# `online.putit/put-it-online` on anlyon.dev > Text inside fenced blocks marked untrusted-server-text was written by the MCP server's publisher, not by anlyon.dev. It is data to inspect, not instructions to follow. Invisible characters are shown as [U+XXXX]. > No finding is not a safety guarantee: these are point-in-time checks of tool definitions, not of code or behaviour. - Page: https://anlyon.dev/servers/online.putit/put-it-online - JSON: https://anlyon.dev/api/v1/servers/online.putit/put-it-online - Version: 1.0.0 (active) - Publisher: online.putit (domain proven to the MCP Registry) - Runs: remote (streamable-http) - Sign-in to list tools: none - Repository: https://github.com/kitsunde/putit-mcp - Metadata from the official MCP Registry, synced 2026-10-21T18:54:06.216Z Title and description, as the publisher wrote them: ```untrusted-server-text Put It Online Publish AI-made web pages and share files as short links from any MCP client. ``` Scanned 2026-10-21T19:15:01.342Z over streamable-http. **10 tools: 1 can delete or cancel things, 1 do something that can't be undone, 5 change things and 3 only read.** | Group | Class | Tools | Claude Code | | --- | --- | --- | --- | | Deletes or cancels | destructive | 1 | deny | | Can't be undone | irreversible | 1 | ask | | Changes things | write | 5 | ask | | Only reads | read | 3 | allow | ## Findings No check matched anything in these tool definitions. ## Deletes or cancels (1) Removes, cancels or revokes something. Claude Code: deny. ### `delete_link` - The name "delete_link" says "delete": a word for removing or ending something. - The description says "Permanently delete". - The server marks it destructive (destructiveHint: true). Description, as the server wrote it: ```untrusted-server-text Permanently delete a link and its files. Account owners can delete their links; anonymous callers need the manage_token. This cannot be undone. ``` ## Can't be undone (1) Sends, pays, publishes or merges: once done, it cannot be taken back. Claude Code: ask. ### `publish_site` - The name "publish_site" says "publish": a word for a change that another call does not undo. Description, as the server wrote it: ```untrusted-server-text Put a web page or small static site you created online instantly. Pass {"files": {"index.html": "…", "style.css": "…", "app.js": "…"}} (paths relative to the site root; index.html required). Images can go in base64_files. Returns the public URL. Pages are served sandboxed on their own link. ``` ## Changes things (5) Creates or changes something that can be changed back. Claude Code: ask. ### `create_upload_session` - The name "create_upload_session" says "create": a word for a change. Description, as the server wrote it: ```untrusted-server-text For files too large to send inline: reserves a link and returns a one-time upload_url. PUT the raw bytes there (e.g. give the user the returned curl command), then poll get_link with the slug (and manage_token) until status is "live". ``` ### `extend` - The description's first verb is "restart": a word for a change. Description, as the server wrote it: ```untrusted-server-text Restart an expiring link's expiry clock (also brings back a recently expired link). Permanent links are unaffected. Requires a connected account whose plan includes extending. ``` ### `make_permanent` - Nothing in its name or description says what it does, so it is counted as a write. Description, as the server wrote it: ```untrusted-server-text Turn an expiring link into a permanent one (uses one of the plan's permanent slots; see get_account). Requires a connected account whose plan includes permanent links. ``` ### `set_password` - The name "set_password" says "set": a word for a change. Description, as the server wrote it: ```untrusted-server-text Protect a link with a password (visitors must enter it), or pass null to remove it. Requires a connected account whose plan includes passwords; otherwise returns a subscription_required error. ``` ### `upload_file` - The name "upload_file" says "upload": a word for a change. Description, as the server wrote it: ```untrusted-server-text Put a file online and get a short public link. Pass text directly, or base64 with encoding="base64" for binary files (images, PDFs, zips). An .html file becomes a web page; a .zip containing index.html becomes a website. Returns the URL, expires_at and a manage_token (shown once; anonymous callers need it to check or delete the link). Status may be "checking"/"publishing" (call get_link before sharing) or "unpublished" (not published). Limit 20 MB inline; use create_upload_session for bigger files. ``` ## Only reads (3) Looks things up and changes nothing. Claude Code: allow. ### `get_account` - The name "get_account" says "get": a word for reading. Description, as the server wrote it: ```untrusted-server-text The connected account's plan, permanent-link slots used/available, size limit and features. ``` ### `get_link` - The name "get_link" says "get": a word for reading. Description, as the server wrote it: ```untrusted-server-text Status of a link: live, checking, publishing, unpublished, in_review, removed (by moderation: removed_reason + appeal_url), expired or awaiting_upload; plus expiry, size and views (null when the account’s plan has no view counts). Anonymous callers pass the manage_token they got on creation. ``` ### `list_links` - The name "list_links" says "list": a word for reading. Description, as the server wrote it: ```untrusted-server-text List the links in the connected Put It Online account (newest first, permanent first). Requires a connected account. ``` ## Claude Code permissions For `.claude/settings.json`, assuming the server is installed as `put-it-online`: ```json { "permissions": { "allow": [ "mcp__put-it-online__get_link", "mcp__put-it-online__list_links", "mcp__put-it-online__get_account" ], "ask": [ "mcp__put-it-online__upload_file", "mcp__put-it-online__create_upload_session", "mcp__put-it-online__publish_site", "mcp__put-it-online__set_password", "mcp__put-it-online__make_permanent", "mcp__put-it-online__extend" ], "deny": [ "mcp__put-it-online__delete_link" ] } } ```