Skip to content

io.github.tang-vu/keryx

by tang-vu · remote · local (npm) · no sign-in to list tools · v0.4.34 · published by GitHub user tang-vu

Budgeted research with cited evidence and visible payment state on the selected Arc network.

Final · 2Changes · 10
CompareRegistry entry

25 tools: 2 do something that can't be undone, 10 change things and 13 only read.

Scanned Oct 21, 2026

4 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http keryx https://keryx.cc/mcp

Findings

Matches of fixed checks, with the text they matched.

4 warn
  • Warnkeryx_purchase_outcomes

    The server marks "keryx_purchase_outcomes" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "keryx_purchase_outcomes" says "purchase": a word that usually means money moves, which cannot be taken back.

    What this check looks for
  • Warnhistory_private_jobs_export

    The server marks "history_private_jobs_export" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The input addresses people (input.to): what it sends cannot be taken back.

    What this check looks for
  • Warnrun_privacy_read

    The server marks "run_privacy_read" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "run_privacy_read" says "run": a word for a change.

    What this check looks for
  • Warnrun_owner_export

    The server marks "run_owner_export" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "run_owner_export" says "run": a word for a change.

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

25 tools

Can't be undone 2Claude Code: ask
  • history_private_jobs_exportPrivate data for this authenticated caller only.1 finding

    Why it is in this group

    • The input addresses people (input.to): what it sends cannot be taken back.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "history_private_jobs_export" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The input addresses people (input.to): what it sends cannot be taken back.

      What this check looks for
    Description, as the server wrote it
    Private data for this authenticated caller only. Exact-payer completed private jobs in the current store; explicit history:read required. Bounded scan/continuation, unknown provenance and NULL own spend/creator settlement remain explicit. No wallet selector, public report/share link, model prompt, research, source fetch, signer, purchase or mutation authority. Manual finite JSON metadata export only; complete/truncated and continuation are returned. Result bodies are excluded.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • keryx_purchase_outcomesRead a public dispatch's retained exact-version BUY/citation/payment observations.1 finding

    Why it is in this group

    • The name "keryx_purchase_outcomes" says "purchase": a word that usually means money moves, which cannot be taken back.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "keryx_purchase_outcomes" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "keryx_purchase_outcomes" says "purchase": a word that usually means money moves, which cannot be taken back.

      What this check looks for
    Description, as the server wrote it
    Read a public dispatch's retained exact-version BUY/citation/payment observations. Returns bounded sample counts, citation hit rate, calibration bands and integer micro-USDC uncited access cost. Recorded settlement is not revalidated on chain. Historical participant cohort is unknown; causal regret, missed value and cost per supported claim are unmeasured. No research, paid read, current-source backfill, private reviews, signing or learning. Use an existing dispatch ID, never a URL.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
Changes things 10Claude Code: ask
  • deliverable_acceptance_submitRecord Accept, Request revision or Reject for the original customer's exact retained delivery.No findings

    Why it is in this group

    • The name "deliverable_acceptance_submit" says "submit": a word for a change.
    Description, as the server wrote it
    Record Accept, Request revision or Reject for the original customer's exact retained delivery. Requires explicit deliverable:write, expected current revision/digests and an idempotency key. Reason is private; publishState explicitly shares state/timestamp only. Request storage does not execute a revision/refund, recharge, change reservations or claw back rewards. Your MCP client may retain private messages.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • draft_checkSplit a private passage into sentences, bind citation markers ([3], cite{key}, [@key], Author (Year)) to a BibTeX, RIS or DOI/link reference list, and compare each cited sentence w…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Split a private passage into sentences, bind citation markers ([3], cite{key}, [@key], Author (Year)) to a BibTeX, RIS or DOI/link reference list, and compare each cited sentence with source text you supply. Each verdict (supported, partly-supported, not-found, source-unavailable) carries a verbatim excerpt of that text or states that no supporting passage was found; a source without supplied text is always source-unavailable. Deterministic wording comparison, not semantic review. No fetching, model, database, history, payment or reward I/O. Inputs and results can be retained by your MCP client; choose that client’s privacy settings before sharing private passages.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • evidence_draftAssemble user-selected claim spans and related-work quote themes from saved Include paper records and caller-supplied retained Keryx report rows.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Assemble user-selected claim spans and related-work quote themes from saved Include paper records and caller-supplied retained Keryx report rows. A theme may carry author-written statements (contribution, agreement, disagreement, gap); a statement naming a paper is exported only with a citation and a selected retained excerpt from each named paper, otherwise it is withheld. Exported citations and BibTeX/RIS entries are checked to correspond one to one. Exact version/excerpt matching does not authenticate imported reports or verify semantic support. No fetching, model, database, history, payment or reward I/O. Inputs and returned draft can be retained by your MCP client; choose that client’s privacy settings before sharing private passages.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • evidence_procurementAssess missing evidence requirements, supplied provider offers, selections, deliveries and caller reviews with the shared private evidence procurement contract.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Assess missing evidence requirements, supplied provider offers, selections, deliveries and caller reviews with the shared private evidence procurement contract. Amounts are exact integer micro-USDC. Signature and content-binding checks do not establish delivery quality, buyer authority, payment or settlement. No fetching, model, provider, database, history, purchase, escrow or reward I/O. Caller selections and reviews are assertions, not financial authorization. Inputs and results may be retained by your MCP client; choose its privacy settings before sharing private material.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • history_exportSame owner-private v2 contract as /api/me/asks.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Same owner-private v2 contract as /api/me/asks. Explicit history:read required. Current store, bounded filters/keysets; missing membership/claims stay explicit. Export has explicit truncation/continuation. No research, signer, payment, public-owner selector or mutation authority.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • history_private_jobs_detailPrivate data for this authenticated caller only.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Private data for this authenticated caller only. Exact-payer completed private jobs in the current store; explicit history:read required. Bounded scan/continuation, unknown provenance and NULL own spend/creator settlement remain explicit. No wallet selector, public report/share link, model prompt, research, source fetch, signer, purchase or mutation authority.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • profile_updateReplace the verified key owner's private display name, handle, one-line bio/purpose and links.No findings

    Why it is in this group

    • The name "profile_update" says "update": a word for a change.
    Description, as the server wrote it
    Replace the verified key owner's private display name, handle, one-line bio/purpose and links. Requires explicit profile:write scope. No wallet selector or identity verification; no payment/history changes.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • researchResearch a question under a USDC creator-payment budget.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Research a question under a USDC creator-payment budget. Keryx selects sources, pays access tolls and weighted citation rewards on the configured Arc network, then returns qualified source excerpts and a receipt. Complete synthesis and per-assertion entailment remain unverified. This remote surface uses Keryx's treasury; anonymous research is sponsored, not caller-funded usage. Public research may send your question to our search provider. The source USDC budget is separate from model and search operating costs. For retained or repository bibliography use free paper_lookup with an exact identifier. An ordinary explicit exact-original bibliography request can also return a separate metadata-only record and references without a model call or creator payment; page status and full-paper evidence remain separate. New runs record remote MCP ingress. A verified ask-scoped API key attributes the run to its wallet; anonymous runs have no wallet owner. Editable client names establish no identity or spending authority.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • run_owner_exportOwner-private current-store read using the verified key's explicit history:read scope.1 finding

    Why it is in this group

    • The name "run_owner_export" says "run": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "run_owner_export" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "run_owner_export" says "run": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Owner-private current-store read using the verified key's explicit history:read scope. No wallet selector or signing. Visibility, defaults and erasure require the interactive web session. Storage admission is required.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • run_privacy_readOwner-private current-store read using the verified key's explicit history:read scope.1 finding

    Why it is in this group

    • The name "run_privacy_read" says "run": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "run_privacy_read" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "run_privacy_read" says "run": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Owner-private current-store read using the verified key's explicit history:read scope. No wallet selector or signing. Visibility, defaults and erasure require the interactive web session. Storage admission is required.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
Only reads 13Claude Code: allow
  • deliverable_acceptance_readOwner-only ordinary prepaid A2A deliverable state.No findings

    Why it is in this group

    • The name "deliverable_acceptance_read" says "read": a word for reading.
    Description, as the server wrote it
    Owner-only ordinary prepaid A2A deliverable state. Requires explicit deliverable:read. Historical remedy:none and missing response window remain visible. Native/enrolled, Monthly, private v2 and browser-only originals are unavailable. Not source-decision agreement or semantic verification.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • history_owned_readSame owner-private v2 contract as /api/me/asks.No findings

    Why it is in this group

    • The name "history_owned_read" says "read": a word for reading.
    Description, as the server wrote it
    Same owner-private v2 contract as /api/me/asks. Explicit history:read required. Current store, bounded filters/keysets; missing membership/claims stay explicit. Export has explicit truncation/continuation. No research, signer, payment, public-owner selector or mutation authority.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • history_private_jobs_listPrivate data for this authenticated caller only.No findings

    Why it is in this group

    • The name "history_private_jobs_list" says "list": a word for reading.
    Description, as the server wrote it
    Private data for this authenticated caller only. Exact-payer completed private jobs in the current store; explicit history:read required. Bounded scan/continuation, unknown provenance and NULL own spend/creator settlement remain explicit. No wallet selector, public report/share link, model prompt, research, source fetch, signer, purchase or mutation authority.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • history_readRead bounded pages of the verified API-key wallet's ordinary current-store runs.No findings

    Why it is in this group

    • The name "history_read" says "read": a word for reading.
    Description, as the server wrote it
    Read bounded pages of the verified API-key wallet's ordinary current-store runs. Requires explicit history:read. Literal case-sensitive question search; storeNetwork describes the deployment, not per-run settlement. Recorded spend/allocation is not a payment receipt. No wallet selector, linked accounts, archive, private jobs, research or payment.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • keryx_operator_statusObserve public prepaid research operations, queue, recorded ordinary/recovered/unknown completion latency cohorts and hold/review rationale.No findings

    Why it is in this group

    • The name "keryx_operator_status" says "status": a word for reading.
    Description, as the server wrote it
    Observe public prepaid research operations, queue, recorded ordinary/recovered/unknown completion latency cohorts and hold/review rationale. Timing is order createdAt to updatedAt (acceptance to recorded completion/update); later reconciliation can extend it. It is not first-answer or settlement time. Missing capability stays null. No spending or execution authority; exact books and customer jobs stay private.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • keryx_public_job_ledgerInspect a partial selected-network public web-dispatch transfer ledger and balanced exact micro-USDC vouchers.No findings

    Why it is in this group

    • The description's first verb is "inspect": a word for reading.
    Description, as the server wrote it
    Inspect a partial selected-network public web-dispatch transfer ledger and balanced exact micro-USDC vouchers. Browser funding and Keryx sponsorship are separate. Pending/ambiguous/batched-attribution legs do not enter settled totals. No customer questions/identities, private invoices, complete business books, margin, cash balance, signing or execution authority. days1–31, default7. Export via /api/operator/ledger; a checksum is not authenticity or independent settlement proof.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • keryx_source_learningRead the same bounded observational source/topic record as the public creator page and API.No findings

    Why it is in this group

    • The description's first verb is "read": a word for reading.
    Description, as the server wrote it
    Read the same bounded observational source/topic record as the public creator page and API. Only write-time independently classified/funded outside observations qualify; owners, unknown and private history are excluded. Source-declared public topics, counts, recorded citation contribution, exact rational average access price, descriptive uncertainty and abrupt-shift flag. No questions, wallets or receipt identifiers. Recorded settlement is not independently revalidated. Live learned selection and exploration are withheld, with zero live exploration allowance. No research, source read, payment, private inspection or policy activation.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • keryx_statusDescribe this MCP surface, its payment behavior, and the active caller tier.No findings

    Why it is in this group

    • The name "keryx_status" says "status": a word for reading.
    Description, as the server wrote it
    Describe this MCP surface, its payment behavior, and the active caller tier.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • operator_obligations_readRead a private conservative obligation projection for the exact server-delegated reader with explicit operator:read API-key scope.No findings

    Why it is in this group

    • The name "operator_obligations_read" says "read": a word for reading.
    Description, as the server wrote it
    Read a private conservative obligation projection for the exact server-delegated reader with explicit operator:read API-key scope. Disabled without protected reader/role configuration. Partial native history remains unknown with zero safe/advisory surplus. No cash probe, signer, custody, spending, release, refund or scheduler authority. No caller owner/role selectors.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • paper_lookupFind paper titles, recorded contributors, DOI and exact repository versions without research or payment.No findings

    Why it is in this group

    • The name "paper_lookup" says "lookup": a word for reading.
    Description, as the server wrote it
    Find paper titles, recorded contributors, DOI and exact repository versions without research or payment. Default: retained catalog metadata with observation times. Set searchRepositories=true only to explicitly send the query to arXiv/Crossref (at most two requests, no paper-body reading). Missing DOI, peer review and withdrawal/replacement status remain unknown. Returns a field-scoped bibliography card with provenance, a short reference and reusable BibTeX/RIS text. Use this for exact title/ordered author/year/journal/DOI/version questions before requesting paid research; original paper text is not required for recorded metadata.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • profile_identities_readRead only the verified key owner's saved ORCID/GitHub identities.No findings

    Why it is in this group

    • The name "profile_identities_read" says "read": a word for reading.
    Description, as the server wrote it
    Read only the verified key owner's saved ORCID/GitHub identities. Requires explicit profile:read scope. No wallet selector, provider OAuth, linking, unlinking, research or payment. Link identities interactively in your private profile browser page.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • profile_readRead the verified key owner's private profile and attributed activity.No findings

    Why it is in this group

    • The name "profile_read" says "read": a word for reading.
    Description, as the server wrote it
    Read the verified key owner's private profile and attributed activity. Requires explicit profile:read scope. No public identity, research or payment.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • research_monthlyRead the four-request, 30-day Research Monthly quote and handoff.No findings

    Why it is in this group

    • The description's first verb is "read": a word for reading.
    Description, as the server wrote it
    Read the four-request, 30-day Research Monthly quote and handoff. The current quote identifies its payment network. Never buys or redeems a plan.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 0.4.34. Values in angle brackets are yours to fill in.

claude mcp add --transport http keryx https://keryx.cc/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__keryx__deliverable_acceptance_read",
      "mcp__keryx__operator_obligations_read",
      "mcp__keryx__paper_lookup",
      "mcp__keryx__keryx_status",
      "mcp__keryx__research_monthly",
      "mcp__keryx__keryx_operator_status",
      "mcp__keryx__keryx_public_job_ledger",
      "mcp__keryx__keryx_source_learning",
      "mcp__keryx__profile_read",
      "mcp__keryx__history_read",
      "mcp__keryx__history_owned_read",
      "mcp__keryx__history_private_jobs_list",
      "mcp__keryx__profile_identities_read"
    ],
    "ask": [
      "mcp__keryx__evidence_draft",
      "mcp__keryx__draft_check",
      "mcp__keryx__evidence_procurement",
      "mcp__keryx__deliverable_acceptance_submit",
      "mcp__keryx__research",
      "mcp__keryx__keryx_purchase_outcomes",
      "mcp__keryx__profile_update",
      "mcp__keryx__history_export",
      "mcp__keryx__history_private_jobs_detail",
      "mcp__keryx__history_private_jobs_export",
      "mcp__keryx__run_privacy_read",
      "mcp__keryx__run_owner_export"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as keryx. Review it before you use it.