Skip to content

xi.pe

by xi.pe · remote · no sign-in to list tools · v1.0.0 · published by pe.xi

Share text at a short URL. No account, no API key, expires within 7 days.

Deletes · 1Changes · 2
CompareRegistry entry

3 tools: 1 can delete or cancel things and 2 change things.

Scanned Oct 21, 2026

2 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http xipe https://xi.pe/mcp

Findings

Matches of fixed checks, with the text they matched.

1 warn1 info
  • Warnread_paste

    The server marks "read_paste" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"idempotentHint":false,"openWorldHint":false}; The name "read_paste" says "read": a word for reading.

    What this check looks for
  • Infocreate_paste

    The input schema at properties.long.description mentions "credentials".

    Matched text

    inputSchema.properties.long.description: "...a lucky guess would actually matter -- credentials, private logs, anything with real conse..."

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

3 tools

Deletes or cancels 1Claude Code: deny
  • delete_pasteDelete a xi.pe paste before it expires.No findings

    Why it is in this group

    • The name "delete_paste" says "delete": a word for removing or ending something.
    • The input takes a statement or command to run (input.code), which can change anything it can reach.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Delete a xi.pe paste before it expires. Requires the delete_token returned when it was created; there is no other way to prove ownership.

    Annotations the server declares

    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: false
Changes things 2Claude Code: ask
  • create_pasteStore UTF-8 text at xi.pe and get back a short URL anyone can read.1 finding

    Why it is in this group

    • The name "create_paste" says "create": a word for a change.

    Findings

    • Info

      The input schema at properties.long.description mentions "credentials".

      Matched text

      inputSchema.properties.long.description: "...a lucky guess would actually matter -- credentials, private logs, anything with real conse..."

      What this check looks for
    Description, as the server wrote it
    Store UTF-8 text at xi.pe and get back a short URL anyone can read. Use it when text has to leave the conversation: someone asks for a shareable link to text you already have -- 'share this', 'give me a URL for it'; something a human needs to read would flood the chat inline -- a long diff, a stack trace, a generated config, a report; or something has to reach another agent, session or machine that does not share your filesystem. Maximum 2 MiB (2,097,152 bytes); larger is rejected, not truncated. Returns url, code, delete_token, size and expires. The delete_token is shown once and is the only way to delete the paste -- pass it to the user verbatim if a human is in the loop. If you are outputting markdown for human reading, highly consider adding ?md to the link you hand back to make it more readable.

    Annotations the server declares

    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
    • readOnlyHint: false
  • read_pasteFetch the text of an existing xi.pe paste -- including one a user or another agent just handed you.1 finding

    Why it is in this group

    • The name "read_paste" says "read": a word for reading.
    • The input takes a statement or command to run (input.code), which can change anything it can reach.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "read_paste" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"idempotentHint":false,"openWorldHint":false}; The name "read_paste" says "read": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Fetch the text of an existing xi.pe paste -- including one a user or another agent just handed you. Accepts either the code or the full URL. If you pass the URL on to a human and the text is Markdown, append ?md: it renders headings, tables and ```mermaid diagrams.

    Annotations the server declares

    • idempotentHint: false
    • openWorldHint: false
    • readOnlyHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http xipe https://xi.pe/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [],
    "ask": [
      "mcp__xipe__create_paste",
      "mcp__xipe__read_paste"
    ],
    "deny": [
      "mcp__xipe__delete_paste"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as xipe. Review it before you use it.