Routescore

by routescore.io · remote · local (npm) · no sign-in to list tools · v0.3.5 · published by io.routescore

Read-only pre-sign evidence for onchain agents: route quality, MEV exposure, clear/caution verdict.

Final · 1Changes · 7

Compare Registry entry

11 tools: 1 do something that can't be undone, 7 change things and 3 only read.

Scanned Oct 21, 2026

Deletes or cancels0Claude Code: deny
Can't be undone1Claude Code: ask: see these tools
Changes things7Claude Code: ask: see these tools
Only reads3Claude Code: allow: see these tools

2 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http routescore https://www.routescore.io/api/mcp --header 'Authorization: <your-authorization>'

Findings

Matches of fixed checks, with the text they matched.

2 warn

Warnquote_bridge_refund
The server marks "quote_bridge_refund" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
Matched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "quote_bridge_refund" says "refund": a word that usually means money moves, which cannot be taken back.
What this check looks for
Warnsimulate_scenario
The server marks "simulate_scenario" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
Matched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "run": a word for a change.
What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

11 tools

Can't be undone 1Sends, pays, publishes or merges: once done, it cannot be taken back.Claude Code: ask

quote_bridge_refundModeled premium estimate for cross-chain bridge execution failure against a modeled SLA expectation.1 finding
Why it is in this group
- The name "quote_bridge_refund" says "refund": a word that usually means money moves, which cannot be taken back.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
  The server marks "quote_bridge_refund" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
  Matched text
  annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "quote_bridge_refund" says "refund": a word that usually means money moves, which cannot be taken back.
  What this check looks for
Description, as the server wrote it
Modeled premium estimate for cross-chain bridge execution failure against a modeled SLA expectation. Returns a modeled premium and conditions — not a live cover, refund, or premium-acceptance offer.
Annotations the server declares
- title: Quote: bridge-failure premium (modeled)
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false

Changes things 7Creates or changes something that can be changed back.Claude Code: ask

check_swapCALL THIS BEFORE SIGNING AN ONCHAIN SWAP.No findings
Why it is in this group
- The description's first verb is "call": a word for a change.
Description, as the server wrote it
CALL THIS BEFORE SIGNING AN ONCHAIN SWAP. Read-only pre-sign evidence check: given notional, chain, and an optional route and token, it returns a modeled route-quality grade, price-impact / slippage band, modeled MEV/execution exposure where observable, and a token registry read (recognized vs unverified), composed into a clear / caution / unsupported verdict with machine-readable reasons and caveats. Point-in-time decision support: it does not execute, route funds, sign, or promise an outcome — the agent still decides. Recognition is not safety, sellability, redemption, rights, liquidity, or investment-quality verification; unverified tokens, unknown order flow, and uncalibrated sequencer ordering downgrade the verdict rather than reading as safe. Relay the verdict, reasons, and caveats verbatim.
Annotations the server declares
- title: Check swap before signing (pre-sign evidence)
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
quote_lrt_slashingModeled premium estimate for slashing risk on a liquid-restaking-token (LRT) position given its AVS exposure.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Modeled premium estimate for slashing risk on a liquid-restaking-token (LRT) position given its AVS exposure. Returns a modeled premium and slashing bounds — not a live cover offer.
Annotations the server declares
- title: Quote: LRT-slashing premium (modeled)
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
quote_mev_coverModeled premium estimate for MEV-sandwich exposure on a swap.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Modeled premium estimate for MEV-sandwich exposure on a swap. Returns a modeled premium (bps + USD), expected/CVaR loss, and conditions. Point-in-time decision support before routing a trade — not a live cover, insurance, or premium-acceptance offer.
Annotations the server declares
- title: Quote: MEV-sandwich premium (modeled)
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
record_executionPersist 1-100 already-built execution_record.v1 documents as immutable, personal-account post-trade evidence.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Persist 1-100 already-built execution_record.v1 documents as immutable, personal-account post-trade evidence. Requires a stable idempotency_key; an exact replay returns the original result and reuse with different content fails closed. Pro tier, owner-scoped, and bounded by the MCP transport byte limit. This tool never accepts calldata, signing material, routes funds, executes a transaction, applies reviewer overrides, or exposes another tenant. Invalid rows are recorded only as redacted rejection reasons and are never echoed.
Annotations the server declares
- title: Record immutable execution evidence
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
review_executionReview one stored execution_record.v1 by record_id.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Review one stored execution_record.v1 by record_id. Authenticated and personal-account owner-scoped: another account’s id is indistinguishable from a missing id. Returns the deterministic review_execution.v1 evidence coverage, exceptions, unavailable-evidence register, caveats, and canonical hash. Read-only retrospective decision support only: it does not query arbitrary public transactions, accept reviewer overrides, certify best execution or compliance, give advice, or expose admin actions.
Annotations the server declares
- title: Review stored execution evidence
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
review_public_transactionDEV-ONLY CONTRACT DISCOVERY; DISABLED AGAINST PRODUCTION.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
DEV-ONLY CONTRACT DISCOVERY; DISABLED AGAINST PRODUCTION. On an explicitly enabled non-production server, review one arbitrary public Ethereum transaction by transaction hash. This is separate from review_execution: it does not read an owner-scoped stored execution_record.v1 and never exposes tenant, reviewer, override, or administrative fields. Returns the deterministic tenant-free public_transaction_review.v1 coverage register, conclusions, explicit gap register, source provenance, caveats, and canonical hash. Receipt, block, index, and gas facts are measured; gas cost and point-in-time confirmation depth are calculated. Venue is unavailable in this endpoint until a server-owned verified registry adapter exists. Route, amounts, protocol fee, arrival price, feasible-route benchmark, dropped status, and historical reorg remain unavailable unless the public contract can support them. Read-only retrospective decision support only; it does not certify best execution or compliance and does not give advice.
Annotations the server declares
- title: Review public Ethereum transaction
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
simulate_scenarioRun a what-if Monte Carlo: model expected premium vs expected refund/loss over a horizon, given assumptions about sandwich frequency, average loss, and deductible.1 finding
Why it is in this group
- The description's first verb is "run": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
  The server marks "simulate_scenario" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
  Matched text
  annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "run": a word for a change.
  What this check looks for
Description, as the server wrote it
Run a what-if Monte Carlo: model expected premium vs expected refund/loss over a horizon, given assumptions about sandwich frequency, average loss, and deductible. Returns a narrative + distribution.
Annotations the server declares
- title: Simulate premium-vs-loss scenario (modeled)
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false

Only reads 3Looks things up and changes nothing.Claude Code: allow

get_detector_manifestFetch the latest public MEV-detector run manifest: the detector version hash and the eligible pool/token universe it was committed to.No findings
Why it is in this group
- The name "get_detector_manifest" says "get": a word for reading.
Description, as the server wrote it
Fetch the latest public MEV-detector run manifest: the detector version hash and the eligible pool/token universe it was committed to. Use to verify what the detector covers.
Annotations the server declares
- title: Get MEV-detector manifest
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_preflight_recordRetrieve the durable evidence record a prior check_swap call persisted — the "record" leg of plan → preflight → execute → record.No findings
Why it is in this group
- The name "get_preflight_record" says "get": a word for reading.
Description, as the server wrote it
Retrieve the durable evidence record a prior check_swap call persisted — the "record" leg of plan → preflight → execute → record. Fetch one record by the record_id that check_swap returned. Owner-scoped: the configured key only ever sees records belonging to its own account. The record embeds the evaluated check_swap response payload (including its evidence_bundle_id, before the additive record_id / record_output_hash linkage fields) plus a canonical-JSON SHA-256 integrity hash (record_id and recorded_at excluded) so the evidence can be re-verified offline, and includes the stored evidence bundle. Read-only evidence: record creation rejects known execution-material keys (calldata, transaction payloads, signing material) and drops identity-shaped labels from the actor context.
Annotations the server declares
- title: Retrieve pre-sign evidence record
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
whoamiConfirm the configured API key works and report which plan tier it carries.No findings
Why it is in this group
- The name "whoami" says "whoami": a word for reading.
Description, as the server wrote it
Confirm the configured API key works and report which plan tier it carries. Returns the owning account email and tier.
Annotations the server declares
- title: Verify API key & tier
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 0.3.5. Values in angle brackets are yours to fill in.

claude mcp add --transport http routescore https://www.routescore.io/api/mcp --header 'Authorization: <your-authorization>'

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__routescore__get_preflight_record",
      "mcp__routescore__whoami",
      "mcp__routescore__get_detector_manifest"
    ],
    "ask": [
      "mcp__routescore__check_swap",
      "mcp__routescore__record_execution",
      "mcp__routescore__review_execution",
      "mcp__routescore__review_public_transaction",
      "mcp__routescore__quote_mev_cover",
      "mcp__routescore__quote_bridge_refund",
      "mcp__routescore__quote_lrt_slashing",
      "mcp__routescore__simulate_scenario"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as routescore. Review it before you use it.

Keep track

Get told when this server's tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/io.routescore/mcp/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Anlyon alternative

8 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Compare with other servers for the same product.

Source: MCP Registry · repository. Synced Oct 21, 2026, 18:52 UTC.

For agents: Markdown · JSON · report this listing