Ultrapedia

run.ultrapedia/ultrapediaultrapedia.runstreamable-httpv1.0.0Scanned 2 hours ago

US ultramarathons: dates, places, distances, elevation, prices. Every value cited.

7 tools: 2 do something that can't be undone, 2 change things and 3 only read.

Reads private data · 1
Reads text others write · 3
Can send data out · 2
1 finding

Anlyon alternative

4 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

7 tools

Can't be undone 2Sends, pays, publishes or merges: once done, it cannot be taken back.Claude Code: ask

propose_correctionSend a value for one field of one race, read from a web page — a correction or a value the index is missing.Reads text others writeCan send data outNo findings
Why it is in this group
- The description's first verb is "send": a word for sending, and what is sent cannot be taken back.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe description's first verb is "send": it sends or publishes something to other people.
Description, as the server wrote it
Send a value for one field of one race, read from a web page — a correction or a value the index is missing. `field` is a column name from `describe`; `value` is in that column's form and units (gain_m in metres, dates yyyy-mm-dd, start_time HH:MM 24h, price_usd a number). `quote` must be copied verbatim from `source_url` and must show the value. For date, start time, price, aid stations, drop bags and runners, `year` is the edition year. The server checks the quote on the page; the result says whether the value was applied, held for a maintainer, or rejected and why.
Annotations the server declares
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
- readOnlyHint: false
propose_raceSend a US ultramarathon the index does not have yet.Reads text others writeCan send data outNo findings
Why it is in this group
- The description's first verb is "send": a word for sending, and what is sent cannot be taken back.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe description's first verb is "send": it sends or publishes something to other people.
Description, as the server wrote it
Send a US ultramarathon the index does not have yet. Check with search_races first. `quote` is copied verbatim from `source_url` and names the race. One call for each distance (a 50K and a 100M at the same event are two races).
Annotations the server declares
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
- readOnlyHint: false

Changes things 2Creates or changes something that can be changed back.Claude Code: ask

queryRun one read-only SQL SELECT (SQLite) over the views `races`, `editions` and `sources`.Reads private data1 finding
Why it is in this group
- The name "query" says "query": a word for reading.
- The description's first verb is "run": a word for a change.
- The input takes a statement or command to run (input.sql), which can change anything it can reach.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- private-dataThe description's first sentence says "sql": it reads databases.
- private-dataThe name says "query" and the input takes a statement (input.sql): it reads databases.
Findings
- Warn
  The server marks "query" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
  Matched text
  annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "query" says "query": a word for reading.
  What this check looks for
Description, as the server wrote it
Run one read-only SQL SELECT (SQLite) over the views `races`, `editions` and `sources`. Returns columns and rows; `truncated` is true when more rows exist than `limit` (max 500). Example: SELECT slug, name, date, city FROM races WHERE state='CO' AND distance_category='100M' AND date >= date('now') ORDER BY date
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
report_problemReport something a single value cannot fix: a cancelled or discontinued race, two rows for the same race, a race filed under the wrong distance.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Report something a single value cannot fix: a cancelled or discontinued race, two rows for the same race, a race filed under the wrong distance. Include a source and quote when you have one.
Annotations the server declares
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
- readOnlyHint: false

Only reads 3Looks things up and changes nothing.Show 3 read-only tools

describeWhat Ultrapedia holds: the queryable views, every column and what it means, the allowed values of category columns, and how many races there are.No findings
Why it is in this group
- The name "describe" says "describe": a word for reading.
Description, as the server wrote it
What Ultrapedia holds: the queryable views, every column and what it means, the allowed values of category columns, and how many races there are. Read this before writing SQL for `query`.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
get_raceEverything about one race: its values, its editions, and for every value the page it was read from and the verbatim quote.No findings
Why it is in this group
- The name "get_race" says "get": a word for reading.
Description, as the server wrote it
Everything about one race: its values, its editions, and for every value the page it was read from and the verbatim quote.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
search_racesFind races.No findings
Why it is in this group
- The name "search_races" says "search": a word for reading.
Description, as the server wrote it
Find races. `text` matches the name, city or start location; `state` is a two-letter code; `distance_category` is one of the values in `describe`; dates are yyyy-mm-dd and filter the current edition's date. Returns the main columns; use `get_race` for everything about one race.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

6 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 1 private-data tool breaks every one.

Reads private data1: Reads files, mail, messages, databases, secrets, calendars or repositories.; query
Reads text others write3: Brings in text someone else can write: web pages, inbound email, messages, issues and comments.; propose_correction
propose_race
report_problem
Can send data out2: Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.; propose_correction
propose_race

deny to break every path

{
  "permissions": {
    "deny": [
      "mcp__ultrapedia__query"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

1 warn

Warnquery
The server marks "query" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
Matched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "query" says "query": a word for reading.
What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http ultrapedia https://ultrapedia.run/mcp

claude mcp add --transport http ultrapedia https://ultrapedia.run/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__ultrapedia__describe",
      "mcp__ultrapedia__search_races",
      "mcp__ultrapedia__get_race"
    ],
    "ask": [
      "mcp__ultrapedia__query",
      "mcp__ultrapedia__propose_correction",
      "mcp__ultrapedia__propose_race",
      "mcp__ultrapedia__report_problem"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as ultrapedia. Review it before you use it.

Capability tags behind 4 rules

mcp__ultrapedia__query private-data
mcp__ultrapedia__propose_correction untrusted-input, outbound
mcp__ultrapedia__propose_race untrusted-input, outbound
mcp__ultrapedia__report_problem untrusted-input

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/run.ultrapedia/ultrapedia/verify?hash=e2affa03c7475e4ad08a3b8a6578aa29f52c63c6d0cac65576b604747933a47f" | jq -e '.changed == false'

Pinned hash e2affa03c747, from Oct 29, 2026, 16:18 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/run.ultrapedia/ultrapedia/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

[![anlyon.dev](https://anlyon.dev/badge/run.ultrapedia/ultrapedia.svg)](https://anlyon.dev/servers/run.ultrapedia/ultrapedia)

Source: MCP Registry. Synced Oct 29, 2026, 17:18 UTC.