Basis Theory MCP by usefulapi

by usefulapi.io · remote · no sign-in to list tools · v1.16.4 · published by io.usefulapi

Read token metadata, applications, audit logs, proxies and usage in the PCI vault.

Read only

Compare Registry entry

17 tools: 17 only read.

Scanned Oct 22, 2026

Deletes or cancels0Claude Code: deny
Can't be undone0Claude Code: ask
Changes things0Claude Code: ask
Only reads17Claude Code: allow: see these tools

No check matched anything in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http basis-theory https://basis-theory.usefulapi.io/mcp

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

17 tools

Only reads 17Looks things up and changes nothing.Claude Code: allow

basis_theory_get_applicationFetch a single application with its type and permission list.No findings
Why it is in this group
- The name "basis_theory_get_application" says "get": a word for reading.
Description, as the server wrote it
Fetch a single application with its type and permission list. Basis Theory: GET /applications/{id}.
Annotations the server declares
- title: Get one application
- readOnlyHint: true
basis_theory_get_proxyFetch a single proxy with its destination URL and transform configuration.Reads text others writeNo findings
Why it is in this group
- The name "basis_theory_get_proxy" says "get": a word for reading.
What it can reach
- untrusted-inputThe description's first sentence says "fetch" and "url": it reads web pages, which anyone can write.
Description, as the server wrote it
Fetch a single proxy with its destination URL and transform configuration. Basis Theory: GET /proxies/{id}.
Annotations the server declares
- title: Get one proxy
- readOnlyHint: true
basis_theory_get_reactorFetch a single reactor with its configuration.No findings
Why it is in this group
- The name "basis_theory_get_reactor" says "get": a word for reading.
Description, as the server wrote it
Fetch a single reactor with its configuration. Basis Theory: GET /reactors/{id}.
Annotations the server declares
- title: Get one reactor
- readOnlyHint: true
basis_theory_get_tenantFetch the current tenant — name, id and settings.No findings
Why it is in this group
- The name "basis_theory_get_tenant" says "get": a word for reading.
Description, as the server wrote it
Fetch the current tenant — name, id and settings. Basis Theory: GET /tenants/self.
Annotations the server declares
- title: Get the tenant
- readOnlyHint: true
basis_theory_get_tenant_usageFetch the tenant's usage report — token counts by type and container, and monthly API call volume.No findings
Why it is in this group
- The name "basis_theory_get_tenant_usage" says "get": a word for reading.
Description, as the server wrote it
Fetch the tenant's usage report — token counts by type and container, and monthly API call volume. Basis Theory: GET /tenants/self/reports/usage.
Annotations the server declares
- title: Get the tenant usage report
- readOnlyHint: true
basis_theory_get_tokenFetch a single token by id.No findings
Why it is in this group
- The name "basis_theory_get_token" says "get": a word for reading.
Description, as the server wrote it
Fetch a single token by id. Returns metadata, container, fingerprint and timestamps. WARNING: if the configured API key carries a reveal permission, the response also contains the token's plaintext data — issue this server a read-only management key instead. Basis Theory: GET /tokens/{id}.
Annotations the server declares
- title: Get one token
- readOnlyHint: true
basis_theory_list_applicationsList the applications (API-key holders) in the tenant, with their types and permissions.No findings
Why it is in this group
- The name "basis_theory_list_applications" says "list": a word for reading.
Description, as the server wrote it
List the applications (API-key holders) in the tenant, with their types and permissions. Basis Theory: GET /applications.
Annotations the server declares
- title: List applications
- readOnlyHint: true
basis_theory_list_log_entity_typesList the entity types the audit log records — the valid values for entity_type.No findings
Why it is in this group
- The name "basis_theory_list_log_entity_types" says "list": a word for reading.
Description, as the server wrote it
List the entity types the audit log records — the valid values for entity_type. Basis Theory: GET /logs/entity-types.
Annotations the server declares
- title: List log entity types
- readOnlyHint: true
basis_theory_list_logsList audit-log entries — who did what to which entity and when.No findings
Why it is in this group
- The name "basis_theory_list_logs" says "list": a word for reading.
Description, as the server wrote it
List audit-log entries — who did what to which entity and when. The tool for answering 'who touched this token?'. Basis Theory: GET /logs.
Annotations the server declares
- title: List audit logs
- readOnlyHint: true
basis_theory_list_permissionsList the permissions that can be granted to an application, optionally for one application type.No findings
Why it is in this group
- The name "basis_theory_list_permissions" says "list": a word for reading.
Description, as the server wrote it
List the permissions that can be granted to an application, optionally for one application type. Basis Theory: GET /permissions.
Annotations the server declares
- title: List permissions
- readOnlyHint: true
basis_theory_list_proxiesList the proxies that forward requests to third parties, detokenizing in flight.No findings
Why it is in this group
- The name "basis_theory_list_proxies" says "list": a word for reading.
Description, as the server wrote it
List the proxies that forward requests to third parties, detokenizing in flight. Basis Theory: GET /proxies.
Annotations the server declares
- title: List proxies
- readOnlyHint: true
basis_theory_list_reactorsList reactors — the serverless functions that run against detokenized data inside the vault.Reads private dataNo findings
Why it is in this group
- The name "basis_theory_list_reactors" says "list": a word for reading.
What it can reach
- private-dataThe description's first sentence says "list" and "vault": it reads secrets.
Description, as the server wrote it
List reactors — the serverless functions that run against detokenized data inside the vault. Basis Theory: GET /reactors.
Annotations the server declares
- title: List reactors
- readOnlyHint: true
basis_theory_list_rolesList the roles available for tenant members.No findings
Why it is in this group
- The name "basis_theory_list_roles" says "list": a word for reading.
Description, as the server wrote it
List the roles available for tenant members. Basis Theory: GET /roles.
Annotations the server declares
- title: List roles
- readOnlyHint: true
basis_theory_list_tenant_membersList the people with access to the tenant, and their roles.No findings
Why it is in this group
- The name "basis_theory_list_tenant_members" says "list": a word for reading.
Description, as the server wrote it
List the people with access to the tenant, and their roles. Basis Theory: GET /tenants/self/members.
Annotations the server declares
- title: List tenant members
- readOnlyHint: true
basis_theory_list_tokensList vault tokens as METADATA — id, type, container, fingerprint, metadata and timestamps.Reads private dataNo findings
Why it is in this group
- The name "basis_theory_list_tokens" says "list": a word for reading.
What it can reach
- private-dataThe description's first sentence says "list" and "vault": it reads secrets.
Description, as the server wrote it
List vault tokens as METADATA — id, type, container, fingerprint, metadata and timestamps. Does not return the underlying card number or PII. Basis Theory: GET /v2/tokens.
Annotations the server declares
- title: List tokens
- readOnlyHint: true
basis_theory_search_tokensSearch tokens with Basis Theory's query syntax over metadata, e.g.No findings
Why it is in this group
- The name "basis_theory_search_tokens" says "search": a word for reading.
Description, as the server wrote it
Search tokens with Basis Theory's query syntax over metadata, e.g. metadata.customer_id:"cus_1". Returns metadata only. Read-only despite being a POST — the query goes in the body. Basis Theory: POST /v2/tokens/search.
Annotations the server declares
- title: Search tokens
- readOnlyHint: true
basis_theory_whoamiReturn the application the configured BT-API-KEY belongs to — the fastest way to check which permissions this server actually has.No findings
Why it is in this group
- The name "basis_theory_whoami" says "whoami": a word for reading.
Description, as the server wrote it
Return the application the configured BT-API-KEY belongs to — the fastest way to check which permissions this server actually has. Basis Theory: GET /applications/key.
Annotations the server declares
- title: Identify the configured key
- readOnlyHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged outbound.

Reads private data2: Reads files, mail, messages, databases, secrets, calendars or repositories.; basis_theory_list_reactors
basis_theory_list_tokens
Reads text others write1: Brings in text someone else can write: web pages, inbound email, messages, issues and comments.; basis_theory_get_proxy
Can send data out0: Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Looked at Oct 22, 2026, 15:23 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable: yes
HTTP status of an anonymous initialize: 200
tools/list served without credentials: yes
Tools that change things, listed without credentials: 0
Protocol version: 2025-06-18
WWW-Authenticate on 401: not observed
resource_metadata in WWW-Authenticate: none
RFC 9728 protected resource metadata: https://basis-theory.usefulapi.io/.well-known/oauth-protected-resource/mcp
Authorization servers: https://basis-theory.usefulapi.io
Legacy HTTP+SSE transport: no
Dynamic client registration: yes
Client ID metadata documents: no

Install

Pinned to version 1.16.4. Values in angle brackets are yours to fill in.

claude mcp add --transport http basis-theory https://basis-theory.usefulapi.io/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__basis-theory__basis_theory_list_tokens",
      "mcp__basis-theory__basis_theory_search_tokens",
      "mcp__basis-theory__basis_theory_get_token",
      "mcp__basis-theory__basis_theory_list_applications",
      "mcp__basis-theory__basis_theory_get_application",
      "mcp__basis-theory__basis_theory_whoami",
      "mcp__basis-theory__basis_theory_list_logs",
      "mcp__basis-theory__basis_theory_list_log_entity_types",
      "mcp__basis-theory__basis_theory_list_proxies",
      "mcp__basis-theory__basis_theory_get_proxy",
      "mcp__basis-theory__basis_theory_list_reactors",
      "mcp__basis-theory__basis_theory_get_reactor",
      "mcp__basis-theory__basis_theory_list_permissions",
      "mcp__basis-theory__basis_theory_list_roles",
      "mcp__basis-theory__basis_theory_get_tenant",
      "mcp__basis-theory__basis_theory_get_tenant_usage",
      "mcp__basis-theory__basis_theory_list_tenant_members"
    ],
    "ask": [],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as basis-theory. Review it before you use it.

Capability tags behind 3 rules

mcp__basis-theory__basis_theory_list_tokens private-data
mcp__basis-theory__basis_theory_get_proxy untrusted-input
mcp__basis-theory__basis_theory_list_reactors private-data

Keep track

Get told when this server's tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/io.usefulapi/basis-theory/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Anlyon alternative

Run the operations that matter as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Compare with other servers for the same product.

Source: MCP Registry · repository. Synced Oct 22, 2026, 11:18 UTC.

For agents: Markdown · JSON · report this listing