Skip to content

PingRoom

by pingroom.io · remote · no sign-in to list tools · v0.1.0 · published by io.pingroom

Send mobile pings and route human questions, approvals, and handoffs from AI agents.

Deletes · 11Final · 1Changes · 11
CompareRegistry entry

41 tools: 11 can delete or cancel things, 1 do something that can't be undone, 11 change things and 18 only read.

Scanned Oct 21, 2026

6 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http pingroom https://api.pingroom.io/api/agent/mcp

Findings

Matches of fixed checks, with the text they matched.

2 warn4 info
  • Warnlive_status

    The server marks "live_status" destructive (destructiveHint: true), and its name says "status", a word for reading.

    Matched text

    annotations: {"readOnlyHint":false,"destructiveHint":true,"idempotentHint":true,"openWorldHint":true}; The name "live_status" says "status": a word for reading.

    What this check looks for
  • Warnwait_for_handoff

    The server marks "wait_for_handoff" as not read-only (readOnlyHint: false), and its words say it reads.

    Matched text

    annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":false}; The name "wait_for_handoff" says "wait": a word for reading.

    What this check looks for
  • Infoconnection_info

    The description mentions "credential".

    Matched text

    description: "...d or restart the MCP client. Includes a credential-protected latest-pings feed and token-f..."

    What this check looks for
  • Infodisconnect

    The description mentions "credentials".

    Matched text

    description: "...ction, including its access and refresh credentials and room memberships. Use only when the..."

    What this check looks for
  • Infoget_live_status

    The description mentions "credential".

    Matched text

    description: "...e. Only returns streams started by this credential, within the last 24 hours. Returns noti..."

    What this check looks for
  • Infocreate_webhook

    The description mentions "credential".

    Matched text

    description: "...the secret trigger URL — treat it as a credential."

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

41 tools

Deletes or cancels 11Claude Code: deny
  • cancel_questionWithdraw a still-pending question you asked.Reads text others writeNo findings

    Why it is in this group

    • The name "cancel_question" says "cancel": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Withdraw a still-pending question you asked.

    Annotations the server declares

    • title: Cancel Question
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
  • delete_attachmentDelete an attachment this agent uploaded that is not yet claimed by a ping.No findings

    Why it is in this group

    • The name "delete_attachment" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Delete an attachment this agent uploaded that is not yet claimed by a ping.

    Annotations the server declares

    • title: Delete Attachment
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • delete_webhookDelete an incoming webhook (by id) from a room the account owns.No findings

    Why it is in this group

    • The name "delete_webhook" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Delete an incoming webhook (by id) from a room the account owns.

    Annotations the server declares

    • title: Delete Webhook
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • disconnectRevoke this authenticated robot connection, including its access and refresh credentials and room memberships.1 finding

    Why it is in this group

    • The description's first verb is "revoke": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).

    Findings

    • Info

      The description mentions "credentials".

      Matched text

      description: "...ction, including its access and refresh credentials and room memberships. Use only when the..."

      What this check looks for
    Description, as the server wrote it
    Revoke this authenticated robot connection, including its access and refresh credentials and room memberships. Use only when the human explicitly requests logout, disconnection, or reconnection. Call BEFORE clearing local credentials or running MCP logout/login. It affects only the current connection and accepts no account or robot selector. After login, restart or reload the MCP client, then match connection_info owner.id and handle to the approved account and robot before sending.

    Annotations the server declares

    • title: Disconnect
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • join_roomJoin a room using its invite code.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Join a room using its invite code. Include the password only if the room is protected.

    Annotations the server declares

    • title: Join Room
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
  • live_statusStart, update, or end a live progress card on the room members' lock screen (an iOS Live Activity / Android live update).Reads text others write1 finding

    Why it is in this group

    • The name "live_status" says "status": a word for reading.
    • The description's first verb is "start": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "live_status" destructive (destructiveHint: true), and its name says "status", a word for reading.

      Matched text

      annotations: {"readOnlyHint":false,"destructiveHint":true,"idempotentHint":true,"openWorldHint":true}; The name "live_status" says "status": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Start, update, or end a live progress card on the room members' lock screen (an iOS Live Activity / Android live update). Reuse the same correlation_id for every ping of one stream: the first ping starts the card and sends one alert, further "running" pings move it silently, and the first "done"/"failed" sends one completion alert and ends it. Free accounts get a small number of NEW streams per day; updates and the final ping of an open stream are never charged; a first ping that is already "done"/"failed" counts as a new stream.

    Annotations the server declares

    • title: Publish Live Status
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
  • rotate_handleRotate this agent's public handle — kill-switch for a leaked handle.No findings

    Why it is in this group

    • The name "rotate_handle" says "handle": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Rotate this agent's public handle — kill-switch for a leaked handle.

    Annotations the server declares

    • title: Rotate Agent Handle
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • set_avatarSet this agent's avatar.No findings

    Why it is in this group

    • The name "set_avatar" says "set": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Set this agent's avatar. Must be one of the PingRoom bot avatars.

    Annotations the server declares

    • title: Set Agent Avatar
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • update_quick_actionConfigure a numbered quick-action slot for a room the account owns.Reads text others writeNo findings

    Why it is in this group

    • The name "update_quick_action" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Configure a numbered quick-action slot for a room the account owns. Sends a background room refresh to room members' devices.

    Annotations the server declares

    • title: Update Quick Action
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
  • update_quick_actionsConfigure several of a room's quick-action slots in one call.Reads text others writeNo findings

    Why it is in this group

    • The name "update_quick_actions" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Configure several of a room's quick-action slots in one call. Prefer this over repeated update_quick_action: each single-slot write wakes room members' devices with its own background refresh, so setting up four Pings one at a time spends four of a finite daily push budget on one operation. Slots you do not list are left exactly as they are, so this is also the right tool for editing a single Ping.

    Annotations the server declares

    • title: Update Quick Actions
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
  • update_webhookUpdate an incoming webhook (by id) on a room the account owns — e.g.No findings

    Why it is in this group

    • The name "update_webhook" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Update an incoming webhook (by id) on a room the account owns — e.g. change its icon, title, message, or sound.

    Annotations the server declares

    • title: Update Webhook
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
Can't be undone 1Claude Code: ask
  • broadcastSend a custom ping to a room the account belongs to.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "broadcast" says "broadcast": a word for sending, and what is sent cannot be taken back.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "broadcast" says "broadcast": it sends or publishes something to other people.
    • outboundThe input takes a URL (input.data.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Send a custom ping to a room the account belongs to. Pass data.checklist.items to send a checklist the room ticks through together; read the ticks back as checklist_state. Rate-limited. In someone else's personal room only a Pro account may send it, text only (a link in the message is refused too), without title, is_urgent or requires_ack (all three are ignored there), and it counts toward the visitor's two-ping cap; otherwise use trigger_quick_action there.

    Annotations the server declares

    • title: Broadcast Ping
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
Changes things 11Claude Code: ask
  • activate_agent_inboxStart or resume the onboarding Question in the private room the human chose during authorization.Reads text others writeNo findings

    Why it is in this group

    • The description's first verb is "start": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Start or resume the onboarding Question in the private room the human chose during authorization. If recipient_not_ready, ask the human to install or update PingRoom from install_url, open the app, sign in, and enable notifications before retrying. Read question.id, then call wait_for_handoff only while state is pending and within a bounded local deadline. Success is answered with activation_completed true. Any other terminal result is incomplete: stop polling that attempt, then call activate_agent_inbox again for one numbered retry. The stamp requires native phone receipt before the human answer.

    Annotations the server declares

    • title: Activate Agent Inbox
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • ask_questionAsk a person a question with 2-4 tappable options, then block on their answer (pair with wait_for_answer).Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Ask a person a question with 2-4 tappable options, then block on their answer (pair with wait_for_answer). Delivered as a push they can answer from the lock screen or in-app; the first valid answer wins. Rate-limited.

    Annotations the server declares

    • title: Ask Question
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • connection_infoVerify the current connection: owner.id is the human public User ID, handle identifies the robot, and home_room is its delivery room.1 finding

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Info

      The description mentions "credential".

      Matched text

      description: "...d or restart the MCP client. Includes a credential-protected latest-pings feed and token-f..."

      What this check looks for
    Description, as the server wrote it
    Verify the current connection: owner.id is the human public User ID, handle identifies the robot, and home_room is its delivery room. After login or reconnect, match owner.id and handle to the approved account and robot before sending. A mismatch means stop and reload or restart the MCP client. Includes a credential-protected latest-pings feed and token-free install URL; never send credentials to the install URL.

    Annotations the server declares

    • title: Connection Info
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • create_handoffHand work to exactly one human as either an acknowledgement or a tappable question.Reads text others writeNo findings

    Why it is in this group

    • The name "create_handoff" says "create": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Hand work to exactly one human as either an acknowledgement or a tappable question. The server verifies that one of the recipient's current devices supports the complete Handoff action before creating anything.

    Annotations the server declares

    • title: Create Handoff
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • create_public_roomCreate a publicly discoverable room with a unique @handle.Reads text others writeNo findings

    Why it is in this group

    • The name "create_public_room" says "create": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Create a publicly discoverable room with a unique @handle. Counts toward the free-plan five-room cap.

    Annotations the server declares

    • title: Create Public Room
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • create_roomCreate a new private room owned by the authenticated account.No findings

    Why it is in this group

    • The name "create_room" says "create": a word for a change.
    Description, as the server wrote it
    Create a new private room owned by the authenticated account. Free accounts may own up to five rooms. If this agent was granted every room and has no delivery room yet, the new room becomes its delivery room — where its handoffs and direct questions land.

    Annotations the server declares

    • title: Create Room
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • create_webhookCreate an incoming webhook for a room the account owns.1 finding

    Why it is in this group

    • The name "create_webhook" says "create": a word for a change.

    Findings

    • Info

      The description mentions "credential".

      Matched text

      description: "...the secret trigger URL — treat it as a credential."

      What this check looks for
    Description, as the server wrote it
    Create an incoming webhook for a room the account owns. The bound account must be Pro. Returns the secret trigger URL — treat it as a credential.

    Annotations the server declares

    • title: Create Webhook
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • request_approvalAsk the human to approve or reject an action, then block on their answer (pair with wait_for_approval).Reads text others writeNo findings

    Why it is in this group

    • The name "request_approval" says "request": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Ask the human to approve or reject an action, then block on their answer (pair with wait_for_approval). Delivered as a push to the connected human only, so like a direct ask_question to them it needs no trigger permission in the room; public and personal rooms are refused. Rate-limited.

    Annotations the server declares

    • title: Request Approval
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • trigger_quick_actionPress a room quick action, notifying its members.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "trigger_quick_action" says "trigger": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.data.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Press a room quick action, notifying its members. Rate-limited. Read the action's input_type first (list_quick_actions): location needs data.location, link needs data.url, file/photo/pdf need attachment_ids — a press without the matching detail is a 422 quick_action_input_required. In someone else's personal room is_urgent and requires_ack are ignored; only the owner's own setting on the action applies.

    Annotations the server declares

    • title: Trigger Quick Action
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • upload_attachmentUpload a small file (max ~90 KiB over MCP; Pro account required) and get an attachment id to include in broadcast or ask_question via attachment_ids.No findings

    Why it is in this group

    • The name "upload_attachment" says "upload": a word for a change.
    Description, as the server wrote it
    Upload a small file (max ~90 KiB over MCP; Pro account required) and get an attachment id to include in broadcast or ask_question via attachment_ids. Larger files: use the PingRoom CLI or agent REST API.

    Annotations the server declares

    • title: Upload Attachment
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • wait_for_handoffLong-poll a Handoff until the human resolves it, it expires, or the bounded timeout elapses.1 finding

    Why it is in this group

    • The name "wait_for_handoff" says "wait": a word for reading.
    • The server marks it as not read-only (readOnlyHint: false).

    Findings

    • Warn

      The server marks "wait_for_handoff" as not read-only (readOnlyHint: false), and its words say it reads.

      Matched text

      annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":false}; The name "wait_for_handoff" says "wait": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Long-poll a Handoff until the human resolves it, it expires, or the bounded timeout elapses. For the onboarding Question returned by activate_agent_inbox, success requires an answered result with activation_completed true; use a bounded local deadline and treat any terminal answer without that stamp as incomplete.

    Annotations the server declares

    • title: Wait for Handoff
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
Only reads 18Claude Code: allow
  • get_approvalFetch the current status of an approval request without blocking.No findings

    Why it is in this group

    • The name "get_approval" says "get": a word for reading.
    Description, as the server wrote it
    Fetch the current status of an approval request without blocking.

    Annotations the server declares

    • title: Get Approval
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_attachmentFetch an attachment visible to this agent as base64 content plus metadata.No findings

    Why it is in this group

    • The name "get_attachment" says "get": a word for reading.
    Description, as the server wrote it
    Fetch an attachment visible to this agent as base64 content plus metadata. Results over the connector size limit return attachment_too_large — fetch those via the agent REST API instead.

    Annotations the server declares

    • title: Get Attachment
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_handoffFetch the authoritative current state of one Handoff without blocking.No findings

    Why it is in this group

    • The name "get_handoff" says "get": a word for reading.
    Description, as the server wrote it
    Fetch the authoritative current state of one Handoff without blocking.

    Annotations the server declares

    • title: Get Handoff
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_live_statusRead back the current state of a live stream you created, so a restarted producer can reconcile instead of starting a duplicate.1 finding

    Why it is in this group

    • The name "get_live_status" says "get": a word for reading.

    Findings

    • Info

      The description mentions "credential".

      Matched text

      description: "...e. Only returns streams started by this credential, within the last 24 hours. Returns noti..."

      What this check looks for
    Description, as the server wrote it
    Read back the current state of a live stream you created, so a restarted producer can reconcile instead of starting a duplicate. Only returns streams started by this credential, within the last 24 hours. Returns notification_id and correlation_id, then the stored display state (state, progress, message, category, template, accent_override, eta_at, deadline_at, duration_seconds, metrics, prompt, options, left, right, center, steps, current_step), action_state, and updated_at. Fields you never set come back as null rather than being omitted, so a matchup/metrics/countdown/question stream can be resumed without re-sending content.

    Annotations the server declares

    • title: Get Live Status
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_notificationFetch one visible ping by notification id, including its current action_state and, once anything on its data.checklist is checked, checklist_state.No findings

    Why it is in this group

    • The name "get_notification" says "get": a word for reading.
    Description, as the server wrote it
    Fetch one visible ping by notification id, including its current action_state and, once anything on its data.checklist is checked, checklist_state.

    Annotations the server declares

    • title: Get Notification
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_questionFetch the current state of a question without blocking.No findings

    Why it is in this group

    • The name "get_question" says "get": a word for reading.
    Description, as the server wrote it
    Fetch the current state of a question without blocking.

    Annotations the server declares

    • title: Get Question
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_roomFetch a single room by its invite code, including members and quick actions.No findings

    Why it is in this group

    • The name "get_room" says "get": a word for reading.
    Description, as the server wrote it
    Fetch a single room by its invite code, including members and quick actions.

    Annotations the server declares

    • title: Get Room
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_handoffsList a bounded page of this agent's Handoffs, newest first.No findings

    Why it is in this group

    • The name "list_handoffs" says "list": a word for reading.
    Description, as the server wrote it
    List a bounded page of this agent's Handoffs, newest first. Omit state (or use open) for unresolved work; use all for history and page while has_more is true.

    Annotations the server declares

    • title: List Handoffs
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_notificationsList a bounded page of recent pings across approved rooms, newest first.No findings

    Why it is in this group

    • The name "list_notifications" says "list": a word for reading.
    Description, as the server wrote it
    List a bounded page of recent pings across approved rooms, newest first. Use page to continue while has_more is true.

    Annotations the server declares

    • title: List Notifications
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_questionsList a bounded page of questions you asked, newest first.No findings

    Why it is in this group

    • The name "list_questions" says "list": a word for reading.
    Description, as the server wrote it
    List a bounded page of questions you asked, newest first. Optionally filter by state; use page while has_more is true.

    Annotations the server declares

    • title: List Questions
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_quick_actionsList the quick actions configured for a room.No findings

    Why it is in this group

    • The name "list_quick_actions" says "list": a word for reading.
    Description, as the server wrote it
    List the quick actions configured for a room.

    Annotations the server declares

    • title: List Quick Actions
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_room_iconsList the room-icon catalog (icon ids, tags, and categories).No findings

    Why it is in this group

    • The name "list_room_icons" says "list": a word for reading.
    Description, as the server wrote it
    List the room-icon catalog (icon ids, tags, and categories). Call this before create_room / create_public_room / create_webhook to pick a valid icon id, and to interpret icon values returned by reads.

    Annotations the server declares

    • title: List Room Icons
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_roomsList the rooms the authenticated account belongs to.No findings

    Why it is in this group

    • The name "list_rooms" says "list": a word for reading.
    Description, as the server wrote it
    List the rooms the authenticated account belongs to.

    Annotations the server declares

    • title: List Rooms
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_webhooksList the incoming webhooks (with their trigger URLs) for a room the account owns.No findings

    Why it is in this group

    • The name "list_webhooks" says "list": a word for reading.
    Description, as the server wrote it
    List the incoming webhooks (with their trigger URLs) for a room the account owns.

    Annotations the server declares

    • title: List Webhooks
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • wait_for_ackLong-poll a generic acknowledgement-required ping until its confirmation rule is met (any: first confirmation; all: every original eligible recipient), it expires, or the timeout e…No findings

    Why it is in this group

    • The name "wait_for_ack" says "wait": a word for reading.
    Description, as the server wrote it
    Long-poll a generic acknowledgement-required ping until its confirmation rule is met (any: first confirmation; all: every original eligible recipient), it expires, or the timeout elapses. Questions use wait_for_answer instead.

    Annotations the server declares

    • title: Wait for Acknowledgement
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • wait_for_answerLong-poll a question until it is answered or expires.No findings

    Why it is in this group

    • The name "wait_for_answer" says "wait": a word for reading.
    Description, as the server wrote it
    Long-poll a question until it is answered or expires. Returns the state and, once answered, the chosen option value + label and the responder.

    Annotations the server declares

    • title: Wait for Answer
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • wait_for_approvalLong-poll an approval request until the human decides or it expires.No findings

    Why it is in this group

    • The name "wait_for_approval" says "wait": a word for reading.
    Description, as the server wrote it
    Long-poll an approval request until the human decides or it expires. Returns the status and, once decided, the chosen option.

    Annotations the server declares

    • title: Wait for Approval
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • wait_for_notificationLong-poll for the next ping.No findings

    Why it is in this group

    • The name "wait_for_notification" says "wait": a word for reading.
    Description, as the server wrote it
    Long-poll for the next ping. Blocks until one arrives or the timeout elapses — the real-time inbound channel for an agent. The agent's own sends are excluded.

    Annotations the server declares

    • title: Wait for Notification
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data.

Reads private data0
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write12
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out2
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Install

Pinned to version 0.1.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http pingroom https://api.pingroom.io/api/agent/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__pingroom__list_rooms",
      "mcp__pingroom__list_quick_actions",
      "mcp__pingroom__get_live_status",
      "mcp__pingroom__list_room_icons",
      "mcp__pingroom__list_notifications",
      "mcp__pingroom__get_notification",
      "mcp__pingroom__wait_for_notification",
      "mcp__pingroom__wait_for_ack",
      "mcp__pingroom__wait_for_approval",
      "mcp__pingroom__get_approval",
      "mcp__pingroom__wait_for_answer",
      "mcp__pingroom__get_question",
      "mcp__pingroom__list_questions",
      "mcp__pingroom__get_handoff",
      "mcp__pingroom__list_handoffs",
      "mcp__pingroom__get_attachment",
      "mcp__pingroom__get_room",
      "mcp__pingroom__list_webhooks"
    ],
    "ask": [
      "mcp__pingroom__connection_info",
      "mcp__pingroom__trigger_quick_action",
      "mcp__pingroom__broadcast",
      "mcp__pingroom__request_approval",
      "mcp__pingroom__ask_question",
      "mcp__pingroom__activate_agent_inbox",
      "mcp__pingroom__create_handoff",
      "mcp__pingroom__wait_for_handoff",
      "mcp__pingroom__upload_attachment",
      "mcp__pingroom__create_room",
      "mcp__pingroom__create_public_room",
      "mcp__pingroom__create_webhook"
    ],
    "deny": [
      "mcp__pingroom__disconnect",
      "mcp__pingroom__live_status",
      "mcp__pingroom__cancel_question",
      "mcp__pingroom__delete_attachment",
      "mcp__pingroom__join_room",
      "mcp__pingroom__update_webhook",
      "mcp__pingroom__delete_webhook",
      "mcp__pingroom__update_quick_action",
      "mcp__pingroom__update_quick_actions",
      "mcp__pingroom__set_avatar",
      "mcp__pingroom__rotate_handle"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as pingroom. Review it before you use it.

Capability tags behind 12 rules
  • mcp__pingroom__trigger_quick_action untrusted-input, outbound
  • mcp__pingroom__broadcast untrusted-input, outbound
  • mcp__pingroom__live_status untrusted-input
  • mcp__pingroom__request_approval untrusted-input
  • mcp__pingroom__ask_question untrusted-input
  • mcp__pingroom__cancel_question untrusted-input
  • mcp__pingroom__activate_agent_inbox untrusted-input
  • mcp__pingroom__create_handoff untrusted-input
  • mcp__pingroom__create_public_room untrusted-input
  • mcp__pingroom__join_room untrusted-input
  • mcp__pingroom__update_quick_action untrusted-input
  • mcp__pingroom__update_quick_actions untrusted-input