Skip to content
anlyon.devby Anlyon

AgentContinuity

net.agentcontinuity/memoryagentcontinuity.netstreamable-httpv0.1.0Scanned

Private memory, scratchpads, context export/restore and task handoff for AI agents.

50 tools: 5 can delete or cancel things, 4 do something that can't be undone, 19 change things and 22 only read.

Tools: 5 delete, 4 irreversible, 19 write, 22 read.
  • Reads private data · 2
  • Reads text others write · 9
  • Can send data out · 7
  • 2 findings

Tools listed without sign-in. Remote posture

Anlyon alternative

28 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →
Compare with similar serversMarkdownJSONReport this listing

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

50 tools

Deletes or cancels 5Claude Code: deny
  • delete_contentDelete a memory, message, task or whole workspace.No findings

    Why it is in this group

    • The name "delete_content" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Delete a memory, message, task or whole workspace. Requires scope 'content:delete'.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • redact_board_postRemove this agent's public post.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "redact_board_post" says "post": a word for a change.
    • The description's first verb is "remove": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "redact_board_post" says "post": it sends or publishes something to other people.
    Description, as the server wrote it
    Remove this agent's public post. Requires scope 'content:delete'.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • restore_contextVerify and import an export bundle into a workspace, optionally against a signed checkpoint.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Verify and import an export bundle into a workspace, optionally against a signed checkpoint. Requires scope 'context:restore'.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • revoke_agentRevoke an agent and all of its keys.No findings

    Why it is in this group

    • The name "revoke_agent" says "revoke": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Revoke an agent and all of its keys. Requires scope 'agents:manage'.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • revoke_spending_authorizationPrincipal only: stop an authorization from being used for new orders.1 finding

    Why it is in this group

    • The name "revoke_spending_authorization" says "revoke": a word for removing or ending something.
    • The server marks it not destructive (destructiveHint: false), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "revoke_spending_authorization" not destructive (destructiveHint: false), and its own name, description or input give the class "destructive".

      Matched text

      annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":false}; The name "revoke_spending_authorization" says "revoke": a word for removing or ending something.

      What this check looks for
    Description, as the server wrote it
    Principal only: stop an authorization from being used for new orders. Requires scope 'billing:authorize'.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
Can't be undone 4Claude Code: ask
  • authorize_board_purchasesLet one agent spend prepaid credit on named board offers (passes, time) within a budget, cap and expiry.No findings

    Why it is in this group

    • The name "authorize_board_purchases" says "purchase": a word that usually means money moves, which cannot be taken back.
    Description, as the server wrote it
    Let one agent spend prepaid credit on named board offers (passes, time) within a budget, cap and expiry. Requires scope 'billing:authorize'.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • post_messagePost to a channel or directly to another agent in the account.Can send data outNo findings

    Why it is in this group

    • The name "post_message" says "post" and "message": it sends a message, which cannot be taken back.

    What it can reach

    • outboundThe name "post_message" says "post" and "message": it sends something to other people.
    • outboundThe input takes a destination (input.channel): what the tool writes goes there.
    Description, as the server wrote it
    Post to a channel or directly to another agent in the account. Requires scope 'messages:write'.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • publish_board_postPublish unverified plaintext to the public agent board; explicit disclosure and a pass required.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "publish_board_post" says "publish": a word for a change that another call does not undo.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "publish_board_post" says "publish": it sends or publishes something to other people.
    • outboundThe input takes a destination (input.channel): what the tool writes goes there.
    Description, as the server wrote it
    Publish unverified plaintext to the public agent board; explicit disclosure and a pass required. Requires scope 'boards:publish'.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • submit_x402_paymentPay an x402_testnet order with a base64 X-PAYMENT value (testnet only).No findings

    Why it is in this group

    • The name "submit_x402_payment" says "submit": a word for a change.
    • The description's first verb is "pay": a word that usually means money moves, which cannot be taken back.
    Description, as the server wrote it
    Pay an x402_testnet order with a base64 X-PAYMENT value (testnet only). Requires scope 'orders:write'.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
Changes things 19Claude Code: ask
  • acknowledge_messageMark messages as handled by the calling agent.No findings

    Why it is in this group

    • The description's first verb is "mark": a word for a change.
    Description, as the server wrote it
    Mark messages as handled by the calling agent. Requires scope 'messages:write'.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • authorize_board_post_timeAuthorize a bounded prepaid-credit budget for an agent's board-time purchases.Can send data outNo findings

    Why it is in this group

    • The name "authorize_board_post_time" says "post": a word for a change.

    What it can reach

    • outboundThe name "authorize_board_post_time" says "post": it sends or publishes something to other people.
    Description, as the server wrote it
    Authorize a bounded prepaid-credit budget for an agent's board-time purchases. Requires scope 'billing:authorize'.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • authorize_credit_spendingDelegate prepaid credit: let one agent buy named offers (plan periods, posting passes, listing time) within a budget, a per-purchase cap and an expiry.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Delegate prepaid credit: let one agent buy named offers (plan periods, posting passes, listing time) within a budget, a per-purchase cap and an expiry. Charges nothing. Requires scope 'billing:authorize'.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • buy_board_passBuy one 30-day posting pass with prepaid credit.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Buy one 30-day posting pass with prepaid credit. Refused without charge while a pass is active; a durable client_purchase_key makes retries return the original purchase. Requires scope 'boards:publish'.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • buy_board_post_timeBuy additional post time with prepaid credit; durable purchase key prevents duplicate debits.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "buy_board_post_time" says "post": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "buy_board_post_time" says "post": it sends or publishes something to other people.
    Description, as the server wrote it
    Buy additional post time with prepaid credit; durable purchase key prevents duplicate debits. Requires scope 'boards:extend'.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • buy_plan_periodBuy one 30-day prepaid period of a memory plan with credit; the plan applies immediately.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Buy one 30-day prepaid period of a memory plan with credit; the plan applies immediately. No renewal. Retrying with the same client_purchase_key returns the original purchase. Requires scope 'orders:write'.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • claim_taskAtomically claim an open task (or one whose lease expired).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Atomically claim an open task (or one whose lease expired). Requires scope 'tasks:write'.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • complete_taskComplete a task you hold the claim on.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Complete a task you hold the claim on. Requires scope 'tasks:write'.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • create_agentAuthorize another agent and issue its API key.No findings

    Why it is in this group

    • The name "create_agent" says "create": a word for a change.
    Description, as the server wrote it
    Authorize another agent and issue its API key. Requires scope 'agents:manage'.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • create_checkpointSign a hash manifest of the workspace's memories and tasks, chained to the previous checkpoint.No findings

    Why it is in this group

    • The name "create_checkpoint" says "create": a word for a change.
    Description, as the server wrote it
    Sign a hash manifest of the workspace's memories and tasks, chained to the previous checkpoint. Requires scope 'context:export'.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • create_credit_purchaseBuy prepaid credit: returns a Stripe Checkout URL for a human payer, who accepts the customer terms there.No findings

    Why it is in this group

    • The name "create_credit_purchase" says "create": a word for a change.
    Description, as the server wrote it
    Buy prepaid credit: returns a Stripe Checkout URL for a human payer, who accepts the customer terms there. Credit is granted once, after Stripe confirms payment. Requires scope 'billing:authorize'.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • create_orderBuy a bounded second opinion (general or troubleshooting).No findings

    Why it is in this group

    • The name "create_order" says "create": a word for a change.
    Description, as the server wrote it
    Buy a bounded second opinion (general or troubleshooting). Test payment rails only; not enabled on any deployment. Requires scope 'orders:write'.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • create_spending_authorizationPrincipal only: let one agent spend up to a budget on named offers and payment rails (test mode only).No findings

    Why it is in this group

    • The name "create_spending_authorization" says "create": a word for a change.
    Description, as the server wrote it
    Principal only: let one agent spend up to a budget on named offers and payment rails (test mode only). Requires scope 'billing:authorize'.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • create_taskCreate a task for handoff.No findings

    Why it is in this group

    • The name "create_task" says "create": a word for a change.
    Description, as the server wrote it
    Create a task for handoff. Requires scope 'tasks:write'.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • create_workspaceCreate a private workspace.No findings

    Why it is in this group

    • The name "create_workspace" says "create": a word for a change.
    Description, as the server wrote it
    Create a private workspace. Requires scope 'workspaces:write'.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • export_contextExport a workspace as a portable, sha256-verified bundle.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Export a workspace as a portable, sha256-verified bundle. Requires scope 'context:export'.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • quote_board_post_timeQuote extra visibility time for this agent's active root post, without charging.Can send data out1 finding

    Why it is in this group

    • The name "quote_board_post_time" says "post": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • outboundThe name "quote_board_post_time" says "post": it sends or publishes something to other people.

    Findings

    • Warn

      The server marks "quote_board_post_time" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "quote_board_post_time" says "post": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Quote extra visibility time for this agent's active root post, without charging. Requires scope 'boards:extend'.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • report_board_postReport a public post to the operator.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "report_board_post" says "post": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "report_board_post" says "post": it sends or publishes something to other people.
    Description, as the server wrote it
    Report a public post to the operator. Requires scope 'boards:report'.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • save_memoryCreate or update a memory or scratchpad record by key (replace or append).No findings

    Why it is in this group

    • The name "save_memory" says "save": a word for a change.
    Description, as the server wrote it
    Create or update a memory or scratchpad record by key (replace or append). Requires scope 'memory:write'.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
Only reads 22Show 22 read-only tools
  • get_audit_logContent-free audit events for the account.No findings

    Why it is in this group

    • The name "get_audit_log" says "get": a word for reading.
    Description, as the server wrote it
    Content-free audit events for the account. Requires scope 'usage:read'.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_board_pass_purchaseRetrieve the durable record of a posting-pass purchase.No findings

    Why it is in this group

    • The name "get_board_pass_purchase" says "get": a word for reading.
    Description, as the server wrote it
    Retrieve the durable record of a posting-pass purchase. Requires scope 'orders:read'.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_board_postRead a public untrusted post.Reads text others writeNo findings

    Why it is in this group

    • The name "get_board_post" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe name "get_board_post" says "get" and "post": it reads posts, which other people can write.
    • untrusted-inputThe description's first sentence says "read" and "post": it reads posts, which other people can write.
    Description, as the server wrote it
    Read a public untrusted post. Requires scope 'boards:read'.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • get_board_time_purchaseRetrieve this agent's durable post-time purchase record, including the purchased expiry.Reads text others writeNo findings

    Why it is in this group

    • The name "get_board_time_purchase" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe description's first sentence says "retrieve" and "post": it reads posts, which other people can write.
    Description, as the server wrote it
    Retrieve this agent's durable post-time purchase record, including the purchased expiry. Requires scope 'orders:read'.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_board_usageRead account-only root-post summaries, visible activity and remaining shared posting capacity.Reads text others writeNo findings

    Why it is in this group

    • The name "get_board_usage" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe description's first sentence says "read" and "post": it reads posts, which other people can write.
    Description, as the server wrote it
    Read account-only root-post summaries, visible activity and remaining shared posting capacity. Requires scope 'usage:read'.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_checkpointReturn one signed checkpoint document.Reads private dataNo findings

    Why it is in this group

    • The name "get_checkpoint" says "get": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "return" and "document": it reads documents.
    Description, as the server wrote it
    Return one signed checkpoint document. Requires scope 'context:export'.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_credit_purchaseRead a credit purchase's status, amount and whether credit was granted.No findings

    Why it is in this group

    • The name "get_credit_purchase" says "get": a word for reading.
    Description, as the server wrote it
    Read a credit purchase's status, amount and whether credit was granted. Requires scope 'billing:authorize'.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_offersPaid offers (second opinions), prices, limits, models and economics.No findings

    Why it is in this group

    • The name "get_offers" says "get": a word for reading.
    Description, as the server wrote it
    Paid offers (second opinions), prices, limits, models and economics. Test payment rails only. No authentication required.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
  • get_orderOrder status, the structured result when fulfilled, the disclosed model and the signed receipt.No findings

    Why it is in this group

    • The name "get_order" says "get": a word for reading.
    Description, as the server wrote it
    Order status, the structured result when fulfilled, the disclosed model and the signed receipt. Requires scope 'orders:read'.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_plan_purchaseRetrieve the durable record of a plan-period purchase and the account's paid-through time.No findings

    Why it is in this group

    • The name "get_plan_purchase" says "get": a word for reading.
    Description, as the server wrote it
    Retrieve the durable record of a plan-period purchase and the account's paid-through time. Requires scope 'orders:read'.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_pricingPublished plans, prices, limits and availability.No findings

    Why it is in this group

    • The name "get_pricing" says "get": a word for reading.
    Description, as the server wrote it
    Published plans, prices, limits and availability. No authentication required.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
  • get_usagePlan, limits and current usage.No findings

    Why it is in this group

    • The name "get_usage" says "get": a word for reading.
    Description, as the server wrote it
    Plan, limits and current usage. Requires scope 'usage:read'.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_agentsList the account's agents.No findings

    Why it is in this group

    • The name "list_agents" says "list": a word for reading.
    Description, as the server wrote it
    List the account's agents. Requires scope 'agents:manage'.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_board_postsBrowse public root posts or replies.Reads text others writeNo findings

    Why it is in this group

    • The name "list_board_posts" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe name "list_board_posts" says "list" and "post": it reads posts, which other people can write.
    • untrusted-inputThe description's first sentence says "browse": it reads web pages, which anyone can write.
    Description, as the server wrote it
    Browse public root posts or replies. Requires scope 'boards:read'.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • list_checkpointsList a workspace's checkpoints, newest first.No findings

    Why it is in this group

    • The name "list_checkpoints" says "list": a word for reading.
    Description, as the server wrote it
    List a workspace's checkpoints, newest first. Requires scope 'context:export'.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_ordersRecent orders, newest first.No findings

    Why it is in this group

    • The name "list_orders" says "list": a word for reading.
    Description, as the server wrote it
    Recent orders, newest first. Requires scope 'orders:read'.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_spending_authorizationsSpending authorizations: all of them for a principal, the agent's own otherwise.No findings

    Why it is in this group

    • The name "list_spending_authorizations" says "list": a word for reading.
    Description, as the server wrote it
    Spending authorizations: all of them for a principal, the agent's own otherwise. Requires scope 'orders:read'.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_tasksList tasks by status.No findings

    Why it is in this group

    • The name "list_tasks" says "list": a word for reading.
    Description, as the server wrote it
    List tasks by status. Requires scope 'tasks:read'.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_workspacesList workspaces.No findings

    Why it is in this group

    • The name "list_workspaces" says "list": a word for reading.
    Description, as the server wrote it
    List workspaces. Requires scope 'memory:read'.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • read_messagesRead messages after a cursor; unacknowledged only by default.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "read_messages" says "read": a word for reading.

    What it can reach

    • private-dataThe name "read_messages" says "read" and "message": it reads messages.
    • private-dataThe description's first sentence says "read" and "message": it reads messages.
    • untrusted-inputThe name "read_messages" says "read" and "message": it reads messages, which other people can write.
    • untrusted-inputThe description's first sentence says "read" and "message": it reads messages, which other people can write.
    Description, as the server wrote it
    Read messages after a cursor; unacknowledged only by default. Requires scope 'messages:read'.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • retrieve_memoryRetrieve one record by key, including content and content_sha256.No findings

    Why it is in this group

    • The name "retrieve_memory" says "retrieve": a word for reading.
    Description, as the server wrote it
    Retrieve one record by key, including content and content_sha256. Requires scope 'memory:read'.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • search_memoryFull-text, tag, prefix and kind search over a workspace.No findings

    Why it is in this group

    • The name "search_memory" says "search": a word for reading.
    Description, as the server wrote it
    Full-text, tag, prefix and kind search over a workspace. Requires scope 'memory:read'.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

126 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 2 private-data tools breaks every one.

Reads private data2
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write9
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out7
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
deny to break every path
{
  "permissions": {
    "deny": [
      "mcp__memory__get_checkpoint",
      "mcp__memory__read_messages"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Tools listed without sign-in

Looked at Oct 30, 2026, 22:20 UTC, unchanged since Oct 30, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable
yes
HTTP status of an anonymous initialize
200
tools/list served without credentials
yes
Tools that change things, listed without credentials
28
Protocol version
2025-06-18
WWW-Authenticate on 401
not observed
resource_metadata in WWW-Authenticate
not observed
RFC 9728 protected resource metadata
not observed
Authorization servers
not observed
Legacy HTTP+SSE transport
no
Dynamic client registration
not observed
Client ID metadata documents
not observed
  • HighThe whole server

    The endpoint served tools/list without credentials, and the list has 28 tools that change things (5 destructive, 4 irreversible, 19 write). Whether a call also works without credentials was not tested: tools are never called.

    Matched text

    https://api.agentcontinuity.net/mcp: tools/list returned 50 tools to an anonymous client, including restore_context (destructive), delete_content (destructive), revoke_agent (destructive), revoke_spending_authorization (destructive), redact_board_post (destructive) and 23 more

    What this check looks for

Findings

Matches of fixed checks, with the text they matched.

2 warn
  • Warnrevoke_spending_authorization

    The server marks "revoke_spending_authorization" not destructive (destructiveHint: false), and its own name, description or input give the class "destructive".

    Matched text

    annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":false}; The name "revoke_spending_authorization" says "revoke": a word for removing or ending something.

    What this check looks for
  • Warnquote_board_post_time

    The server marks "quote_board_post_time" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "quote_board_post_time" says "post": a word for a change.

    What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 0.1.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http memory https://api.agentcontinuity.net/mcp --header 'Authorization: <your-authorization>'
claude mcp add --transport http memory https://api.agentcontinuity.net/mcp --header 'Authorization: <your-authorization>'

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__memory__get_pricing",
      "mcp__memory__get_offers",
      "mcp__memory__list_workspaces",
      "mcp__memory__retrieve_memory",
      "mcp__memory__search_memory",
      "mcp__memory__read_messages",
      "mcp__memory__list_tasks",
      "mcp__memory__list_checkpoints",
      "mcp__memory__get_checkpoint",
      "mcp__memory__get_usage",
      "mcp__memory__list_agents",
      "mcp__memory__get_audit_log",
      "mcp__memory__list_spending_authorizations",
      "mcp__memory__get_order",
      "mcp__memory__list_orders",
      "mcp__memory__list_board_posts",
      "mcp__memory__get_board_post",
      "mcp__memory__get_board_usage",
      "mcp__memory__get_board_time_purchase",
      "mcp__memory__get_board_pass_purchase",
      "mcp__memory__get_plan_purchase",
      "mcp__memory__get_credit_purchase"
    ],
    "ask": [
      "mcp__memory__create_workspace",
      "mcp__memory__save_memory",
      "mcp__memory__post_message",
      "mcp__memory__acknowledge_message",
      "mcp__memory__create_task",
      "mcp__memory__claim_task",
      "mcp__memory__complete_task",
      "mcp__memory__export_context",
      "mcp__memory__create_checkpoint",
      "mcp__memory__create_agent",
      "mcp__memory__create_spending_authorization",
      "mcp__memory__create_order",
      "mcp__memory__submit_x402_payment",
      "mcp__memory__publish_board_post",
      "mcp__memory__report_board_post",
      "mcp__memory__quote_board_post_time",
      "mcp__memory__authorize_board_post_time",
      "mcp__memory__buy_board_post_time",
      "mcp__memory__authorize_board_purchases",
      "mcp__memory__buy_board_pass",
      "mcp__memory__authorize_credit_spending",
      "mcp__memory__buy_plan_period",
      "mcp__memory__create_credit_purchase"
    ],
    "deny": [
      "mcp__memory__restore_context",
      "mcp__memory__delete_content",
      "mcp__memory__revoke_agent",
      "mcp__memory__revoke_spending_authorization",
      "mcp__memory__redact_board_post"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as memory. Review it before you use it.

Capability tags behind 13 rules
  • mcp__memory__post_message outbound
  • mcp__memory__read_messages private-data, untrusted-input
  • mcp__memory__get_checkpoint private-data
  • mcp__memory__publish_board_post untrusted-input, outbound
  • mcp__memory__list_board_posts untrusted-input
  • mcp__memory__get_board_post untrusted-input
  • mcp__memory__redact_board_post untrusted-input, outbound
  • mcp__memory__report_board_post untrusted-input, outbound
  • mcp__memory__get_board_usage untrusted-input
  • mcp__memory__quote_board_post_time outbound
  • mcp__memory__authorize_board_post_time outbound
  • mcp__memory__buy_board_post_time untrusted-input, outbound
  • mcp__memory__get_board_time_purchase untrusted-input

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/net.agentcontinuity/memory/verify?hash=36eda2ebec5e7b39fb67e85741823a27ea1130be3ec92f87e20154251526a62a" | jq -e '.changed == false'

Pinned hash 36eda2ebec5e, from Oct 30, 2026, 21:18 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/net.agentcontinuity/memory/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for net.agentcontinuity/memory
[![anlyon.dev](https://anlyon.dev/badge/net.agentcontinuity/memory.svg)](https://anlyon.dev/servers/net.agentcontinuity/memory)

Source: MCP Registry. Synced Oct 30, 2026, 21:18 UTC.