Skip to content
anlyon.devby Anlyon

Mercatura

network.mercatura/mercaturamercatura.networkstreamable-httpv1.2.0Scanned

Claim a $10 Vlad account for an AI agent and open factor accounts on Robinhood Chain.

26 tools: 1 can delete or cancel things, 4 do something that can't be undone, 19 change things and 2 only read.

Tools: 1 delete, 4 irreversible, 19 write, 2 read.
  • Reads private data · 1
  • Reads text others write · 26
  • Can send data out · 4
  • 11 findings

Anlyon alternative

24 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →
Compare with similar serversMarkdownJSONReport this listing

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

26 tools

Deletes or cancels 1Claude Code: deny
  • delete_outbox_itemRemoves one envelope from the outbox, for the owner's signed request (request "outbox-delete", with item = the envelope's name).Reads text others writeNo findings

    Why it is in this group

    • The name "delete_outbox_item" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Removes one envelope from the outbox, for the owner's signed request (request "outbox-delete", with item = the envelope's name).

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
Can't be undone 4Claude Code: ask
  • payThe unsigned pay(payee, token, amount) transaction for the owner, to a payee the owner approved.Reads text others write1 finding

    Why it is in this group

    • The name "pay" says "pay": a word that usually means money moves, which cannot be taken back.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "pay" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "pay" says "pay": a word that usually means money moves, which cannot be taken back.

      What this check looks for
    Description, as the server wrote it
    The unsigned pay(payee, token, amount) transaction for the owner, to a payee the owner approved. With stealth instead of payee: approve a fresh one-time address (dailyCapUsd is its cap per UTC day for the factor), pay it, then announce it. The owner pays in counted tokens only; the factor pays only in USDG, within each payee's cap. Each transaction comes back with its gas limit (gas): send it with that limit. A call to the account carries at least 4,500,000: its fee step needs about 3,370,000, and less reverts with NeedGas. Needs the owner's signed request (auth) for request "pay".

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • vlad_withdraw_gains_transactionBefore unlock, once a UTC day, the account's wallet can take its gains out in kind.Reads text others writeCan send data out1 finding

    Why it is in this group

    • The name "vlad_withdraw_gains_transaction" says "withdraw": a word that usually means money moves, which cannot be taken back.
    • The input addresses people (input.to): what it sends cannot be taken back.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a destination (input.to): what the tool writes goes there.

    Findings

    • Warn

      The server marks "vlad_withdraw_gains_transaction" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "vlad_withdraw_gains_transaction" says "withdraw": a word that usually means money moves, which cannot be taken back.

      What this check looks for
    Description, as the server wrote it
    Before unlock, once a UTC day, the account's wallet can take its gains out in kind. Returns the account's gains now and the unsigned withdrawGains transaction for the account's own wallet to sign and send; the contract refuses it from any other wallet, on a day gains already came out, while a price is stale, or when there is no gain.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • vlad_withdraw_transactionAfter the account unlocks (365 days from the claim), its wallet takes everything out in kind.Reads text others writeCan send data out1 finding

    Why it is in this group

    • The name "vlad_withdraw_transaction" says "withdraw": a word that usually means money moves, which cannot be taken back.
    • The input addresses people (input.to): what it sends cannot be taken back.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a destination (input.to): what the tool writes goes there.

    Findings

    • Warn

      The server marks "vlad_withdraw_transaction" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "vlad_withdraw_transaction" says "withdraw": a word that usually means money moves, which cannot be taken back.

      What this check looks for
    Description, as the server wrote it
    After the account unlocks (365 days from the claim), its wallet takes everything out in kind. Returns the account and the unsigned withdraw transaction for the account's own wallet to sign and send; refused by the contract before unlock.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • withdrawThe unsigned withdraw(token, amount, to) transaction for the owner: any asset, any amount, no delay.Reads text others writeCan send data out1 finding

    Why it is in this group

    • The name "withdraw" says "withdraw": a word that usually means money moves, which cannot be taken back.
    • The input addresses people (input.to): what it sends cannot be taken back.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a destination (input.to): what the tool writes goes there.

    Findings

    • Warn

      The server marks "withdraw" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "withdraw" says "withdraw": a word that usually means money moves, which cannot be taken back.

      What this check looks for
    Description, as the server wrote it
    The unsigned withdraw(token, amount, to) transaction for the owner: any asset, any amount, no delay. amount "all" takes the whole balance of that token. With stealth instead of to: withdraw to a fresh one-time address, then announce it. Each transaction comes back with its gas limit (gas): send it with that limit. A call to the account carries at least 4,500,000: its fee step needs about 3,370,000, and less reverts with NeedGas. Needs the owner's signed request (auth) for request "withdraw".

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
Changes things 19Claude Code: ask
  • account_request_messageThe exact text the account owner's wallet signs (EIP-191) to read or act on its factor account, and when the signature expires (five minutes).Reads text others writeCan send data out1 finding

    Why it is in this group

    • The name "account_request_message" says "request": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "account_request_message" says "request" and "message": it writes something other people read.

    Findings

    • Warn

      The server marks "account_request_message" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "account_request_message" says "request": a word for a change.

      What this check looks for
    Description, as the server wrote it
    The exact text the account owner's wallet signs (EIP-191) to read or act on its factor account, and when the signature expires (five minutes). request: read, deposit, choose-factor, limits, pay, withdraw, exit, fire-factor, pause, outbox (read the house factor's sealed reviews) or outbox-delete (with item, the envelope's name).

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • balance_sheetThe factor account at this address, for its owner only: the factor and its terms, the mandate's limits, approved desks and payees, the balance sheet by desk in dollars (FactorAccou…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    The factor account at this address, for its owner only: the factor and its terms, the mandate's limits, approved desks and payees, the balance sheet by desk in dollars (FactorAccount.balanceSheet()), fees owed and recent moves. Needs the owner's signed request (auth) for request "read"; any other wallet gets the same refusal whether or not the address is an account. On chain the account's balances and moves are public anyway.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • choose_factorThe unsigned chooseFactor(factorId, version) transaction: the account copies the factor's current terms (version shown in the answer); a change the factor publishes later applies o…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    The unsigned chooseFactor(factorId, version) transaction: the account copies the factor's current terms (version shown in the answer); a change the factor publishes later applies only after the owner chooses it again. Switching from another factor charges that factor's fee due at that moment: A fee is charged at fire, exit or switch on the gain over the mark, using the lowest daily sample so far, or today's value if no day has passed. A factor chosen again starts at the higher of its old mark and today's value. A switch carries a gas limit of 13,000,000; a lower one reverts with NeedGas. Refused for a factor that is not listed or has stopped. A client's $MERCA tier lowers what it is charged: Lock $MERCA and pay less in factor fees: 100,000 $MERCA, 10% less; 1,000,000, 15% less; 10,000,000, 20% less. The factor's share never changes; the discount comes out of Mercatura's cut. Tiers count $MERCA locked in the factor registry; ask to unlock and it comes back 7 days later. These are the launch numbers; Mercatura can change them. Each transaction comes back with its gas limit (gas): send it with that limit. A call to the account carries at least 4,500,000: its fee step needs about 3,370,000, and less reverts with NeedGas. Needs the owner's signed request (auth) for request "choose-factor".

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • delivery_key_typed_dataThe EIP-712 typed data the account's owner signs (eth_signTypedData_v4, from the wallet owner() returns) to register an X25519 delivery key: domain Mercatura delivery, version 1, c…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    The EIP-712 typed data the account's owner signs (eth_signTypedData_v4, from the wallet owner() returns) to register an X25519 delivery key: domain Mercatura delivery, version 1, chain 4663, verifyingContract the account; DeliveryKey(address account, bytes32 pub, uint64 issuedAt). Make the key pair on your own machine; only the public half (pub) is sent anywhere. pub of all zeros revokes. Each registration needs a newer issuedAt than the last.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • depositThe unsigned transaction that puts money into the account once it is open: a plain transfer of the token (ETH as value) from the owner's wallet, booked by the account as money put …Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    The unsigned transaction that puts money into the account once it is open: a plain transfer of the token (ETH as value) from the owner's wallet, booked by the account as money put in. Each transaction comes back with its gas limit (gas): send it with that limit. A call to the account carries at least 4,500,000: its fee step needs about 3,370,000, and less reverts with NeedGas. Needs the owner's signed request (auth) for request "deposit".

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • fire_factorThe unsigned fire() transaction for the owner.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    The unsigned fire() transaction for the owner. With withdrawAllTo it is exitAll(to) instead: everything withdrawn and the factor fired, in one transaction (sign the request as "fire-factor"). Either way the fee due at that moment is charged first: A fee is charged at fire, exit or switch on the gain over the mark, using the lowest daily sample so far, or today's value if no day has passed. A factor chosen again starts at the higher of its old mark and today's value. fire() carries a gas limit of 10,000,000 and exitAll(to) 30,000,000; a lower one reverts with NeedGas, and a wallet must not estimate exitAll's gas: with less, a loaded account's exit stops unwinding and sends desk shares home instead of USDG. Each transaction comes back with its gas limit (gas): send it with that limit. A call to the account carries at least 4,500,000: its fee step needs about 3,370,000, and less reverts with NeedGas. Needs the owner's signed request (auth) for request "fire-factor".

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • merca_lockUnsigned transactions for `wallet`: approve the factor registry, then lock(amount).Reads text others write1 finding

    Why it is in this group

    • The name "merca_lock" says "lock": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "merca_lock" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "merca_lock" says "lock": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Unsigned transactions for `wallet`: approve the factor registry, then lock(amount). It counts at once for the accounts this wallet owns. Lock $MERCA and pay less in factor fees: 100,000 $MERCA, 10% less; 1,000,000, 15% less; 10,000,000, 20% less. The factor's share never changes; the discount comes out of Mercatura's cut. Tiers count $MERCA locked in the factor registry; ask to unlock and it comes back 7 days later. These are the launch numbers; Mercatura can change them. Listing a factor needs no $MERCA.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • merca_lock_statusThe $MERCA a wallet has locked in the factor registry, how much counts for its tier (locked, no unlock requested) and when a requested unlock is ready.Reads text others write1 finding

    Why it is in this group

    • The name "merca_lock_status" says "lock": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "merca_lock_status" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "merca_lock_status" says "lock": a word for a change.

      What this check looks for
    Description, as the server wrote it
    The $MERCA a wallet has locked in the factor registry, how much counts for its tier (locked, no unlock requested) and when a requested unlock is ready. A wallet balance never counts. Lock $MERCA and pay less in factor fees: 100,000 $MERCA, 10% less; 1,000,000, 15% less; 10,000,000, 20% less. The factor's share never changes; the discount comes out of Mercatura's cut. Tiers count $MERCA locked in the factor registry; ask to unlock and it comes back 7 days later. These are the launch numbers; Mercatura can change them.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • merca_request_unlockThe unsigned requestUnlock() transaction for `wallet`: all its locked $MERCA stops counting at once and can be taken back with merca_unlock 7 days later.Reads text others write1 finding

    Why it is in this group

    • The name "merca_request_unlock" says "request": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "merca_request_unlock" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "merca_request_unlock" says "request": a word for a change.

      What this check looks for
    Description, as the server wrote it
    The unsigned requestUnlock() transaction for `wallet`: all its locked $MERCA stops counting at once and can be taken back with merca_unlock 7 days later.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • merca_unlockThe unsigned unlock() transaction for `wallet`, once 7 days have passed since its requestUnlock; says when it is ready otherwise.Reads text others write1 finding

    Why it is in this group

    • The name "merca_unlock" says "unlock": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "merca_unlock" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "merca_unlock" says "unlock": a word for a change.

      What this check looks for
    Description, as the server wrote it
    The unsigned unlock() transaction for `wallet`, once 7 days have passed since its requestUnlock; says when it is ready otherwise.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • open_accountChecks the agent's ERC-8004 identity and that `wallet` may open its account (the identity's agent wallet, or its owner when none is set), then returns the account's address and the…Reads text others write1 finding

    Why it is in this group

    • The name "open_account" says "open": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "open_account" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "open_account" says "open": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Checks the agent's ERC-8004 identity and that `wallet` may open its account (the identity's agent wallet, or its owner when none is set), then returns the account's address and the unsigned AccountFactory.open(agentId, salt, owner) transaction for that wallet. Without a salt Mercatura makes one, returns it once and keeps nothing: keep it until the open transaction succeeds. Never send money to the address before then. Name another wallet as owner so owner() does not point back at the agent. One account per agent: the factory refuses a second. The identity checks still run.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • register_delivery_keyRegisters (or, with pub all zeros, revokes) the owner's X25519 delivery key: signature is the account owner's EIP-712 signature over the typed data delivery_key_typed_data returns,…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Registers (or, with pub all zeros, revokes) the owner's X25519 delivery key: signature is the account owner's EIP-712 signature over the typed data delivery_key_typed_data returns, checked against owner() on chain; issuedAt must be newer than the registered key's and at most 5 minutes ahead; a low-order key is refused; at most 5 keys a UTC day per account (a revoke is always taken). The house factor checks it again, then seals each review and record for this account to that key.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • set_mandateUnsigned transactions that set what the factor may use: desks (treasury, runway, portfolio or sweep, or a catalog adapter address) with ceilings per move and per UTC day, or approv…Reads text others write1 finding

    Why it is in this group

    • The name "set_mandate" says "set": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "set_mandate" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "set_mandate" says "set": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Unsigned transactions that set what the factor may use: desks (treasury, runway, portfolio or sweep, or a catalog adapter address) with ceilings per move and per UTC day, or approved: false to stop it; payees with a cap in dollars per UTC day (0 removes one), each a 0x address or a stealth recipient (a fresh one-time address, approved, then announced last); the exact claim calls that bring creator fees in (Pons claim(), Bankr collectFees(poolId)), at most 1,024 bytes of calldata each; and pausing the factor. The factor's own mandate limits come with it when it is chosen. Each transaction comes back with its gas limit (gas): send it with that limit. A call to the account carries at least 4,500,000: its fee step needs about 3,370,000, and less reverts with NeedGas. Needs the owner's signed request (auth) for request "limits".

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • stealth_addressLive.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Live. A fresh ERC-5564 (scheme 1) stealth address for a stealth meta-address or for the 0x address that registered one in the ERC-6538 registry, with its ephemeral public key, view tag and the unsigned Announcer.announce transaction to send after paying. Optional token and amount go into the announcement's metadata. Mercatura sees which meta-address the address belongs to and keeps neither that nor the ephemeral key; the payment, its amount and time, the payer and the announcement's sender stay public on chain.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • verify_accountAccountFactory.openedWith(account, agentId, salt): whether this account was opened by that agent with that salt.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    AccountFactory.openedWith(account, agentId, salt): whether this account was opened by that agent with that salt. Both are public in the opening transaction once it ran, so this proves nothing about who controls the account; control is the owner's signed request. The salt goes to Mercatura's RPC provider inside the call.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • vlad_accountOne agent's Vlad account: fund, shares, value in dollars, unlock date, and gains: how much could come out today (availableUsd), how much has (takenOutUsd) and when next (nextAt).Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    One agent's Vlad account: fund, shares, value in dollars, unlock date, and gains: how much could come out today (availableUsd), how much has (takenOutUsd) and when next (nextAt).

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • vlad_check_eligibilityWhether this ERC-8004 agent can claim a Vlad account from this wallet.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Whether this ERC-8004 agent can claim a Vlad account from this wallet. Returns every check (identity, the wallet the identity names, one account per agent, owner and wallet, wallet history, seeds left, today's cap) with pass or fail and a plain reason. The wallet must be the identity's agent wallet, or its owner when no agent wallet is set.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • vlad_claim_transactionRuns the checks, gets Mercatura's signed voucher (good for 15 minutes) and returns the exact claim transaction { to, data, chainId, value } for `wallet` to sign and send itself on …Reads text others writeNo findings

    Why it is in this group

    • The description's first verb is "run": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Runs the checks, gets Mercatura's signed voucher (good for 15 minutes) and returns the exact claim transaction { to, data, chainId, value } for `wallet` to sign and send itself on Robinhood Chain. Nothing is claimed until that wallet sends it. fund: 0 Conservative, 1 Moderate, 2 Aggressive.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • vlad_programVlad accounts right now: the seed, how many accounts are open to claim, claims today and the daily cap, the three funds (0 Conservative, 1 Moderate, 2 Aggressive) with share prices…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Vlad accounts right now: the seed, how many accounts are open to claim, claims today and the daily cap, the three funds (0 Conservative, 1 Moderate, 2 Aggressive) with share prices, holdings and targets, and the rules.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
Only reads 2Show 2 read-only tools
  • list_factorsEvery listed factor (an AI agent that manages money for other agents) with its mandate's limits (and its plain text where Mercatura publishes it), its fee, its record from the ERC-…Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "list_factors" says "list": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "directory": it reads files.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Every listed factor (an AI agent that manages money for other agents) with its mandate's limits (and its plain text where Mercatura publishes it), its fee, its record from the ERC-8004 Reputation Registry and its place in the directory, which is ordered by record. It never shows which clients a factor serves.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • read_outboxThe house factor's envelopes for this account, newest first, for the owner's signed request (request "outbox").Reads text others writeNo findings

    Why it is in this group

    • The name "read_outbox" says "read": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    The house factor's envelopes for this account, newest first, for the owner's signed request (request "outbox"). Each is v2: { v, account, kind, at, sealed, sig }, sig by the factor key. On your own machine, check sig against account.factor() on chain, then decrypt sealed with the X25519 secret key (scripts/open-envelope.mjs, or the snippet at /developers#delivery).

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

104 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 1 private-data tool breaks every one.

Reads private data1
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write26
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out4
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
deny to break every path
{
  "permissions": {
    "deny": [
      "mcp__mercatura__list_factors"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

11 warn
  • Warnvlad_withdraw_gains_transaction

    The server marks "vlad_withdraw_gains_transaction" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "vlad_withdraw_gains_transaction" says "withdraw": a word that usually means money moves, which cannot be taken back.

    What this check looks for
  • Warnvlad_withdraw_transaction

    The server marks "vlad_withdraw_transaction" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "vlad_withdraw_transaction" says "withdraw": a word that usually means money moves, which cannot be taken back.

    What this check looks for
  • Warnaccount_request_message

    The server marks "account_request_message" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "account_request_message" says "request": a word for a change.

    What this check looks for
  • Warnopen_account

    The server marks "open_account" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "open_account" says "open": a word for a change.

    What this check looks for
  • Warnset_mandate

    The server marks "set_mandate" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "set_mandate" says "set": a word for a change.

    What this check looks for
  • Warnpay

    The server marks "pay" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "pay" says "pay": a word that usually means money moves, which cannot be taken back.

    What this check looks for
Show 5 more findings
  • Warnwithdraw

    The server marks "withdraw" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "withdraw" says "withdraw": a word that usually means money moves, which cannot be taken back.

    What this check looks for
  • Warnmerca_lock_status

    The server marks "merca_lock_status" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "merca_lock_status" says "lock": a word for a change.

    What this check looks for
  • Warnmerca_lock

    The server marks "merca_lock" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "merca_lock" says "lock": a word for a change.

    What this check looks for
  • Warnmerca_request_unlock

    The server marks "merca_request_unlock" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "merca_request_unlock" says "request": a word for a change.

    What this check looks for
  • Warnmerca_unlock

    The server marks "merca_unlock" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "merca_unlock" says "unlock": a word for a change.

    What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 1.2.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http mercatura https://mercatura.network/mcp
claude mcp add --transport http mercatura https://mercatura.network/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__mercatura__list_factors",
      "mcp__mercatura__read_outbox"
    ],
    "ask": [
      "mcp__mercatura__vlad_program",
      "mcp__mercatura__vlad_check_eligibility",
      "mcp__mercatura__vlad_claim_transaction",
      "mcp__mercatura__vlad_account",
      "mcp__mercatura__vlad_withdraw_gains_transaction",
      "mcp__mercatura__vlad_withdraw_transaction",
      "mcp__mercatura__account_request_message",
      "mcp__mercatura__open_account",
      "mcp__mercatura__verify_account",
      "mcp__mercatura__balance_sheet",
      "mcp__mercatura__deposit",
      "mcp__mercatura__choose_factor",
      "mcp__mercatura__set_mandate",
      "mcp__mercatura__pay",
      "mcp__mercatura__withdraw",
      "mcp__mercatura__fire_factor",
      "mcp__mercatura__stealth_address",
      "mcp__mercatura__merca_lock_status",
      "mcp__mercatura__merca_lock",
      "mcp__mercatura__merca_request_unlock",
      "mcp__mercatura__merca_unlock",
      "mcp__mercatura__delivery_key_typed_data",
      "mcp__mercatura__register_delivery_key"
    ],
    "deny": [
      "mcp__mercatura__delete_outbox_item"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as mercatura. Review it before you use it.

Capability tags behind 26 rules
  • mcp__mercatura__vlad_program untrusted-input
  • mcp__mercatura__vlad_check_eligibility untrusted-input
  • mcp__mercatura__vlad_claim_transaction untrusted-input
  • mcp__mercatura__vlad_account untrusted-input
  • mcp__mercatura__vlad_withdraw_gains_transaction untrusted-input, outbound
  • mcp__mercatura__vlad_withdraw_transaction untrusted-input, outbound
  • mcp__mercatura__list_factors private-data, untrusted-input
  • mcp__mercatura__account_request_message untrusted-input, outbound
  • mcp__mercatura__open_account untrusted-input
  • mcp__mercatura__verify_account untrusted-input
  • mcp__mercatura__balance_sheet untrusted-input
  • mcp__mercatura__deposit untrusted-input
  • mcp__mercatura__choose_factor untrusted-input
  • mcp__mercatura__set_mandate untrusted-input
  • mcp__mercatura__pay untrusted-input
  • mcp__mercatura__withdraw untrusted-input, outbound
  • mcp__mercatura__fire_factor untrusted-input
  • mcp__mercatura__stealth_address untrusted-input
  • mcp__mercatura__merca_lock_status untrusted-input
  • mcp__mercatura__merca_lock untrusted-input
  • mcp__mercatura__merca_request_unlock untrusted-input
  • mcp__mercatura__merca_unlock untrusted-input
  • mcp__mercatura__delivery_key_typed_data untrusted-input
  • mcp__mercatura__register_delivery_key untrusted-input
  • mcp__mercatura__read_outbox untrusted-input
  • mcp__mercatura__delete_outbox_item untrusted-input

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/network.mercatura/mercatura/verify?hash=af694af5d920ce56f93e82eb00c0588f032618ddfeec1743d309f400df0fae9e" | jq -e '.changed == false'

Pinned hash af694af5d920, from Oct 24, 2026, 14:18 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/network.mercatura/mercatura/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for network.mercatura/mercatura
[![anlyon.dev](https://anlyon.dev/badge/network.mercatura/mercatura.svg)](https://anlyon.dev/servers/network.mercatura/mercatura)

Source: MCP Registry. Synced Oct 24, 2026, 14:18 UTC.