check_url_custom. POST the tool inputs as JSON to paid_url with an x402 v2 PAYMENT-SIGNATURE header. See https://docs.cdp.coinbase.com/x402 Paid tool — $222.00, USDC on Base or Arbitrum One. Paid URL: https://aemb.pro/v1/watch.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • check_url_customYour conditions, one fetch: status, substring, JSON value — signed pass/fail receipt.Reads text others writeCan send data out1 finding

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.

    Findings

    • Info

      The input schema at properties.url.description mentions "credentials".

      Matched text

      inputSchema.properties.url.description: "HTTPS URL to check (max 2000 chars; no credentials in URL). Fetched once; up to 3 redirect..."

      What this check looks for
    Description, as the server wrote it
    Your conditions, one fetch: status, substring, JSON value — signed pass/fail receipt. Default status 200. Public proof: check_url_sealed. Watch: check_url_changes. POST the tool inputs as JSON to paid_url with an x402 v2 PAYMENT-SIGNATURE header. See https://docs.cdp.coinbase.com/x402 Paid tool — $0.05, USDC on Base or Arbitrum One. Paid URL: https://aemb.pro/v1/check/ping.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • check_url_sealedProof anyone can verify: one fetch, transcript sealed in a signed receipt — HTTP 200 at that moment, fixed at 200.Reads text others writeCan send data out1 finding

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.

    Findings

    • Info

      The input schema at properties.url.description mentions "credentials".

      Matched text

      inputSchema.properties.url.description: "...S URL to prove live (max 2000 chars; no credentials in URL). Fetched once; up to 3 redirect..."

      What this check looks for
    Description, as the server wrote it
    Proof anyone can verify: one fetch, transcript sealed in a signed receipt — HTTP 200 at that moment, fixed at 200. Your own conditions instead: check_url_custom. POST the tool inputs as JSON to paid_url with an x402 v2 PAYMENT-SIGNATURE header. See https://docs.cdp.coinbase.com/x402 Paid tool — $0.25, USDC on Base or Arbitrum One. Paid URL: https://aemb.pro/v1/check/prove.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • compute_alertsGPU price moves that matter: significant spot moves, in a signed receipt.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    GPU price moves that matter: significant spot moves, in a signed receipt. limit defaults to 25. Live snapshot: compute_spot_prices. Past: compute_history. POST the tool inputs as JSON to paid_url with an x402 v2 PAYMENT-SIGNATURE header. See https://docs.cdp.coinbase.com/x402 Paid tool — $0.25, USDC on Base or Arbitrum One. Paid URL: https://aemb.pro/v1/markets/compute/alerts.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • compute_historyGPU market memory: cheapest and median asks per class, in a signed receipt.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    GPU market memory: cheapest and median asks per class, in a signed receipt. limit defaults to 50. Live: compute_spot_prices. Moves: compute_alerts. POST the tool inputs as JSON to paid_url with an x402 v2 PAYMENT-SIGNATURE header. See https://docs.cdp.coinbase.com/x402 Paid tool — $0.25, USDC on Base or Arbitrum One. Paid URL: https://aemb.pro/v1/markets/compute/history.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • compute_spot_pricesGPU asks, not quotes: one timestamped snapshot; asks may vanish.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    GPU asks, not quotes: one timestamped snapshot; asks may vanish. Observes only. Omit gpu = full snapshot; type defaults ondemand. Sealed: compute_spot_sealed. GET the paid_url with an x402 v2 PAYMENT-SIGNATURE header carrying the USDC authorization. Paid tool — $0.25 per snapshot, USDC on Base or Arbitrum One. Paid URL: https://aemb.pro/v1/markets/compute/spot.

    Annotations the server declares

    • title: Compute Spot Prices
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • compute_spot_sealedGPU price, sealed proof: snapshot, cheapest ask/class, signed receipt.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    GPU price, sealed proof: snapshot, cheapest ask/class, signed receipt. type defaults ondemand; omit gpu = all classes. Raw: compute_spot_prices. POST the tool inputs as JSON to paid_url with an x402 v2 PAYMENT-SIGNATURE header. See https://docs.cdp.coinbase.com/x402 Paid tool — $0.25, USDC on Base or Arbitrum One. Paid URL: https://aemb.pro/v1/check/proveit-verified.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • correct_copy$25 correction pass on your draft: clean formatting, links verified live, terms confirmed, leaks scanned — corrected copy + signed report.Reads text others writeNo findings

    Why it is in this group

    • The name "correct_copy" says "copy": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    $25 correction pass on your draft: clean formatting, links verified live, terms confirmed, leaks scanned — corrected copy + signed report. register sets the voice. POST the tool inputs as JSON to paid_url with an x402 v2 PAYMENT-SIGNATURE header. See https://docs.cdp.coinbase.com/x402 Paid tool — $25.00, USDC on Base or Arbitrum One. Paid URL: https://aemb.pro/v1/copy/correct.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • diligence_packAll checks, one call: liveness, content, TLS fingerprint, trust verdict, doc timestamp — one signed receipt.Reads text others writeCan send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    All checks, one call: liveness, content, TLS fingerprint, trust verdict, doc timestamp — one signed receipt. document_hash optional. One check: the tool alone. POST the tool inputs as JSON to paid_url with an x402 v2 PAYMENT-SIGNATURE header. See https://docs.cdp.coinbase.com/x402 Paid tool — $222.00, USDC on Base or Arbitrum One. Paid URL: https://aemb.pro/v1/diligence/pack.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • farcaster_kitFarcaster from zero: first casts, frame spec, launch checklist in one fill-in template with a signed receipt.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Farcaster from zero: first casts, frame spec, launch checklist in one fill-in template with a signed receipt. On Nostr instead: nostr_kit. agent_wallet optional, on the receipt. POST to paid_url with an x402 v2 PAYMENT-SIGNATURE header. See https://docs.cdp.coinbase.com/x402 Paid tool — $0.25, USDC on Base or Arbitrum One. Paid URL: https://aemb.pro/v1/kits/farcaster.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • giveSupport the Embassy: open-amount USDC gift, $0.01–$222.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Support the Embassy: open-amount USDC gift, $0.01–$222. The signed quote binds your exact amount; receipt: patronage, never for work. POST the tool inputs as JSON to paid_url with an x402 v2 PAYMENT-SIGNATURE header. See https://docs.cdp.coinbase.com/x402 Paid tool — open amount, buyer chooses $0.01–$222.00, USDC on Base or Arbitrum One. Paid URL: https://aemb.pro/v1/give.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • nostr_kitNostr from zero: first notes, profile, relays, launch checklist in one fill-in template with a signed receipt.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Nostr from zero: first notes, profile, relays, launch checklist in one fill-in template with a signed receipt. On Farcaster instead: farcaster_kit. agent_wallet optional, on the receipt. POST to paid_url with an x402 v2 PAYMENT-SIGNATURE header. See https://docs.cdp.coinbase.com/x402 Paid tool — $0.25, USDC on Base or Arbitrum One. Paid URL: https://aemb.pro/v1/kits/nostr.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • rank_the_rankersSkip the sweep: the ranked directory of ranking surfaces — methods, integrity, freshness, our standing — in a signed receipt.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Skip the sweep: the ranked directory of ranking surfaces — methods, integrity, freshness, our standing — in a signed receipt. Omit surface = full directory. POST the tool inputs as JSON to paid_url with an x402 v2 PAYMENT-SIGNATURE header. See https://docs.cdp.coinbase.com/x402 Paid tool — $0.25, USDC on Base or Arbitrum One. Paid URL: https://aemb.pro/v1/directory/rankers.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • register_recoveryEscrow an encrypted recovery blob: stored opaquely — we cannot decrypt it — for operator review, signed receipt proving its hash; quorum_rules govern release.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Escrow an encrypted recovery blob: stored opaquely — we cannot decrypt it — for operator review, signed receipt proving its hash; quorum_rules govern release. POST the tool inputs as JSON to paid_url with an x402 v2 PAYMENT-SIGNATURE header. See https://docs.cdp.coinbase.com/x402 Paid tool — $1.00, USDC on Base or Arbitrum One. Paid URL: https://aemb.pro/v1/recovery/register.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • research_paperThe research paper: $222; $444 with the provenance pack — paper plus its proof.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    The research paper: $222; $444 with the provenance pack — paper plus its proof. bundle defaults to paper; prior receipt: $222 upgrade. Licensed to your wallet. POST the tool inputs as JSON to paid_url with an x402 v2 PAYMENT-SIGNATURE header. See https://docs.cdp.coinbase.com/x402 Paid tool — $222.00, USDC on Base or Arbitrum One. Paid URL: https://aemb.pro/v1/research/paper.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • ticker_shelfShop an idea: delayed scan — a ticker, two compared, or a theme — expressions fitting your budget, freshness-labeled, signed receipt.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Shop an idea: delayed scan — a ticker, two compared, or a theme — expressions fitting your budget, freshness-labeled, signed receipt. budget_usd omitted: uncapped. Ideas only — no orders placed. POST to paid_url with an x402 v2 PAYMENT-SIGNATURE header. See https://docs.cdp.coinbase.com/x402 Paid tool — $0.25, USDC on Base or Arbitrum One. Paid URL: https://aemb.pro/v1/shelf.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • trust_assuranceAction gate: endpoint, action, amount, permissions probed unpaid — ALLOW, RESTRICT, ASK_HUMAN, or QUARANTINE.Reads text others write1 finding

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Info

      The input schema at properties.provider_endpoint.description mentions "credentials".

      Matched text

      inputSchema.properties.provider_endpoint.description: "...provider to assess (max 2000 chars; no credentials in URL)"

      What this check looks for
    Description, as the server wrote it
    Action gate: endpoint, action, amount, permissions probed unpaid — ALLOW, RESTRICT, ASK_HUMAN, or QUARANTINE. Verdict: trust_report. Terms: trust_preflight. POST the tool inputs as JSON to paid_url with an x402 v2 PAYMENT-SIGNATURE header. See https://docs.cdp.coinbase.com/x402 Paid tool — $0.25, USDC on Base or Arbitrum One. Paid URL: https://aemb.pro/v1/assurance/check.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • trust_preflightBefore paying: who is paid, what's delivered, what changed — signed verdict against your policies.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Before paying: who is paid, what's delivered, what changed — signed verdict against your policies. Free quote: dry_run=true. Endpoint verdict: trust_report. POST the tool inputs as JSON to paid_url with an x402 v2 PAYMENT-SIGNATURE header. See https://docs.cdp.coinbase.com/x402 Paid tool — $0.25, USDC on Base or Arbitrum One. Paid URL: https://aemb.pro/v1/preflight/check.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • trust_reportBuy/don't-buy verdict on an x402 endpoint: probed unpaid, signed PROCEED, VERIFY_FIRST, or DO_NOT_PAY.Reads text others writeCan send data out1 finding

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.

    Findings

    • Info

      The input schema at properties.url.description mentions "credentials".

      Matched text

      inputSchema.properties.url.description: "...2 endpoint to probe (max 2000 chars; no credentials in URL). Probed unpaid via GET, falling..."

      What this check looks for
    Description, as the server wrote it
    Buy/don't-buy verdict on an x402 endpoint: probed unpaid, signed PROCEED, VERIFY_FIRST, or DO_NOT_PAY. Terms: trust_preflight. Action gate: trust_assurance. POST the tool inputs as JSON to paid_url with an x402 v2 PAYMENT-SIGNATURE header. See https://docs.cdp.coinbase.com/x402 Paid tool — $0.25, USDC on Base or Arbitrum One. Paid URL: https://aemb.pro/v1/trust/report.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data.

Reads private data0
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write9
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out5
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Install

Pinned to version 1.0.1. Values in angle brackets are yours to fill in.

claude mcp add --transport http agent-embassy https://agent-embassy.fly.dev/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [],
    "ask": [
      "mcp__agent-embassy__register_recovery",
      "mcp__agent-embassy__check_url_custom",
      "mcp__agent-embassy__check_url_sealed",
      "mcp__agent-embassy__compute_spot_sealed",
      "mcp__agent-embassy__trust_report",
      "mcp__agent-embassy__trust_preflight",
      "mcp__agent-embassy__compute_history",
      "mcp__agent-embassy__compute_alerts",
      "mcp__agent-embassy__research_paper",
      "mcp__agent-embassy__trust_assurance",
      "mcp__agent-embassy__agentid_issue",
      "mcp__agent-embassy__agentid_verify",
      "mcp__agent-embassy__correct_copy",
      "mcp__agent-embassy__give",
      "mcp__agent-embassy__attest_document",
      "mcp__agent-embassy__diligence_pack",
      "mcp__agent-embassy__check_url_changes",
      "mcp__agent-embassy__attest_work",
      "mcp__agent-embassy__ticker_shelf",
      "mcp__agent-embassy__farcaster_kit",
      "mcp__agent-embassy__nostr_kit",
      "mcp__agent-embassy__rank_the_rankers",
      "mcp__agent-embassy__compute_spot_prices"
    ],
    "deny": [
      "mcp__agent-embassy__agentid_revoke",
      "mcp__agent-embassy__agentid_renew"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as agent-embassy. Review it before you use it.

Capability tags behind 9 rules
  • mcp__agent-embassy__check_url_custom untrusted-input, outbound
  • mcp__agent-embassy__check_url_sealed untrusted-input, outbound
  • mcp__agent-embassy__trust_report untrusted-input, outbound
  • mcp__agent-embassy__trust_preflight untrusted-input
  • mcp__agent-embassy__trust_assurance untrusted-input
  • mcp__agent-embassy__correct_copy untrusted-input
  • mcp__agent-embassy__diligence_pack untrusted-input, outbound
  • mcp__agent-embassy__check_url_changes untrusted-input, outbound
  • mcp__agent-embassy__attest_work untrusted-input