Unkey MCP by usefulapi

by usefulapi.io · remote · no sign-in to list tools · v1.16.3 · published by io.usefulapi

Manage API keys, identities, permissions, rate-limit overrides and verification analytics.

Deletes · 7Changes · 2

Compare Registry entry

19 tools: 7 can delete or cancel things, 2 change things and 10 only read.

Scanned Oct 21, 2026

Deletes or cancels7Claude Code: deny: see these tools
Can't be undone0Claude Code: ask
Changes things2Claude Code: ask: see these tools
Only reads10Claude Code: allow: see these tools

1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http unkey https://unkey.usefulapi.io/mcp

Findings

Matches of fixed checks, with the text they matched.

1 warn

Warnunkey_query_verification_analytics
The server marks "unkey_query_verification_analytics" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
Matched text
annotations: {"readOnlyHint":true}; The name "unkey_query_verification_analytics" says "query": a word for reading.
What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

19 tools

Deletes or cancels 7Removes, cancels or revokes something.Claude Code: deny

unkey_create_apiCreate a new API namespace to issue keys under.No findings
Why it is in this group
- The name "unkey_create_api" says "create": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Create a new API namespace to issue keys under. Unkey: POST /v2/apis.createApi.
Annotations the server declares
- title: Create an API
- destructiveHint: true
unkey_create_identityCreate an identity — an end user or organisation that keys and shared rate limits attach to.No findings
Why it is in this group
- The name "unkey_create_identity" says "create": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Create an identity — an end user or organisation that keys and shared rate limits attach to. Unkey: POST /v2/identities.createIdentity.
Annotations the server declares
- title: Create an identity
- destructiveHint: true
unkey_create_keyIssue a new API key under an API.No findings
Why it is in this group
- The name "unkey_create_key" says "create": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Issue a new API key under an API. The plaintext key is returned ONCE in the response and cannot be retrieved later unless recoverable is set. Unkey: POST /v2/keys.createKey.
Annotations the server declares
- title: Create an API key
- destructiveHint: true
unkey_delete_keyRevoke a key.No findings
Why it is in this group
- The name "unkey_delete_key" says "delete": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Revoke a key. By default this is a soft delete the key stops working but stays queryable; pass permanent to erase it. Unkey: POST /v2/keys.deleteKey.
Annotations the server declares
- title: Delete a key
- destructiveHint: true
unkey_set_ratelimit_overrideSet a custom rate limit for one identifier in a namespace — how you raise or lower a single customer's limit.No findings
Why it is in this group
- The name "unkey_set_ratelimit_override" says "set": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Set a custom rate limit for one identifier in a namespace — how you raise or lower a single customer's limit. Unkey: POST /v2/ratelimit.setOverride.
Annotations the server declares
- title: Set a rate-limit override
- destructiveHint: true
unkey_update_keyChange a key's name, owner, metadata, expiry, roles, permissions or enabled state.No findings
Why it is in this group
- The name "unkey_update_key" says "update": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Change a key's name, owner, metadata, expiry, roles, permissions or enabled state. Unkey: POST /v2/keys.updateKey.
Annotations the server declares
- title: Update a key
- destructiveHint: true
unkey_update_key_creditsSet, increment or decrement a key's remaining credits.No findings
Why it is in this group
- The name "unkey_update_key_credits" says "update": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Set, increment or decrement a key's remaining credits. Use set with no value for unlimited. Unkey: POST /v2/keys.updateCredits.
Annotations the server declares
- title: Update a key's credits
- destructiveHint: true

Changes things 2Creates or changes something that can be changed back.Claude Code: ask

unkey_livenessCheck that the Unkey API is reachable and the root key works.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Check that the Unkey API is reachable and the root key works. The only GET in the v2 surface. Unkey: GET /v2/liveness.
Annotations the server declares
- title: Check API health
- readOnlyHint: true
unkey_query_verification_analyticsRun a read-only SQL query over key-verification analytics.1 finding
Why it is in this group
- The name "unkey_query_verification_analytics" says "query": a word for reading.
- The description's first verb is "run": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
  The server marks "unkey_query_verification_analytics" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
  Matched text
  annotations: {"readOnlyHint":true}; The name "unkey_query_verification_analytics" says "query": a word for reading.
  What this check looks for
Description, as the server wrote it
Run a read-only SQL query over key-verification analytics. The query must use one of the public aliases: key_verifications_v1, key_verifications_per_minute_v1, key_verifications_per_hour_v1, key_verifications_per_day_v1 or key_verifications_per_month_v1. Physical default.* table names are rejected, and results are scoped to your workspace. Unkey: POST /v2/analytics.getVerifications.
Annotations the server declares
- title: Query key-verification analytics
- readOnlyHint: true

Only reads 10Looks things up and changes nothing.Claude Code: allow

unkey_get_apiFetch an API namespace by id.No findings
Why it is in this group
- The name "unkey_get_api" says "get": a word for reading.
Description, as the server wrote it
Fetch an API namespace by id. Read-only despite being a POST. Unkey: POST /v2/apis.getApi.
Annotations the server declares
- title: Get one API
- readOnlyHint: true
unkey_get_identityFetch a single identity with its metadata and shared rate limits.No findings
Why it is in this group
- The name "unkey_get_identity" says "get": a word for reading.
Description, as the server wrote it
Fetch a single identity with its metadata and shared rate limits. Read-only despite being a POST. Unkey: POST /v2/identities.getIdentity.
Annotations the server declares
- title: Get one identity
- readOnlyHint: true
unkey_get_keyFetch a key's metadata by its key id — name, owner, permissions, credits, rate limits and whether it is enabled.No findings
Why it is in this group
- The name "unkey_get_key" says "get": a word for reading.
Description, as the server wrote it
Fetch a key's metadata by its key id — name, owner, permissions, credits, rate limits and whether it is enabled. Read-only despite being a POST. Unkey: POST /v2/keys.getKey.
Annotations the server declares
- title: Get one key by id
- readOnlyHint: true
unkey_get_ratelimit_overrideFetch the override for one identifier in a namespace.No findings
Why it is in this group
- The name "unkey_get_ratelimit_override" says "get": a word for reading.
Description, as the server wrote it
Fetch the override for one identifier in a namespace. Read-only despite being a POST. Unkey: POST /v2/ratelimit.getOverride.
Annotations the server declares
- title: Get one rate-limit override
- readOnlyHint: true
unkey_list_api_keysList every key issued under one API, optionally narrowed to a single customer by externalId.No findings
Why it is in this group
- The name "unkey_list_api_keys" says "list": a word for reading.
Description, as the server wrote it
List every key issued under one API, optionally narrowed to a single customer by externalId. Read-only despite being a POST. Unkey: POST /v2/apis.listKeys.
Annotations the server declares
- title: List the keys of an API
- readOnlyHint: true
unkey_list_identitiesList identities — the end users or organisations your keys belong to.No findings
Why it is in this group
- The name "unkey_list_identities" says "list": a word for reading.
Description, as the server wrote it
List identities — the end users or organisations your keys belong to. Read-only despite being a POST. Unkey: POST /v2/identities.listIdentities.
Annotations the server declares
- title: List identities
- readOnlyHint: true
unkey_list_permissionsList the permissions defined in the workspace.No findings
Why it is in this group
- The name "unkey_list_permissions" says "list": a word for reading.
Description, as the server wrote it
List the permissions defined in the workspace. Read-only despite being a POST. Unkey: POST /v2/permissions.listPermissions.
Annotations the server declares
- title: List permissions
- readOnlyHint: true
unkey_list_ratelimit_overridesList the per-identifier overrides in one rate-limit namespace.No findings
Why it is in this group
- The name "unkey_list_ratelimit_overrides" says "list": a word for reading.
Description, as the server wrote it
List the per-identifier overrides in one rate-limit namespace. Read-only despite being a POST. Unkey: POST /v2/ratelimit.listOverrides.
Annotations the server declares
- title: List rate-limit overrides
- readOnlyHint: true
unkey_list_rolesList the roles defined in the workspace.No findings
Why it is in this group
- The name "unkey_list_roles" says "list": a word for reading.
Description, as the server wrote it
List the roles defined in the workspace. Read-only despite being a POST. Unkey: POST /v2/permissions.listRoles.
Annotations the server declares
- title: List roles
- readOnlyHint: true
unkey_whoami_keyGiven a plaintext API key, return which key it is and its metadata — without spending credits or recording a verification.No findings
Why it is in this group
- The name "unkey_whoami_key" says "whoami": a word for reading.
Description, as the server wrote it
Given a plaintext API key, return which key it is and its metadata — without spending credits or recording a verification. This is the safe way to identify a key a customer sent you. Unkey: POST /v2/keys.whoami.
Annotations the server declares
- title: Look up a key by its secret
- readOnlyHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.16.3. Values in angle brackets are yours to fill in.

claude mcp add --transport http unkey https://unkey.usefulapi.io/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__unkey__unkey_get_key",
      "mcp__unkey__unkey_whoami_key",
      "mcp__unkey__unkey_get_api",
      "mcp__unkey__unkey_list_api_keys",
      "mcp__unkey__unkey_list_identities",
      "mcp__unkey__unkey_get_identity",
      "mcp__unkey__unkey_list_permissions",
      "mcp__unkey__unkey_list_roles",
      "mcp__unkey__unkey_list_ratelimit_overrides",
      "mcp__unkey__unkey_get_ratelimit_override"
    ],
    "ask": [
      "mcp__unkey__unkey_liveness",
      "mcp__unkey__unkey_query_verification_analytics"
    ],
    "deny": [
      "mcp__unkey__unkey_create_api",
      "mcp__unkey__unkey_create_key",
      "mcp__unkey__unkey_update_key",
      "mcp__unkey__unkey_update_key_credits",
      "mcp__unkey__unkey_delete_key",
      "mcp__unkey__unkey_create_identity",
      "mcp__unkey__unkey_set_ratelimit_override"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as unkey. Review it before you use it.

Keep track

Get told when this server's tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/io.usefulapi/unkey/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Anlyon alternative

9 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Compare with other servers for the same product.

Source: MCP Registry · repository. Synced Oct 21, 2026, 19:23 UTC.

For agents: Markdown · JSON · report this listing