Skip to content
anlyon.dev

Basis Theory MCP by usefulapi

io.usefulapi/basis-theoryusefulapi.iostreamable-httpv1.16.4Scanned

Read token metadata, applications, audit logs, proxies and usage in the PCI vault.

17 tools: 17 only read.

Tools: 0 delete, 0 irreversible, 0 write, 17 read.
  • Reads private data · 2
  • Reads text others write · 1
  • Can send data out · 0
  • No findings

Tools listed without sign-in. Remote posture

Anlyon alternative

Run the operations that matter as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →
Compare with similar serversMarkdownJSONReport this listing

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

17 tools

Only reads 17Show 17 read-only tools
  • basis_theory_get_applicationFetch a single application with its type and permission list.No findings

    Why it is in this group

    • The name "basis_theory_get_application" says "get": a word for reading.
    Description, as the server wrote it
    Fetch a single application with its type and permission list. Basis Theory: GET /applications/{id}.

    Annotations the server declares

    • title: Get one application
    • readOnlyHint: true
  • basis_theory_get_proxyFetch a single proxy with its destination URL and transform configuration.Reads text others writeNo findings

    Why it is in this group

    • The name "basis_theory_get_proxy" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe description's first sentence says "fetch" and "url": it reads web pages, which anyone can write.
    Description, as the server wrote it
    Fetch a single proxy with its destination URL and transform configuration. Basis Theory: GET /proxies/{id}.

    Annotations the server declares

    • title: Get one proxy
    • readOnlyHint: true
  • basis_theory_get_reactorFetch a single reactor with its configuration.No findings

    Why it is in this group

    • The name "basis_theory_get_reactor" says "get": a word for reading.
    Description, as the server wrote it
    Fetch a single reactor with its configuration. Basis Theory: GET /reactors/{id}.

    Annotations the server declares

    • title: Get one reactor
    • readOnlyHint: true
  • basis_theory_get_tenantFetch the current tenant — name, id and settings.No findings

    Why it is in this group

    • The name "basis_theory_get_tenant" says "get": a word for reading.
    Description, as the server wrote it
    Fetch the current tenant — name, id and settings. Basis Theory: GET /tenants/self.

    Annotations the server declares

    • title: Get the tenant
    • readOnlyHint: true
  • basis_theory_get_tenant_usageFetch the tenant's usage report — token counts by type and container, and monthly API call volume.No findings

    Why it is in this group

    • The name "basis_theory_get_tenant_usage" says "get": a word for reading.
    Description, as the server wrote it
    Fetch the tenant's usage report — token counts by type and container, and monthly API call volume. Basis Theory: GET /tenants/self/reports/usage.

    Annotations the server declares

    • title: Get the tenant usage report
    • readOnlyHint: true
  • basis_theory_get_tokenFetch a single token by id.No findings

    Why it is in this group

    • The name "basis_theory_get_token" says "get": a word for reading.
    Description, as the server wrote it
    Fetch a single token by id. Returns metadata, container, fingerprint and timestamps. WARNING: if the configured API key carries a reveal permission, the response also contains the token's plaintext data — issue this server a read-only management key instead. Basis Theory: GET /tokens/{id}.

    Annotations the server declares

    • title: Get one token
    • readOnlyHint: true
  • basis_theory_list_applicationsList the applications (API-key holders) in the tenant, with their types and permissions.No findings

    Why it is in this group

    • The name "basis_theory_list_applications" says "list": a word for reading.
    Description, as the server wrote it
    List the applications (API-key holders) in the tenant, with their types and permissions. Basis Theory: GET /applications.

    Annotations the server declares

    • title: List applications
    • readOnlyHint: true
  • basis_theory_list_log_entity_typesList the entity types the audit log records — the valid values for entity_type.No findings

    Why it is in this group

    • The name "basis_theory_list_log_entity_types" says "list": a word for reading.
    Description, as the server wrote it
    List the entity types the audit log records — the valid values for entity_type. Basis Theory: GET /logs/entity-types.

    Annotations the server declares

    • title: List log entity types
    • readOnlyHint: true
  • basis_theory_list_logsList audit-log entries — who did what to which entity and when.No findings

    Why it is in this group

    • The name "basis_theory_list_logs" says "list": a word for reading.
    Description, as the server wrote it
    List audit-log entries — who did what to which entity and when. The tool for answering 'who touched this token?'. Basis Theory: GET /logs.

    Annotations the server declares

    • title: List audit logs
    • readOnlyHint: true
  • basis_theory_list_permissionsList the permissions that can be granted to an application, optionally for one application type.No findings

    Why it is in this group

    • The name "basis_theory_list_permissions" says "list": a word for reading.
    Description, as the server wrote it
    List the permissions that can be granted to an application, optionally for one application type. Basis Theory: GET /permissions.

    Annotations the server declares

    • title: List permissions
    • readOnlyHint: true
  • basis_theory_list_proxiesList the proxies that forward requests to third parties, detokenizing in flight.No findings

    Why it is in this group

    • The name "basis_theory_list_proxies" says "list": a word for reading.
    Description, as the server wrote it
    List the proxies that forward requests to third parties, detokenizing in flight. Basis Theory: GET /proxies.

    Annotations the server declares

    • title: List proxies
    • readOnlyHint: true
  • basis_theory_list_reactorsList reactors — the serverless functions that run against detokenized data inside the vault.Reads private dataNo findings

    Why it is in this group

    • The name "basis_theory_list_reactors" says "list": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "list" and "vault": it reads secrets.
    Description, as the server wrote it
    List reactors — the serverless functions that run against detokenized data inside the vault. Basis Theory: GET /reactors.

    Annotations the server declares

    • title: List reactors
    • readOnlyHint: true
  • basis_theory_list_rolesList the roles available for tenant members.No findings

    Why it is in this group

    • The name "basis_theory_list_roles" says "list": a word for reading.
    Description, as the server wrote it
    List the roles available for tenant members. Basis Theory: GET /roles.

    Annotations the server declares

    • title: List roles
    • readOnlyHint: true
  • basis_theory_list_tenant_membersList the people with access to the tenant, and their roles.No findings

    Why it is in this group

    • The name "basis_theory_list_tenant_members" says "list": a word for reading.
    Description, as the server wrote it
    List the people with access to the tenant, and their roles. Basis Theory: GET /tenants/self/members.

    Annotations the server declares

    • title: List tenant members
    • readOnlyHint: true
  • basis_theory_list_tokensList vault tokens as METADATA — id, type, container, fingerprint, metadata and timestamps.Reads private dataNo findings

    Why it is in this group

    • The name "basis_theory_list_tokens" says "list": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "list" and "vault": it reads secrets.
    Description, as the server wrote it
    List vault tokens as METADATA — id, type, container, fingerprint, metadata and timestamps. Does not return the underlying card number or PII. Basis Theory: GET /v2/tokens.

    Annotations the server declares

    • title: List tokens
    • readOnlyHint: true
  • basis_theory_search_tokensSearch tokens with Basis Theory's query syntax over metadata, e.g.No findings

    Why it is in this group

    • The name "basis_theory_search_tokens" says "search": a word for reading.
    Description, as the server wrote it
    Search tokens with Basis Theory's query syntax over metadata, e.g. metadata.customer_id:"cus_1". Returns metadata only. Read-only despite being a POST — the query goes in the body. Basis Theory: POST /v2/tokens/search.

    Annotations the server declares

    • title: Search tokens
    • readOnlyHint: true
  • basis_theory_whoamiReturn the application the configured BT-API-KEY belongs to — the fastest way to check which permissions this server actually has.No findings

    Why it is in this group

    • The name "basis_theory_whoami" says "whoami": a word for reading.
    Description, as the server wrote it
    Return the application the configured BT-API-KEY belongs to — the fastest way to check which permissions this server actually has. Basis Theory: GET /applications/key.

    Annotations the server declares

    • title: Identify the configured key
    • readOnlyHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged outbound.

Reads private data2
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write1
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out0
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Tools listed without sign-in

Looked at Oct 22, 2026, 15:23 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable
yes
HTTP status of an anonymous initialize
200
tools/list served without credentials
yes
Tools that change things, listed without credentials
0
Protocol version
2025-06-18
WWW-Authenticate on 401
not observed
resource_metadata in WWW-Authenticate
not observed
RFC 9728 protected resource metadata
https://basis-theory.usefulapi.io/.well-known/oauth-protected-resource/mcp
Authorization servers
https://basis-theory.usefulapi.io
Legacy HTTP+SSE transport
no
Dynamic client registration
yes
Client ID metadata documents
no

Findings

Matches of fixed checks, with the text they matched.

No check matched anything in these tool definitions. That is not a safety guarantee.

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 1.16.4. Values in angle brackets are yours to fill in.

claude mcp add --transport http basis-theory https://basis-theory.usefulapi.io/mcp
claude mcp add --transport http basis-theory https://basis-theory.usefulapi.io/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__basis-theory__basis_theory_list_tokens",
      "mcp__basis-theory__basis_theory_search_tokens",
      "mcp__basis-theory__basis_theory_get_token",
      "mcp__basis-theory__basis_theory_list_applications",
      "mcp__basis-theory__basis_theory_get_application",
      "mcp__basis-theory__basis_theory_whoami",
      "mcp__basis-theory__basis_theory_list_logs",
      "mcp__basis-theory__basis_theory_list_log_entity_types",
      "mcp__basis-theory__basis_theory_list_proxies",
      "mcp__basis-theory__basis_theory_get_proxy",
      "mcp__basis-theory__basis_theory_list_reactors",
      "mcp__basis-theory__basis_theory_get_reactor",
      "mcp__basis-theory__basis_theory_list_permissions",
      "mcp__basis-theory__basis_theory_list_roles",
      "mcp__basis-theory__basis_theory_get_tenant",
      "mcp__basis-theory__basis_theory_get_tenant_usage",
      "mcp__basis-theory__basis_theory_list_tenant_members"
    ],
    "ask": [],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as basis-theory. Review it before you use it.

Capability tags behind 3 rules
  • mcp__basis-theory__basis_theory_list_tokens private-data
  • mcp__basis-theory__basis_theory_get_proxy untrusted-input
  • mcp__basis-theory__basis_theory_list_reactors private-data

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/io.usefulapi/basis-theory/verify?hash=7fea519c624ae61e96b4269f0030bcae4e66edf82675ec86759f915e0db38b06" | jq -e '.changed == false'

Pinned hash 7fea519c624a, from Oct 22, 2026, 10:19 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/io.usefulapi/basis-theory/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for io.usefulapi/basis-theory
[![anlyon.dev](https://anlyon.dev/badge/io.usefulapi/basis-theory.svg)](https://anlyon.dev/servers/io.usefulapi/basis-theory)

Source: MCP Registry · repository. Synced Oct 22, 2026, 11:18 UTC.