Skip to content
anlyon.devby Anlyon

SnapEX Pay

pro.snapex/paysnapex.prostreamable-httpv1.0.0Scanned

Crypto payments for AI agents: self-serve account, invoices, receiving, payouts, exchange.

32 tools: 3 can delete or cancel things, 4 do something that can't be undone, 9 change things and 16 only read.

Tools: 3 delete, 4 irreversible, 9 write, 16 read.
  • Reads private data · 1
  • Reads text others write · 15
  • Can send data out · 2
  • 6 findings

Anlyon alternative

16 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →
Compare with similar serversMarkdownJSONReport this listing

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

32 tools

Deletes or cancels 3Claude Code: deny
  • create_conversionStep 2: executes a preview_conversion quote before its expires_at; the balance changes at once.Reads text others writeNo findings

    Why it is in this group

    • The name "create_conversion" says "create": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Step 2: executes a preview_conversion quote before its expires_at; the balance changes at once. A preview runs once — calling again returns the same conversion.

    Annotations the server declares

    • title: Execute conversion
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
  • create_payoutStep 2 of sending money: executes a preview_payout quote and sends real funds from your balance — irreversible once sent.Reads text others writeNo findings

    Why it is in this group

    • The name "create_payout" says "create": a word for a change.
    • The name "create_payout" also says "payout": a word that usually means money moves, which cannot be taken back.
    • The description says "irreversible".
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Step 2 of sending money: executes a preview_payout quote and sends real funds from your balance — irreversible once sent. destination_network and destination_address must be the ones of the preview. idempotency_key is required: reuse the same key when retrying after a timeout so the payout is never sent twice. Then follow get_payout (status until completed or failed, transaction_url) or webhooks payout.completed / payout.failed.

    Annotations the server declares

    • title: Send payout
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
  • rotate_webhook_secretIssues a new signing secret for an endpoint (shown once); the old one stops working at once.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Issues a new signing secret for an endpoint (shown once); the old one stops working at once.

    Annotations the server declares

    • title: Rotate webhook secret
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
Can't be undone 4Claude Code: ask
  • create_paymentCreates a payment from a preview_payment quote and returns deposit_address (and deposit_memo when the network needs one) and the exact amount the payer must send before expires_at.Reads text others writeNo findings

    Why it is in this group

    • The name "create_payment" says "create": a word for a change.
    • The name "create_payment" also says "payment": a word that usually means money moves, which cannot be taken back.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Creates a payment from a preview_payment quote and returns deposit_address (and deposit_memo when the network needs one) and the exact amount the payer must send before expires_at.

    Annotations the server declares

    • title: Create payment
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • list_paymentsPayments of the account, newest first, optionally filtered by status.1 finding

    Why it is in this group

    • The name "list_payments" says "list": a word for reading.
    • The description's first verb is "payment": a word that usually means money moves, which cannot be taken back.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "list_payments" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "list_payments" says "list": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Payments of the account, newest first, optionally filtered by status. Paginated with cursor.

    Annotations the server declares

    • title: List payments
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_payoutsPayouts of the account, newest first, optionally filtered by status.1 finding

    Why it is in this group

    • The name "list_payouts" says "list": a word for reading.
    • The description's first verb is "payout": a word that usually means money moves, which cannot be taken back.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "list_payouts" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "list_payouts" says "list": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Payouts of the account, newest first, optionally filtered by status. Paginated with cursor.

    Annotations the server declares

    • title: List payouts
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_static_address_depositsTransfers received on one permanent address with their status and credited USDT.1 finding

    Why it is in this group

    • The name "list_static_address_deposits" says "list": a word for reading.
    • The description's first verb is "transfer": a word for a change that another call does not undo.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "list_static_address_deposits" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "list_static_address_deposits" says "list": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Transfers received on one permanent address with their status and credited USDT. Paginated with cursor.

    Annotations the server declares

    • title: Static address deposits
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
Changes things 9Claude Code: ask
  • create_accountOpens a new SnapEX Pay merchant account for you and returns a merchant API key with every scope (receive, pay out, convert, webhooks).Reads text others writeNo findings

    Why it is in this group

    • The name "create_account" says "create": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Opens a new SnapEX Pay merchant account for you and returns a merchant API key with every scope (receive, pay out, convert, webhooks). No captcha, no email confirmation, no person needed. Call it once, only when you have no key yet (other tools answer "unauthorized"). On this MCP connection the new key is used automatically from now on; save api_key (shown once) and use it next time as "Authorization: Bearer <api_key>", or connect to mcp_personal_url. login and password (generated when omitted) let a person open the cabinet at cabinet_url. The account starts with a zero balance; money arrives only from payments to your invoices or addresses. Limited to a few accounts per IP per hour.

    Annotations the server declares

    • title: Open an account
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • create_invoiceCreates an invoice and returns pay_url — a hosted payment page where the payer picks a coin and pays; the amount is credited to your balance in USDT minus the fee.Reads text others writeNo findings

    Why it is in this group

    • The name "create_invoice" says "create": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Creates an invoice and returns pay_url — a hosted payment page where the payer picks a coin and pays; the amount is credited to your balance in USDT minus the fee. Give amount_usd, or price_amount + price_currency (converted at get_fiat_rates). Use environment "test" to try the whole flow without real money: a test invoice turns paid by itself about 10 seconds after a coin is selected (on its page or with select_invoice_payment_method); the real balance does not change. Then follow the status with get_invoice or webhooks (invoice.paid). To get a deposit address right away instead of a page, pass asset_id (and lock_method true), or call select_invoice_payment_method.

    Annotations the server declares

    • title: Create invoice
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • create_static_addressGets (or creates) a permanent deposit address for a coin/network and optional customer_ref: the same address comes back for the same customer_ref.Reads text others writeNo findings

    Why it is in this group

    • The name "create_static_address" says "create": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Gets (or creates) a permanent deposit address for a coin/network and optional customer_ref: the same address comes back for the same customer_ref. Every transfer to it is credited to your balance in USDT as a separate payment — good for top-ups. Networks: list_static_address_networks.

    Annotations the server declares

    • title: Static address
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • create_webhookRegisters a public HTTPS URL that receives a POST for each chosen event (JSON {id, type, created_at, data}).Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "create_webhook" says "create": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Registers a public HTTPS URL that receives a POST for each chosen event (JSON {id, type, created_at, data}). Returns secret (shown once): verify each delivery with HMAC-SHA256 of "<Webhook-Timestamp>.<raw body>" against the Webhook-Signature header ("v1=<hex>"). Deliveries are at-least-once — dedupe by Webhook-Id. Up to 10 endpoints.

    Annotations the server declares

    • title: Add webhook
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • preview_conversionStep 1 of converting assets held on the account into USDT.Reads text others write1 finding

    Why it is in this group

    • The name "preview_conversion" says "preview": a word for reading.
    • The server marks it as not read-only (readOnlyHint: false).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "preview_conversion" as not read-only (readOnlyHint: false), and its words say it reads.

      Matched text

      annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "preview_conversion" says "preview": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Step 1 of converting assets held on the account into USDT. The balance is kept in USDT (every payment is credited in USDT), so this matters only for an account that still holds another asset; to exchange USDT into another coin, send a payout in that coin (preview_payout, e.g. to your own address). mode "single": convert amount of from_asset_id (to USDT, or to to_asset_id); mode "all_to_usdt": convert every non-USDT holding to USDT. Returns preview_id with the amounts and expires_at; nothing moves yet. Then create_conversion.

    Annotations the server declares

    • title: Quote conversion
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • preview_paymentLow-level alternative to invoices: quotes a payment of an exact amount in one coin and how much USDT you will be credited.Reads text others write1 finding

    Why it is in this group

    • The name "preview_payment" says "preview": a word for reading.
    • The server marks it as not read-only (readOnlyHint: false).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "preview_payment" as not read-only (readOnlyHint: false), and its words say it reads.

      Matched text

      annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "preview_payment" says "preview": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Low-level alternative to invoices: quotes a payment of an exact amount in one coin and how much USDT you will be credited. Returns credit_lock_id for create_payment (valid until expires_at). Most agents should use create_invoice instead.

    Annotations the server declares

    • title: Quote payment
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • preview_payoutStep 1 of sending money.Reads text others write1 finding

    Why it is in this group

    • The name "preview_payout" says "preview": a word for reading.
    • The server marks it as not read-only (readOnlyHint: false).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "preview_payout" as not read-only (readOnlyHint: false), and its words say it reads.

      Matched text

      annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "preview_payout" says "preview": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Step 1 of sending money. Quotes a payout of amount USDT from your balance to an address in any coin with payout=true in list_assets: returns preview_id, to_amount (what the recipient gets), fee and expires_at. Nothing is sent yet and the quote is free; check the address and amounts, then call create_payout with preview_id before expires_at. An invalid address answers invalid_address.

    Annotations the server declares

    • title: Quote payout
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • select_invoice_payment_methodChooses the coin for an invoice and returns the deposit address and exact amount to send (in the invoice payment attempt) — use it when you pass the address to the payer yourself i…Reads text others writeNo findings

    Why it is in this group

    • The name "select_invoice_payment_method" says "select": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Chooses the coin for an invoice and returns the deposit address and exact amount to send (in the invoice payment attempt) — use it when you pass the address to the payer yourself instead of pay_url.

    Annotations the server declares

    • title: Select invoice coin
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • update_webhookReplaces the url and events of an endpoint, or disables/enables it (status).Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "update_webhook" says "update": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Replaces the url and events of an endpoint, or disables/enables it (status).

    Annotations the server declares

    • title: Change webhook
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
Only reads 16Show 16 read-only tools
  • get_accountReturns the account behind the API key in use: login, the key prefix and scopes, cabinet_url for a person and mcp_personal_url (a secret MCP URL with this key built in, for clients…Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "get_account" says "get": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "return" and "secret": it reads secrets.
    • untrusted-inputThe description's first sentence says "return" and "url": it reads web pages, which anyone can write.
    Description, as the server wrote it
    Returns the account behind the API key in use: login, the key prefix and scopes, cabinet_url for a person and mcp_personal_url (a secret MCP URL with this key built in, for clients that cannot send headers). Use it to check you are connected to the right account.

    Annotations the server declares

    • title: Show account
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_balancesReturns the account balance.No findings

    Why it is in this group

    • The name "get_balances" says "get": a word for reading.
    Description, as the server wrote it
    Returns the account balance. Every payment is credited in USDT (TRC20 accounting), whatever coin the payer used: available (can be paid out or converted now) and held (reserved by payouts in progress), each as a decimal string and in atomic units.

    Annotations the server declares

    • title: Balance
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_conversionOne conversion with its status and amounts.No findings

    Why it is in this group

    • The name "get_conversion" says "get": a word for reading.
    Description, as the server wrote it
    One conversion with its status and amounts.

    Annotations the server declares

    • title: Conversion status
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_feesWhat SnapEX Pay charges, no key needed.No findings

    Why it is in this group

    • The name "get_fees" says "get": a word for reading.
    Description, as the server wrote it
    What SnapEX Pay charges, no key needed. pricing: invoice_fee_percent (of a paid invoice; fee_on=customer puts it on the payer), invoice_min_usd/invoice_max_usd, static_address_fee_percent, payout_service_fee_percent; the network fee of a payout depends on the coin and is quoted by preview_payout, the smallest payout per coin is payout_min_usd in list_assets. data: recent cached route fee quotes (often empty; filter by route and asset codes).

    Annotations the server declares

    • title: Fee quotes
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_fiat_ratesFiat → USD rates used for invoices priced in another currency (create_invoice with price_amount + price_currency).No findings

    Why it is in this group

    • The name "get_fiat_rates" says "get": a word for reading.
    Description, as the server wrote it
    Fiat → USD rates used for invoices priced in another currency (create_invoice with price_amount + price_currency). Without currency returns all rates; with currency (ISO 4217, e.g. "EUR") returns one or not_found. No key needed.

    Annotations the server declares

    • title: Fiat rates
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_invoiceReturns one invoice with its status (open, awaiting, underpaid, paid, partially_paid, expired), pay_url, credit_usd, the selected coin and the payment attempts.Reads text others writeNo findings

    Why it is in this group

    • The name "get_invoice" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe description's first sentence says "return" and "url": it reads web pages, which anyone can write.
    Description, as the server wrote it
    Returns one invoice with its status (open, awaiting, underpaid, paid, partially_paid, expired), pay_url, credit_usd, the selected coin and the payment attempts. Poll it every 15–30 s while the payer pays, or use webhooks.

    Annotations the server declares

    • title: Invoice status
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_invoice_payment_methodsLists the coins and networks the payer can use for this invoice, with the amount to send in each.No findings

    Why it is in this group

    • The name "get_invoice_payment_methods" says "get": a word for reading.
    Description, as the server wrote it
    Lists the coins and networks the payer can use for this invoice, with the amount to send in each.

    Annotations the server declares

    • title: Invoice methods
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_paymentOne payment (from an invoice, a static address or create_payment): status (e.g.No findings

    Why it is in this group

    • The name "get_payment" says "get": a word for reading.
    Description, as the server wrote it
    One payment (from an invoice, a static address or create_payment): status (e.g. awaiting_deposit, detected, confirmed, expired), amounts expected/received/credited, deposit address.

    Annotations the server declares

    • title: Payment status
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_payoutOne payout: status (e.g.No findings

    Why it is in this group

    • The name "get_payout" says "get": a word for reading.
    Description, as the server wrote it
    One payout: status (e.g. processing, completed, failed; manual_review — SnapEX staff checks it), amounts, fee, transaction_hash and transaction_url in the destination network's explorer.

    Annotations the server declares

    • title: Payout status
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_assetsLists the coins and networks SnapEX Pay works with now: asset_id (the code other tools take), symbol, network, decimals, price_usd, payment (can be received), payout (can be paid o…No findings

    Why it is in this group

    • The name "list_assets" says "list": a word for reading.
    Description, as the server wrote it
    Lists the coins and networks SnapEX Pay works with now: asset_id (the code other tools take), symbol, network, decimals, price_usd, payment (can be received), payout (can be paid out) and payout_min_usd. No key needed. Call it before creating invoices, payouts or conversions to pick valid asset codes.

    Annotations the server declares

    • title: List assets
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_conversionsConversions of the account, newest first.No findings

    Why it is in this group

    • The name "list_conversions" says "list": a word for reading.
    Description, as the server wrote it
    Conversions of the account, newest first. Paginated with cursor.

    Annotations the server declares

    • title: List conversions
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_invoicesInvoices of the account, newest first, optionally filtered by status and environment.No findings

    Why it is in this group

    • The name "list_invoices" says "list": a word for reading.
    Description, as the server wrote it
    Invoices of the account, newest first, optionally filtered by status and environment. Paginated with cursor.

    Annotations the server declares

    • title: List invoices
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_static_address_networksLists the coins/networks for which you can get a permanent deposit address (create_static_address): asset code (e.g.No findings

    Why it is in this group

    • The name "list_static_address_networks" says "list": a word for reading.
    Description, as the server wrote it
    Lists the coins/networks for which you can get a permanent deposit address (create_static_address): asset code (e.g. "usdt.trc20", "usdc.polygon", "btc"), symbol, network, available, and how a deposit is credited (always in USDT). No key needed.

    Annotations the server declares

    • title: Static address networks
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_static_addressesPermanent deposit addresses of the account, optionally for one customer_ref.No findings

    Why it is in this group

    • The name "list_static_addresses" says "list": a word for reading.
    Description, as the server wrote it
    Permanent deposit addresses of the account, optionally for one customer_ref. Paginated with cursor.

    Annotations the server declares

    • title: List static addresses
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_transactionsLedger of the balance, newest first: every credit and debit (payments, payouts, fees, conversions) with amount, direction and time.No findings

    Why it is in this group

    • The name "list_transactions" says "list": a word for reading.
    Description, as the server wrote it
    Ledger of the balance, newest first: every credit and debit (payments, payouts, fees, conversions) with amount, direction and time. Paginated with cursor.

    Annotations the server declares

    • title: Balance history
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_webhooksWebhook endpoints of the account: endpoint_id, url, events, status.Reads text others writeNo findings

    Why it is in this group

    • The name "list_webhooks" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe description's first sentence says "url": it reads web pages, which anyone can write.
    Description, as the server wrote it
    Webhook endpoints of the account: endpoint_id, url, events, status.

    Annotations the server declares

    • title: List webhooks
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

30 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 1 private-data tool breaks every one.

Reads private data1
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write15
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out2
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
deny to break every path
{
  "permissions": {
    "deny": [
      "mcp__pay__get_account"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

6 warn
  • Warnpreview_payment

    The server marks "preview_payment" as not read-only (readOnlyHint: false), and its words say it reads.

    Matched text

    annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "preview_payment" says "preview": a word for reading.

    What this check looks for
  • Warnlist_payments

    The server marks "list_payments" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "list_payments" says "list": a word for reading.

    What this check looks for
  • Warnlist_static_address_deposits

    The server marks "list_static_address_deposits" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "list_static_address_deposits" says "list": a word for reading.

    What this check looks for
  • Warnpreview_payout

    The server marks "preview_payout" as not read-only (readOnlyHint: false), and its words say it reads.

    Matched text

    annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "preview_payout" says "preview": a word for reading.

    What this check looks for
  • Warnlist_payouts

    The server marks "list_payouts" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "list_payouts" says "list": a word for reading.

    What this check looks for
  • Warnpreview_conversion

    The server marks "preview_conversion" as not read-only (readOnlyHint: false), and its words say it reads.

    Matched text

    annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "preview_conversion" says "preview": a word for reading.

    What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http pay https://pay.snapex.pro/mcp
claude mcp add --transport http pay https://pay.snapex.pro/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__pay__get_account",
      "mcp__pay__list_assets",
      "mcp__pay__get_fiat_rates",
      "mcp__pay__get_fees",
      "mcp__pay__list_static_address_networks",
      "mcp__pay__get_balances",
      "mcp__pay__list_transactions",
      "mcp__pay__get_invoice",
      "mcp__pay__list_invoices",
      "mcp__pay__get_invoice_payment_methods",
      "mcp__pay__get_payment",
      "mcp__pay__list_static_addresses",
      "mcp__pay__get_payout",
      "mcp__pay__get_conversion",
      "mcp__pay__list_conversions",
      "mcp__pay__list_webhooks"
    ],
    "ask": [
      "mcp__pay__create_account",
      "mcp__pay__create_invoice",
      "mcp__pay__select_invoice_payment_method",
      "mcp__pay__preview_payment",
      "mcp__pay__create_payment",
      "mcp__pay__list_payments",
      "mcp__pay__create_static_address",
      "mcp__pay__list_static_address_deposits",
      "mcp__pay__preview_payout",
      "mcp__pay__list_payouts",
      "mcp__pay__preview_conversion",
      "mcp__pay__create_webhook",
      "mcp__pay__update_webhook"
    ],
    "deny": [
      "mcp__pay__create_payout",
      "mcp__pay__create_conversion",
      "mcp__pay__rotate_webhook_secret"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as pay. Review it before you use it.

Capability tags behind 15 rules
  • mcp__pay__create_account untrusted-input
  • mcp__pay__get_account private-data, untrusted-input
  • mcp__pay__create_invoice untrusted-input
  • mcp__pay__get_invoice untrusted-input
  • mcp__pay__select_invoice_payment_method untrusted-input
  • mcp__pay__preview_payment untrusted-input
  • mcp__pay__create_payment untrusted-input
  • mcp__pay__create_static_address untrusted-input
  • mcp__pay__preview_payout untrusted-input
  • mcp__pay__create_payout untrusted-input
  • mcp__pay__preview_conversion untrusted-input
  • mcp__pay__create_conversion untrusted-input
  • mcp__pay__list_webhooks untrusted-input
  • mcp__pay__create_webhook untrusted-input, outbound
  • mcp__pay__update_webhook untrusted-input, outbound

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/pro.snapex/pay/verify?hash=e04e39b79ec2df013497248590bdd50d2266ecb5962c6bac307535c4e9b704ff" | jq -e '.changed == false'

Pinned hash e04e39b79ec2, from Nov 2, 2026, 15:18 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/pro.snapex/pay/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for pro.snapex/pay
[![anlyon.dev](https://anlyon.dev/badge/pro.snapex/pay.svg)](https://anlyon.dev/servers/pro.snapex/pay)

Source: MCP Registry · repository. Synced Nov 2, 2026, 15:18 UTC.