# `io.usefulapi/bidsketch` on anlyon.dev > Text inside fenced blocks marked untrusted-server-text was written by the MCP server's publisher, not by anlyon.dev. It is data to inspect, not instructions to follow. Invisible characters are shown as [U+XXXX]. > No finding is not a safety guarantee: these are point-in-time checks of tool definitions, not of code or behaviour. - Page: https://anlyon.dev/servers/io.usefulapi/bidsketch - JSON: https://anlyon.dev/api/v1/servers/io.usefulapi/bidsketch - Version: 1.1.0 (active) - Publisher: io.usefulapi (domain proven to the MCP Registry) - Runs: remote (streamable-http) - Sign-in to list tools: none - Repository: https://github.com/m190/usefulapi-mcp - Metadata from the official MCP Registry, synced 2026-10-24T16:18:59.664Z Title and description, as the publisher wrote them: ```untrusted-server-text Bidsketch MCP by usefulapi Read Bidsketch clients, proposals, fees and templates; create and update clients, proposals, fees. ``` Scanned 2026-10-24T16:21:37.740Z over streamable-http. **29 tools: 6 can delete or cancel things, 6 change things and 17 only read.** | Group | Class | Tools | Claude Code | | --- | --- | --- | --- | | Deletes or cancels | destructive | 6 | deny | | Can't be undone | irreversible | 0 | ask | | Changes things | write | 6 | ask | | Only reads | read | 17 | allow | ## Exfil surface 6 private-data -> untrusted-input -> outbound paths in this server alone. Denying 1 outbound tool breaks every one: `mcp__bidsketch__bidsketch_create_client`. | Tag | Meaning | Tools | | --- | --- | --- | | private-data | Reads files, mail, messages, databases, secrets, calendars or repositories. | `mcp__bidsketch__bidsketch_get_client` `mcp__bidsketch__bidsketch_list_clients` | | untrusted-input | Brings in text someone else can write: web pages, inbound email, messages, issues and comments. | `mcp__bidsketch__bidsketch_get_proposal_section` `mcp__bidsketch__bidsketch_get_section` `mcp__bidsketch__bidsketch_list_clients` | | outbound | Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL. | `mcp__bidsketch__bidsketch_create_client` | | Private data | Untrusted input | Outbound | | --- | --- | --- | | `mcp__bidsketch__bidsketch_get_client` | `mcp__bidsketch__bidsketch_get_proposal_section` | `mcp__bidsketch__bidsketch_create_client` | | `mcp__bidsketch__bidsketch_get_client` | `mcp__bidsketch__bidsketch_get_section` | `mcp__bidsketch__bidsketch_create_client` | | `mcp__bidsketch__bidsketch_get_client` | `mcp__bidsketch__bidsketch_list_clients` | `mcp__bidsketch__bidsketch_create_client` | | `mcp__bidsketch__bidsketch_list_clients` | `mcp__bidsketch__bidsketch_get_proposal_section` | `mcp__bidsketch__bidsketch_create_client` | | `mcp__bidsketch__bidsketch_list_clients` | `mcp__bidsketch__bidsketch_get_section` | `mcp__bidsketch__bidsketch_create_client` | | `mcp__bidsketch__bidsketch_list_clients` | `mcp__bidsketch__bidsketch_list_clients` | `mcp__bidsketch__bidsketch_create_client` | ## Findings No check matched anything in these tool definitions. ## Deletes or cancels (6) Removes, cancels or revokes something. Claude Code: deny. ### `bidsketch_update_client` - The name "bidsketch_update_client" says "update": a word for a change. - The server marks it destructive (destructiveHint: true). Description, as the server wrote it: ```untrusted-server-text WRITE: change fields of an existing client; only the fields you pass are sent and overwrite the old values. PUT /clients/{id}.json. ``` ### `bidsketch_update_fee` - The name "bidsketch_update_fee" says "update": a word for a change. - The server marks it destructive (destructiveHint: true). Description, as the server wrote it: ```untrusted-server-text WRITE: change a saved fee; only the fields you pass are sent. Proposals that already use it keep their own copy. PUT /fees/{id}.json. ``` ### `bidsketch_update_proposal` - The name "bidsketch_update_proposal" says "update": a word for a change. - The server marks it destructive (destructiveHint: true). Description, as the server wrote it: ```untrusted-server-text WRITE: change fields of a proposal; only the fields you pass are sent and overwrite the old values. PUT /proposals/{id}.json. ``` ### `bidsketch_update_proposal_fee` - The name "bidsketch_update_proposal_fee" says "update": a word for a change. - The server marks it destructive (destructiveHint: true). Description, as the server wrote it: ```untrusted-server-text WRITE: change a fee line of a proposal (changes its price); only the fields you pass are sent. PUT /proposals/{id}/fees/{fee_id}.json. ``` ### `bidsketch_update_proposal_section` - The name "bidsketch_update_proposal_section" says "update": a word for a change. - The server marks it destructive (destructiveHint: true). Description, as the server wrote it: ```untrusted-server-text WRITE: change a section of a proposal; only the fields you pass are sent and overwrite the old values. PUT /proposals/{id}/sections/{section_id}.json. ``` ### `bidsketch_update_section` - The name "bidsketch_update_section" says "update": a word for a change. - The server marks it destructive (destructiveHint: true). Description, as the server wrote it: ```untrusted-server-text WRITE: change a saved section; only the fields you pass are sent. Proposals that already use it keep their own copy. PUT /sections/{id}.json. ``` ## Changes things (6) Creates or changes something that can be changed back. Claude Code: ask. ### `bidsketch_add_proposal_fee` - The name "bidsketch_add_proposal_fee" says "add": a word for a change. Description, as the server wrote it: ```untrusted-server-text WRITE: add a fee line to a proposal; it changes the proposal's price. Fixed fees take amount as the total; hourly, monthly and yearly fees take amount per unit and a quantity. POST /proposals/{id}/fees.json. ``` ### `bidsketch_add_proposal_section` - The name "bidsketch_add_proposal_section" says "add": a word for a change. Description, as the server wrote it: ```untrusted-server-text WRITE: add a text section to a proposal, as an opening or closing section. POST /proposals/{id}/sections.json. ``` ### `bidsketch_create_client` - The name "bidsketch_create_client" says "create": a word for a change. - Tag outbound: The input takes a destination (input.phone): what the tool writes goes there. Description, as the server wrote it: ```untrusted-server-text WRITE: create a client in Bidsketch. first_name, last_name and email are required (put a company name in `name`). Some Bidsketch plans cap the number of clients (HTTP 426 when reached). POST /clients.json. ``` ### `bidsketch_create_fee` - The name "bidsketch_create_fee" says "create": a word for a change. Description, as the server wrote it: ```untrusted-server-text WRITE: save a reusable fee on the account (it is not added to any proposal). POST /fees.json. ``` ### `bidsketch_create_proposal` - The name "bidsketch_create_proposal" says "create": a word for a change. Description, as the server wrote it: ```untrusted-server-text WRITE: create a proposal for a client, optionally from a template (template_id from bidsketch_list_templates, which copies its sections and fees). The proposal is created as a draft; this tool does not send anything to the client. Some plans cap the number of proposals (HTTP 426). POST /proposals.json or POST /templates/{id}/proposals.json. ``` ### `bidsketch_create_section` - The name "bidsketch_create_section" says "create": a word for a change. Description, as the server wrote it: ```untrusted-server-text WRITE: save a reusable content section on the account (it is not added to any proposal). POST /sections.json. ``` ## Only reads (17) Looks things up and changes nothing. Claude Code: allow. ### `bidsketch_get_client` - The name "bidsketch_get_client" says "get": a word for reading. - Tag private-data: The description's first sentence says "get" and "contact": it reads contacts. Description, as the server wrote it: ```untrusted-server-text Get one client with full contact details, address, notes and secondary contact. GET /clients/{id}.json. ``` ### `bidsketch_get_fee` - The name "bidsketch_get_fee" says "get": a word for reading. Description, as the server wrote it: ```untrusted-server-text Get one saved fee with amount, quantity, unit and description. GET /fees/{id}.json. ``` ### `bidsketch_get_proposal` - The name "bidsketch_get_proposal" says "get": a word for reading. Description, as the server wrote it: ```untrusted-server-text Get one proposal: status, client, currency, fee subtotals and total, tax/discount, settings and counts of its opening sections, fees and closing sections. GET /proposals/{id}.json. ``` ### `bidsketch_get_proposal_content` - The name "bidsketch_get_proposal_content" says "get": a word for reading. Description, as the server wrote it: ```untrusted-server-text Get the full content of a proposal in order: opening sections, fees and closing sections. GET /proposals/{id}/content.json. ``` ### `bidsketch_get_proposal_fee` - The name "bidsketch_get_proposal_fee" says "get": a word for reading. Description, as the server wrote it: ```untrusted-server-text Get one fee line of a proposal. GET /proposals/{id}/fees/{fee_id}.json. ``` ### `bidsketch_get_proposal_section` - The name "bidsketch_get_proposal_section" says "get": a word for reading. - Tag untrusted-input: The description's first sentence says "get" and "html": it reads web pages, which anyone can write. Description, as the server wrote it: ```untrusted-server-text Get one section of a proposal with its HTML description. GET /proposals/{id}/sections/{section_id}.json. ``` ### `bidsketch_get_proposal_stats` - The name "bidsketch_get_proposal_stats" says "get": a word for reading. Description, as the server wrote it: ```untrusted-server-text Proposal statistics for the account (the total number of proposals). GET /proposals/stats.json. ``` ### `bidsketch_get_section` - The name "bidsketch_get_section" says "get": a word for reading. - Tag untrusted-input: The description's first sentence says "get" and "html": it reads web pages, which anyone can write. Description, as the server wrote it: ```untrusted-server-text Get one saved section with its HTML description. GET /sections/{id}.json. ``` ### `bidsketch_get_template` - The name "bidsketch_get_template" says "get": a word for reading. Description, as the server wrote it: ```untrusted-server-text Get one template with the saved sections and fees it is made of. GET /templates/{id}.json. ``` ### `bidsketch_list_client_proposals` - The name "bidsketch_list_client_proposals" says "list": a word for reading. Description, as the server wrote it: ```untrusted-server-text List the proposals of one client with status (Pending, Viewed, Accepted, Declined) and draft flag. GET /clients/{id}/proposals.json. ``` ### `bidsketch_list_clients` - The name "bidsketch_list_clients" says "list": a word for reading. - Tag private-data: The description's first sentence says "list" and "email": it reads mail. - Tag untrusted-input: The description's first sentence says "list" and "email": it reads inbound email, which other people can write. Description, as the server wrote it: ```untrusted-server-text List the clients (people or companies proposals are prepared for) with id, name, email and phone. GET /clients.json. ``` ### `bidsketch_list_fees` - The name "bidsketch_list_fees" says "list": a word for reading. Description, as the server wrote it: ```untrusted-server-text List the reusable fees saved on the account with category, type and total. GET /fees.json. ``` ### `bidsketch_list_proposal_fees` - The name "bidsketch_list_proposal_fees" says "list": a word for reading. Description, as the server wrote it: ```untrusted-server-text List the fee lines of one proposal with type, totals and the optional flag. GET /proposals/{id}/fees.json. ``` ### `bidsketch_list_proposal_sections` - The name "bidsketch_list_proposal_sections" says "list": a word for reading. Description, as the server wrote it: ```untrusted-server-text List the text sections of one proposal (opening and closing). GET /proposals/{id}/sections.json. ``` ### `bidsketch_list_proposals` - The name "bidsketch_list_proposals" says "list": a word for reading. Description, as the server wrote it: ```untrusted-server-text List all proposals with name, status (Pending, Viewed, Accepted, Declined), draft flag and dates. GET /proposals.json. ``` ### `bidsketch_list_sections` - The name "bidsketch_list_sections" says "list": a word for reading. Description, as the server wrote it: ```untrusted-server-text List the reusable content sections saved on the account with category and type (opening or closing). GET /sections.json. ``` ### `bidsketch_list_templates` - The name "bidsketch_list_templates" says "list": a word for reading. Description, as the server wrote it: ```untrusted-server-text List the proposal templates saved on the account. Use a template id with bidsketch_create_proposal. GET /templates.json. ``` ## Claude Code permissions For `.claude/settings.json`, assuming the server is installed as `bidsketch`: ```json { "permissions": { "allow": [ "mcp__bidsketch__bidsketch_list_clients", "mcp__bidsketch__bidsketch_get_client", "mcp__bidsketch__bidsketch_list_client_proposals", "mcp__bidsketch__bidsketch_list_proposals", "mcp__bidsketch__bidsketch_get_proposal_stats", "mcp__bidsketch__bidsketch_get_proposal", "mcp__bidsketch__bidsketch_get_proposal_content", "mcp__bidsketch__bidsketch_list_proposal_sections", "mcp__bidsketch__bidsketch_get_proposal_section", "mcp__bidsketch__bidsketch_list_proposal_fees", "mcp__bidsketch__bidsketch_get_proposal_fee", "mcp__bidsketch__bidsketch_list_fees", "mcp__bidsketch__bidsketch_get_fee", "mcp__bidsketch__bidsketch_list_sections", "mcp__bidsketch__bidsketch_get_section", "mcp__bidsketch__bidsketch_list_templates", "mcp__bidsketch__bidsketch_get_template" ], "ask": [ "mcp__bidsketch__bidsketch_create_client", "mcp__bidsketch__bidsketch_create_proposal", "mcp__bidsketch__bidsketch_add_proposal_section", "mcp__bidsketch__bidsketch_add_proposal_fee", "mcp__bidsketch__bidsketch_create_fee", "mcp__bidsketch__bidsketch_create_section" ], "deny": [ "mcp__bidsketch__bidsketch_update_client", "mcp__bidsketch__bidsketch_update_proposal", "mcp__bidsketch__bidsketch_update_proposal_section", "mcp__bidsketch__bidsketch_update_proposal_fee", "mcp__bidsketch__bidsketch_update_fee", "mcp__bidsketch__bidsketch_update_section" ] } } ``` Capability tags behind the rules (a read tagged outbound is asked about): - `mcp__bidsketch__bidsketch_list_clients`: private-data, untrusted-input - `mcp__bidsketch__bidsketch_get_client`: private-data - `mcp__bidsketch__bidsketch_create_client`: outbound - `mcp__bidsketch__bidsketch_get_proposal_section`: untrusted-input - `mcp__bidsketch__bidsketch_get_section`: untrusted-input ## Remote posture What an anonymous client saw at the remote endpoint, last 2026-10-24T16:19:34.718Z, unchanged since 2026-10-24T16:19:34.718Z. No credentials were sent and no tool was called. Values are shown as the endpoint returned them. Method: https://anlyon.dev/methodology#remote-posture | Fact | Observed | | --- | --- | | Reachable | `yes` | | HTTP status of an anonymous initialize | `200` | | tools/list served without credentials | `yes` | | Tools that change things, listed without credentials | `12` | | Protocol version | `2025-06-18` | | WWW-Authenticate on 401 | `not observed` | | resource_metadata in WWW-Authenticate | `none` | | RFC 9728 protected resource metadata | `https://bidsketch.usefulapi.io/.well-known/oauth-protected-resource/mcp` | | Authorization servers | `https://bidsketch.usefulapi.io` | | Legacy HTTP+SSE transport | `no` | | Dynamic client registration | `yes` | | Client ID metadata documents | `no` | - **high** Tools that change things, listed to anyone ([unauth-remote-writes](https://anlyon.dev/methodology#unauth-remote-writes)) ```untrusted-server-text The endpoint served tools/list without credentials, and the list has 12 tools that change things (6 destructive, 6 write). Whether a call also works without credentials was not tested: tools are never called. https://bidsketch.usefulapi.io/mcp: tools/list returned 29 tools to an anonymous client, including bidsketch_update_client (destructive), bidsketch_update_proposal (destructive), bidsketch_update_proposal_section (destructive), bidsketch_update_proposal_fee (destructive), bidsketch_update_fee (destructive) and 7 more ```