Skip to content
anlyon.devby Anlyon

FFxF

net.ffxf/cloudffxf.netstreamable-httpv1.12.0Scanned

Create and manage VMs, managed databases, firewalls and load balancers in Montréal, Canada.

71 tools: 19 can delete or cancel things, 1 do something that can't be undone, 26 change things and 25 only read.

Tools: 19 delete, 1 irreversible, 26 write, 25 read.
  • Reads private data · 9
  • Reads text others write · 71
  • Can send data out · 1
  • 5 findings

Anlyon alternative

46 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →
Compare with similar serversMarkdownJSONReport this listing

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

71 tools

Deletes or cancels 19Claude Code: deny
  • delete_databaseDELETES the database and its data; billing stops.Reads text others writeNo findings

    Why it is in this group

    • The name "delete_database" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    DELETES the database and its data; billing stops. Ask the user first. confirm_name must be the database's exact name. Its backups stay 7 days (restore_database can bring it back meanwhile). Refused while a linked fork depends on it. Scope: vms.destroy.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
  • delete_database_userHands the user's objects to the admin, then drops the user.Reads text others writeNo findings

    Why it is in this group

    • The name "delete_database_user" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Hands the user's objects to the admin, then drops the user. The admin (ffxfadmin, or default on Valkey) cannot be deleted. Scope: databases.write.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
  • delete_firewallDeletes a firewall attached to no machine.Reads text others writeNo findings

    Why it is in this group

    • The name "delete_firewall" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Deletes a firewall attached to no machine. Refused while it protects one: detach it first. Scope: network.write.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
  • delete_listenerCloses the port and removes its rules.Reads text others writeNo findings

    Why it is in this group

    • The name "delete_listener" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Closes the port and removes its rules. Scope: network.write.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
  • delete_load_balancerDeletes the load balancer, its address and its configuration; billing stops.Reads text others writeNo findings

    Why it is in this group

    • The name "delete_load_balancer" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Deletes the load balancer, its address and its configuration; billing stops. Target machines are not touched. Ask the user first. Scope: vms.destroy.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
  • delete_logical_databaseDROPS the logical database with everything in it (the backups keep it 7 days).Reads text others writeNo findings

    Why it is in this group

    • The name "delete_logical_database" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    DROPS the logical database with everything in it (the backups keep it 7 days). Ask the user first. Scope: databases.write.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
  • delete_poolRemoves a pool, its targets and the rules leading to it.Reads text others writeNo findings

    Why it is in this group

    • The name "delete_pool" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Removes a pool, its targets and the rules leading to it. Scope: network.write.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
  • delete_ssh_keyRemoves a key from the account.Reads text others writeNo findings

    Why it is in this group

    • The name "delete_ssh_key" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Removes a key from the account. Machines already deployed with it keep it; only future deployments change. Scope: sshkeys.write.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
  • delete_vpcDeletes an empty private network.Reads text others writeNo findings

    Why it is in this group

    • The name "delete_vpc" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Deletes an empty private network. Refused while a machine is still on it: disconnect or destroy those first. Ask the user first. Scope: network.write.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
  • destroy_vmDESTROYS the machine and its disk, with no undo and no backup kept.Reads text others writeNo findings

    Why it is in this group

    • The name "destroy_vm" says "destroy": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    DESTROYS the machine and its disk, with no undo and no backup kept. Ask the user first. confirm_hostname must be the machine's exact hostname. Scope: vms.destroy.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • openWorldHint: true
  • detach_firewallRemoves the firewall's rules from the machine; with no other firewall it accepts all inbound traffic again.Reads text others write1 finding

    Why it is in this group

    • The name "detach_firewall" says "detach": a word for a change.
    • The description's first verb is "remove": a word for removing or ending something.
    • The server marks it not destructive (destructiveHint: false), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "detach_firewall" not destructive (destructiveHint: false), and its own name, description or input give the class "destructive".

      Matched text

      annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "detach_firewall" says "detach": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Removes the firewall's rules from the machine; with no other firewall it accepts all inbound traffic again. Scope: network.write.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • disable_extensionDrops the extension without CASCADE: if objects depend on it, it stays and get_database shows why in warning.Reads text others writeNo findings

    Why it is in this group

    • The name "disable_extension" says "disable": a word for a change.
    • The description's first verb is "drop": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Drops the extension without CASCADE: if objects depend on it, it stays and get_database shows why in warning. Scope: databases.write.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
  • disconnect_vpcRemoves the machine's private address and card, without a restart.Reads text others writeNo findings

    Why it is in this group

    • The description's first verb is "remove": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Removes the machine's private address and card, without a restart. Refused for the only network of a machine with no public address. Scope: network.write.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
  • reinstall_vmERASES THE DISK and redeploys another image.Reads text others writeNo findings

    Why it is in this group

    • The description's first verb is "erase": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    ERASES THE DISK and redeploys another image. Ask the user first. confirm_hostname must be the machine's exact current hostname. Scope: vms.action.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • openWorldHint: true
  • reset_database_passwordGives the user a new password, returned here; the old one stops working within seconds, so update the application first or right after.Reads text others writeNo findings

    Why it is in this group

    • The name "reset_database_password" says "reset": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Gives the user a new password, returned here; the old one stops working within seconds, so update the application first or right after. Scope: databases.write.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • openWorldHint: true
  • set_database_user_accessSets the logical databases a user connects to (databases: a list, or null for all of them, future ones included) and whether it only reads; a field left out keeps its value.Reads text others writeNo findings

    Why it is in this group

    • The name "set_database_user_access" says "set": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Sets the logical databases a user connects to (databases: a list, or null for all of them, future ones included) and whether it only reads; a field left out keeps its value. Applied within seconds; where its access is removed or lowered, its open connections are closed, so tell the user first if an application uses it. Not on the admin (it always has every database) nor on Valkey. Scope: databases.write.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
  • set_rulesREPLACES the http/https listener's rules: each sends a hostname and/or path prefix to an http pool (up to 25).Reads text others writeNo findings

    Why it is in this group

    • The name "set_rules" says "set": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    REPLACES the http/https listener's rules: each sends a hostname and/or path prefix to an http pool (up to 25). They are evaluated most specific first, whatever the order sent; anything unmatched goes to the default pool. No wildcard hostname on https. Each https hostname gets a certificate once it points to the load balancer. Scope: network.write.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
  • set_targetsREPLACES the pool's targets with exactly this list (up to 25): send every target to keep.Reads text others writeNo findings

    Why it is in this group

    • The name "set_targets" says "set": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    REPLACES the pool's targets with exactly this list (up to 25): send every target to keep. Each machine must be in the load balancer's private network (connect_vpc first). drain: true stops new connections to a target before maintenance. Scope: network.write.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
  • update_firewallrules REPLACES the whole list and is applied at once to every attached machine: send every rule to keep, not only the new one (read get_firewall first).Reads text others writeNo findings

    Why it is in this group

    • The name "update_firewall" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    rules REPLACES the whole list and is applied at once to every attached machine: send every rule to keep, not only the new one (read get_firewall first). Removing the SSH rule can lock the agent out. pending_machines counts machines not updated yet, retried automatically. Scope: network.write.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
Can't be undone 1Claude Code: ask
  • move_vpcJoins the target network, then leaves this one, so the machine is never cut off.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "move_vpc" says "move": a word for a change.
    • The input addresses people (input.to): what it sends cannot be taken back.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a destination (input.to): what the tool writes goes there.
    Description, as the server wrote it
    Joins the target network, then leaves this one, so the machine is never cut off. Keeps the same address ending when free. Scope: network.write.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: true
Changes things 26Claude Code: ask
  • add_ssh_keySaves a public key on the account so new machines can be reached without a password.Reads text others writeNo findings

    Why it is in this group

    • The name "add_ssh_key" says "add": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Saves a public key on the account so new machines can be reached without a password. Scope: sshkeys.write.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: true
  • attach_firewallFrom now on the machine refuses inbound traffic no rule of its firewalls opens; enforced within about ten seconds of the call.Reads text others writeNo findings

    Why it is in this group

    • The name "attach_firewall" says "attach": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    From now on the machine refuses inbound traffic no rule of its firewalls opens; enforced within about ten seconds of the call. Up to 5 firewalls per machine, rules add up. Refused for a machine with no public address. Attaching again is harmless. Scope: network.write.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • backup_databaseStarts a differential backup within a minute, e.g.Reads text others writeNo findings

    Why it is in this group

    • The description's first verb is "start": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Starts a differential backup within a minute, e.g. before a risky migration. Not available on a linked fork. Scope: backups.write.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: true
  • connect_vpcHot-adds a card on the private network and sets its address in the system, without a restart.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Hot-adds a card on the private network and sets its address in the system, without a restart. configuration: manual means the address must be set by hand in the guest. Connecting again returns the same address. Scope: network.write.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • create_databaseOrders a managed database (PostgreSQL, MySQL, MariaDB or Valkey) in a private network, billed by the hour from now (the account needs 24 hours of credit), or by the month (730 hour…Reads text others writeNo findings

    Why it is in this group

    • The name "create_database" says "create": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Orders a managed database (PostgreSQL, MySQL, MariaDB or Valkey) in a private network, billed by the hour from now (the account needs 24 hours of credit), or by the month (730 hours) or the year (ten months) with billing; get_database_options gives each price. A monthly or yearly period comes out of credit if it covers it; otherwise billing.pending_invoice holds the invoice to pay and it stays hourly until then. Ready within minutes (status pending → active), with the admin user ffxfadmin and the logical database defaultdb (Valkey: the admin default, no logical database). Retrying the same call is safe. Scope: vms.create.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • create_database_userCreates a user with a generated password, returned here once (also readable with get_database_credentials); live within seconds.Reads text others writeNo findings

    Why it is in this group

    • The name "create_database_user" says "create": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Creates a user with a generated password, returned here once (also readable with get_database_credentials); live within seconds. Up to 30 users. It connects only to its databases (every logical database, future ones included, when databases is omitted): it reads and writes everything there and creates tables (on PostgreSQL in public too), or only reads with read_only; elsewhere it has no access. Its connection_uri points to defaultdb, or to its first database without access to defaultdb. On Valkey, an ACL user with every key and data command (no databases, no read_only). Treat the password as a secret. Scope: databases.write.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: true
  • create_firewallCreates a reusable set of inbound and outbound rules.Reads text others writeNo findings

    Why it is in this group

    • The name "create_firewall" says "create": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Creates a reusable set of inbound and outbound rules. Without rules it starts with SSH (TCP 22) and ping open from anywhere; pass rules: [] for none. Nothing is filtered until it is attached to a machine. Scope: network.write.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: true
  • create_load_balancerOrders a load balancer in a private network, billed by the hour from now (the account needs 24 hours of credit), or by the month (7.30 CAD) or the year (73 CAD) with billing.Reads text others writeNo findings

    Why it is in this group

    • The name "create_load_balancer" says "create": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Orders a load balancer in a private network, billed by the hour from now (the account needs 24 hours of credit), or by the month (7.30 CAD) or the year (73 CAD) with billing. A monthly or yearly period comes out of credit if it covers it; otherwise billing.pending_invoice holds the invoice to pay and it stays hourly until then. Ready within minutes (status pending → active); pools and listeners can be added meanwhile. Retrying the same call is safe. Scope: vms.create.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • create_logical_databaseCreates another database inside the managed database (like defaultdb), owned by the admin; up to 30.Reads text others writeNo findings

    Why it is in this group

    • The name "create_logical_database" says "create": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Creates another database inside the managed database (like defaultdb), owned by the admin; up to 30. Not on Valkey (numbered databases, SELECT 0 to 15). Scope: databases.write.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: true
  • create_vmOrders a machine and spends credit (hourly) or raises an invoice (monthly).Reads text others writeNo findings

    Why it is in this group

    • The name "create_vm" says "create": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Orders a machine and spends credit (hourly) or raises an invoice (monthly). Returns the machine and a provisioning action to poll with get_action. Retrying the same order is safe: it is deduplicated for 24 hours. Scope: vms.create.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • create_vpcCreates an isolated private network; ready when the call returns.Reads text others writeNo findings

    Why it is in this group

    • The name "create_vpc" says "create": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Creates an isolated private network; ready when the call returns. The first usable address (.1) is reserved for the gateway. Scope: network.write.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: true
  • detach_database_forkGives a linked fork its own copy of the data; the database is unavailable for about 30 seconds, then its backups start.Reads text others writeNo findings

    Why it is in this group

    • The name "detach_database_fork" says "detach": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Gives a linked fork its own copy of the data; the database is unavailable for about 30 seconds, then its backups start. Scope: vms.action.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • enable_extensionPostgreSQL only.Reads text others writeNo findings

    Why it is in this group

    • The name "enable_extension" says "enable": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    PostgreSQL only. Enables an extension from get_database_options (vector for pgvector, postgis, pg_trgm…) in one logical database; installed on demand, live within a minute. Scope: databases.write.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • estimate_vmRuns every check of create_vm and prices it, without creating anything: would_succeed, hourly rate, monthly price, credit required.Reads text others write1 finding

    Why it is in this group

    • The description's first verb is "run": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "estimate_vm" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"openWorldHint":true}; The description's first verb is "run": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Runs every check of create_vm and prices it, without creating anything: would_succeed, hourly rate, monthly price, credit required. Call it before create_vm. Scope: vms.create.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • fork_databaseCreates a NEW database, billed like any other, whose data is an instant copy of this one (for a test or staging copy), with the same users and passwords.Reads text others writeNo findings

    Why it is in this group

    • The name "fork_database" says "fork": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Creates a NEW database, billed like any other, whose data is an instant copy of this one (for a test or staging copy), with the same users and passwords. It stays linked to its source for up to 7 days (no backups of its own, the source cannot be deleted) unless detach_database_fork ends that sooner. Retrying the same call is safe. Scope: vms.create.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • get_load_balancer_metricsRequests by response class, connections, bytes in/out and peak sessions over 1h (1-minute buckets), 24h (15 minutes) or 7d (1 hour), plus totals.Reads text others write1 finding

    Why it is in this group

    • The name "get_load_balancer_metrics" says "get": a word for reading.
    • The description's first verb is "request": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "get_load_balancer_metrics" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"openWorldHint":true}; The name "get_load_balancer_metrics" says "get": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Requests by response class, connections, bytes in/out and peak sessions over 1h (1-minute buckets), 24h (15 minutes) or 7d (1 hour), plus totals. Scope: vms.read.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • get_runnersThe runs-on labels with their vCPU, memory and price per minute, the account's concurrency (vCPU of jobs starting or running, and the cap), the linked GitHub organizations and acco…Reads private dataReads text others write1 finding

    Why it is in this group

    • The name "get_runners" says "get": a word for reading.
    • The description's first verb is "run": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • private-dataThe description's first sentence says "repository": it reads repositories.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "get_runners" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"openWorldHint":true}; The name "get_runners" says "get": a word for reading.

      What this check looks for
    Description, as the server wrote it
    The runs-on labels with their vCPU, memory and price per minute, the account's concurrency (vCPU of jobs starting or running, and the cap), the linked GitHub organizations and accounts, this month's minutes and cost per repository, the actions cache next to the runners (bytes, entries and last use per repository, price per GB per month), and the Docker cache per repository (enabled in the console, bytes, last successful job). Scope: billing.read.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • power_vmstart, shutdown (clean ACPI), reboot, or stop (hard power-off).Reads text others writeNo findings

    Why it is in this group

    • The description's first verb is "start": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    start, shutdown (clean ACPI), reboot, or stop (hard power-off). Returns an action to poll with get_action. Scope: vms.action.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: true
  • rename_vmChanges the hostname, inside the guest and in the console.Reads text others writeNo findings

    Why it is in this group

    • The name "rename_vm" says "rename": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Changes the hostname, inside the guest and in the console. Scope: vms.action.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • resize_databaseMoves the database to a LARGER size (more vCPU, memory and included disk; see get_database_options): same data, users, names and addresses.Reads text others writeNo findings

    Why it is in this group

    • The name "resize_database" says "resize": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Moves the database to a LARGER size (more vCPU, memory and included disk; see get_database_options): same data, users, names and addresses. It restarts: one to two minutes of downtime, status maintenance meanwhile (resize.to_gb set), then active with the new size_gb. The new rate applies from the next hour. Larger sizes only, there is no way back: tell the user the new price and the downtime first. Retrying the same call is safe. Scope: vms.create.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • restore_databaseCreates a NEW database, billed like any other, holding the data as it was at a given minute of the source's restore window (list_database_backups; Valkey: the last snapshot before …Reads text others writeNo findings

    Why it is in this group

    • The description's first verb is "create": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Creates a NEW database, billed like any other, holding the data as it was at a given minute of the source's restore window (list_database_backups; Valkey: the last snapshot before that minute), with the same users and passwords. The source is not touched and may have been deleted in the last 7 days. Retrying the same call is safe. Scope: vms.create.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • set_database_public_accessOpens the database to the internet at its public host and port (IPv4 and IPv6, TLS and password still required), or closes it.Reads text others writeNo findings

    Why it is in this group

    • The name "set_database_public_access" says "set": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Opens the database to the internet at its public host and port (IPv4 and IPv6, TLS and password still required), or closes it. sources restricts who may connect (IPv4/IPv6 addresses or ranges); omitted it is left as is, null or [] means everyone. Prefer listing the user's addresses. Live within about 30 seconds. Scope: network.write.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • set_reverse_dnsSets the PTR record of one of the machine's addresses; null restores the default.Reads text others writeNo findings

    Why it is in this group

    • The name "set_reverse_dns" says "set": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Sets the PTR record of one of the machine's addresses; null restores the default. Scope: network.write.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • update_databaseAny of: the name; the weekly maintenance window (day 0 = Sunday, start hour, Montréal time, 2 hours long; minor updates, usually under 2 minutes of downtime); the disk cap (the dis…Reads text others writeNo findings

    Why it is in this group

    • The name "update_database" says "update": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Any of: the name; the weekly maintenance window (day 0 = Sunday, start hour, Montréal time, 2 hours long; minor updates, usually under 2 minutes of downtime); the disk cap (the disk grows by itself at 80 % full, up to the cap; disk beyond what the size includes is billed per GB); on Valkey, the eviction policy. Scope: databases.write.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • upsert_listenerAn entry port on the load balancer's address.Reads text others writeNo findings

    Why it is in this group

    • The name "upsert_listener" says "upsert": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    An entry port on the load balancer's address. Without listener: opens one (port and protocol required, up to 5; 22 and 8402 are reserved). https gets certificates for its rules' hostnames; redirect_https makes port 80 redirect to it. A tcp listener needs a tcp default_pool. sources restricts who may connect (null: everyone); with an https listener, port 80 stays open to everyone. Scope: network.write.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: true
  • upsert_poolWithout pool: creates one (name required, up to 10).Reads text others writeNo findings

    Why it is in this group

    • The name "upsert_pool" says "upsert": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Without pool: creates one (name required, up to 10). With pool: changes only the fields given. Deleting a pool also removes its targets and the rules leading to it. Scope: network.write.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: true
Only reads 25Show 25 read-only tools
  • get_accountCredit balance, hourly burn rate and runway, quota and budget caps.Reads text others writeNo findings

    Why it is in this group

    • The name "get_account" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Credit balance, hourly burn rate and runway, quota and budget caps. Scope: billing.read.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • get_actionFollows an asynchronous action (create, reinstall, power…).Reads text others writeNo findings

    Why it is in this group

    • The name "get_action" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Follows an asynchronous action (create, reinstall, power…). Poll until status leaves running; on error it carries the reason. Scope: vms.read.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • get_databaseOne database: status, connection (host, private ip, port, defaultdb and ffxfadmin; on Valkey no database and default), public access and sources, disk usage and cap, users with the…Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "get_database" says "get": a word for reading.

    What it can reach

    • private-dataThe name "get_database" says "get" and "database": it reads databases.
    • private-dataThe description's first sentence says "database": it reads databases.
    • private-dataThe input names a database (input.database), and the tool reads: it reads databases.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    One database: status, connection (host, private ip, port, defaultdb and ffxfadmin; on Valkey no database and default), public access and sources, disk usage and cap, users with their databases (null: all) and read_only, logical databases and extensions, Valkey's eviction policy and data memory, backups and restore window, maintenance window, fork link, warning. No passwords. Scope: vms.read.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • get_database_credentialsEvery user with its password, databases and read_only, and its own connection_uri; ready-made connection strings for the admin (private network, and public when open).Reads private dataReads text others write1 finding

    Why it is in this group

    • The name "get_database_credentials" says "get": a word for reading.

    What it can reach

    • private-dataThe name "get_database_credentials" says "get" and "database": it reads databases.
    • private-dataThe description's first sentence says "password": it reads secrets.
    • private-dataThe input names a database (input.database), and the tool reads: it reads databases.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe description's first sentence says "uri": it reads web pages, which anyone can write.

    Findings

    Description, as the server wrote it
    Every user with its password, databases and read_only, and its own connection_uri; ready-made connection strings for the admin (private network, and public when open). Treat the result as a secret: give it to the application through an environment variable or a secret store, never into code, commits or logs. Scope: databases.write.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • get_database_metricsCPU, memory, connections and commits per minute (commands per minute on Valkey) over 1h (1-minute buckets), 24h (10 minutes) or 7d (1 hour); only buckets with samples.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "get_database_metrics" says "get": a word for reading.

    What it can reach

    • private-dataThe name "get_database_metrics" says "get" and "database": it reads databases.
    • private-dataThe description's first sentence says "commit": it reads repositories.
    • private-dataThe input names a database (input.database), and the tool reads: it reads databases.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    CPU, memory, connections and commits per minute (commands per minute on Valkey) over 1h (1-minute buckets), 24h (10 minutes) or 7d (1 hour); only buckets with samples. Scope: vms.read.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • get_database_optionsWhat can be ordered: engines and versions, extensions, sizes with their hourly, monthly and yearly prices per region, and the price of disk beyond what a size includes.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "get_database_options" says "get": a word for reading.

    What it can reach

    • private-dataThe name "get_database_options" says "get" and "database": it reads databases.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    What can be ordered: engines and versions, extensions, sizes with their hourly, monthly and yearly prices per region, and the price of disk beyond what a size includes. Call it before create_database and show the price to the user. Scope: vms.read.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • get_firewallOne firewall: its rules and the machines it protects, with the status of each (applied, pending, error).Reads text others writeNo findings

    Why it is in this group

    • The name "get_firewall" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    One firewall: its rules and the machines it protects, with the status of each (applied, pending, error). Scope: vms.read.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • get_load_balancerOne load balancer in full: status, ipv4/ipv6 to put in DNS, pools with targets (health, sessions, response time), listeners with rules in evaluation order, certificates.Reads text others writeNo findings

    Why it is in this group

    • The name "get_load_balancer" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    One load balancer in full: status, ipv4/ipv6 to put in DNS, pools with targets (health, sessions, response time), listeners with rules in evaluation order, certificates. Scope: vms.read.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • get_slow_queriesThe 20 queries with the most total time (pg_stat_statements, values replaced by $1, $2…; performance_schema on MySQL and MariaDB, values replaced by ?): calls, total and mean time,…Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "get_slow_queries" says "get": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "sql": it reads databases.
    • private-dataThe input names a database (input.database), and the tool reads: it reads databases.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    The 20 queries with the most total time (pg_stat_statements, values replaced by $1, $2…; performance_schema on MySQL and MariaDB, values replaced by ?): calls, total and mean time, rows. A starting point for indexes. On Valkey, the commands with the most total time since the engine started (GET, HSET…). Scope: vms.read.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • get_vmOne machine: status, IPv4, IPv6 /64, specs, traffic (Internet only, this traffic month: used_gb, limit_gb, period_ends_at), billing, suspension.Reads text others writeNo findings

    Why it is in this group

    • The name "get_vm" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe description's first sentence says "internet": it reads web pages, which anyone can write.
    Description, as the server wrote it
    One machine: status, IPv4, IPv6 /64, specs, traffic (Internet only, this traffic month: used_gb, limit_gb, period_ends_at), billing, suspension. Scope: vms.read.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • get_vm_metricsCPU, memory, disk and network as measured from outside the machine.Reads text others writeNo findings

    Why it is in this group

    • The name "get_vm_metrics" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    CPU, memory, disk and network as measured from outside the machine. Scope: vms.read.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • get_vm_networkIPv4 and IPv6 addresses of a machine with their reverse DNS, and its private networks.Reads text others writeNo findings

    Why it is in this group

    • The name "get_vm_network" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    IPv4 and IPv6 addresses of a machine with their reverse DNS, and its private networks. Scope: vms.read.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • get_vpcOne private network and the machines on it, with their private address.Reads text others writeNo findings

    Why it is in this group

    • The name "get_vpc" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    One private network and the machines on it, with their private address. Scope: vms.read.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • list_database_backupsCompleted backups (weekly full, daily differential; the transaction log is archived continuously) and the restore window: any minute in it can be restored with restore_database.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "list_database_backups" says "list": a word for reading.

    What it can reach

    • private-dataThe name "list_database_backups" says "list" and "database": it reads databases.
    • private-dataThe description's first sentence says "database": it reads databases.
    • private-dataThe input names a database (input.database), and the tool reads: it reads databases.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Completed backups (weekly full, daily differential; the transaction log is archived continuously) and the restore window: any minute in it can be restored with restore_database. On Valkey, snapshots (rdb) every hour when there were writes, all kept 24 hours, then one a day. Scope: vms.read.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • list_databasesThe account's managed databases with their status, private and public addresses, disk, backups and billing (no passwords), plus the quota.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "list_databases" says "list": a word for reading.

    What it can reach

    • private-dataThe name "list_databases" says "list" and "database": it reads databases.
    • private-dataThe description's first sentence says "database": it reads databases.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    The account's managed databases with their status, private and public addresses, disk, backups and billing (no passwords), plus the quota. Scope: vms.read.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • list_firewallsThe account's firewalls with their inbound rules and the machines they protect, plus the quota.Reads text others writeNo findings

    Why it is in this group

    • The name "list_firewalls" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    The account's firewalls with their inbound rules and the machines they protect, plus the quota. Scope: vms.read.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • list_imagesOperating systems and ready-to-use application images.Reads text others writeNo findings

    Why it is in this group

    • The name "list_images" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Operating systems and ready-to-use application images. The slug is what create_vm expects. Public, no key needed.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • list_load_balancersThe account's load balancers with their addresses, pools, targets and health, listeners and rules, certificates; plus the quota.Reads text others writeNo findings

    Why it is in this group

    • The name "list_load_balancers" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    The account's load balancers with their addresses, pools, targets and health, listeners and rules, certificates; plus the quota. Scope: vms.read.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • list_plansPlans with their resources and prices (hourly and monthly, in CAD).Reads text others writeNo findings

    Why it is in this group

    • The name "list_plans" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Plans with their resources and prices (hourly and monthly, in CAD). Public, no key needed.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • list_regionsWhere machines can run.Reads text others writeNo findings

    Why it is in this group

    • The name "list_regions" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Where machines can run. Public, no key needed.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • list_runner_jobsJobs that ran or wait on FFxF runners, most recent first: repository, workflow and job, label, status (queued with waiting_reason credit, budget or account; running; succeeded; fai…Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "list_runner_jobs" says "list": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "repository": it reads repositories.
    • private-dataThe input names a repository (input.repository), and the tool reads: it reads repositories.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Jobs that ran or wait on FFxF runners, most recent first: repository, workflow and job, label, status (queued with waiting_reason credit, budget or account; running; succeeded; failed, stopped_for_credit when the credit ran out; cancelled; refused with refusal), times, billed minutes and amount, link to the run. Scope: billing.read.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • list_ssh_keysSSH keys saved on the account, to pass to create_vm.Reads text others writeNo findings

    Why it is in this group

    • The name "list_ssh_keys" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    SSH keys saved on the account, to pass to create_vm. Scope: sshkeys.write or vms.read.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • list_vm_actionsHistory of actions on one machine, from the API and the console.Reads text others writeNo findings

    Why it is in this group

    • The name "list_vm_actions" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    History of actions on one machine, from the API and the console. Scope: vms.read.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • list_vmsThe account's machines with their status, addresses and billing.Reads text others writeNo findings

    Why it is in this group

    • The name "list_vms" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    The account's machines with their status, addresses and billing. Scope: vms.read.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true
  • list_vpcsThe account's private networks with their range, gateway and connected machines, plus the quota.Reads text others writeNo findings

    Why it is in this group

    • The name "list_vpcs" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    The account's private networks with their range, gateway and connected machines, plus the quota. Scope: vms.read.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

639 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 1 outbound tool breaks every one.

Reads private data9
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write71
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out1
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
deny to break every path
{
  "permissions": {
    "deny": [
      "mcp__cloud__move_vpc"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

4 warn1 info
  • Warnestimate_vm

    The server marks "estimate_vm" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"openWorldHint":true}; The description's first verb is "run": a word for a change.

    What this check looks for
  • Warndetach_firewall

    The server marks "detach_firewall" not destructive (destructiveHint: false), and its own name, description or input give the class "destructive".

    Matched text

    annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "detach_firewall" says "detach": a word for a change.

    What this check looks for
  • Warnget_load_balancer_metrics

    The server marks "get_load_balancer_metrics" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"openWorldHint":true}; The name "get_load_balancer_metrics" says "get": a word for reading.

    What this check looks for
  • Warnget_runners

    The server marks "get_runners" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"openWorldHint":true}; The name "get_runners" says "get": a word for reading.

    What this check looks for
  • Infoget_database_credentials

    The title mentions "credentials".

    Matched text

    title: "Get database credentials"

    What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 1.12.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http cloud https://ffxf.net/mcp
claude mcp add --transport http cloud https://ffxf.net/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__cloud__list_regions",
      "mcp__cloud__list_plans",
      "mcp__cloud__list_images",
      "mcp__cloud__get_account",
      "mcp__cloud__list_vms",
      "mcp__cloud__get_vm",
      "mcp__cloud__get_vm_metrics",
      "mcp__cloud__get_action",
      "mcp__cloud__list_vm_actions",
      "mcp__cloud__get_vm_network",
      "mcp__cloud__list_vpcs",
      "mcp__cloud__get_vpc",
      "mcp__cloud__list_firewalls",
      "mcp__cloud__get_firewall",
      "mcp__cloud__list_load_balancers",
      "mcp__cloud__get_load_balancer",
      "mcp__cloud__list_databases",
      "mcp__cloud__get_database_options",
      "mcp__cloud__get_database",
      "mcp__cloud__get_database_credentials",
      "mcp__cloud__get_database_metrics",
      "mcp__cloud__get_slow_queries",
      "mcp__cloud__list_database_backups",
      "mcp__cloud__list_runner_jobs",
      "mcp__cloud__list_ssh_keys"
    ],
    "ask": [
      "mcp__cloud__estimate_vm",
      "mcp__cloud__create_vm",
      "mcp__cloud__power_vm",
      "mcp__cloud__rename_vm",
      "mcp__cloud__set_reverse_dns",
      "mcp__cloud__create_vpc",
      "mcp__cloud__connect_vpc",
      "mcp__cloud__move_vpc",
      "mcp__cloud__create_firewall",
      "mcp__cloud__attach_firewall",
      "mcp__cloud__get_load_balancer_metrics",
      "mcp__cloud__create_load_balancer",
      "mcp__cloud__upsert_pool",
      "mcp__cloud__upsert_listener",
      "mcp__cloud__create_database",
      "mcp__cloud__restore_database",
      "mcp__cloud__fork_database",
      "mcp__cloud__detach_database_fork",
      "mcp__cloud__resize_database",
      "mcp__cloud__update_database",
      "mcp__cloud__set_database_public_access",
      "mcp__cloud__backup_database",
      "mcp__cloud__create_database_user",
      "mcp__cloud__create_logical_database",
      "mcp__cloud__enable_extension",
      "mcp__cloud__get_runners",
      "mcp__cloud__add_ssh_key"
    ],
    "deny": [
      "mcp__cloud__reinstall_vm",
      "mcp__cloud__destroy_vm",
      "mcp__cloud__delete_vpc",
      "mcp__cloud__disconnect_vpc",
      "mcp__cloud__update_firewall",
      "mcp__cloud__delete_firewall",
      "mcp__cloud__detach_firewall",
      "mcp__cloud__delete_load_balancer",
      "mcp__cloud__delete_pool",
      "mcp__cloud__set_targets",
      "mcp__cloud__delete_listener",
      "mcp__cloud__set_rules",
      "mcp__cloud__delete_database",
      "mcp__cloud__set_database_user_access",
      "mcp__cloud__reset_database_password",
      "mcp__cloud__delete_database_user",
      "mcp__cloud__delete_logical_database",
      "mcp__cloud__disable_extension",
      "mcp__cloud__delete_ssh_key"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as cloud. Review it before you use it.

Capability tags behind 71 rules
  • mcp__cloud__list_regions untrusted-input
  • mcp__cloud__list_plans untrusted-input
  • mcp__cloud__list_images untrusted-input
  • mcp__cloud__get_account untrusted-input
  • mcp__cloud__list_vms untrusted-input
  • mcp__cloud__get_vm untrusted-input
  • mcp__cloud__get_vm_metrics untrusted-input
  • mcp__cloud__estimate_vm untrusted-input
  • mcp__cloud__create_vm untrusted-input
  • mcp__cloud__power_vm untrusted-input
  • mcp__cloud__rename_vm untrusted-input
  • mcp__cloud__reinstall_vm untrusted-input
  • mcp__cloud__destroy_vm untrusted-input
  • mcp__cloud__get_action untrusted-input
  • mcp__cloud__list_vm_actions untrusted-input
  • mcp__cloud__get_vm_network untrusted-input
  • mcp__cloud__set_reverse_dns untrusted-input
  • mcp__cloud__list_vpcs untrusted-input
  • mcp__cloud__get_vpc untrusted-input
  • mcp__cloud__create_vpc untrusted-input
  • mcp__cloud__delete_vpc untrusted-input
  • mcp__cloud__connect_vpc untrusted-input
  • mcp__cloud__disconnect_vpc untrusted-input
  • mcp__cloud__move_vpc untrusted-input, outbound
  • mcp__cloud__list_firewalls untrusted-input
  • mcp__cloud__get_firewall untrusted-input
  • mcp__cloud__create_firewall untrusted-input
  • mcp__cloud__update_firewall untrusted-input
  • mcp__cloud__delete_firewall untrusted-input
  • mcp__cloud__attach_firewall untrusted-input
  • mcp__cloud__detach_firewall untrusted-input
  • mcp__cloud__list_load_balancers untrusted-input
  • mcp__cloud__get_load_balancer untrusted-input
  • mcp__cloud__get_load_balancer_metrics untrusted-input
  • mcp__cloud__create_load_balancer untrusted-input
  • mcp__cloud__delete_load_balancer untrusted-input
  • mcp__cloud__upsert_pool untrusted-input
  • mcp__cloud__delete_pool untrusted-input
  • mcp__cloud__set_targets untrusted-input
  • mcp__cloud__upsert_listener untrusted-input
  • mcp__cloud__delete_listener untrusted-input
  • mcp__cloud__set_rules untrusted-input
  • mcp__cloud__list_databases private-data, untrusted-input
  • mcp__cloud__get_database_options private-data, untrusted-input
  • mcp__cloud__get_database private-data, untrusted-input
  • mcp__cloud__get_database_credentials private-data, untrusted-input
  • mcp__cloud__get_database_metrics private-data, untrusted-input
  • mcp__cloud__get_slow_queries private-data, untrusted-input
  • mcp__cloud__list_database_backups private-data, untrusted-input
  • mcp__cloud__create_database untrusted-input
  • mcp__cloud__restore_database untrusted-input
  • mcp__cloud__fork_database untrusted-input
  • mcp__cloud__detach_database_fork untrusted-input
  • mcp__cloud__resize_database untrusted-input
  • mcp__cloud__delete_database untrusted-input
  • mcp__cloud__update_database untrusted-input
  • mcp__cloud__set_database_public_access untrusted-input
  • mcp__cloud__backup_database untrusted-input
  • mcp__cloud__create_database_user untrusted-input
  • mcp__cloud__set_database_user_access untrusted-input
  • mcp__cloud__reset_database_password untrusted-input
  • mcp__cloud__delete_database_user untrusted-input
  • mcp__cloud__create_logical_database untrusted-input
  • mcp__cloud__delete_logical_database untrusted-input
  • mcp__cloud__enable_extension untrusted-input
  • mcp__cloud__disable_extension untrusted-input
  • mcp__cloud__get_runners private-data, untrusted-input
  • mcp__cloud__list_runner_jobs private-data, untrusted-input
  • mcp__cloud__list_ssh_keys untrusted-input
  • mcp__cloud__add_ssh_key untrusted-input
  • mcp__cloud__delete_ssh_key untrusted-input

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/net.ffxf/cloud/verify?hash=e4cab9512897a078ca6085815b6d88ae216be0a5f7b0dcded0e19f595cc3ad46" | jq -e '.changed == false'

Pinned hash e4cab9512897, from Oct 28, 2026, 19:19 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/net.ffxf/cloud/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for net.ffxf/cloud
[![anlyon.dev](https://anlyon.dev/badge/net.ffxf/cloud.svg)](https://anlyon.dev/servers/net.ffxf/cloud)

Source: MCP Registry. Synced Oct 28, 2026, 19:18 UTC.