Skip to content

Borro

markets.borro/borroborro.marketsstreamable-httpv1.0.0Scanned

Stock lending on Robinhood Chain: read markets and prepare lends, loans, shorts and credit lines.

47 tools: 1 can delete or cancel things, 6 do something that can't be undone and 40 change things.

Tools: 1 delete, 6 irreversible, 40 write, 0 read.
  • Reads private data · 0
  • Reads text others write · 0
  • Can send data out · 3
  • 16 findings

Anlyon alternative

47 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

47 tools

Deletes or cancels 1Claude Code: deny
  • cancel_orderUnsigned transaction cancelling an ask or a bid: what it still locks goes back to its maker (an ask's collateral, a bid's USDG).2 findings

    Why it is in this group

    • The name "cancel_order" says "cancel": a word for removing or ending something.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    • The server marks it not destructive (destructiveHint: false), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "cancel_order" read-only (readOnlyHint: true), and its own name, description or input give the class "destructive".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "cancel_order" says "cancel": a word for removing or ending something.

      What this check looks for
    • Warn

      The server marks "cancel_order" not destructive (destructiveHint: false), and its own name, description or input give the class "destructive".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "cancel_order" says "cancel": a word for removing or ending something.

      What this check looks for
    Description, as the server wrote it
    Unsigned transaction cancelling an ask or a bid: what it still locks goes back to its maker (an ask's collateral, a bid's USDG). Only the maker may, until the series expires; then anyone may.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
Can't be undone 6Claude Code: ask
  • credit_billPay a merchant's x402 bill (HTTP 402 Payment Required) in USDG on Robinhood Chain from an agent credit line.1 finding

    Why it is in this group

    • The description's first verb is "pay": a word that usually means money moves, which cannot be taken back.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "credit_bill" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "pay": a word that usually means money moves, which cannot be taken back.

      What this check looks for
    Description, as the server wrote it
    Pay a merchant's x402 bill (HTTP 402 Payment Required) in USDG on Robinhood Chain from an agent credit line. Give the 402's payment_required (its PAYMENT-REQUIRED header value, or its JSON body); the bill is its exact-scheme USDG option on eip155:4663, refused in words if it has none or asks more than max_usdg. The wallet is the payer and must be the line's agent or owner: if it holds less USDG than the bill, one unsigned borrow of just what it is short, from the line to the wallet itself (the wallet must be on the line's allowlist: bill pay, credit_guardrails bills: true; checked as the line checks it and simulated). Returns the EIP-3009 authorization and its typed_data to sign (eth_signTypedData_v4) and the steps: send the borrow, sign, call credit_bill_header, send the request again with its header before valid_until.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • credit_openUnsigned transactions.Can send data out1 finding

    Why it is in this group

    • The name "credit_open" says "open": a word for a change.
    • The input addresses people (input.to): what it sends cannot be taken back.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • outboundThe input takes a destination (input.to): what the tool writes goes there.

    Findings

    • Warn

      The server marks "credit_open" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "credit_open" says "open": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Unsigned transactions. Without account: open a line owned by the signing wallet for an agent (never the wallet itself), in a market credit_markets lists ("CREDIT", the default), post its credits and optionally borrow USDG at once (to the wallet unless to names an allowlisted address); exact credit approval to the factory first. The owner's limits: ceiling (USDG, default the most the target allows today), daily_limit (USDG out in any 24 hours, borrows and the agent's withdrawals together, or "none"; default the ceiling, or $100 with a gas station; at most $5,000 with one), target_ltv (a fraction under 1 like 0.18, or a percent with its sign like "18%"; the market's default, 0.18 for CREDIT, at most the market's max trigger), trigger_ltv for protect (by the market's rule; CREDIT: the target plus 7 points, at least 0.27 and at most 0.3), allow (addresses borrowed USDG may go to, 16 at most), gas_station (true: put the agent's gas station on the allowlist), bills (true: bill pay, the agent's own wallet on the allowlist, for x402 bills through credit_bill; the daily limit then defaults to $100), keeper ("borro", the default, "none" or an address), sell_bps and slip_bps for protect's sales (CREDIT defaults 2500 and 300; 0 in a market with no pool). With account: post more credits (anyone) and/or borrow (the line's agent or owner) to an allowed address. A wallet holding $BORRO borrows for less once Holder Credit counts it (holder_benefits). Refuses locally what the line would refuse (over the daily limit, the ceiling or the target, during a write-off, past what the market has free, past 90% used, past what the depth gate allows, before CREDIT's price starts); simulated from the wallet. Check each transaction's to: the factory, a line the factory confirms (isAccount), or the credit for an exact approval.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • credit_payOne unsigned borrow from a line straight to a payee on its allowlist (or its owner): the line's agent or owner signs it, the USDG goes from Morpho to the payee, and the line owes i…Can send data out1 finding

    Why it is in this group

    • The name "credit_pay" says "pay": a word that usually means money moves, which cannot be taken back.
    • The input addresses people (input.to): what it sends cannot be taken back.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • outboundThe input takes a destination (input.to): what the tool writes goes there.

    Findings

    • Warn

      The server marks "credit_pay" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "credit_pay" says "pay": a word that usually means money moves, which cannot be taken back.

      What this check looks for
    Description, as the server wrote it
    One unsigned borrow from a line straight to a payee on its allowlist (or its owner): the line's agent or owner signs it, the USDG goes from Morpho to the payee, and the line owes it until repaid. Checked as the line checks it: the allowlist, a write-off, what is left of the daily limit today, the ceiling, the target LTV at today's price, the market's 90% and depth gate; simulated from the wallet. Check the transaction's to: a line the factory confirms (isAccount).

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • farm_withdrawUnsigned transaction to take part or all of the wallet's money out of a farm.1 finding

    Why it is in this group

    • The name "farm_withdraw" says "withdraw": a word that usually means money moves, which cannot be taken back.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "farm_withdraw" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "farm_withdraw" says "withdraw": a word that usually means money moves, which cannot be taken back.

      What this check looks for
    Description, as the server wrote it
    Unsigned transaction to take part or all of the wallet's money out of a farm. Run from the wallet first to show what comes back now, and what comes as the vault's own shares because borrowers have it out (they keep earning and redeem on Supply once it is free). Always works: never paused, no price feed needed.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • withdrawUnsigned transaction to take back lent stock or USDG (part, or all with all: true).1 finding

    Why it is in this group

    • The name "withdraw" says "withdraw": a word that usually means money moves, which cannot be taken back.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "withdraw" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "withdraw" says "withdraw": a word that usually means money moves, which cannot be taken back.

      What this check looks for
    Description, as the server wrote it
    Unsigned transaction to take back lent stock or USDG (part, or all with all: true). Stock on loan to shorters comes back once it is returned.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • withdraw_coverUnsigned transaction to take USDG out of the gap cover pool, an amount or all: true.1 finding

    Why it is in this group

    • The name "withdraw_cover" says "withdraw": a word that usually means money moves, which cannot be taken back.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "withdraw_cover" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "withdraw_cover" says "withdraw": a word that usually means money moves, which cannot be taken back.

      What this check looks for
    Description, as the server wrote it
    Unsigned transaction to take USDG out of the gap cover pool, an amount or all: true. Capital is locked while covers are live, from the first buy of a closure until Monday's settlement; withdraw during the week. Run from the wallet first to show what comes back.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
Changes things 40Claude Code: ask
  • bear_coinsThe bear coins directory: every coin launched on Pons from Borro with its own short, its stock, P/L, burns and fees.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    The bear coins directory: every coin launched on Pons from Borro with its own short, its stock, P/L, burns and fees.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • bind_builderCredits a bookrunner's code with the wallet's borrowing on Borro (Bookrunners): the bookrunner earns Borro's own fee on the interest the wallet pays, all of it for 12 months, half …No findings

    Why it is in this group

    • The input takes a statement or command to run (input.code), which can change anything it can reach.
    Description, as the server wrote it
    Credits a bookrunner's code with the wallet's borrowing on Borro (Bookrunners): the bookrunner earns Borro's own fee on the interest the wallet pays, all of it for 12 months, half after; the wallet pays nothing more. Without signature: EIP-712 typed data for the wallet to sign (eth_signTypedData_v4, no transaction, no gas), good for 10 minutes. With signature and that timestamp: submits it, the same as POST https://borro.markets/builders/bind. One code per wallet; the first binding stands.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • borrowUnsigned transaction to borrow USDG against stock already lent and posted (supply with post: true first).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Unsigned transaction to borrow USDG against stock already lent and posted (supply with post: true first). The quote's rebate_estimate is what this loan puts in the wallet's weekly locker rebate.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • buy_coverUnsigned transactions to buy Monday-gap cover on a stock while the market is shut (until an hour before the reopen): side up pays if the first feed print after the reopen is more t…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Unsigned transactions to buy Monday-gap cover on a stock while the market is shut (until an hour before the reopen): side up pays if the first feed print after the reopen is more than the strike above the last print (cover for a short), down if it is more than the strike below (for a long); it pays the move beyond the strike, times the cover, up to the pool's cap. Approve exactly the premium, then buy with that premium as the most it may take. Simulated from the wallet.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • buy_optionUnsigned transactions to buy options from the best ask of a series (or a given ask with order_id), checked on chain: exact approval of the premium, then fillAsk with that premium a…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Unsigned transactions to buy options from the best ask of a series (or a given ask with order_id), checked on chain: exact approval of the premium, then fillAsk with that premium as the most it may take. A fill takes the whole ask or leaves at least 0.001 of a share. Returns the cost, Borro's share, the break-even and what it pays at expiry.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • buy_with_ethUnsigned transaction swapping the wallet's ETH for USDG or a stock on Uniswap, or through Route (route.fun) for a stock bought exact in when Route guarantees more (no Borro contrac…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Unsigned transaction swapping the wallet's ETH for USDG or a stock on Uniswap, or through Route (route.fun) for a stock bought exact in when Route guarantees more (no Borro contract, no Borro fee), for the flows that need them.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • claim_coverUnsigned transaction taking USDG a settled or voided cover could not send to the wallet (it waits in the pool's owed); position shows owed_usdg.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Unsigned transaction taking USDG a settled or voided cover could not send to the wallet (it waits in the pool's owed); position shows owed_usdg.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • claim_optionUnsigned transaction burning the wallet's tokens of a settled series and taking what they pay: a call pays the stock's Borro vault shares, a put USDG (or the Steakhouse vault's sha…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Unsigned transaction burning the wallet's tokens of a settled series and taking what they pay: a call pays the stock's Borro vault shares, a put USDG (or the Steakhouse vault's shares with as_shares, for when the vault is short of free USDG). All the wallet holds unless shares is given.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • close_longUnsigned transaction closing all or part of the wallet's leveraged long on a stock: the stock is sold, the debt repaid, and the rest comes back in USDG.1 finding

    Why it is in this group

    • The name "close_long" says "close": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "close_long" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "close_long" says "close": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Unsigned transaction closing all or part of the wallet's leveraged long on a stock: the stock is sold, the debt repaid, and the rest comes back in USDG.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • close_pairUnsigned transactions to close the wallet's newest open pair of these two stocks: the pair's own part of the short closed (a basket leg or a short of its own on the same stock stay…1 finding

    Why it is in this group

    • The name "close_pair" says "close": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "close_pair" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "close_pair" says "close": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Unsigned transactions to close the wallet's newest open pair of these two stocks: the pair's own part of the short closed (a basket leg or a short of its own on the same stock stays open, listed in stays_open), the long's lent stock taken back (what is free now, if part is on loan). If something else already closed part of the pair's short, this closes what is left and the note says so.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • close_shortUnsigned transactions to close the wallet's short on a stock: buy back everything owed, return it, take out the money held (with a USDG top-up approval if it is under water).1 finding

    Why it is in this group

    • The name "close_short" says "close": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "close_short" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "close_short" says "close": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Unsigned transactions to close the wallet's short on a stock: buy back everything owed, return it, take out the money held (with a USDG top-up approval if it is under water). A wallet has one short per stock, shared by any pair or basket legs on it: this closes all of it, and closes_parts lists the parts it takes with it. close_pair closes only a pair's own part.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • credit_bill_headerAfter credit_bill and the wallet's signature: the header the merchant reads (PAYMENT-SIGNATURE, or X-PAYMENT for x402 version 1), base64 JSON with the authorization and signature.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    After credit_bill and the wallet's signature: the header the merchant reads (PAYMENT-SIGNATURE, or X-PAYMENT for x402 version 1), base64 JSON with the authorization and signature. Reads no chain and sends nothing: checks the authorization against the bill (the merchant's payTo, exactly its amount, not run out) and recovers a 65-byte signature to its payer. Send the same request again with header.name set to header.value.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • credit_gasUnsigned transactions that turn a line's credit into ETH in its agent's own wallet: make the agent's gas station if it has no code yet (anyone may; the station is the GasStationFac…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Unsigned transactions that turn a line's credit into ETH in its agent's own wallet: make the agent's gas station if it has no code yet (anyone may; the station is the GasStationFactory's predict of the agent's wallet, never an address given), borrow amount USDG from the line to the station (the agent or the owner; the station must be on the allowlist), then pump(minOut, maxIn) by its full signature, with maxIn everything the station will hold and minOut a tenth of a percent under the pool's own fill for that size (never under the station's Chainlink floor). No amount: pump what the station already holds (anyone may). If ETH's price feed has been stale for 4 days, release() instead, sending the station's USDG to the agent's wallet as it is. Simulated from the wallet.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • credit_guardrailsOne unsigned configure() transaction for the line's owner, starting from the line's current settings: agent (or revoke_agent: true, a JSON boolean, at once; never the owner's own w…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    One unsigned configure() transaction for the line's owner, starting from the line's current settings: agent (or revoke_agent: true, a JSON boolean, at once; never the owner's own wallet), keeper ("borro", "none" or an address), ceiling (USDG), daily_limit (USDG, or "none"), target_ltv and trigger_ltv (at most the line's max trigger, 30% for CREDIT; a new target over the line's trigger moves the trigger by the market's rule), sell_bps (0 in a market with no pool), slip_bps, allow (add addresses), deny (take them off), gas_station (true adds the agent's gas station, false takes it off), bills (true: bill pay, the agent's own wallet on the allowlist so it can borrow what it is short of an x402 bill, credit_bill; false takes it off; such a line needs a daily limit, $100 unless given). When the agent changes, the old agent's gas station and own wallet come off the allowlist in the same transaction and the new agent's go on in their place. A line with a gas station on its allowlist keeps a daily limit of at most $5,000 ($100 unless given). Checked as the line checks it; shows before and after. Ownership: transfer_to (the owner offers the line), or accept: true (the wallet it was offered to takes it with acceptOwnership, then names Borro's keeper again with setKeeper: two transactions sent one after the other; accepting clears the keeper, so until the second is sent the line has no keeper and no auto-repay; keeper: "none" leaves it off). Check each transaction's to: a line the factory confirms (isAccount).

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • credit_lineOne agent credit line (account) or the lines a wallet owns (owner: five a call, newest first; page 2 for the next five): its market, credits posted, USDG owed, LTV against its targ…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    One agent credit line (account) or the lines a wallet owns (owner: five a call, newest first; page 2 for the next five): its market, credits posted, USDG owed, LTV against its target, trigger and LLTV, a health word, what the agent can still borrow, the daily limit and what went out and is left of it today, the price at which it can be liquidated, its agent, keeper, owner, allowlist and sale settings, the agent's gas station and whether it is allowlisted, USDG it holds, and whether protect would act now. holder: what holding $BORRO gets this line (Hold $BORRO. Borrow for less.): up to half its interest back every Monday, what Borro's keeper makes if it liquidates the line unless it was left short or left bad debt, and where switched on gas on the house; counts (Borro's keeper counted it on the last day it counted), share, via (owner or agent: whichever has the larger share), heldBorro (wallet plus own lock), borroForFull ($BORRO for the full rate at today's price), weekSoFarUsdg, interestBackBps (the part of the line's interest that would come back, up to 5000; share and interestBackBps are estimates if held through a whole UTC day) and gasOnTheHouse (only where switched on, and only for a counted line owing gas.minDebtUsdg, 25 USDG by default, or more whose holder holds at least gas.minShare, half by default, of the $BORRO its lines' full rate needs, within weekly limits); live false until Borro's keeper publishes its count.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • credit_marketsAgent Credit Lines: an agent posts its AI credits (Orbio CREDIT) and borrows USDG against them inside limits its owner sets once: a ceiling, a daily limit, a target LTV and an allo…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Agent Credit Lines: an agent posts its AI credits (Orbio CREDIT) and borrows USDG against them inside limits its owner sets once: a ceiling, a daily limit, a target LTV and an allowlist. markets: every market lines can open in now, each with its price, one yearly borrow rate (borrow_apr), its LLTV and max target and trigger, its defaults (CREDIT: 18% and 27%, with sales), the lending cap and any write-off. For CREDIT besides, as before: the feed's 2-hour median, its anchor, the last minute's and the pool's price, the line check price, whether the price has started and anything to know (a write-off proposed or in force, a pool with no data), the depth gate, what is lent, borrowed and free, the 90% most, the room under Borro's USDG vault caps, and the contracts. gas_stations: the factory and the station rules ($100 a day by default, $5,000 at most on a line with a station on its allowlist). Before the market is on chain: the pool's price and how lines will work.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • credit_repayUnsigned transactions repaying a line's USDG debt from the wallet (anyone may): an amount, or amount "all"; exact USDG approval to the line first (all: the debt plus a hundredth of…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Unsigned transactions repaying a line's USDG debt from the wallet (anyone may): an amount, or amount "all"; exact USDG approval to the line first (all: the debt plus a hundredth of a percent for interest until it lands; repay takes only what is owed). With close: true (a JSON boolean; the owner only): repay everything and take every credit and any USDG left back to the wallet. With unwind: true (a JSON boolean; the owner only; a line whose market has a pool): no USDG needed, the line sells its own CREDIT in its pool into the debt (sellAndRepay: by default enough to repay it all, at a minimum of the whole debt, then closes the line; sell and min_usdg to choose). Repaying, closing and an unwind at the whole debt work before CREDIT's price starts and during a write-off too. Check each transaction's to: a line the factory confirms (isAccount), or USDG for an exact approval.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • deposit_coverUnsigned transactions to put USDG into the gap cover pool, which backs every cover and keeps the premiums (less Borro's share) on top of the Steakhouse USDG vault's interest.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Unsigned transactions to put USDG into the gap cover pool, which backs every cover and keeps the premiums (less Borro's share) on top of the Steakhouse USDG vault's interest. Approve exactly the amount, then deposit. A big gap pays covers out of the pool.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • farm_depositUnsigned transactions to put USDG and a stock into its farm from the wallet: give usdg or stock (or both) and the other follows the farm's ratio (the feed's price for the first dep…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Unsigned transactions to put USDG and a stock into its farm from the wallet: give usdg or stock (or both) and the other follows the farm's ratio (the feed's price for the first deposit, which sets the farm's price). Approvals of the exact amounts first, then the deposit, simulated from the wallet. Shares are accepted down to slip_bps under the quote.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • farmsBorro's stock farms: a Uniswap v4 USDG/stock pool per stock, run by Borro's own hook, that lends what swaps do not need on Borro.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Borro's stock farms: a Uniswap v4 USDG/stock pool per stock, run by Borro's own hook, that lends what swaps do not need on Borro. For each farm: its size, what is kept for swaps and what is lent, its swap fee and squeeze fee now, the lending fees and interest its lent part earns, the last day's and week's swap volume and farmers' fees, and Your APR on a $1,000 deposit as one number (fees at the last week's pace, lending fees and interest, and the $BORRO Drip at today's rate with the lent part counted 1.5x). With a wallet, its part of each farm.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • healthFor bots that watch for liquidation: every short and USDG loan of a wallet, worst first, with how much of its limit it uses (limit_used, 1 = Morpho can liquidate it now), health (1…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    For bots that watch for liquidation: every short and USDG loan of a wallet, worst first, with how much of its limit it uses (limit_used, 1 = Morpho can liquidate it now), health (1 / limit_used), the stock price that liquidates it, how far the price is from that in percent, a status (ok, warn from 0.85, danger from 0.95, liquidatable), and the market clock. Also at /health/<wallet>.json.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • holder_benefitsHold $BORRO.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Hold $BORRO. Borrow for less. What a wallet's $BORRO gets it on Agent Credit Lines, with or without lines. Keep $BORRO in the wallet that borrows (its own BorroLock lock counts as held) and its lines get, always: (1) up to half their interest back every Monday, in USDG: the full rate when it holds $BORRO worth a quarter of what its lines owe together, proportionally less with less; (2) liquidation profit back: when Borro's keeper liquidates a line, what it makes comes back, in proportion to the holding, unless the line was left short or left bad debt. And where switched on (rules.gas says whether it is): (3) gas on the house: on a line owing gas.minDebtUsdg (25 USDG by default) or more, while the holder holds at least gas.minShare (half by default) of the $BORRO its lines' full rate needs, Borro tops up the agent's wallet when it runs low on ETH (the owner's, if the agent has not borrowed on the line within 7 days), within weekly limits, if it is a plain wallet (no smart-account code). Send the $BORRO away and it stops (and forfeits that part of the week's unpaid benefits). Nothing to sign, lock or stake. Answers live (false until Borro's keeper publishes its count; until then nothing is counted or paid), counts (what Borro's keeper counted on the last day it counted), share, via, heldBorro, borroForFull ($BORRO for the full rate at today's price) and borro_to_add_for_full, covers_debt_usdg (the most its lines may owe at the full rate), weekSoFarUsdg, interestBackBps, gasOnTheHouse, each line with what it owes and its rate back, each market's Borro-run supply share (interest paid to anyone else's direct supply, or to the wallet's own part of Borro's USDG vault, gets nothing back), the rules and the paid weeks; share and the rates are estimates if held through a whole UTC day. With borrow_usdg: the same for a planned borrow on top. It reads; it builds no transaction.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • marketOne stock's full line from the shelf: rates, sizes, limits, open fee and its contracts.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    One stock's full line from the shelf: rates, sizes, limits, open fee and its contracts.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • marketsEvery stock on Borro and the USDG vault: price, what is lent, borrowed and free to short, what lenders earn and what shorters pay a year (one number each, $BORRO included once it h…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Every stock on Borro and the USDG vault: price, what is lent, borrowed and free to short, what lenders earn and what shorters pay a year (one number each, $BORRO included once it has been paid), the USDG borrowing rate against each stock, and the $BORRO Drip to lenders: dollars a day per pool at today's price, and the rate a deposit of a given size would get.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • open_longUnsigned transactions for a leveraged long on a stock in one open: USDG margin plus a flash-borrowed debt buy the stock, which is lent (it earns lending fees) and posted, and the d…1 finding

    Why it is in this group

    • The name "open_long" says "open": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "open_long" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "open_long" says "open": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Unsigned transactions for a leveraged long on a stock in one open: USDG margin plus a flash-borrowed debt buy the stock, which is lent (it earns lending fees) and posted, and the debt is borrowed against it in the wallet's own name. Approve the margin and authorize LeverRouter on Morpho if needed, then open. Leverage up to 1.80x on SPY, QQQ and NVDA, 1.35x on the rest.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • open_pairUnsigned transactions for a pair trade: buy and lend the long stock in your name (it earns lending fees while held), then short the other, approvals first.1 finding

    Why it is in this group

    • The name "open_pair" says "open": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "open_pair" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "open_pair" says "open": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Unsigned transactions for a pair trade: buy and lend the long stock in your name (it earns lending fees while held), then short the other, approvals first. Priced now; simulated from the wallet in order.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • open_shortUnsigned transactions to short a stock from the wallet: approve the deposit if needed, then BorroShort.open (borrow the stock, sell it, hold the money plus the deposit).1 finding

    Why it is in this group

    • The name "open_short" says "open": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "open_short" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "open_short" says "open": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Unsigned transactions to short a stock from the wallet: approve the deposit if needed, then BorroShort.open (borrow the stock, sell it, hold the money plus the deposit). Priced now, with half a percent of slip allowed; simulated from the wallet. The quote's rebate_estimate is what this short puts in the wallet's weekly locker rebate.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • optionsOne stock's options chain for this Friday and next (expiry Friday 8pm New York): per strike and side the series id, Borro's fair value (Black-Scholes from the stock's own measured …No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    One stock's options chain for this Friday and next (expiry Friday 8pm New York): per strike and side the series id, Borro's fair value (Black-Scholes from the stock's own measured volatility, a guide), delta, the best ask and bid (checked on chain), the IV the ask implies, the shares written and the last traded IV; the stock's price, its volatility a year and the last traded IV; and whether the desk is live, paused and its fee. Prices are dollars a share, premiums USDG a share.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • positionEverything a wallet has on Borro: stock lent, shorts (owed, money held, the price it is closed for you at, and parts: how much of the stock's one short is the wallet's own, a pair'…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Everything a wallet has on Borro: stock lent, shorts (owed, money held, the price it is closed for you at, and parts: how much of the stock's one short is the wallet's own, a pair's and a basket leg's), USDG loans, USDG lent, open pairs (each with short_now, its own part of the short), gap covers bought and its part of the gap cover pool, options held, written and on order (with what to do next and one yearly number for premiums over what they locked), bear coins it launched, $BORRO to claim, its locker rebates (the share of Borro's fees it gets back for its $BORRO lock, what is owed and what has been paid), and its ETH and USDG.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • post_bidUnsigned transactions to post a bid for a series at a premium a share: the premium for all the shares is locked now in USDG (exact approval, then postBid) and goes to the writer wh…Can send data out1 finding

    Why it is in this group

    • The name "post_bid" says "post": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • outboundThe name "post_bid" says "post": it sends or publishes something to other people.

    Findings

    • Warn

      The server marks "post_bid" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "post_bid" says "post": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Unsigned transactions to post a bid for a series at a premium a share: the premium for all the shares is locked now in USDG (exact approval, then postBid) and goes to the writer who fills it, less Borro's share; the option tokens come to this wallet. cancel_order takes it back while it is open.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • pricesFor each stock token on Borro: the stock's own price (its Chainlink feed while the market is open; Borro's weekend estimate and 95% band while it is shut), the token's executable b…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    For each stock token on Borro: the stock's own price (its Chainlink feed while the market is open; Borro's weekend estimate and 95% band while it is shut), the token's executable buy and sell price on chain for $1,000 and $10,000 (what Borro's short desk would pay or get through its own swap route, before Borro's fee), and the gap in percent (gapPct: the token's mid against the stock). Positive: the token trades over the stock (short it on Borro); negative: under it (buy and lend it). Refreshed every 30 seconds; the same as https://borro.markets/prices.json.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • release_collateralUnsigned transaction giving a writer back the lock of a settled series less what its written options pay, once: stock vault shares for a call, Steakhouse USDG vault shares for a pu…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Unsigned transaction giving a writer back the lock of a settled series less what its written options pay, once: stock vault shares for a call, Steakhouse USDG vault shares for a put.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • repayUnsigned transactions to repay USDG borrowed against a stock (part, or all with all: true).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Unsigned transactions to repay USDG borrowed against a stock (part, or all with all: true).

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • rulesBorro's house rules, limits, what can go wrong, and every contract address with what it does, to verify on chain.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Borro's house rules, limits, what can go wrong, and every contract address with what it does, to verify on chain.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • settle_coverUnsigned transaction settling a cover with the feed's first round at or after its reopen (found by walking back from the latest round), with what it pays the buyer.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Unsigned transaction settling a cover with the feed's first round at or after its reopen (found by walking back from the latest round), with what it pays the buyer. Anyone may send it; the payout always goes to the buyer. When that first print came more than two hours after the reopen, or more than 50% from the reference, or never came in seven days, the transaction voids the cover instead (the premium the pool kept goes back).

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • settle_seriesUnsigned transaction settling a series after its Friday 8pm New York expiry with the feed's last round at or before it, found by walking back from the latest round, once the proof …No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Unsigned transaction settling a series after its Friday 8pm New York expiry with the feed's last round at or before it, found by walking back from the latest round, once the proof holds (the next round printed after expiry, or it is the feed's latest); when the feed printed nothing in the two days before expiry, with its first round after. Gives the settlement price and what it pays a share. Fourteen days after expiry with no round to prove a price it builds void(id) instead. Anyone may send either.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • supplyUnsigned transactions to lend a stock to shorters (it earns lending fees) or USDG in the Borro USDG vault (it earns interest).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Unsigned transactions to lend a stock to shorters (it earns lending fees) or USDG in the Borro USDG vault (it earns interest). With post: true, a stock is lent and posted in one step so USDG can be borrowed against it.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • tradesBorro-wide recent shorts opened and closed, newest first.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Borro-wide recent shorts opened and closed, newest first.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • weekendWhile the stock market is shut (Friday 8pm to Sunday 8pm New York, and holidays) the price feeds stop at their last print.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    While the stock market is shut (Friday 8pm to Sunday 8pm New York, and holidays) the price feeds stop at their last print. For each stock: the paused price, Borro's weekend price and 95% band (low, high), its typical Monday gap and the last closures' gaps, and the gap cover quotes per side and strike. Also the market clock (closed since, reopens at) and the gap cover pool: what is in it, free and set aside, Borro's share, and one yearly number for what the pool earned. Nothing on chain reads the weekend price.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • write_optionUnsigned transactions to write options from the wallet: post an ask at a premium (the collateral is locked now; it fills when a buyer takes it), or with order_id sell into that bid…1 finding

    Why it is in this group

    • The name "write_option" says "write": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "write_option" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "write_option" says "write": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Unsigned transactions to write options from the wallet: post an ask at a premium (the collateral is locked now; it fills when a buyer takes it), or with order_id sell into that bid now and receive its premium less Borro's share. A call locks one share of the stock's Borro vault per share written: from the stock (lent into its vault in the same transaction, the default) or from vault shares held (bNVDA). A put locks the strike in USDG in the Steakhouse vault: from USDG (the default) or that vault's shares held. Exact approval of the lock, then the call; simulated from the wallet.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data or untrusted-input.

Reads private data0
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write0
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out3
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

16 warn
  • The server marks "open_short" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "open_short" says "open": a word for a change.

    What this check looks for
  • The server marks "close_short" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "close_short" says "close": a word for a change.

    What this check looks for
  • The server marks "withdraw" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "withdraw" says "withdraw": a word that usually means money moves, which cannot be taken back.

    What this check looks for
  • The server marks "open_pair" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "open_pair" says "open": a word for a change.

    What this check looks for
  • The server marks "close_pair" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "close_pair" says "close": a word for a change.

    What this check looks for
  • The server marks "open_long" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "open_long" says "open": a word for a change.

    What this check looks for
Show 10 more findings
  • The server marks "close_long" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "close_long" says "close": a word for a change.

    What this check looks for
  • The server marks "farm_withdraw" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "farm_withdraw" says "withdraw": a word that usually means money moves, which cannot be taken back.

    What this check looks for
  • The server marks "withdraw_cover" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "withdraw_cover" says "withdraw": a word that usually means money moves, which cannot be taken back.

    What this check looks for
  • The server marks "write_option" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "write_option" says "write": a word for a change.

    What this check looks for
  • The server marks "post_bid" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "post_bid" says "post": a word for a change.

    What this check looks for
  • The server marks "cancel_order" read-only (readOnlyHint: true), and its own name, description or input give the class "destructive".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "cancel_order" says "cancel": a word for removing or ending something.

    What this check looks for
  • The server marks "cancel_order" not destructive (destructiveHint: false), and its own name, description or input give the class "destructive".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "cancel_order" says "cancel": a word for removing or ending something.

    What this check looks for
  • The server marks "credit_open" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "credit_open" says "open": a word for a change.

    What this check looks for
  • The server marks "credit_pay" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "credit_pay" says "pay": a word that usually means money moves, which cannot be taken back.

    What this check looks for
  • The server marks "credit_bill" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "pay": a word that usually means money moves, which cannot be taken back.

    What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http borro https://borro.markets/mcp
claude mcp add --transport http borro https://borro.markets/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [],
    "ask": [
      "mcp__borro__markets",
      "mcp__borro__market",
      "mcp__borro__health",
      "mcp__borro__position",
      "mcp__borro__trades",
      "mcp__borro__prices",
      "mcp__borro__bear_coins",
      "mcp__borro__rules",
      "mcp__borro__open_short",
      "mcp__borro__close_short",
      "mcp__borro__supply",
      "mcp__borro__withdraw",
      "mcp__borro__borrow",
      "mcp__borro__repay",
      "mcp__borro__bind_builder",
      "mcp__borro__open_pair",
      "mcp__borro__close_pair",
      "mcp__borro__buy_with_eth",
      "mcp__borro__open_long",
      "mcp__borro__close_long",
      "mcp__borro__farms",
      "mcp__borro__farm_deposit",
      "mcp__borro__farm_withdraw",
      "mcp__borro__weekend",
      "mcp__borro__buy_cover",
      "mcp__borro__deposit_cover",
      "mcp__borro__withdraw_cover",
      "mcp__borro__settle_cover",
      "mcp__borro__claim_cover",
      "mcp__borro__options",
      "mcp__borro__write_option",
      "mcp__borro__buy_option",
      "mcp__borro__post_bid",
      "mcp__borro__settle_series",
      "mcp__borro__claim_option",
      "mcp__borro__release_collateral",
      "mcp__borro__credit_markets",
      "mcp__borro__credit_line",
      "mcp__borro__holder_benefits",
      "mcp__borro__credit_open",
      "mcp__borro__credit_pay",
      "mcp__borro__credit_gas",
      "mcp__borro__credit_bill",
      "mcp__borro__credit_bill_header",
      "mcp__borro__credit_repay",
      "mcp__borro__credit_guardrails"
    ],
    "deny": [
      "mcp__borro__cancel_order"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as borro. Review it before you use it.

Capability tags behind 3 rules
  • mcp__borro__post_bid outbound
  • mcp__borro__credit_open outbound
  • mcp__borro__credit_pay outbound

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/markets.borro/borro/verify?hash=5eb8424ce9e7e42219c0c4f348686e2e1a5847d52fba521ac9f81fda89507454" | jq -e '.changed == false'

Pinned hash 5eb8424ce9e7, from Oct 27, 2026, 15:18 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/markets.borro/borro/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for markets.borro/borro
[![anlyon.dev](https://anlyon.dev/badge/markets.borro/borro.svg)](https://anlyon.dev/servers/markets.borro/borro)

Source: MCP Registry. Synced Oct 27, 2026, 15:18 UTC.