Chatra MCP by usefulapi
io.usefulapi/chatrausefulapi.iostreamable-httpv1.0.0Scanned
Read and update Chatra visitors; send, edit and delete chat and pushed messages.
10 tools: 7 can delete or cancel things and 3 only read.
- Reads private data · 3
- Reads text others write · 10
- Can send data out · 4
- No findings
Anlyon alternative
7 of these tools change something. Run those as governed actions.
Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.
Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.
Import an OpenAPI spec →Tools
Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.
10 tools
Deletes or cancels 7Claude Code: deny
chatra_delete_messageWRITE, IRREVERSIBLE: delete an agent message from the conversation.Reads text others writeNo findings
Why it is in this group
- The name "chatra_delete_message" says "delete": a word for removing or ending something.
- The description says "IRREVERSIBLE".
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it WRITE, IRREVERSIBLE: delete an agent message from the conversation. Only agents' messages can be deleted, not visitors'. Returns the deleted message. DELETE /messages/{id}.
Annotations the server declares
- title: Delete agent message
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: true
chatra_delete_pushed_messageWRITE, IRREVERSIBLE: delete a pushed message sent earlier.Reads text others writeNo findings
Why it is in this group
- The name "chatra_delete_pushed_message" says "delete": a word for removing or ending something.
- The description says "IRREVERSIBLE".
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it WRITE, IRREVERSIBLE: delete a pushed message sent earlier. Returns the deleted message. DELETE /pushedMessages/{id}.
Annotations the server declares
- title: Delete pushed message
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: true
chatra_edit_messageWRITE: replace the text of an agent message that was sent earlier.Reads text others writeCan send data outNo findings
Why it is in this group
- The name "chatra_edit_message" says "edit": a word for a change.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe name "chatra_edit_message" says "edit" and "message": it writes something other people read.
Description, as the server wrote it WRITE: replace the text of an agent message that was sent earlier. Only agents' messages can be edited, not visitors'. The visitor sees the edited text. Returns the updated message. PUT /messages/{id}.
Annotations the server declares
- title: Edit agent message
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: true
chatra_edit_pushed_messageWRITE: replace the text of a pushed message sent earlier; the visitor sees the edited text.Reads text others writeCan send data outNo findings
Why it is in this group
- The name "chatra_edit_pushed_message" says "edit": a word for a change.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe name "chatra_edit_pushed_message" says "edit" and "message": it writes something other people read.
Description, as the server wrote it WRITE: replace the text of a pushed message sent earlier; the visitor sees the edited text. Returns the updated message. PUT /pushedMessages/{id}.
Annotations the server declares
- title: Edit pushed message
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: true
chatra_push_messageWRITE: send an automated message (order status, product update, announcement) to a visitor whose account is bound to Chatra through a clientId.Reads text others writeCan send data outNo findings
Why it is in this group
- The name "chatra_push_message" says "push": a word for a change.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe name "chatra_push_message" says "push" and "message": it writes something other people read.
Description, as the server wrote it WRITE: send an automated message (order status, product update, announcement) to a visitor whose account is bound to Chatra through a clientId. It is delivered into the visitor's chat on behalf of a random agent, a given agent (agent_id) or a random agent of a group (group_id). It reaches a real customer and cannot be unsent except by deleting it, so only call it with text the user asked you to send. Returns the new message with its id. POST /pushedMessages/.
Annotations the server declares
- title: Push message to a visitor
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: false
- openWorldHint: true
chatra_send_messageWRITE: send a chat message to a visitor as a Chatra agent.Reads text others writeCan send data outNo findings
Why it is in this group
- The name "chatra_send_message" says "send": a word for sending, and what is sent cannot be taken back.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe name "chatra_send_message" says "send": it sends or publishes something to other people.
Description, as the server wrote it WRITE: send a chat message to a visitor as a Chatra agent. The visitor sees it immediately in their chat window as if the agent typed it, so only call it with text the user asked you to send. It cannot be unsent except by deleting it. Say which agent writes: agent_id, or agent_email + agent_name + received_from (a dummy agent is created in Chatra when the email is unknown). For automated notices (order status, announcements) use chatra_push_message instead. Returns the new message with its id. POST /messages/.
Annotations the server declares
- title: Send message as an agent
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: false
- openWorldHint: true
chatra_update_visitorWRITE: edit a visitor's basic info (name, email, phone, notes) exactly as if an agent edited it in the Chatra dashboard.Reads text others writeNo findings
Why it is in this group
- The name "chatra_update_visitor" says "update": a word for a change.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it WRITE: edit a visitor's basic info (name, email, phone, notes) exactly as if an agent edited it in the Chatra dashboard. Only the fields you pass change; `null` removes a value. Returns the updated visitor. PUT /clients/{id}.
Annotations the server declares
- title: Update visitor
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: true
Only reads 3Show 3 read-only tools
chatra_get_messageOne chat message by id (a visitor's or an agent's): type (agent or client), text, visitor id, agent id, timestamp (ms) and receivedFrom.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "chatra_get_message" says "get": a word for reading.
What it can reach
- private-dataThe name "chatra_get_message" says "get" and "message": it reads messages.
- private-dataThe description's first sentence says "chat": it reads messages.
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe name "chatra_get_message" says "get" and "message": it reads messages, which other people can write.
- untrusted-inputThe description's first sentence says "chat": it reads messages, which other people can write.
Description, as the server wrote it One chat message by id (a visitor's or an agent's): type (agent or client), text, visitor id, agent id, timestamp (ms) and receivedFrom. Chatra has no endpoint to list a conversation, so the id must come from a send call or a webhook. GET /messages/{id}.
Annotations the server declares
- title: Get message
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
chatra_get_pushed_messageOne pushed (automated) message sent earlier by id: text, visitor id, agent id, timestamp (ms), isPushed.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "chatra_get_pushed_message" says "get": a word for reading.
What it can reach
- private-dataThe name "chatra_get_pushed_message" says "get" and "message": it reads messages.
- private-dataThe description's first sentence says "message": it reads messages.
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe name "chatra_get_pushed_message" says "get" and "message": it reads messages, which other people can write.
- untrusted-inputThe description's first sentence says "message": it reads messages, which other people can write.
Description, as the server wrote it One pushed (automated) message sent earlier by id: text, visitor id, agent id, timestamp (ms), isPushed. GET /pushedMessages/{id}.
Annotations the server declares
- title: Get pushed message
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
chatra_get_visitorA chat visitor by id: name and contact details (basicInfo, integrationData and the merged `info`), custom form answers, location, browser, the link to the chat in the Chatra dashbo…Reads private dataReads text others writeNo findings
Why it is in this group
- The name "chatra_get_visitor" says "get": a word for reading.
What it can reach
- private-dataThe description's first sentence says "chat": it reads messages.
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe description's first sentence says "chat": it reads messages, which other people can write.
Description, as the server wrote it A chat visitor by id: name and contact details (basicInfo, integrationData and the merged `info`), custom form answers, location, browser, the link to the chat in the Chatra dashboard, the agent group, and the pages viewed in the latest visit. The id is the `clientId` your website passed to the widget or the visitor id from a Chatra webhook; Chatra has no endpoint to list or search visitors. GET /clients/{id}.
Annotations the server declares
- title: Get visitor
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Exfil surface
Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.
120 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 3 private-data tools breaks every one.
- Reads private data3
- Reads files, mail, messages, databases, secrets, calendars or repositories.
- Reads text others write10
- Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
- Can send data out4
- Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
{
"permissions": {
"deny": [
"mcp__chatra__chatra_get_message",
"mcp__chatra__chatra_get_pushed_message",
"mcp__chatra__chatra_get_visitor"
]
}
}Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.
Findings
Matches of fixed checks, with the text they matched.
No check matched anything in these tool definitions. That is not a safety guarantee.
History
Changes to its tool definitions and to its remote endpoint, newest first.
No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.
Install
Pinned to version 1.0.0. Values in angle brackets are yours to fill in.
claude mcp add --transport http chatra https://chatra.usefulapi.io/mcpclaude mcp add --transport http chatra https://chatra.usefulapi.io/mcpRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__chatra__chatra_get_visitor",
"mcp__chatra__chatra_get_message",
"mcp__chatra__chatra_get_pushed_message"
],
"ask": [],
"deny": [
"mcp__chatra__chatra_update_visitor",
"mcp__chatra__chatra_send_message",
"mcp__chatra__chatra_edit_message",
"mcp__chatra__chatra_delete_message",
"mcp__chatra__chatra_push_message",
"mcp__chatra__chatra_edit_pushed_message",
"mcp__chatra__chatra_delete_pushed_message"
]
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as chatra. Review it before you use it.
Capability tags behind 10 rules
- mcp__chatra__chatra_get_visitor private-data, untrusted-input
- mcp__chatra__chatra_update_visitor untrusted-input
- mcp__chatra__chatra_get_message private-data, untrusted-input
- mcp__chatra__chatra_send_message untrusted-input, outbound
- mcp__chatra__chatra_edit_message untrusted-input, outbound
- mcp__chatra__chatra_delete_message untrusted-input
- mcp__chatra__chatra_get_pushed_message private-data, untrusted-input
- mcp__chatra__chatra_push_message untrusted-input, outbound
- mcp__chatra__chatra_edit_pushed_message untrusted-input, outbound
- mcp__chatra__chatra_delete_pushed_message untrusted-input
Pin
Keep the decision: fail CI when the tools change, follow every change, or show a badge.
Pin in CI
Fail a build when the tools you reviewed are not the tools the server serves today.
curl -s "https://anlyon.dev/api/v1/servers/io.usefulapi/chatra/verify?hash=720c5c37eedf85509df282598d8325c6ef86a67748c3a9c613afe7907cf0e722" | jq -e '.changed == false'Pinned hash 720c5c37eedf, from Oct 24, 2026, 11:18 UTC.
Watch
Get told when its tools change: a new tool, a new description, a new class.
https://anlyon.dev/servers/io.usefulapi/chatra/changes.xmlAn Atom feed. Works in any feed reader or Slack's RSS app.
Badge
[](https://anlyon.dev/servers/io.usefulapi/chatra)Source: MCP Registry · repository. Synced Oct 24, 2026, 11:18 UTC.