Estuary Flow MCP by usefulapi

by usefulapi.io · remote · no sign-in to list tools · v1.16.4 · published by io.usefulapi

Inspect Estuary Flow captures, materializations, collections and stats.

Deletes · 3

Compare Registry entry

15 tools: 3 can delete or cancel things and 12 only read.

Scanned Oct 22, 2026

Deletes or cancels3Claude Code: deny: see these tools
Can't be undone0Claude Code: ask
Changes things0Claude Code: ask
Only reads12Claude Code: allow: see these tools

1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http estuary-flow https://estuary-flow.usefulapi.io/mcp

Findings

Matches of fixed checks, with the text they matched.

1 info

Infoestuary_list_roles
The description mentions "credential".
Matched text
description: "List the roles/capabilities the current credential is granted — which catalog prefixes it..."
What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

15 tools

Deletes or cancels 3Removes, cancels or revokes something.Claude Code: deny

estuary_create_draftWRITE: create a new empty draft workspace (a staging area for catalog changes; does not affect live pipelines).No findings
Why it is in this group
- The name "estuary_create_draft" says "create": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
WRITE: create a new empty draft workspace (a staging area for catalog changes; does not affect live pipelines). Estuary control-plane: POST /drafts. Returns the created row.
Annotations the server declares
- title: Create draft
- destructiveHint: true
estuary_publish_draftWRITE (DESTRUCTIVE when dry_run=false): publish a draft.Can send data outNo findings
Why it is in this group
- The name "estuary_publish_draft" says "publish": a word for a change that another call does not undo.
- The server marks it destructive (destructiveHint: true).
What it can reach
- outboundThe name "estuary_publish_draft" says "publish": it sends or publishes something to other people.
Description, as the server wrote it
WRITE (DESTRUCTIVE when dry_run=false): publish a draft. dry_run=true (default) only VALIDATES the draft without changing anything. dry_run=false APPLIES the draft to the LIVE catalog — this can create, modify, or DELETE running data pipelines and their data. Set dry_run=false only when you intend to change live infrastructure. Estuary control-plane: POST /publications. Returns the publication row.
Annotations the server declares
- title: Publish draft
- destructiveHint: true
estuary_upsert_draft_specWRITE: stage (insert or replace) a catalog spec inside a draft.No findings
Why it is in this group
- The name "estuary_upsert_draft_spec" says "upsert": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
WRITE: stage (insert or replace) a catalog spec inside a draft. Edits only the draft — live pipelines are unaffected until the draft is published. Estuary control-plane: POST /draft_specs (upsert on draft_id,catalog_name). Returns the staged row.
Annotations the server declares
- title: Upsert draft spec
- destructiveHint: true

Only reads 12Looks things up and changes nothing.Claude Code: allow

estuary_get_catalog_specGet one live catalog entity by its exact catalog_name, including the full serialized `spec` and compiled `built_spec`.No findings
Why it is in this group
- The name "estuary_get_catalog_spec" says "get": a word for reading.
Description, as the server wrote it
Get one live catalog entity by its exact catalog_name, including the full serialized `spec` and compiled `built_spec`. Estuary control-plane view live_specs_ext. PostgREST: GET /live_specs_ext?catalog_name=eq.<name>&limit=1.
Annotations the server declares
- title: Get catalog spec
- readOnlyHint: true
estuary_get_catalog_statsGet usage/throughput stats for one catalog entity — bytes & docs read/written (both directions), usage_seconds, warnings/errors/failures, and txn_count — per time grain.Reads private dataNo findings
Why it is in this group
- The name "estuary_get_catalog_stats" says "get": a word for reading.
What it can reach
- private-dataThe description's first sentence says "get" and "doc": it reads documents.
Description, as the server wrote it
Get usage/throughput stats for one catalog entity — bytes & docs read/written (both directions), usage_seconds, warnings/errors/failures, and txn_count — per time grain. Optionally bound by a timestamp range. Estuary control-plane view catalog_stats. PostgREST: GET /catalog_stats.
Annotations the server declares
- title: Get catalog stats
- readOnlyHint: true
estuary_get_tenantGet the user's tenant(s) — quotas (tasks/collections), billing tiers, recurring charge, trial start, and payment provider.No findings
Why it is in this group
- The name "estuary_get_tenant" says "get": a word for reading.
Description, as the server wrote it
Get the user's tenant(s) — quotas (tasks/collections), billing tiers, recurring charge, trial start, and payment provider. Estuary control-plane table tenants. PostgREST: GET /tenants.
Annotations the server declares
- title: Get tenant
- readOnlyHint: true
estuary_list_catalogList live catalog entities (captures, collections, materializations, tests) the user can read, with connector + last-publication metadata.No findings
Why it is in this group
- The name "estuary_list_catalog" says "list": a word for reading.
Description, as the server wrote it
List live catalog entities (captures, collections, materializations, tests) the user can read, with connector + last-publication metadata. Optionally filter by a catalog-name prefix and spec_type. Estuary control-plane view live_specs_ext. PostgREST: GET /live_specs_ext.
Annotations the server declares
- title: List catalog entities
- readOnlyHint: true
estuary_list_connector_versionsList available versions (image tags) of connectors, with protocol and documentation URL.Reads text others writeNo findings
Why it is in this group
- The name "estuary_list_connector_versions" says "list": a word for reading.
What it can reach
- untrusted-inputThe description's first sentence says "list" and "url": it reads web pages, which anyone can write.
Description, as the server wrote it
List available versions (image tags) of connectors, with protocol and documentation URL. Optionally filter by connector_id. Estuary control-plane table connector_tags. PostgREST: GET /connector_tags.
Annotations the server declares
- title: List connector versions
- readOnlyHint: true
estuary_list_connectorsList the connector catalog — available capture/materialization Docker connectors, with titles, descriptions, and logos.No findings
Why it is in this group
- The name "estuary_list_connectors" says "list": a word for reading.
Description, as the server wrote it
List the connector catalog — available capture/materialization Docker connectors, with titles, descriptions, and logos. Optionally filter to recommended connectors. Estuary control-plane table connectors. PostgREST: GET /connectors.
Annotations the server declares
- title: List connectors
- readOnlyHint: true
estuary_list_discoversList connector discovery jobs (auto-detecting bindings/resources for a capture).No findings
Why it is in this group
- The name "estuary_list_discovers" says "list": a word for reading.
Description, as the server wrote it
List connector discovery jobs (auto-detecting bindings/resources for a capture). Estuary control-plane table discovers. PostgREST: GET /discovers.
Annotations the server declares
- title: List discovers
- readOnlyHint: true
estuary_list_draft_specsList the staged spec entries within a draft (each an insert/replace of a catalog entity pending publication).No findings
Why it is in this group
- The name "estuary_list_draft_specs" says "list": a word for reading.
Description, as the server wrote it
List the staged spec entries within a draft (each an insert/replace of a catalog entity pending publication). Estuary control-plane table draft_specs. PostgREST: GET /draft_specs.
Annotations the server declares
- title: List draft specs
- readOnlyHint: true
estuary_list_draftsList the user's draft workspaces (staging areas for catalog edits before publishing).No findings
Why it is in this group
- The name "estuary_list_drafts" says "list": a word for reading.
Description, as the server wrote it
List the user's draft workspaces (staging areas for catalog edits before publishing). Estuary control-plane table drafts. PostgREST: GET /drafts.
Annotations the server declares
- title: List drafts
- readOnlyHint: true
estuary_list_publicationsList publication history/status — each publish attempt of a draft; job_status carries the queued/success/failed outcome.No findings
Why it is in this group
- The name "estuary_list_publications" says "list": a word for reading.
Description, as the server wrote it
List publication history/status — each publish attempt of a draft; job_status carries the queued/success/failed outcome. Estuary control-plane table publications. PostgREST: GET /publications.
Annotations the server declares
- title: List publications
- readOnlyHint: true
estuary_list_rolesList the roles/capabilities the current credential is granted — which catalog prefixes it can read/write/admin.Reads private data1 finding
Why it is in this group
- The name "estuary_list_roles" says "list": a word for reading.
What it can reach
- private-dataThe description's first sentence says "list" and "credential": it reads secrets.
Findings
- Info
  The description mentions "credential".
  Matched text
  description: "List the roles/capabilities the current credential is granted — which catalog prefixes it..."
  What this check looks for
Description, as the server wrote it
List the roles/capabilities the current credential is granted — which catalog prefixes it can read/write/admin. Read-only RPC. Estuary control-plane: POST /rpc/auth_roles.
Annotations the server declares
- title: List roles
- readOnlyHint: true
estuary_view_task_logsFetch the log lines for a job by its logs_token (a UUID found on a publication, discover, or connector-tag record).No findings
Why it is in this group
- The name "estuary_view_task_logs" says "view": a word for reading.
Description, as the server wrote it
Fetch the log lines for a job by its logs_token (a UUID found on a publication, discover, or connector-tag record). Optionally page from a last-seen timestamp. Read-only RPC. Estuary control-plane: POST /rpc/view_logs.
Annotations the server declares
- title: View task logs
- readOnlyHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

2 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 1 outbound tool breaks every one.

Reads private data2: Reads files, mail, messages, databases, secrets, calendars or repositories.; estuary_get_catalog_stats
estuary_list_roles
Reads text others write1: Brings in text someone else can write: web pages, inbound email, messages, issues and comments.; estuary_list_connector_versions
Can send data out1: Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.; estuary_publish_draft

deny to break every path

{
  "permissions": {
    "deny": [
      "mcp__estuary-flow__estuary_publish_draft"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Install

Pinned to version 1.16.4. Values in angle brackets are yours to fill in.

claude mcp add --transport http estuary-flow https://estuary-flow.usefulapi.io/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__estuary-flow__estuary_list_catalog",
      "mcp__estuary-flow__estuary_get_catalog_spec",
      "mcp__estuary-flow__estuary_get_catalog_stats",
      "mcp__estuary-flow__estuary_list_connectors",
      "mcp__estuary-flow__estuary_list_connector_versions",
      "mcp__estuary-flow__estuary_list_drafts",
      "mcp__estuary-flow__estuary_list_draft_specs",
      "mcp__estuary-flow__estuary_list_publications",
      "mcp__estuary-flow__estuary_list_discovers",
      "mcp__estuary-flow__estuary_list_roles",
      "mcp__estuary-flow__estuary_get_tenant",
      "mcp__estuary-flow__estuary_view_task_logs"
    ],
    "ask": [],
    "deny": [
      "mcp__estuary-flow__estuary_create_draft",
      "mcp__estuary-flow__estuary_upsert_draft_spec",
      "mcp__estuary-flow__estuary_publish_draft"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as estuary-flow. Review it before you use it.

Capability tags behind 4 rules

mcp__estuary-flow__estuary_get_catalog_stats private-data
mcp__estuary-flow__estuary_list_connector_versions untrusted-input
mcp__estuary-flow__estuary_list_roles private-data
mcp__estuary-flow__estuary_publish_draft outbound

Keep track

Get told when this server's tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/io.usefulapi/estuary-flow/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Anlyon alternative

3 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Compare with other servers for the same product.

Source: MCP Registry · repository. Synced Oct 22, 2026, 11:18 UTC.

For agents: Markdown · JSON · report this listing