io.github.wygogogo19/robotbase-dev
io.github.wygogogo19/robotbase-devwygogogo19streamable-httpv0.32.0Scanned
Agent MCP: 18 tools — GitHub/HF/npm/PyPI/HN trends plus 17 web tools for coding agents.
18 tools: 1 can delete or cancel things, 1 do something that can't be undone, 10 change things and 6 only read.
- Reads private data · 0
- Reads text others write · 17
- Can send data out · 13
- 5 findings
Anlyon alternative
12 of these tools change something. Run those as governed actions.
Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.
Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.
Import an OpenAPI spec →Tools
Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.
18 tools
Deletes or cancels 1Claude Code: deny
web_monitor_deleteDelete one scheduled change monitor owned by the calling IP (its event history is removed too).Reads text others write2 findings
Why it is in this group
- The name "web_monitor_delete" says "delete": a word for removing or ending something.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
- The server marks it not destructive (destructiveHint: false), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Findings
- Warn
The server marks "web_monitor_delete" read-only (readOnlyHint: true), and its own name, description or input give the class "destructive".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "web_monitor_delete" says "delete": a word for removing or ending something.
- Warn
The server marks "web_monitor_delete" not destructive (destructiveHint: false), and its own name, description or input give the class "destructive".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "web_monitor_delete" says "delete": a word for removing or ending something.
Description, as the server wrote it Delete one scheduled change monitor owned by the calling IP (its event history is removed too). When to use: the user no longer needs to watch a page, or the per-IP monitor limit was reached. Do not use: to pause a monitor temporarily - there is no pause; delete and re-create. Returns: {ok, deleted, monitor_id, note}; unknown or foreign ids return {ok:false,error:'monitor_not_found'} and delete nothing. Free (not metered); rate-limited to 20 calls/min per IP.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
Can't be undone 1Claude Code: ask
web_screenshotCapture a screenshot of one public web page as an image (JPEG) plus metadata.Reads text others writeCan send data out1 finding
Why it is in this group
- The name "web_screenshot" says "screenshot": a word for reading.
- The description's first verb is "capture": a word that usually means money moves, which cannot be taken back.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe name "web_screenshot" says "screenshot" and "web": it reads web pages, which anyone can write.
- untrusted-inputThe description's first sentence says "capture" and "web": it reads web pages, which anyone can write.
- untrusted-inputThe input takes a URL (input.url), and the tool reads it: it reads web pages, which anyone can write.
- outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
Findings
- Warn
The server marks "web_screenshot" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "web_screenshot" says "screenshot": a word for reading.
Description, as the server wrote it Capture a screenshot of one public web page as an image (JPEG) plus metadata. When to use: visual layout matters - a dashboard, chart, UI state, or 'what does this page look like'. Do not use: to read text (use web_fetch), for pages behind a login or paywall, or for bulk capture. Returns: image content (image/jpeg) plus {url, final_url, title, width, height, bytes, engine, elapsed_ms, _metering}. Rendered by a real Chromium browser, robots.txt-respecting, SSRF-guarded, max 3MB per image. Metered: shares the web free bucket (100 calls/day per IP shared by all twelve web tools), then 2 credits per call over x402 - there is no API key; the 402 answer carries accepts[].
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
Changes things 10Claude Code: ask
dev_trendingDeveloper ecosystem trends: GitHub repos, Hugging Face models, npm packages, PyPI stats and Hacker News.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Developer ecosystem trends: GitHub repos, Hugging Face models, npm packages, PyPI stats and Hacker News. When to use: choosing a library/model, seeing what developers are adopting, checking package health. Do not use: for general web search (web_search) or social hot lists (social_hot). Returns: {ecosystem, items:[{name, metric, value, url, description, source}], errors}.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
web_actDrive a real Chromium browser on one public page: click, type, press keys, scroll, wait for selectors, then return the resulting text (and optionally a screenshot and JSON XHR resp…Reads text others writeCan send data outNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
Description, as the server wrote it Drive a real Chromium browser on one public page: click, type, press keys, scroll, wait for selectors, then return the resulting text (and optionally a screenshot and JSON XHR responses). When to use: the page needs interaction before its content appears (cookie banners, tabs, 'load more', form submit) and web_fetch/web_crawl cannot see it. Do not use: for plain reading (web_fetch) or bulk crawling (web_crawl); no login/paywall bypass. Returns: {ok, url, final_url, title, markdown, chars, elapsed_ms, screenshot?, xhr?, took_ms, _metering}. Max 10 actions; screenshot returns MCP image content. Metered: shares the web free bucket (100 calls/day per IP shared by all web tools), then 3 credits per call over x402.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
web_crawlCrawl one site's same-host pages starting from a URL (depth 1-2, at most 20 pages) and return each page's title, URL and readable text.Reads text others writeCan send data outNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe name "web_crawl" says "crawl": it reads web pages, which anyone can write.
- untrusted-inputThe description's first sentence says "crawl": it reads web pages, which anyone can write.
- outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
Description, as the server wrote it Crawl one site's same-host pages starting from a URL (depth 1-2, at most 20 pages) and return each page's title, URL and readable text. When to use: you need several pages from one site (docs section, news index, product list) and web_map alone is not enough. Do not use: to mirror a whole site (hard cap 20 pages, same host), or for one page (web_fetch). Returns: {ok, url, final_url, count, pages:[{url, title, status, chars, content}], cached, took_ms, _metering}. Respects robots.txt and SSRF guards; partial page failures are skipped. Metered: shares the web free bucket (100 calls/day per IP shared by all web tools), then 3 credits per call over x402 - no API key.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
web_crawl_asyncSubmit a same-host crawl as an asynchronous job and return a job_id immediately.Reads text others writeCan send data out1 finding
Why it is in this group
- The description's first verb is "submit": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe name "web_crawl_async" says "crawl": it reads web pages, which anyone can write.
- untrusted-inputThe description's first sentence says "crawl": it reads web pages, which anyone can write.
- outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
Findings
- Warn
The server marks "web_crawl_async" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The description's first verb is "submit": a word for a change.
Description, as the server wrote it Submit a same-host crawl as an asynchronous job and return a job_id immediately. When to use: you need more than a couple of pages and cannot hold a long HTTP request; submit here, then poll web_crawl_job until status is done, failed or cancelled. Do not use: for one page (web_fetch) or when you need the result in this call (web_crawl). Returns: {ok, job_id, status, url, depth, max_pages, max_chars, idempotent, poll_with}. Pass idempotency_key to retry safely (24h window returns the same job). Metered: shares the web free bucket (100 calls/day per IP), then 3 credits per submit over x402.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
web_crawl_jobCheck or cancel an asynchronous crawl job created by web_crawl_async.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe name "web_crawl_job" says "crawl": it reads web pages, which anyone can write.
- untrusted-inputThe description's first sentence says "crawl": it reads web pages, which anyone can write.
Description, as the server wrote it Check or cancel an asynchronous crawl job created by web_crawl_async. When to use: after web_crawl_async, poll with action=status until status is done/failed/cancelled; use action=cancel to stop a running job. Do not use: to start a crawl (web_crawl_async) or for a quick one-page read (web_fetch). Returns status: {ok, job_id, status: queued|running|done|failed|cancelled, progress:{pages_done,max_pages}, created_at, updated_at, result?, error?}. Free (not metered); rate-limited. Done result uses the same shape as web_crawl.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
web_extractExtract structured data from one public page: tables (headers + rows), JSON-LD blocks, and Open Graph/Twitter/canonical/language metadata.Reads text others writeCan send data outNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
Description, as the server wrote it Extract structured data from one public page: tables (headers + rows), JSON-LD blocks, and Open Graph/Twitter/canonical/language metadata. When to use: the page has tables or schema.org JSON-LD you need as data, without an LLM. Do not use: when you only need the page text (web_fetch) or a screenshot (web_screenshot). Returns: {ok, url, final_url, title, meta:{description,image,site_name,type,canonical,lang}, jsonld[], tables:[{caption,headers,rows}], links? , cached, took_ms, _metering}. Metered: shares the web free bucket (100 calls/day per IP shared by all web tools), then 1 credit per call over x402.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
web_extract_schemaExtract a page's structured data into a named schema's common fields (no LLM): article, product, event, faq, recipe, course, organization, local_business, breadcrumb, dataset or jo…Reads text others writeCan send data outNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
Description, as the server wrote it Extract a page's structured data into a named schema's common fields (no LLM): article, product, event, faq, recipe, course, organization, local_business, breadcrumb, dataset or job_posting. When to use: you need fields (title/author/date, price/currency/availability, event dates, FAQ Q&A, recipe ingredients, org address) rather than raw markdown or tables. Do not use: to get every JSON-LD block verbatim (web_metadata/web_extract) or to read text (web_fetch). Returns: {ok, url, final_url, schema, requested_schema, detected_types, matched, fields:{...}, sources:[jsonld|meta], jsonld_count, tables_count, took_ms, cached, _metering}. If no matching JSON-LD exists it falls back to Open Graph/meta fields and matched=false. Metered: shares the web free bucket (100 calls/day per IP), then 1 credit per call over x402.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
web_mapDiscover the URLs of one site - sitemap first, then same-host links from the homepage.Reads text others writeCan send data outNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
Description, as the server wrote it Discover the URLs of one site - sitemap first, then same-host links from the homepage. When to use: you need the list of pages a site exposes before fetching a few of them. Do not use: as a crawler (max 50 URLs, no page content) or to bypass robots.txt. Returns: {url, final_url, count, urls:[{url,source}], cached, took_ms, _metering}. Metered: shares the web free bucket (100 calls/day per IP shared by all web tools), then 1 credit per call over x402 - there is no API key; the 402 answer carries accepts[].
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
web_metadataExtract a page's structured metadata: Open Graph, Twitter cards, canonical URL, language and JSON-LD.Reads text others writeCan send data outNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
Description, as the server wrote it Extract a page's structured metadata: Open Graph, Twitter cards, canonical URL, language and JSON-LD. When to use: you need the title/description/author/image of a page, or JSON-LD structured data for a product/article, without reading the whole page. Do not use: when you need the page text (use web_fetch) or a screenshot (use web_screenshot). Returns: {ok, url, final_url, title, description, image, site_name, type, canonical, lang, jsonld[], cached, took_ms, _metering}. Metered: shares the web free bucket (100 calls/day per IP shared by all web tools), then 1 credit per call over x402 - there is no API key.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
web_monitor_setCreate a scheduled change monitor for one public URL: the server re-fetches the page on an interval, stores a new snapshot and records a diff event whenever the readable text chang…Reads text others writeCan send data out1 finding
Why it is in this group
- The name "web_monitor_set" says "set": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
Findings
- Warn
The server marks "web_monitor_set" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "web_monitor_set" says "set": a word for a change.
Description, as the server wrote it Create a scheduled change monitor for one public URL: the server re-fetches the page on an interval, stores a new snapshot and records a diff event whenever the readable text changes. When to use: the user wants to be told when a page changes (price, docs, policy page, job post, release notes) and cannot poll it themselves; also for handing off 'watch this for me'. Do not use: for a single comparison right now (web_diff) or when you only need the page today (web_fetch). Returns: {ok, monitor_id, url, status:active, interval_minutes, next_check_ts, webhook_enabled, webhook_secret?, webhook_signature?, hint}. The first check runs within ~60s to store the baseline; later changes show up in web_monitor_list.recent_events and, if requested, are POSTed to webhook_url. Webhook: https only, no redirects, 8s timeout, up to 2 retries (30s/120s); body JSON {monitor_id,url,ts,changed,added_lines,removed_lines,title,diff,event_id}; verify header 'X-RobotBase-Signature: sha256=<hex HMAC-SHA256 of the raw body using webhook_secret>'. Limits: 15-1440 minutes; max 5 monitors per IP; monitors expire after 7 days. Metered: 1 credit (shares the web free bucket of 100 calls/day per IP).
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
Only reads 6Show 6 read-only tools
web_diffFetch a page now and compare it with the previous snapshot of the same URL, returning whether it changed and a unified diff (no LLM).Reads text others writeCan send data outNo findings
Why it is in this group
- The name "web_diff" says "diff": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe name "web_diff" says "diff" and "web": it reads web pages, which anyone can write.
- untrusted-inputThe description's first sentence says "fetch" and "url": it reads web pages, which anyone can write.
- untrusted-inputThe input takes a URL (input.url), and the tool reads it: it reads web pages, which anyone can write.
- outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
Claude Code: ask, because it is tagged outbound.
Description, as the server wrote it Fetch a page now and compare it with the previous snapshot of the same URL, returning whether it changed and a unified diff (no LLM). When to use: monitoring a page for updates - prices, docs, policy pages, SEO titles/meta; first call stores the baseline, later calls return added/removed lines. Do not use: for one-off reading (web_fetch) or structured fields (web_extract_schema). Returns: {ok, url, baseline, changed, diff, added_lines, removed_lines, previous_ts, current_ts, title, hash, chars, fetched_cached, took_ms, _metering}. fresh=true (default) adds a cache-busting query to bypass the 6h page cache; pass fresh=false to compare cached content. Snapshots are kept per URL in SQLite (latest only). Metered: shares the web free bucket (100 calls/day per IP), then 1 credit per call over x402.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
web_feedRead an RSS or Atom feed and return its latest items.Reads text others writeCan send data outNo findings
Why it is in this group
- The description's first verb is "read": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe name "web_feed" says "web": it reads web pages, which anyone can write.
- untrusted-inputThe description's first sentence says "read" and "rss": it reads web pages, which anyone can write.
- untrusted-inputThe input takes a URL (input.url), and the tool reads it: it reads web pages, which anyone can write.
- outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
Claude Code: ask, because it is tagged outbound.
Description, as the server wrote it Read an RSS or Atom feed and return its latest items. When to use: the user wants the latest posts/news from a site that publishes a feed, or you found a feed URL and want headlines plus links. Do not use: to read article text (use web_fetch) or to discover a site's URLs (use web_map). Returns: {ok, url, final_url, title, count, items:[{title, link, published, summary}], cached, took_ms, _metering}. Summary is HTML-stripped and capped at 500 characters. Metered: shares the web free bucket (100 calls/day per IP shared by all web tools), then 1 credit per call over x402 - there is no API key.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
web_fetchFetch one public web page and return its readable text as clean markdown or plain text, with navigation, scripts, headers and footers stripped.Reads text others writeCan send data outNo findings
Why it is in this group
- The name "web_fetch" says "fetch": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe name "web_fetch" says "fetch" and "web": it reads web pages, which anyone can write.
- untrusted-inputThe description's first sentence says "fetch" and "web": it reads web pages, which anyone can write.
- untrusted-inputThe input takes a URL (input.url), and the tool reads it: it reads web pages, which anyone can write.
- outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
Claude Code: ask, because it is tagged outbound.
Description, as the server wrote it Fetch one public web page and return its readable text as clean markdown or plain text, with navigation, scripts, headers and footers stripped. When to use: you have a specific URL (from web_search or the user) and need what the page actually says - 'read this article', 'summarise this docs page', 'turn this URL into markdown'. Do not use: to crawl or mirror a site, to fetch a page behind a login or paywall, to read API/RPC endpoints, or for book text inside CyberLibrary (use cyberlibrary_get_chapter). Returns: {url, final_url, status, title, content, chars, truncated, fetched_at, source (direct|provider), cached, took_ms, _metering}. The response is capped at 12000 characters per call; raise max_chars (up to 20000) when you need more. Reads one public URL only, respects robots.txt, and does not bypass login or paywall. Direct fetch is tried first; pages blocked from this node are fetched through a provider and marked source=provider. Metered: all web tools share 100 free calls/day per IP (separate from the risk/library allowance), then 1 credit per call over x402 - there is no API key; the 402 answer carries accepts[].
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
web_fetch_batchFetch up to 5 public URLs in one call and return each page's title, engine and a short snippet (first ~1200 characters), so an agent can triage several links quickly.Reads text others writeCan send data outNo findings
Why it is in this group
- The name "web_fetch_batch" says "fetch": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe name "web_fetch_batch" says "fetch" and "web": it reads web pages, which anyone can write.
- untrusted-inputThe input takes a URL (input.urls), and the tool reads it: it reads web pages, which anyone can write.
- outboundThe input takes a URL (input.urls): a request to a URL can carry data to whoever runs it.
Claude Code: ask, because it is tagged outbound.
Description, as the server wrote it Fetch up to 5 public URLs in one call and return each page's title, engine and a short snippet (first ~1200 characters), so an agent can triage several links quickly. When to use: search returned several candidate pages and you want a first pass over all of them; then call web_fetch on the ones worth reading in full. Do not use: when you need the complete text of a page (use web_fetch), or to crawl a site (use web_map). Returns: {ok, count, ok_count, results:[{url, ok, final_url, status, title, engine, chars, snippet, error?}], took_ms, _metering}. Partial failures do not fail the whole call. Metered: counts one call per URL against the shared web free bucket (50 URLs/day per IP together with web_fetch), then 1 credit per URL over x402 - max 5 URLs per call, no API key.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
web_monitor_listList the scheduled change monitors owned by the calling IP, with latest/next check time, last title or error, and the 5 most recent change events.Reads text others writeNo findings
Why it is in this group
- The name "web_monitor_list" says "list": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe name "web_monitor_list" says "list" and "web": it reads web pages, which anyone can write.
Description, as the server wrote it List the scheduled change monitors owned by the calling IP, with latest/next check time, last title or error, and the 5 most recent change events. When to use: after web_monitor_set, poll this instead of re-fetching the page; or to show the user what is currently being watched. Do not use: to create a monitor (web_monitor_set) or to compare one page now (web_diff). Returns: {ok, count, monitors:[{monitor_id,url,interval_minutes,active,created_ts,last_check_ts,next_check_ts,last_title,last_error,webhook_enabled,events_total,recent_events}], note}. Pass monitor_id to get that one monitor plus last_event.diff (the most recent detected change, up to 4000 chars) so you can read what changed without a webhook. Free (not metered); rate-limited to 20 calls/min per IP.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
web_searchSearch the live web and get ranked results with title, URL, snippet and published date.Reads text others writeNo findings
Why it is in this group
- The name "web_search" says "search": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe name "web_search" says "search" and "web": it reads web pages, which anyone can write.
- untrusted-inputThe description's first sentence says "search" and "web": it reads web pages, which anyone can write.
Description, as the server wrote it Search the live web and get ranked results with title, URL, snippet and published date. When to use: an agent needs current facts, news or links that are not on chain - 'what is the BTC fee market saying today', 'recent Zcash governance proposals', 'find the docs page for X'. Use it before web_fetch, then fetch the one URL that looks authoritative. Do not use: for on-chain facts (use the BTC/ETH/XMR/ZEC/TRON tools) or for content inside a CyberLibrary book (use cyberlibrary_fulltext_search). Provider: self-hosted SearXNG (Bing/Baidu/360/Sogou/Yandex/Marginalia) first, then Serper, Tavily and cn.bing RSS as automatic fallbacks. Returns: {query, count, results:[{title,url,snippet,published}], provider (serper|tavily|bing_rss), cached, took_ms, _metering}. Results may be cached for up to 10 minutes; a cached result still counts as one call against the free allowance. Metered: all web tools share 100 free calls/day per IP (separate from the risk/library allowance), then 1 credit per call over x402 - there is no API key; the 402 answer carries accepts[]. max count is 10.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Exfil surface
Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.
No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data.
- Reads private data0
- Reads files, mail, messages, databases, secrets, calendars or repositories.
- Reads text others write17
- Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
- Can send data out13
- Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.
Findings
Matches of fixed checks, with the text they matched.
- Warnweb_screenshot
The server marks "web_screenshot" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "web_screenshot" says "screenshot": a word for reading.
- Warnweb_crawl_async
The server marks "web_crawl_async" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The description's first verb is "submit": a word for a change.
- Warnweb_monitor_set
The server marks "web_monitor_set" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "web_monitor_set" says "set": a word for a change.
The server marks "web_monitor_delete" read-only (readOnlyHint: true), and its own name, description or input give the class "destructive".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "web_monitor_delete" says "delete": a word for removing or ending something.
The server marks "web_monitor_delete" not destructive (destructiveHint: false), and its own name, description or input give the class "destructive".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "web_monitor_delete" says "delete": a word for removing or ending something.
History
Changes to its tool definitions and to its remote endpoint, newest first.
No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.
Install
Pinned to version 0.32.0. Values in angle brackets are yours to fill in.
claude mcp add --transport http robotbase-dev https://dev.robotbase.cc/mcpclaude mcp add --transport http robotbase-dev https://dev.robotbase.cc/mcpRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__robotbase-dev__web_search",
"mcp__robotbase-dev__web_monitor_list"
],
"ask": [
"mcp__robotbase-dev__web_fetch",
"mcp__robotbase-dev__web_screenshot",
"mcp__robotbase-dev__web_map",
"mcp__robotbase-dev__web_fetch_batch",
"mcp__robotbase-dev__web_feed",
"mcp__robotbase-dev__web_metadata",
"mcp__robotbase-dev__web_crawl",
"mcp__robotbase-dev__web_extract",
"mcp__robotbase-dev__web_act",
"mcp__robotbase-dev__web_crawl_async",
"mcp__robotbase-dev__web_crawl_job",
"mcp__robotbase-dev__web_extract_schema",
"mcp__robotbase-dev__web_diff",
"mcp__robotbase-dev__web_monitor_set",
"mcp__robotbase-dev__dev_trending"
],
"deny": [
"mcp__robotbase-dev__web_monitor_delete"
]
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as robotbase-dev. Review it before you use it.
Capability tags behind 17 rules
- mcp__robotbase-dev__web_search untrusted-input
- mcp__robotbase-dev__web_fetch untrusted-input, outbound
- mcp__robotbase-dev__web_screenshot untrusted-input, outbound
- mcp__robotbase-dev__web_map untrusted-input, outbound
- mcp__robotbase-dev__web_fetch_batch untrusted-input, outbound
- mcp__robotbase-dev__web_feed untrusted-input, outbound
- mcp__robotbase-dev__web_metadata untrusted-input, outbound
- mcp__robotbase-dev__web_crawl untrusted-input, outbound
- mcp__robotbase-dev__web_extract untrusted-input, outbound
- mcp__robotbase-dev__web_act untrusted-input, outbound
- mcp__robotbase-dev__web_crawl_async untrusted-input, outbound
- mcp__robotbase-dev__web_crawl_job untrusted-input
- mcp__robotbase-dev__web_extract_schema untrusted-input, outbound
- mcp__robotbase-dev__web_diff untrusted-input, outbound
- mcp__robotbase-dev__web_monitor_set untrusted-input, outbound
- mcp__robotbase-dev__web_monitor_list untrusted-input
- mcp__robotbase-dev__web_monitor_delete untrusted-input
Pin
Keep the decision: fail CI when the tools change, follow every change, or show a badge.
Pin in CI
Fail a build when the tools you reviewed are not the tools the server serves today.
curl -s "https://anlyon.dev/api/v1/servers/io.github.wygogogo19/robotbase-dev/verify?hash=9355a648030eb82f448974394d3017e09d18e5fc57eed40296180987505619c7" | jq -e '.changed == false'Pinned hash 9355a648030e, from Oct 23, 2026, 06:18 UTC.
Watch
Get told when its tools change: a new tool, a new description, a new class.
https://anlyon.dev/servers/io.github.wygogogo19/robotbase-dev/changes.xmlAn Atom feed. Works in any feed reader or Slack's RSS app.
Badge
[](https://anlyon.dev/servers/io.github.wygogogo19/robotbase-dev)Source: MCP Registry · repository. Synced Oct 23, 2026, 06:17 UTC.