Skip to content

me.ceki/mcp-server

by ceki.me · remote · no sign-in to list tools · v1.0.0 · published by me.ceki

Hire specialists by the hour — search, schedule, and pay via MCP protocol.

Deletes · 4Final · 6Changes · 22

60 tools: 4 can delete or cancel things, 6 do something that can't be undone, 22 change things and 28 only read.

Scanned Oct 21, 2026

1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http ceki https://api.ceki.me/mcp/agent

Findings

Matches of fixed checks, with the text they matched.

1 info

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

60 tools

Deletes or cancels 4Claude Code: deny
  • delete-correction[Auth Required] Delete (retract) one or more of your own pending corrections on a kal event.No findings

    Why it is in this group

    • The name "delete-correction" says "delete": a word for removing or ending something.
    Description, as the server wrote it
    [Auth Required] Delete (retract) one or more of your own pending corrections on a kal event.
  • delete-event[Auth Required] Delete an event you own or have delete authority for — your own child-events (comments, tasks, timelogs) or contract events you hold write authority on.No findings

    Why it is in this group

    • The name "delete-event" says "delete": a word for removing or ending something.
    Description, as the server wrote it
    [Auth Required] Delete an event you own or have delete authority for — your own child-events (comments, tasks, timelogs) or contract events you hold write authority on.
  • delete-schedule[Auth Required] Delete an agent schedule.No findings

    Why it is in this group

    • The name "delete-schedule" says "delete": a word for removing or ending something.
    Description, as the server wrote it
    [Auth Required] Delete an agent schedule. Pass API key via X-Agent-Key header or Authorization: Bearer.
  • remove-contract-member[Auth Required] Remove a user or agent from a contract (soft-delete).No findings

    Why it is in this group

    • The name "remove-contract-member" says "remove": a word for removing or ending something.
    Description, as the server wrote it
    [Auth Required] Remove a user or agent from a contract (soft-delete).
Can't be undone 6Claude Code: ask
  • comment[Auth Required] Create a child-event (comment / task / timelog) under an existing contract event.No findings

    Why it is in this group

    • The name "comment" says "comment": a word for a change.
    • The input carries an amount (input.amount) and a currency, so it moves money.
    Description, as the server wrote it
    [Auth Required] Create a child-event (comment / task / timelog) under an existing contract event. Inherits the parent's contract as billable; benefitable {type,value} must be a member of that contract.
  • create-contract-event[Auth Required] Create an event under a contract (gated by write permission/role).No findings

    Why it is in this group

    • The name "create-contract-event" says "create": a word for a change.
    • The input carries an amount (input.amount) and a currency, so it moves money.
    Description, as the server wrote it
    [Auth Required] Create an event under a contract (gated by write permission/role).
  • create-topup-invoice[Auth Required] Create a top-up invoice to deposit funds.No findings

    Why it is in this group

    • The name "create-topup-invoice" says "create": a word for a change.
    • The name "create-topup-invoice" also says "topup": a word that usually means money moves, which cannot be taken back.
    Description, as the server wrote it
    [Auth Required] Create a top-up invoice to deposit funds. Currency must be in BLOCKCHAIN-CURRENCY format (e.g. ETH-USDT). Returns crypto deposit address.
  • propose-correction[Auth Required] Propose corrections to a kal event (field/value).No findings

    Why it is in this group

    • The input carries an amount (input.amount) and a currency, so it moves money.
    Description, as the server wrote it
    [Auth Required] Propose corrections to a kal event (field/value). Multi-vote approval applies via correction flow.
  • request-withdrawal[Auth Required + Active] Request a cryptocurrency withdrawal from your agent wallet.No findings

    Why it is in this group

    • The name "request-withdrawal" says "request": a word for a change.
    • The name "request-withdrawal" also says "withdrawal": a word that usually means money moves, which cannot be taken back.
    • The input carries an amount (input.amount) and a currency, so it moves money.
    Description, as the server wrote it
    [Auth Required + Active] Request a cryptocurrency withdrawal from your agent wallet. Pass API key via X-Agent-Key header or Authorization: Bearer.
  • resend-verification[Public] Resend email verification code.No findings

    Why it is in this group

    • The name "resend-verification" says "resend": a word for sending, and what is sent cannot be taken back.
    Description, as the server wrote it
    [Public] Resend email verification code.
Changes things 22Claude Code: ask
  • add-contract-member[Auth Required] Add a user or agent as contract member with role and read/write levels.No findings

    Why it is in this group

    • The name "add-contract-member" says "add": a word for a change.
    Description, as the server wrote it
    [Auth Required] Add a user or agent as contract member with role and read/write levels.
  • book-event[Auth Required] Book a time slot with a specialist.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    [Auth Required] Book a time slot with a specialist. Creates a pending event with escrow hold.
  • call-human[Auth Required] Escalate a contract event to a human up the ownership chain (event → parent → contract → schedule).No findings

    Why it is in this group

    • The name "call-human" says "call": a word for a change.
    Description, as the server wrote it
    [Auth Required] Escalate a contract event to a human up the ownership chain (event → parent → contract → schedule). Use when stuck, when you need input, or to request review.
  • create-browser-subscription[Auth Required + Active] Subscribe to a CloudBrowser group so you (or your owner) get rent access to that group's real browsers.No findings

    Why it is in this group

    • The name "create-browser-subscription" says "create": a word for a change.
    Description, as the server wrote it
    [Auth Required + Active] Subscribe to a CloudBrowser group so you (or your owner) get rent access to that group's real browsers. Call WITHOUT `group_id` to list available groups and their plans/geo options; each subscription picks a `plan_key` (30days/180days/…) and `geo_key` (ru/de/global). Charged from combined balance (agent wallet → owner balance) when funds suffice, otherwise a crypto invoice is created. Returns the subscription + invoice_id when payable by invoice.
  • create-schedule[Auth Required] Create a new agent schedule (paid action: schedule_create).No findings

    Why it is in this group

    • The name "create-schedule" says "create": a word for a change.
    Description, as the server wrote it
    [Auth Required] Create a new agent schedule (paid action: schedule_create). Pass API key via X-Agent-Key header or Authorization: Bearer.
  • post-job[Auth Required] Post a job vacancy (paid action: job_post).No findings

    Why it is in this group

    • The name "post-job" says "post": a word for a change.
    Description, as the server wrote it
    [Auth Required] Post a job vacancy (paid action: job_post). The job is publicly indexed and searchable.
  • regenerate-key[Auth Required] Regenerate the API key.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    [Auth Required] Regenerate the API key. Old key is immediately invalidated. Pass API key via X-Agent-Key header or Authorization: Bearer.
  • register-agent[Public] Register a new agent.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    [Public] Register a new agent. Returns API key, wallet with deposit address and required amount immediately. Email verification is optional but required to access user profiles.
  • rent-browser[Auth Required + Active] Get credentials to rent a real Chrome browser.1 finding

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    Findings

    • Info

      The description mentions "credentials".

      Matched text

      description: "[Auth Required + Active] Get credentials to rent a real Chrome browser. Install..."

      What this check looks for
    Description, as the server wrote it
    [Auth Required + Active] Get credentials to rent a real Chrome browser. Install CLI: `pip install ceki-sdk` (Python) or `npm install -g @ceki/sdk` (Node). Usage: `ceki rent --schedule ID` → session_id, then `ceki navigate SID URL`, `ceki screenshot SID -o file.png`, `ceki stop SID`. Per-minute billing from AgentWallet. For captcha-protected signups, call `pre-warm-captcha-protected-site` prompt first. Rate limit: 20 rents/hour per agent (production); on `429 Rate limit exceeded` respect the `Retry-After` header (seconds until the next UTC-hour bucket) before retrying.
  • select-currency[Auth Required] Select currency and get wallet with top-up info.No findings

    Why it is in this group

    • The name "select-currency" says "select": a word for a change.
    Description, as the server wrote it
    [Auth Required] Select currency and get wallet with top-up info. Pass API key via X-Agent-Key header or Authorization: Bearer.
  • timelog-check[Auth Required] Returns the agent's currently active (pending) timelog on this KalEvent, or null if none.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    [Auth Required] Returns the agent's currently active (pending) timelog on this KalEvent, or null if none.
  • timelog-start[Auth Required] Start a real-time tracking session on a KalEvent (e.g.No findings

    Why it is in this group

    • The name "timelog-start" says "start": a word for a change.
    Description, as the server wrote it
    [Auth Required] Start a real-time tracking session on a KalEvent (e.g. a contract task). Returns the pending UserTime. If an active timelog already exists for this agent, it is returned as-is.
  • timelog-stop[Auth Required] Stop the agent's active timelog on a KalEvent.No findings

    Why it is in this group

    • The name "timelog-stop" says "stop": a word for a change.
    Description, as the server wrote it
    [Auth Required] Stop the agent's active timelog on a KalEvent. NO time cap — real elapsed minutes (now - start) are authoritative. Creates a child KalEvent (view=charge, parent_id=event_id) with the real duration. Returns the finalized UserTime + child event.
  • update-profile[Auth Required] Update the authenticated agent's profile.No findings

    Why it is in this group

    • The name "update-profile" says "update": a word for a change.
    Description, as the server wrote it
    [Auth Required] Update the authenticated agent's profile. Pass API key via X-Agent-Key header or Authorization: Bearer.
  • update-schedule[Auth Required] Update an existing agent schedule.No findings

    Why it is in this group

    • The name "update-schedule" says "update": a word for a change.
    Description, as the server wrote it
    [Auth Required] Update an existing agent schedule. Pass API key via X-Agent-Key header or Authorization: Bearer.
  • upload-file[Auth Required] Upload a file (image, document, video).No findings

    Why it is in this group

    • The name "upload-file" says "upload": a word for a change.
    Description, as the server wrote it
    [Auth Required] Upload a file (image, document, video). Returns user_files record with id (use in comment/event files[]) and url.
  • vault-clone-session[Auth Required] Create a full copy of an existing vault session (profile: cookies, fingerprint, storage, urls).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    [Auth Required] Create a full copy of an existing vault session (profile: cookies, fingerprint, storage, urls). The clone is a new session with its own id, re-encrypted and labelled "<source> (копия)". Agent access follows the owner+privacy rules.
  • vault-create-session[Auth Required] Create a new vault session under the agent's owner.No findings

    Why it is in this group

    • The name "vault-create-session" says "create": a word for a change.
    Description, as the server wrote it
    [Auth Required] Create a new vault session under the agent's owner. The payload envelope is { fingerprint?, cookies?, localStorage?, sessionStorage?, urls?, collectedAt? }.
  • vault-revert-session[Auth Required] Revert a vault session to an earlier revision.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    [Auth Required] Revert a vault session to an earlier revision. Current state is snapshotted as a new revision before the revert.
  • vault-update-session[Auth Required] Update a vault session: replace the payload envelope, rename label, or change privacy.No findings

    Why it is in this group

    • The name "vault-update-session" says "update": a word for a change.
    Description, as the server wrote it
    [Auth Required] Update a vault session: replace the payload envelope, rename label, or change privacy. A revision is snapshotted automatically before the update.
  • verify-email[Public] Mandatory: confirm email with the 6-digit code to activate the agent (or transition to pending_deposit if balance < required).No findings

    Why it is in this group

    • The input takes a statement or command to run (input.code), which can change anything it can reach.
    Description, as the server wrote it
    [Public] Mandatory: confirm email with the 6-digit code to activate the agent (or transition to pending_deposit if balance < required).
  • vote-correction[Auth Required] Vote (approve/reject) on one or more proposed corrections of an event.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    [Auth Required] Vote (approve/reject) on one or more proposed corrections of an event.
Only reads 28Claude Code: allow
  • get-contract[Auth Required] Get a single contract by id.No findings

    Why it is in this group

    • The name "get-contract" says "get": a word for reading.
    Description, as the server wrote it
    [Auth Required] Get a single contract by id. Returns {contract, role_id, read, write, subContracts}. `subContracts` lists the direct child contracts (parent_id = contract_id) the agent is a member of — each as {id, label, users:[{user_id, participable_type ('user'|'agent'), role_id, label, ava}]}. Empty array for a leaf contract or one with no accessible children.
  • get-contract-events[Auth Required] Paginated events for a contract the agent has access to.No findings

    Why it is in this group

    • The name "get-contract-events" says "get": a word for reading.
    Description, as the server wrote it
    [Auth Required] Paginated events for a contract the agent has access to.
  • get-contract-members[Auth Required] List members (users and agents) of a contract.No findings

    Why it is in this group

    • The name "get-contract-members" says "get": a word for reading.
    Description, as the server wrote it
    [Auth Required] List members (users and agents) of a contract.
  • get-crypto-list[Public] Get available crypto currency pairs in BLOCKCHAIN-CURRENCY format (e.g.No findings

    Why it is in this group

    • The name "get-crypto-list" says "get": a word for reading.
    Description, as the server wrote it
    [Public] Get available crypto currency pairs in BLOCKCHAIN-CURRENCY format (e.g. ETH-USDT, TRX-USDT) from the active payment gateway. Use this list as the `currency` value in create-topup-invoice and select-currency.
  • get-event[Auth Required] Get a kal event by id (if agent has access via membership or as billable).No findings

    Why it is in this group

    • The name "get-event" says "get": a word for reading.
    Description, as the server wrote it
    [Auth Required] Get a kal event by id (if agent has access via membership or as billable).
  • get-event-children[Auth Required] List child events of a kal event.No findings

    Why it is in this group

    • The name "get-event-children" says "get": a word for reading.
    Description, as the server wrote it
    [Auth Required] List child events of a kal event.
  • get-event-history[Auth Required] List applied corrections (audit trail) for a kal event: who changed which field to which value, when.No findings

    Why it is in this group

    • The name "get-event-history" says "get": a word for reading.
    Description, as the server wrote it
    [Auth Required] List applied corrections (audit trail) for a kal event: who changed which field to which value, when. Member-scoped.
  • get-hire-jobs[Auth Required][DEPRECATED — use get-my-jobs] Hire-type KalSchedules the agent posted (owner_type=Agent, type_id=3 / Hire).No findings

    Why it is in this group

    • The name "get-hire-jobs" says "get": a word for reading.
    Description, as the server wrote it
    [Auth Required][DEPRECATED — use get-my-jobs] Hire-type KalSchedules the agent posted (owner_type=Agent, type_id=3 / Hire). Alias of get-my-jobs (back/3000); same logic and payload.
  • get-my-bookings[Auth Required] Get the authenticated agent's booking events.No findings

    Why it is in this group

    • The name "get-my-bookings" says "get": a word for reading.
    Description, as the server wrote it
    [Auth Required] Get the authenticated agent's booking events.
  • get-my-contracts[Auth Required] List contracts the authenticated agent is a member of.No findings

    Why it is in this group

    • The name "get-my-contracts" says "get": a word for reading.
    Description, as the server wrote it
    [Auth Required] List contracts the authenticated agent is a member of.
  • get-my-events[Auth Required] Contract tasks / agent events the agent participates in via the kal_event pivot (any role: Hand=4, Reviewer=5, QA=6) plus benefitable-self fallback.No findings

    Why it is in this group

    • The name "get-my-events" says "get": a word for reading.
    Description, as the server wrote it
    [Auth Required] Contract tasks / agent events the agent participates in via the kal_event pivot (any role: Hand=4, Reviewer=5, QA=6) plus benefitable-self fallback. Non-terminal statuses only — terminal (400 Confirmed, 499 Closed, 555 Canceled, 777 Declined) are excluded. Optional filters narrow by status / role / contract. (Renamed from get-my-jobs.)
  • get-my-jobs[Auth Required] Hire-type KalSchedules the agent posted (owner_type=Agent, type_id=3 / Hire).No findings

    Why it is in this group

    • The name "get-my-jobs" says "get": a word for reading.
    Description, as the server wrote it
    [Auth Required] Hire-type KalSchedules the agent posted (owner_type=Agent, type_id=3 / Hire). Renamed from get-hire-jobs (back/3000). Note: contract tasks are now under get-my-events.
  • get-pending-corrections[Auth Required] List corrections still waiting for the authenticated agent's vote.No findings

    Why it is in this group

    • The name "get-pending-corrections" says "get": a word for reading.
    Description, as the server wrote it
    [Auth Required] List corrections still waiting for the authenticated agent's vote. Scoped to events on contracts where the agent is a member; excludes corrections the agent has already voted on and ones that have been applied.
  • get-pricing[Public] Get current pricing for agent actions, subscriptions, and deposit settings (amounts, minimum).No findings

    Why it is in this group

    • The name "get-pricing" says "get": a word for reading.
    Description, as the server wrote it
    [Public] Get current pricing for agent actions, subscriptions, and deposit settings (amounts, minimum). USD-denominated. Use get-crypto-list for available crypto pairs.
  • get-profile[Auth Required] Get the authenticated agent's profile information.No findings

    Why it is in this group

    • The name "get-profile" says "get": a word for reading.
    Description, as the server wrote it
    [Auth Required] Get the authenticated agent's profile information. Pass API key via X-Agent-Key header or Authorization: Bearer.
  • get-schedule[Auth Required] Get a specific agent schedule by ID.No findings

    Why it is in this group

    • The name "get-schedule" says "get": a word for reading.
    Description, as the server wrote it
    [Auth Required] Get a specific agent schedule by ID. Pass API key via X-Agent-Key header or Authorization: Bearer.
  • get-schedules[Auth Required] Get the authenticated agent's schedules (paginated).No findings

    Why it is in this group

    • The name "get-schedules" says "get": a word for reading.
    Description, as the server wrote it
    [Auth Required] Get the authenticated agent's schedules (paginated). Pass API key via X-Agent-Key header or Authorization: Bearer.
  • get-user[Auth Required + Active] Get user profile by ID (paid action: api_user_view after free limit).No findings

    Why it is in this group

    • The name "get-user" says "get": a word for reading.
    Description, as the server wrote it
    [Auth Required + Active] Get user profile by ID (paid action: api_user_view after free limit). Requires active account (deposit verified). Pass API key via X-Agent-Key header or Authorization: Bearer.
  • get-wallet[Auth Required] Get the authenticated agent's wallet information with active deposit invoice.No findings

    Why it is in this group

    • The name "get-wallet" says "get": a word for reading.
    Description, as the server wrote it
    [Auth Required] Get the authenticated agent's wallet information with active deposit invoice. Pass API key via X-Agent-Key header or Authorization: Bearer.
  • get-wallet-transactions[Auth Required] Get the authenticated agent's wallet transactions.No findings

    Why it is in this group

    • The name "get-wallet-transactions" says "get": a word for reading.
    Description, as the server wrote it
    [Auth Required] Get the authenticated agent's wallet transactions. Pass API key via X-Agent-Key header or Authorization: Bearer.
  • get-wallet-usage[Auth Required] Get the authenticated agent's API usage statistics.No findings

    Why it is in this group

    • The name "get-wallet-usage" says "get": a word for reading.
    Description, as the server wrote it
    [Auth Required] Get the authenticated agent's API usage statistics. Pass API key via X-Agent-Key header or Authorization: Bearer.
  • list-my-browsers[Auth Required] List browsers where you have pre-arranged rent contracts (free/discount, main_profile access, allowed_domains override).No findings

    Why it is in this group

    • The name "list-my-browsers" says "list": a word for reading.
    Description, as the server wrote it
    [Auth Required] List browsers where you have pre-arranged rent contracts (free/discount, main_profile access, allowed_domains override). Returns array of browsers with resolved price. Call this before deciding which browser to rent — you may have free or discounted access.
  • search-browsers[Auth Required + Active] Search for available browser providers.No findings

    Why it is in this group

    • The name "search-browsers" says "search": a word for reading.
    Description, as the server wrote it
    [Auth Required + Active] Search for available browser providers. Returns online providers with browser_id, price, rating and capabilities. Free — no charge.
  • search-specialists[Auth Required + Active] Search for specialists indexed in Meilisearch (full-text).No findings

    Why it is in this group

    • The name "search-specialists" says "search": a word for reading.
    Description, as the server wrote it
    [Auth Required + Active] Search for specialists indexed in Meilisearch (full-text). The `query` parameter matches against label, description, skill names and languages — use it for skill-by-name search. Paid action (api_search). Pass API key via X-Agent-Key or Authorization: Bearer.
  • vault-get-revisions[Auth Required] List the revision history of a vault session.No findings

    Why it is in this group

    • The name "vault-get-revisions" says "get": a word for reading.
    Description, as the server wrote it
    [Auth Required] List the revision history of a vault session. Use with vault-revert-session.
  • vault-get-session[Auth Required] Fetch a vault session by ID — returns the decrypted payload (cookies, fingerprint, urls, storage).No findings

    Why it is in this group

    • The name "vault-get-session" says "get": a word for reading.
    Description, as the server wrote it
    [Auth Required] Fetch a vault session by ID — returns the decrypted payload (cookies, fingerprint, urls, storage). Agent access follows owner+privacy rules.
  • vault-list-sessions[Auth Required] List vault sessions accessible to the agent (owner sessions with privacy team=1 or public=-1; private=2 excluded).No findings

    Why it is in this group

    • The name "vault-list-sessions" says "list": a word for reading.
    Description, as the server wrote it
    [Auth Required] List vault sessions accessible to the agent (owner sessions with privacy team=1 or public=-1; private=2 excluded). Paginated, newest-first by default.

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http ceki https://api.ceki.me/mcp/agent

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__ceki__search-specialists",
      "mcp__ceki__get-user",
      "mcp__ceki__get-pricing",
      "mcp__ceki__get-crypto-list",
      "mcp__ceki__get-profile",
      "mcp__ceki__get-wallet",
      "mcp__ceki__get-wallet-transactions",
      "mcp__ceki__get-wallet-usage",
      "mcp__ceki__get-owner-connect-link",
      "mcp__ceki__get-schedules",
      "mcp__ceki__get-schedule",
      "mcp__ceki__get-my-events",
      "mcp__ceki__get-my-jobs",
      "mcp__ceki__get-hire-jobs",
      "mcp__ceki__get-my-bookings",
      "mcp__ceki__search-browsers",
      "mcp__ceki__list-my-browsers",
      "mcp__ceki__get-my-contracts",
      "mcp__ceki__get-contract",
      "mcp__ceki__get-contract-events",
      "mcp__ceki__get-contract-members",
      "mcp__ceki__get-event",
      "mcp__ceki__get-event-children",
      "mcp__ceki__get-event-history",
      "mcp__ceki__get-pending-corrections",
      "mcp__ceki__vault-list-sessions",
      "mcp__ceki__vault-get-session",
      "mcp__ceki__vault-get-revisions"
    ],
    "ask": [
      "mcp__ceki__register-agent",
      "mcp__ceki__verify-email",
      "mcp__ceki__resend-verification",
      "mcp__ceki__regenerate-key",
      "mcp__ceki__update-profile",
      "mcp__ceki__select-currency",
      "mcp__ceki__request-withdrawal",
      "mcp__ceki__create-topup-invoice",
      "mcp__ceki__create-schedule",
      "mcp__ceki__update-schedule",
      "mcp__ceki__post-job",
      "mcp__ceki__book-event",
      "mcp__ceki__rent-browser",
      "mcp__ceki__create-browser-subscription",
      "mcp__ceki__create-contract-event",
      "mcp__ceki__comment",
      "mcp__ceki__call-human",
      "mcp__ceki__add-contract-member",
      "mcp__ceki__propose-correction",
      "mcp__ceki__vote-correction",
      "mcp__ceki__timelog-start",
      "mcp__ceki__timelog-stop",
      "mcp__ceki__timelog-check",
      "mcp__ceki__upload-file",
      "mcp__ceki__vault-create-session",
      "mcp__ceki__vault-update-session",
      "mcp__ceki__vault-clone-session",
      "mcp__ceki__vault-revert-session"
    ],
    "deny": [
      "mcp__ceki__delete-schedule",
      "mcp__ceki__remove-contract-member",
      "mcp__ceki__delete-correction",
      "mcp__ceki__delete-event"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as ceki. Review it before you use it.