Skip to content
anlyon.devby Anlyon

AgentWeb

live.agentweb/agentwebagentweb.livestreamable-httpv1.21.1Scanned

Free web search, 130M+ business records, local search, weather and travel data for AI agents.

37 tools: 2 can delete or cancel things, 2 do something that can't be undone, 9 change things and 24 only read.

Tools: 2 delete, 2 irreversible, 9 write, 24 read.
  • Reads private data · 1
  • Reads text others write · 37
  • Can send data out · 5
  • 7 findings

Anlyon alternative

13 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →
Compare with similar serversMarkdownJSONReport this listing

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

37 tools

Deletes or cancels 2Claude Code: deny
  • research_cancelRequest cancellation of an accepted research execution.Reads text others write1 finding

    Why it is in this group

    • The name "research_cancel" says "cancel": a word for removing or ending something.
    • The server marks it not destructive (destructiveHint: false), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "research_cancel" not destructive (destructiveHint: false), and its own name, description or input give the class "destructive".

      Matched text

      annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":true}; The name "research_cancel" says "cancel": a word for removing or ending something.

      What this check looks for
    Description, as the server wrote it
    Request cancellation of an accepted research execution. In-flight usage can remain pending; retrying cancellation does not start new work.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • watch_cancelCancel a watch and its queued callback deliveries.Reads text others write1 finding

    Why it is in this group

    • The name "watch_cancel" says "cancel": a word for removing or ending something.
    • The server marks it not destructive (destructiveHint: false), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "watch_cancel" not destructive (destructiveHint: false), and its own name, description or input give the class "destructive".

      Matched text

      annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":true}; The name "watch_cancel" says "cancel": a word for removing or ending something.

      What this check looks for
    Description, as the server wrote it
    Cancel a watch and its queued callback deliveries. An already in-flight delivery may still arrive.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
Can't be undone 2Claude Code: ask
  • currency_convertConvert between currencies using live ECB exchange rates.Reads text others writeCan send data out1 finding

    Why it is in this group

    • The name "currency_convert" says "convert": a word for a change.
    • The input addresses people (input.to): what it sends cannot be taken back.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a destination (input.to): what the tool writes goes there.

    Findings

    • Warn

      The server marks "currency_convert" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "currency_convert" says "convert": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Convert between currencies using live ECB exchange rates. 30+ currencies. Returns converted amount and rate. ~0.5s.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • time_convertConvert a local date/time between IANA zones, supported cities or countries.Reads text others writeCan send data out1 finding

    Why it is in this group

    • The name "time_convert" says "convert": a word for a change.
    • The input addresses people (input.to): what it sends cannot be taken back.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a destination (input.to): what the tool writes goes there.

    Findings

    • Warn

      The server marks "time_convert" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "time_convert" says "convert": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Convert a local date/time between IANA zones, supported cities or countries. Rejects nonexistent clock-change times. Repeated local times require fold=0/1 or an explicit UTC offset. HH:MM uses today's date in the source zone.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
Changes things 9Claude Code: ask
  • agentweb_healthCheck the health status of the AgentWeb API, including total businesses and countries available.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Check the health status of the AgentWeb API, including total businesses and countries available.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • contribute_businessContribute a new business to AgentWeb, OR enrich an existing one with missing data (phone, email, website, hours, address).Reads text others writeCan send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a destination (input.phone): what the tool writes goes there.
    Description, as the server wrote it
    Contribute a new business to AgentWeb, OR enrich an existing one with missing data (phone, email, website, hours, address). Deduplicates automatically: same name within 100m, or a matching phone, merges into the existing record. Use whenever you find structured business data AgentWeb doesn't have yet.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • execute_recipeExecute a public recipe discovered with list_recipes.Reads text others write1 finding

    Why it is in this group

    • The name "execute_recipe" says "execute": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Info

      The input schema at properties.params.description mentions "credentials".

      Matched text

      inputSchema.properties.params.description: "..._recipes. Do not include authentication credentials."

      What this check looks for
    Description, as the server wrote it
    Execute a public recipe discovered with list_recipes. Pass its exact domain, recipe_name and named params. Covers all public recipes, including those without a dedicated tool. Upstream errors are returned as tool errors. Authentication follows the selected recipe.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • report_businessReport a business as closed, having wrong info, or being spam.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Report a business as closed, having wrong info, or being spam. Three or more 'closed' reports automatically lower its confidence score. Use when you discover a business is permanently closed, has wrong phone/address/hours, is spam, or is a duplicate.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • search_businessesSearch the AgentWeb global business directory.Reads private dataReads text others write1 finding

    Why it is in this group

    • The name "search_businesses" says "search": a word for reading.
    • The server marks it as not read-only (readOnlyHint: false).

    What it can reach

    • private-dataThe description's first sentence says "search" and "directory": it reads files.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe description's first sentence says "search" and "web": it reads web pages, which anyone can write.

    Findings

    • Warn

      The server marks "search_businesses" as not read-only (readOnlyHint: false), and its words say it reads.

      Matched text

      annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":true}; The name "search_businesses" says "search": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Search the AgentWeb global business directory. Use agentweb_health for current counts. If a business is not in the database yet, AgentWeb tries to discover it from the web in real time (~3s) and saves it. Returns markdown prose by default. Supports text search (q), category, city/country, and geographic search (lat+lng+radius_km). ONE CALL RETURNS EVERYTHING: name, phone, email, hours, website, address, geo, trust score. Use format='json' for structured JSON.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • suggestAutocomplete / type-ahead for business names, cities, or categories.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Autocomplete / type-ahead for business names, cities, or categories. Use to disambiguate user input before searching. Returns up to 15 suggestions by relevance. Fast (<20ms).

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • watch_createCreate an expiring, resource-limited watch for URL text changes, text appearance or an unambiguous structured product price.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "watch_create" says "create": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Create an expiring, resource-limited watch for URL text changes, text appearance or an unambiguous structured product price. Baselines are silent by default. An optional webhook receives signed changes; without it, poll watch_events.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • web_researchWeb search PLUS the cleaned text of the top pages in one call (pages are fetched in parallel).Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Web search PLUS the cleaned text of the top pages in one call (pages are fetched in parallel). Prefer this over web_search + web_fetch whenever you need to read the results, not just list them.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
Only reads 24Show 24 read-only tools
  • agent_favoritesGet this agent's implicit favorites: businesses it interacted with more than once, by frequency.Reads text others writeNo findings

    Why it is in this group

    • The description's first verb is "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Get this agent's implicit favorites: businesses it interacted with more than once, by frequency.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • agent_historyRetrieve this agent's interaction history: every business it searched for, viewed, or contributed to.Reads text others writeNo findings

    Why it is in this group

    • The description's first verb is "retrieve": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Retrieve this agent's interaction history: every business it searched for, viewed, or contributed to. Persists 90 days, up to 500 interactions. Recall past lookups without re-searching.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • agent_profileGet this agent's identity and stats: API key info, tier, contribution count, request totals, remembered interactions.Reads text others writeNo findings

    Why it is in this group

    • The description's first verb is "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Get this agent's identity and stats: API key info, tier, contribution count, request totals, remembered interactions.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • agentweb_capabilitiesGet the machine-readable description of the entire AgentWeb API: every endpoint, tool, data source, and current live counts.Reads text others writeNo findings

    Why it is in this group

    • The description's first verb is "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe description's first sentence says "get" and "web": it reads web pages, which anyone can write.
    Description, as the server wrote it
    Get the machine-readable description of the entire AgentWeb API: every endpoint, tool, data source, and current live counts. Use to discover what AgentWeb can do.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • agentweb_get_shortFetch a business in the AgentWeb compact shorthand format (~320 bytes vs 3-5 KB).Reads text others writeNo findings

    Why it is in this group

    • The name "agentweb_get_short" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe description's first sentence says "fetch" and "web": it reads web pages, which anyone can write.
    Description, as the server wrote it
    Fetch a business in the AgentWeb compact shorthand format (~320 bytes vs 3-5 KB). Single-letter keys (n=name, p=phone, e=email, w=website, h=hours, g=[lat,lng]…). ~80% fewer tokens. Use when you just need contact info. Schema: https://api.agentweb.live/v1/schema/short

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • agentweb_leaderboardGet the public leaderboard of top contributing AI agents (most creates, enrichments, reports).Reads text others writeNo findings

    Why it is in this group

    • The description's first verb is "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Get the public leaderboard of top contributing AI agents (most creates, enrichments, reports).

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • batch_get_businessesFetch up to 50 businesses in a single call by IDs or slugs.Reads text others writeNo findings

    Why it is in this group

    • The name "batch_get_businesses" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Fetch up to 50 businesses in a single call by IDs or slugs. Saves N round-trips. Supports prose (markdown), JSON, and shorthand formats.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • evidence_getRetrieve an exact evidence passage and its immutable capture metadata.Reads text others writeNo findings

    Why it is in this group

    • The name "evidence_get" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Retrieve an exact evidence passage and its immutable capture metadata. Evidence is scoped to this application's user/workspace and retained for seven days.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • get_businessFetch a single business by slug or UUID.Reads text others writeNo findings

    Why it is in this group

    • The name "get_business" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Fetch a single business by slug or UUID. Returns markdown prose by default (~60% fewer tokens than JSON). Slugs look like 'noma-copenhagen-abc12345'. Use when you already have an identifier from a previous search. Set format='json' for structured data.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • kiwi_search_flightsSearch flights on Kiwi.com: aggregates all airlines, often cheaper than airline sites.Reads text others writeNo findings

    Why it is in this group

    • The name "kiwi_search_flights" says "search": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Search flights on Kiwi.com: aggregates all airlines, often cheaper than airline sites. Returns prices, airlines, times, stops, duration, booking links. ~1.5s.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • list_recipesDiscover every public recipe and its parameters, authentication and cache policy.Reads text others writeNo findings

    Why it is in this group

    • The name "list_recipes" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Discover every public recipe and its parameters, authentication and cache policy. Includes news, holidays, Wikipedia, Amazon products and provider-specific travel. A listed recipe is not a guarantee of upstream availability.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • research_statusGet the status, evidence and usage receipt of an accepted research request.Reads text others writeNo findings

    Why it is in this group

    • The name "research_status" says "status": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Get the status, evidence and usage receipt of an accepted research request.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • search_attractionsSearch real-time attractions, tours, and activities on booking.com via AgentWeb.Reads text others writeNo findings

    Why it is in this group

    • The name "search_attractions" says "search": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe description's first sentence says "search" and "web": it reads web pages, which anyone can write.
    Description, as the server wrote it
    Search real-time attractions, tours, and activities on booking.com via AgentWeb. Returns name, price, description, rating, duration, free-cancellation, discounts, booking links. ~2s.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • search_carsSearch real-time car rental availability and prices on booking.com via AgentWeb.Reads text others writeNo findings

    Why it is in this group

    • The name "search_cars" says "search": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe description's first sentence says "search" and "web": it reads web pages, which anyone can write.
    Description, as the server wrote it
    Search real-time car rental availability and prices on booking.com via AgentWeb. Returns vehicle, supplier (Avis, Hertz, Sixt…), price, transmission, doors, mileage, pickup location, booking links. Works with any airport IATA code. ~1s.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • search_flightsSearch flights across multiple sources (booking.com + kiwi.com) and return the cheapest.Reads text others writeNo findings

    Why it is in this group

    • The name "search_flights" says "search": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Search flights across multiple sources (booking.com + kiwi.com) and return the cheapest. Returns airlines, prices, times, stops, duration, source, and booking links. ~3s.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • search_hotelsSearch hotels across multiple sources (booking.com + kiwi.com) and return the cheapest.Reads text others writeNo findings

    Why it is in this group

    • The name "search_hotels" says "search": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Search hotels across multiple sources (booking.com + kiwi.com) and return the cheapest. Returns name, price, stars, rating, reviews, source, booking links. ~2s.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • time_nowGet the current date and time in a country (e.g.Reads text others writeNo findings

    Why it is in this group

    • The description's first verb is "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Get the current date and time in a country (e.g. Denmark), supported city, or IANA timezone. Returns UTC offset, DST, Unix timestamp and timezone-data version. Fresh every call. Countries with multiple zones return choices; select one and retry. Use this for 'What time is it in Denmark right now?'.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • watch_eventsRead detected changes, supporting evidence and delivery status for a watch in the current scope.Reads text others writeNo findings

    Why it is in this group

    • The description's first verb is "read": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Read detected changes, supporting evidence and delivery status for a watch in the current scope.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • watch_listList change watches in the current application/user/workspace scope.Reads text others writeNo findings

    Why it is in this group

    • The name "watch_list" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    List change watches in the current application/user/workspace scope.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • weather_forecastGet weather forecast for any city worldwide.Reads text others writeNo findings

    Why it is in this group

    • The description's first verb is "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Get weather forecast for any city worldwide. Returns current conditions plus daily forecast up to 14 days (high/low, rain chance, UV, sunrise/sunset, packing advisories). ~1s.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • web_fetchPage fetch.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "web_fetch" says "fetch": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe name "web_fetch" says "fetch" and "web": it reads web pages, which anyone can write.
    • untrusted-inputThe input takes a URL (input.url), and the tool reads it: it reads web pages, which anyone can write.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.

    Claude Code: ask, because it is tagged outbound.

    Description, as the server wrote it
    Page fetch. Fetches a public URL and returns its cleaned text content (title + body) ready to read.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

185 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 1 private-data tool breaks every one.

Reads private data1
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write37
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out5
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
deny to break every path
{
  "permissions": {
    "deny": [
      "mcp__agentweb__search_businesses"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

6 warn1 info
  • Warnsearch_businesses

    The server marks "search_businesses" as not read-only (readOnlyHint: false), and its words say it reads.

    Matched text

    annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":true}; The name "search_businesses" says "search": a word for reading.

    What this check looks for
  • Warnlocal_search

    The server marks "local_search" as not read-only (readOnlyHint: false), and its words say it reads.

    Matched text

    annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":true}; The name "local_search" says "search": a word for reading.

    What this check looks for
  • Warncurrency_convert

    The server marks "currency_convert" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "currency_convert" says "convert": a word for a change.

    What this check looks for
  • Warntime_convert

    The server marks "time_convert" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "time_convert" says "convert": a word for a change.

    What this check looks for
  • Warnresearch_cancel

    The server marks "research_cancel" not destructive (destructiveHint: false), and its own name, description or input give the class "destructive".

    Matched text

    annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":true}; The name "research_cancel" says "cancel": a word for removing or ending something.

    What this check looks for
  • Warnwatch_cancel

    The server marks "watch_cancel" not destructive (destructiveHint: false), and its own name, description or input give the class "destructive".

    Matched text

    annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":true}; The name "watch_cancel" says "cancel": a word for removing or ending something.

    What this check looks for
Show 1 more finding
  • Infoexecute_recipe

    The input schema at properties.params.description mentions "credentials".

    Matched text

    inputSchema.properties.params.description: "..._recipes. Do not include authentication credentials."

    What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 1.21.1. Values in angle brackets are yours to fill in.

claude mcp add --transport http agentweb https://api.agentweb.live/mcp --header 'X-API-Key: <your-x-api-key>'
claude mcp add --transport http agentweb https://api.agentweb.live/mcp --header 'X-API-Key: <your-x-api-key>'

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__agentweb__get_business",
      "mcp__agentweb__agentweb_get_short",
      "mcp__agentweb__agentweb_capabilities",
      "mcp__agentweb__agentweb_leaderboard",
      "mcp__agentweb__batch_get_businesses",
      "mcp__agentweb__trending_businesses",
      "mcp__agentweb__agent_history",
      "mcp__agentweb__agent_favorites",
      "mcp__agentweb__agent_profile",
      "mcp__agentweb__search_flights",
      "mcp__agentweb__search_hotels",
      "mcp__agentweb__search_cars",
      "mcp__agentweb__kiwi_search_flights",
      "mcp__agentweb__flixbus_search",
      "mcp__agentweb__time_now",
      "mcp__agentweb__weather_forecast",
      "mcp__agentweb__search_attractions",
      "mcp__agentweb__list_recipes",
      "mcp__agentweb__web_search",
      "mcp__agentweb__evidence_get",
      "mcp__agentweb__research_status",
      "mcp__agentweb__watch_list",
      "mcp__agentweb__watch_events"
    ],
    "ask": [
      "mcp__agentweb__search_businesses",
      "mcp__agentweb__local_search",
      "mcp__agentweb__agentweb_health",
      "mcp__agentweb__contribute_business",
      "mcp__agentweb__report_business",
      "mcp__agentweb__suggest",
      "mcp__agentweb__currency_convert",
      "mcp__agentweb__time_convert",
      "mcp__agentweb__execute_recipe",
      "mcp__agentweb__web_research",
      "mcp__agentweb__web_fetch",
      "mcp__agentweb__watch_create"
    ],
    "deny": [
      "mcp__agentweb__research_cancel",
      "mcp__agentweb__watch_cancel"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as agentweb. Review it before you use it.

Capability tags behind 37 rules
  • mcp__agentweb__search_businesses private-data, untrusted-input
  • mcp__agentweb__local_search untrusted-input
  • mcp__agentweb__get_business untrusted-input
  • mcp__agentweb__agentweb_get_short untrusted-input
  • mcp__agentweb__agentweb_health untrusted-input
  • mcp__agentweb__agentweb_capabilities untrusted-input
  • mcp__agentweb__contribute_business untrusted-input, outbound
  • mcp__agentweb__report_business untrusted-input
  • mcp__agentweb__agentweb_leaderboard untrusted-input
  • mcp__agentweb__suggest untrusted-input
  • mcp__agentweb__batch_get_businesses untrusted-input
  • mcp__agentweb__trending_businesses untrusted-input
  • mcp__agentweb__agent_history untrusted-input
  • mcp__agentweb__agent_favorites untrusted-input
  • mcp__agentweb__agent_profile untrusted-input
  • mcp__agentweb__search_flights untrusted-input
  • mcp__agentweb__search_hotels untrusted-input
  • mcp__agentweb__search_cars untrusted-input
  • mcp__agentweb__kiwi_search_flights untrusted-input
  • mcp__agentweb__flixbus_search untrusted-input
  • mcp__agentweb__currency_convert untrusted-input, outbound
  • mcp__agentweb__time_now untrusted-input
  • mcp__agentweb__time_convert untrusted-input, outbound
  • mcp__agentweb__weather_forecast untrusted-input
  • mcp__agentweb__search_attractions untrusted-input
  • mcp__agentweb__list_recipes untrusted-input
  • mcp__agentweb__execute_recipe untrusted-input
  • mcp__agentweb__web_search untrusted-input
  • mcp__agentweb__web_research untrusted-input
  • mcp__agentweb__web_fetch untrusted-input, outbound
  • mcp__agentweb__evidence_get untrusted-input
  • mcp__agentweb__research_status untrusted-input
  • mcp__agentweb__research_cancel untrusted-input
  • mcp__agentweb__watch_create untrusted-input, outbound
  • mcp__agentweb__watch_list untrusted-input
  • mcp__agentweb__watch_events untrusted-input
  • mcp__agentweb__watch_cancel untrusted-input

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/live.agentweb/agentweb/verify?hash=bce2ba150571a0933ef02d8ca4b4388659af3e2b6b788ba1bca7c0f5933b707c" | jq -e '.changed == false'

Pinned hash bce2ba150571, from Oct 28, 2026, 15:18 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/live.agentweb/agentweb/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for live.agentweb/agentweb
[![anlyon.dev](https://anlyon.dev/badge/live.agentweb/agentweb.svg)](https://anlyon.dev/servers/live.agentweb/agentweb)

Source: MCP Registry. Synced Oct 28, 2026, 15:18 UTC.