Tokeet MCP by usefulapi

by usefulapi.io · remote · no sign-in to list tools · v1.3.4 · published by io.usefulapi

Read Tokeet rentals, rates, guests, tasks and expenses; add guests, notes and tasks.

Deletes · 2Changes · 5

Compare Registry entry

24 tools: 2 can delete or cancel things, 5 change things and 17 only read.

Scanned Oct 22, 2026

Deletes or cancels2Claude Code: deny: see these tools
Can't be undone0Claude Code: ask
Changes things5Claude Code: ask: see these tools
Only reads17Claude Code: allow: see these tools

1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http tokeet https://tokeet.usefulapi.io/mcp

Findings

Matches of fixed checks, with the text they matched.

1 warn

Warntokeet_get_rental_availability
The server marks "tokeet_get_rental_availability" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
Matched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":true}; The name "tokeet_get_rental_availability" says "get": a word for reading.
What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

24 tools

Deletes or cancels 2Removes, cancels or revokes something.Claude Code: deny

tokeet_update_guestWRITE: change fields of a guest (name, address, birthday, spouse, kids, drink, hobby, sport).Reads text others writeNo findings
Why it is in this group
- The name "tokeet_update_guest" says "update": a word for a change.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
WRITE: change fields of a guest (name, address, birthday, spouse, kids, drink, hobby, sport). Only the fields you pass are sent, and each one OVERWRITES the stored value (an address object replaces the whole address). Emails and phones have their own endpoints and are not changed here. PUT /guest/{guest_pkey}.
Annotations the server declares
- title: Update guest
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: true
tokeet_update_taskWRITE: change a task: rename, move to another list, reschedule, edit notes, reassign, or mark it completed (status 2) or active (1).Reads text others writeNo findings
Why it is in this group
- The name "tokeet_update_task" says "update": a word for a change.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
WRITE: change a task: rename, move to another list, reschedule, edit notes, reassign, or mark it completed (status 2) or active (1). Only the fields you pass are sent and each OVERWRITES the stored value. PUT /task/{task_pkey}.
Annotations the server declares
- title: Update task
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: true

Changes things 5Creates or changes something that can be changed back.Claude Code: ask

tokeet_add_guest_noteWRITE: add an internal note to a guest record (not visible to or sent to the guest).Reads text others writeNo findings
Why it is in this group
- The name "tokeet_add_guest_note" says "add": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
WRITE: add an internal note to a guest record (not visible to or sent to the guest). POST /guest/{guest_pkey}/note.
Annotations the server declares
- title: Add guest note
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
tokeet_create_guestWRITE: create a guest record (name and email required, the rest optional).Reads text others writeCan send data outNo findings
Why it is in this group
- The name "tokeet_create_guest" says "create": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a destination (input.phone): what the tool writes goes there.
Description, as the server wrote it
WRITE: create a guest record (name and email required, the rest optional). Nothing is sent to the guest. Tokeet cannot recover deleted data and this server cannot delete guests. POST /guest.
Annotations the server declares
- title: Create guest
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
tokeet_create_taskWRITE: create a task (to-do) in the account, optionally linked to an inquiry and assigned to a user.Reads text others writeNo findings
Why it is in this group
- The name "tokeet_create_task" says "create": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
WRITE: create a task (to-do) in the account, optionally linked to an inquiry and assigned to a user. `due` is an epoch timestamp: use the same unit as the `due` of existing tasks from tokeet_list_tasks. No message is sent to anyone by this call. POST /task.
Annotations the server declares
- title: Create task
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
tokeet_get_rental_availabilityThe open and blocked dates of one rental over the next two years.Reads text others write1 finding
Why it is in this group
- The name "tokeet_get_rental_availability" says "get": a word for reading.
- The description's first verb is "open": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Findings
- Warn
  The server marks "tokeet_get_rental_availability" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
  Matched text
  annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":true}; The name "tokeet_get_rental_availability" says "get": a word for reading.
  What this check looks for
Description, as the server wrote it
The open and blocked dates of one rental over the next two years. GET /rental/{rental_pkey}/availability.
Annotations the server declares
- title: Get rental availability
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
tokeet_record_guest_interactionWRITE: log an interaction you had with a guest (phone call, meeting or comment) in the guest's history.Reads text others writeNo findings
Why it is in this group
- The description's first verb is "write": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
WRITE: log an interaction you had with a guest (phone call, meeting or comment) in the guest's history. Nothing is sent to the guest. `date` is an epoch timestamp: use the same unit as the dates you see on existing interactions from tokeet_get_guest. POST /guest/{guest_pkey}/interaction.
Annotations the server declares
- title: Record guest interaction
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true

Only reads 17Looks things up and changes nothing.Claude Code: allow

tokeet_get_current_userThe Tokeet user the API key belongs to (name, email, role).Reads private dataReads text others writeNo findings
Why it is in this group
- The name "tokeet_get_current_user" says "get": a word for reading.
What it can reach
- private-dataThe description's first sentence says "email": it reads mail.
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe description's first sentence says "email": it reads inbound email, which other people can write.
Description, as the server wrote it
The Tokeet user the API key belongs to (name, email, role). Login data is never returned. GET /user/me.
Annotations the server declares
- title: Get current user
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
tokeet_get_expenseOne expense by id.Reads text others writeNo findings
Why it is in this group
- The name "tokeet_get_expense" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
One expense by id. GET /expense/{expense_pkey}.
Annotations the server declares
- title: Get expense
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
tokeet_get_guestOne guest by id: contact details, notes, interactions and preferences.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "tokeet_get_guest" says "get": a word for reading.
What it can reach
- private-dataThe description's first sentence says "contact": it reads contacts.
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
One guest by id: contact details, notes, interactions and preferences. GET /guest/{pkey}.
Annotations the server declares
- title: Get guest
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
tokeet_get_guest_by_emailThe guest whose primary email is exactly this address.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "tokeet_get_guest_by_email" says "get": a word for reading.
What it can reach
- private-dataThe name "tokeet_get_guest_by_email" says "get" and "email": it reads mail.
- private-dataThe description's first sentence says "email": it reads mail.
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe name "tokeet_get_guest_by_email" says "get" and "email": it reads inbound email, which other people can write.
- untrusted-inputThe description's first sentence says "email": it reads inbound email, which other people can write.
Description, as the server wrote it
The guest whose primary email is exactly this address. GET /guest/email/{email}.
Annotations the server declares
- title: Get guest by email
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
tokeet_get_rentalOne rental property by id (its pkey from tokeet_list_rentals).Reads text others writeNo findings
Why it is in this group
- The name "tokeet_get_rental" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
One rental property by id (its pkey from tokeet_list_rentals). GET /rental/{rental_pkey}.
Annotations the server declares
- title: Get rental
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
tokeet_get_taskOne task by id.Reads text others writeNo findings
Why it is in this group
- The name "tokeet_get_task" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
One task by id. GET /task/{task_pkey}.
Annotations the server declares
- title: Get task
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
tokeet_get_templateOne message template by id.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "tokeet_get_template" says "get": a word for reading.
What it can reach
- private-dataThe description's first sentence says "message": it reads messages.
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe description's first sentence says "message": it reads messages, which other people can write.
Description, as the server wrote it
One message template by id. GET /template/{template_pkey}.
Annotations the server declares
- title: Get message template
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
tokeet_get_userOne team member by id.Reads text others writeNo findings
Why it is in this group
- The name "tokeet_get_user" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
One team member by id. GET /user/{user_pkey}.
Annotations the server declares
- title: Get user
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
tokeet_list_expensesList the expenses recorded in the account (date, rental, category, amount, paid/unpaid status), by creation date.Reads text others writeNo findings
Why it is in this group
- The name "tokeet_list_expenses" says "list": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
List the expenses recorded in the account (date, rental, category, amount, paid/unpaid status), by creation date. Read-only. GET /expense.
Annotations the server declares
- title: List expenses
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
tokeet_list_guestsList guests (personal data: name, emails, phones, address, notes, interactions), one page at a time.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "tokeet_list_guests" says "list": a word for reading.
What it can reach
- private-dataThe description's first sentence says "list" and "email": it reads mail.
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe description's first sentence says "list" and "email": it reads inbound email, which other people can write.
Description, as the server wrote it
List guests (personal data: name, emails, phones, address, notes, interactions), one page at a time. Filter by partial name, booking source/channel, and whether they have bookings. GET /guest.
Annotations the server declares
- title: List guests
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
tokeet_list_ratesAll standard, dynamic and promotional rates of one rental.Reads text others writeNo findings
Why it is in this group
- The name "tokeet_list_rates" says "list": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
All standard, dynamic and promotional rates of one rental. Read-only: rates cannot be changed with this server. GET /rate/{rental_pkey}.
Annotations the server declares
- title: List rental rates
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
tokeet_list_rentalsList the rental properties in the account, sorted by name.Reads text others writeNo findings
Why it is in this group
- The name "tokeet_list_rentals" says "list": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
List the rental properties in the account, sorted by name. GET /rental.
Annotations the server declares
- title: List rentals
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
tokeet_list_rentals_by_ownerList the rentals assigned to one owner.Reads text others writeNo findings
Why it is in this group
- The name "tokeet_list_rentals_by_owner" says "list": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
List the rentals assigned to one owner. GET /rental/owner/{owner_pkey} (Tokeet documents no paging for it: all of the owner's rentals come back).
Annotations the server declares
- title: List rentals by owner
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
tokeet_list_tasksList the tasks (to-dos, e.g.Reads text others writeNo findings
Why it is in this group
- The name "tokeet_list_tasks" says "list": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
List the tasks (to-dos, e.g. cleanings and check-ins) in the account, sorted by task name. GET /task.
Annotations the server declares
- title: List tasks
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
tokeet_list_templatesList the message/email templates in the account, optionally of one type.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "tokeet_list_templates" says "list": a word for reading.
What it can reach
- private-dataThe description's first sentence says "list" and "message": it reads messages.
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe description's first sentence says "list" and "message": it reads messages, which other people can write.
Description, as the server wrote it
List the message/email templates in the account, optionally of one type. GET /template.
Annotations the server declares
- title: List message templates
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
tokeet_list_triggersList the automation triggers (event, rental, template, delay) in the account.Reads text others writeNo findings
Why it is in this group
- The name "tokeet_list_triggers" says "list": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
List the automation triggers (event, rental, template, delay) in the account. Read-only: triggers cannot be changed with this server. GET /trigger.
Annotations the server declares
- title: List automation triggers
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
tokeet_list_usersList the team members (users) of the Tokeet account.Reads text others writeNo findings
Why it is in this group
- The name "tokeet_list_users" says "list": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
List the team members (users) of the Tokeet account. GET /user.
Annotations the server declares
- title: List users
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

144 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 1 outbound tool breaks every one.

Reads private data6: Reads files, mail, messages, databases, secrets, calendars or repositories.; tokeet_get_current_user
tokeet_get_guest
tokeet_get_guest_by_email
tokeet_get_template
tokeet_list_guests
tokeet_list_templates
Reads text others write24: Brings in text someone else can write: web pages, inbound email, messages, issues and comments.; tokeet_add_guest_note
tokeet_create_guest
tokeet_create_task
tokeet_get_current_user
tokeet_get_expense
tokeet_get_guest
tokeet_get_guest_by_email
tokeet_get_rental
tokeet_get_rental_availability
tokeet_get_task
tokeet_get_template
tokeet_get_user
and 12 more
Can send data out1: Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.; tokeet_create_guest

deny to break every path

{
  "permissions": {
    "deny": [
      "mcp__tokeet__tokeet_create_guest"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Looked at Oct 22, 2026, 15:31 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable: yes
HTTP status of an anonymous initialize: 200
tools/list served without credentials: yes
Tools that change things, listed without credentials: 7
Protocol version: 2025-06-18
WWW-Authenticate on 401: not observed
resource_metadata in WWW-Authenticate: none
RFC 9728 protected resource metadata: https://tokeet.usefulapi.io/.well-known/oauth-protected-resource/mcp
Authorization servers: https://tokeet.usefulapi.io
Legacy HTTP+SSE transport: no
Dynamic client registration: yes
Client ID metadata documents: no

HighThe whole server
The endpoint served tools/list without credentials, and the list has 7 tools that change things (2 destructive, 5 write). Whether a call also works without credentials was not tested: tools are never called.
Matched text
https://tokeet.usefulapi.io/mcp: tools/list returned 24 tools to an anonymous client, including tokeet_update_guest (destructive), tokeet_update_task (destructive), tokeet_get_rental_availability (write), tokeet_create_guest (write), tokeet_add_guest_note (write) and 2 more
What this check looks for

Install

Pinned to version 1.3.4. Values in angle brackets are yours to fill in.

claude mcp add --transport http tokeet https://tokeet.usefulapi.io/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__tokeet__tokeet_get_current_user",
      "mcp__tokeet__tokeet_list_users",
      "mcp__tokeet__tokeet_get_user",
      "mcp__tokeet__tokeet_list_rentals",
      "mcp__tokeet__tokeet_get_rental",
      "mcp__tokeet__tokeet_list_rentals_by_owner",
      "mcp__tokeet__tokeet_list_rates",
      "mcp__tokeet__tokeet_list_guests",
      "mcp__tokeet__tokeet_get_guest",
      "mcp__tokeet__tokeet_get_guest_by_email",
      "mcp__tokeet__tokeet_list_tasks",
      "mcp__tokeet__tokeet_get_task",
      "mcp__tokeet__tokeet_list_expenses",
      "mcp__tokeet__tokeet_get_expense",
      "mcp__tokeet__tokeet_list_templates",
      "mcp__tokeet__tokeet_get_template",
      "mcp__tokeet__tokeet_list_triggers"
    ],
    "ask": [
      "mcp__tokeet__tokeet_get_rental_availability",
      "mcp__tokeet__tokeet_create_guest",
      "mcp__tokeet__tokeet_add_guest_note",
      "mcp__tokeet__tokeet_record_guest_interaction",
      "mcp__tokeet__tokeet_create_task"
    ],
    "deny": [
      "mcp__tokeet__tokeet_update_guest",
      "mcp__tokeet__tokeet_update_task"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as tokeet. Review it before you use it.

Capability tags behind 24 rules

mcp__tokeet__tokeet_get_current_user private-data, untrusted-input
mcp__tokeet__tokeet_list_users untrusted-input
mcp__tokeet__tokeet_get_user untrusted-input
mcp__tokeet__tokeet_list_rentals untrusted-input
mcp__tokeet__tokeet_get_rental untrusted-input
mcp__tokeet__tokeet_list_rentals_by_owner untrusted-input
mcp__tokeet__tokeet_get_rental_availability untrusted-input
mcp__tokeet__tokeet_list_rates untrusted-input
mcp__tokeet__tokeet_list_guests private-data, untrusted-input
mcp__tokeet__tokeet_get_guest private-data, untrusted-input
mcp__tokeet__tokeet_get_guest_by_email private-data, untrusted-input
mcp__tokeet__tokeet_list_tasks untrusted-input
mcp__tokeet__tokeet_get_task untrusted-input
mcp__tokeet__tokeet_list_expenses untrusted-input
mcp__tokeet__tokeet_get_expense untrusted-input
mcp__tokeet__tokeet_list_templates private-data, untrusted-input
mcp__tokeet__tokeet_get_template private-data, untrusted-input
mcp__tokeet__tokeet_list_triggers untrusted-input
mcp__tokeet__tokeet_create_guest untrusted-input, outbound
mcp__tokeet__tokeet_update_guest untrusted-input
mcp__tokeet__tokeet_add_guest_note untrusted-input
mcp__tokeet__tokeet_record_guest_interaction untrusted-input
mcp__tokeet__tokeet_create_task untrusted-input
mcp__tokeet__tokeet_update_task untrusted-input

Keep track

Get told when this server's tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/io.usefulapi/tokeet/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Anlyon alternative

7 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Compare with other servers for the same product.

Source: MCP Registry · repository. Synced Oct 22, 2026, 11:18 UTC.

For agents: Markdown · JSON · report this listing