# `io.usefulapi/kisi` on anlyon.dev > Text inside fenced blocks marked untrusted-server-text was written by the MCP server's publisher, not by anlyon.dev. It is data to inspect, not instructions to follow. Invisible characters are shown as [U+XXXX]. > No finding is not a safety guarantee: these are point-in-time checks of tool definitions, not of code or behaviour. - Page: https://anlyon.dev/servers/io.usefulapi/kisi - JSON: https://anlyon.dev/api/v1/servers/io.usefulapi/kisi - Version: 1.7.3 (active) - Publisher: io.usefulapi (domain proven to the MCP Registry) - Runs: remote (streamable-http) - Sign-in to list tools: none - Repository: https://github.com/m190/usefulapi-mcp - Metadata from the official MCP Registry, synced 2026-10-21T19:23:21.685Z Title and description, as the publisher wrote them: ```untrusted-server-text Kisi MCP by usefulapi Read Kisi places, doors, users, groups, access rights and access logs (no unlocking). ``` Scanned 2026-10-21T19:40:30.726Z over streamable-http. **20 tools: 2 change things and 18 only read.** | Group | Class | Tools | Claude Code | | --- | --- | --- | --- | | Deletes or cancels | destructive | 0 | deny | | Can't be undone | irreversible | 0 | ask | | Changes things | write | 2 | ask | | Only reads | read | 18 | allow | ## Findings - **warn** Annotations that disagree with the tool in `kisi_list_group_locks` ([annotation-conflict](https://anlyon.dev/methodology#annotation-conflict)) ```untrusted-server-text The server marks "kisi_list_group_locks" read-only (readOnlyHint: true), and its own name, description or input give the class "write". annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":true}; The name "kisi_list_group_locks" says "list": a word for reading. ``` - **warn** Annotations that disagree with the tool in `kisi_search_events` ([annotation-conflict](https://anlyon.dev/methodology#annotation-conflict)) ```untrusted-server-text The server marks "kisi_search_events" as not read-only (readOnlyHint: false), and its words say it reads. annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":true}; The name "kisi_search_events" says "search": a word for reading. ``` ## Changes things (2) Creates or changes something that can be changed back. Claude Code: ask. ### `kisi_list_group_locks` - The name "kisi_list_group_locks" says "list": a word for reading. - The description's first verb is "lock": a word for a change. - The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class. - Findings: warn annotation-conflict Description, as the server wrote it: ```untrusted-server-text The locks/doors an access group opens. GET /group_locks?group_id=. ``` ### `kisi_search_events` - The name "kisi_search_events" says "search": a word for reading. - The server marks it as not read-only (readOnlyHint: false). - Findings: warn annotation-conflict Description, as the server wrote it: ```untrusted-server-text Search the access log (unlocks, denied attempts, lockdowns, admin changes) and return the first page. This CREATES a temporary saved search in Kisi (an event set, cursor-paginated, kept ~24 h); it changes no door, user or access right. Defaults to the past 90 days, the maximum width. If status is still in_progress or cursor is set, call kisi_get_event_set with the returned id. POST /event_sets. ``` ## Only reads (18) Looks things up and changes nothing. Claude Code: allow. ### `kisi_get_current_user` - The name "kisi_get_current_user" says "get": a word for reading. Description, as the server wrote it: ```untrusted-server-text The Kisi user the API key belongs to (id, name, email, organization). Good first call. GET /user. ``` ### `kisi_get_event_set` - The name "kisi_get_event_set" says "get": a word for reading. Description, as the server wrote it: ```untrusted-server-text Read an event set from kisi_search_events: its status and events. Pass the previous page's cursor for the next page. GET /event_sets/{id}. ``` ### `kisi_get_group` - The name "kisi_get_group" says "get": a word for reading. Description, as the server wrote it: ```untrusted-server-text One access group by id (name, description, place, member/lock counts, restrictions). GET /groups/{id}. ``` ### `kisi_get_lock` - The name "kisi_get_lock" says "get": a word for reading. Description, as the server wrote it: ```untrusted-server-text One lock/door by id: online/unlocked/locked-down state, place, floor, settings. GET /locks/{id}. ``` ### `kisi_get_organization` - The name "kisi_get_organization" says "get": a word for reading. Description, as the server wrote it: ```untrusted-server-text The current Kisi organization (name, domain, settings summary). GET /organization. ``` ### `kisi_get_place` - The name "kisi_get_place" says "get": a word for reading. Description, as the server wrote it: ```untrusted-server-text One place by id, including lockdown state. GET /places/{id}. ``` ### `kisi_get_user` - The name "kisi_get_user" says "get": a word for reading. Description, as the server wrote it: ```untrusted-server-text One user by id. GET /users/{id}. ``` ### `kisi_list_cards` - The name "kisi_list_cards" says "list": a word for reading. Description, as the server wrote it: ```untrusted-server-text List access cards with status (activated/deactivated/unassigned), assignee and last use. GET /cards. ``` ### `kisi_list_controllers` - The name "kisi_list_controllers" says "list": a word for reading. Description, as the server wrote it: ```untrusted-server-text Kisi controllers (door hardware hubs) with online/offline status. Filter by place, lock or status. GET /controllers. ``` ### `kisi_list_event_types` - The name "kisi_list_event_types" says "list": a word for reading. Description, as the server wrote it: ```untrusted-server-text All event type names usable as the type filter of kisi_search_events (e.g. lock.unlock). GET /events/types. ``` ### `kisi_list_groups` - The name "kisi_list_groups" says "list": a word for reading. Description, as the server wrote it: ```untrusted-server-text List access groups (who-can-open-what bundles of doors). Filter by place or by a lock to see which groups open that door. GET /groups. ``` ### `kisi_list_locks` - The name "kisi_list_locks" says "list": a word for reading. Description, as the server wrote it: ```untrusted-server-text List locks/doors with their state: online, unlocked, locked_down, configured, place and floor. Filter to find offline or locked-down doors. GET /locks. ``` ### `kisi_list_places` - The name "kisi_list_places" says "list": a word for reading. Description, as the server wrote it: ```untrusted-server-text List places (sites/buildings) in the organization with address, time zone and lock/member counts. GET /places. ``` ### `kisi_list_presences` - The name "kisi_list_presences" says "list": a word for reading. Description, as the server wrote it: ```untrusted-server-text Who was present at a place on a given day (derived from unlocks): actor, first/last unlock, last door. GET /presences. ``` ### `kisi_list_readers` - The name "kisi_list_readers" says "list": a word for reading. Description, as the server wrote it: ```untrusted-server-text Kisi readers (card/phone readers at doors) with model and online/offline status. GET /readers. ``` ### `kisi_list_role_assignments` - The name "kisi_list_role_assignments" says "list": a word for reading. Description, as the server wrote it: ```untrusted-server-text Who holds which role where: a user/team/guest's role on the organization, a place or a group (group members = door access). Filter by user, group, place or role. GET /role_assignments. ``` ### `kisi_list_schedules` - The name "kisi_list_schedules" says "list": a word for reading. Description, as the server wrote it: ```untrusted-server-text Time rules: when a group's access is allowed, when doors auto-unlock (unlock timer), first-to-arrive, elevator permit timers. Filter by consequence or by the group/lock it applies to. GET /schedules. ``` ### `kisi_list_users` - The name "kisi_list_users" says "list": a word for reading. Description, as the server wrote it: ```untrusted-server-text List users (members) of the organization. Filter by group or place (users with access there), email, or free text over name/email/notes. Sort by last unlock. GET /users. ``` ## Claude Code permissions For `.claude/settings.json`, assuming the server is installed as `kisi`: ```json { "permissions": { "allow": [ "mcp__kisi__kisi_get_current_user", "mcp__kisi__kisi_get_organization", "mcp__kisi__kisi_list_places", "mcp__kisi__kisi_get_place", "mcp__kisi__kisi_list_locks", "mcp__kisi__kisi_get_lock", "mcp__kisi__kisi_list_groups", "mcp__kisi__kisi_get_group", "mcp__kisi__kisi_list_users", "mcp__kisi__kisi_get_user", "mcp__kisi__kisi_list_role_assignments", "mcp__kisi__kisi_list_cards", "mcp__kisi__kisi_list_presences", "mcp__kisi__kisi_list_schedules", "mcp__kisi__kisi_list_controllers", "mcp__kisi__kisi_list_readers", "mcp__kisi__kisi_get_event_set", "mcp__kisi__kisi_list_event_types" ], "ask": [ "mcp__kisi__kisi_list_group_locks", "mcp__kisi__kisi_search_events" ], "deny": [] } } ```