Bullpen

sale.bullpen/bullpenbullpen.salestreamable-httpv1.0.2Scanned 5 hours ago

AI sales team that works the phone: gets a real person on the line. Agents sign up by paying (MPP).

19 tools: 4 do something that can't be undone, 13 change things and 2 only read.

Reads private data · 0
Reads text others write · 9
Can send data out · 5
2 findings

Anlyon alternative

17 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

19 tools

Can't be undone 4Sends, pays, publishes or merges: once done, it cannot be taken back.Claude Code: ask

knockReach a human at a company's main line and leave a short hello pointing to your principal.Reads text others writeCan send data outNo findings
Why it is in this group
- The input addresses people (input.to): what it sends cannot be taken back.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a destination (input.to): what the tool writes goes there.
Description, as the server wrote it
Reach a human at a company's main line and leave a short hello pointing to your principal. Business hours, once a week per company. Spends credits.
Annotations the server declares
- title: Knock on a company
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true
send_emailEmail from the workspace's agent inbox.Reads text others writeCan send data outNo findings
Why it is in this group
- The name "send_email" says "send": a word for sending, and what is sent cannot be taken back.
- The input addresses people (input.to): what it sends cannot be taken back.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe name "send_email" says "send": it sends or publishes something to other people.
- outboundThe input takes a destination (input.to): what the tool writes goes there.
Description, as the server wrote it
Email from the workspace's agent inbox.
Annotations the server declares
- title: Send an email
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true
send_textText from the workspace's line.Reads text others writeCan send data outNo findings
Why it is in this group
- The name "send_text" says "send": a word for sending, and what is sent cannot be taken back.
- The input addresses people (input.to): what it sends cannot be taken back.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe name "send_text" says "send": it sends or publishes something to other people.
- outboundThe input takes a destination (input.to): what the tool writes goes there.
Description, as the server wrote it
Text from the workspace's line. Opt-outs are honored. Spends credits.
Annotations the server declares
- title: Send a text
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true
work_campaignSend the crew to work a campaign's contacts now.Reads text others writeCan send data outNo findings
Why it is in this group
- The description's first verb is "send": a word for sending, and what is sent cannot be taken back.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe description's first verb is "send": it sends or publishes something to other people.
Description, as the server wrote it
Send the crew to work a campaign's contacts now. Spends credits.
Annotations the server declares
- title: Work a campaign
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true

Changes things 13Creates or changes something that can be changed back.Claude Code: ask

ask_brainAnswer a question from the workspace's own knowledge (calls, notes, docs), with sources, limited by the key's role.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Answer a question from the workspace's own knowledge (calls, notes, docs), with sources, limited by the key's role.
Annotations the server declares
- title: Ask the company brain
- readOnlyHint: true
- openWorldHint: false
ask_hermanTalk to Herman, the manager agent who runs the whole bullpen in plain language: status, finding companies, running campaigns, sending the crew to call.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Talk to Herman, the manager agent who runs the whole bullpen in plain language: status, finding companies, running campaigns, sending the crew to call. Anything that reaches the outside world comes back as a pending action with an id — nothing goes out until confirm_herman_action.
Annotations the server declares
- title: Ask Herman (runs the bullpen)
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true
bullpen_aboutWhat Bullpen does, what it costs, and how an agent gets a workspace and API key.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
What Bullpen does, what it costs, and how an agent gets a workspace and API key. Call this first if you have no key. (No API key needed.)
Annotations the server declares
- title: What Bullpen is
- readOnlyHint: true
- openWorldHint: false
bullpen_signupStart creating a Bullpen workspace for your principal by paying with the Machine Payments Protocol (MPP, Stripe).Reads text others writeNo findings
Why it is in this group
- The description's first verb is "start": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Start creating a Bullpen workspace for your principal by paying with the Machine Payments Protocol (MPP, Stripe). Returns the 402 payment challenge and the exact URL to retry with your MPP client (e.g. `npx @stripe/link-cli mpp pay <url>`). The paid retry returns an api_key; pass it to this MCP server as `Authorization: Bearer bp_live_…`. $25–$500, all of it becomes credits, plus $10 free. (No API key needed.)
Annotations the server declares
- title: Hire a bullpen (sign up by paying)
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true
confirm_herman_actionRun or drop a pending action Herman proposed (a call, text or Salesforce update).Reads text others writeNo findings
Why it is in this group
- The description's first verb is "run": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Run or drop a pending action Herman proposed (a call, text or Salesforce update). Only confirm what your principal actually wants.
Annotations the server declares
- title: Confirm or cancel Herman's pending action
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true
create_campaignStart a calling campaign.No findings
Why it is in this group
- The name "create_campaign" says "create": a word for a change.
Description, as the server wrote it
Start a calling campaign. Add contacts with import_campaign_contacts, then work_campaign.
Annotations the server declares
- title: Create a campaign
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: false
find_companiesSearch for companies to sell to (e.g.1 finding
Why it is in this group
- The name "find_companies" says "find": a word for reading.
- The server marks it as not read-only (readOnlyHint: false).
Findings
- Warn
  The server marks "find_companies" as not read-only (readOnlyHint: false), and its words say it reads.
  Matched text
  annotations: {"readOnlyHint":false,"destructiveHint":false,"openWorldHint":false}; The name "find_companies" says "find": a word for reading.
  What this check looks for
Description, as the server wrote it
Search for companies to sell to (e.g. 'HVAC companies in Salt Lake City'). Returns names, main phone lines and websites.
Annotations the server declares
- title: Find companies
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: false
floor_stateLive and recent crew calls.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Live and recent crew calls.
Annotations the server declares
- title: Who's on the floor
- readOnlyHint: true
- openWorldHint: false
get_a_humanA crew member dials the number, works the phone menu, hold and AI receptionist until a real person answers, then connects the key's owner into the live call.Reads text others writeCan send data out1 finding
Why it is in this group
- The name "get_a_human" says "get": a word for reading.
- The server marks it as not read-only (readOnlyHint: false).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a destination (input.to): what the tool writes goes there.
Findings
- Warn
  The server marks "get_a_human" as not read-only (readOnlyHint: false), and its words say it reads.
  Matched text
  annotations: {"readOnlyHint":false,"destructiveHint":false,"openWorldHint":true}; The name "get_a_human" says "get": a word for reading.
  What this check looks for
Description, as the server wrote it
A crew member dials the number, works the phone menu, hold and AI receptionist until a real person answers, then connects the key's owner into the live call. Spends credits ($5 per human reached). Company lines only unless the callee gave written consent.
Annotations the server declares
- title: Get a human on the line
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true
import_campaign_contactsAdd contacts to a campaign from CSV text (header row: company, phone, name, title, email).No findings
Why it is in this group
- The name "import_campaign_contacts" says "import": a word for a change.
Description, as the server wrote it
Add contacts to a campaign from CSV text (header row: company, phone, name, title, email).
Annotations the server declares
- title: Import contacts
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: false
research_companyWho to ask for at a company returned by find_companies.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Who to ask for at a company returned by find_companies.
Annotations the server declares
- title: Research a company
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: false
top_up_creditsStart an MPP credit top-up ($5–$500).Reads text others writeNo findings
Why it is in this group
- The description's first verb is "start": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Start an MPP credit top-up ($5–$500). Returns the 402 challenge and the URL to pay and retry with your MPP client, sending your key as X-Bullpen-Key.
Annotations the server declares
- title: Top up credits
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true
watch_companiesAdd companies to Social Intel, which scans them for buying and risk signals.No findings
Why it is in this group
- The description's first verb is "add": a word for a change.
Description, as the server wrote it
Add companies to Social Intel, which scans them for buying and risk signals.
Annotations the server declares
- title: Watch companies for signals
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: false

Only reads 2Looks things up and changes nothing.Show 2 read-only tools

credits_statusPrepaid credit balance and recent usage.No findings
Why it is in this group
- The name "credits_status" says "status": a word for reading.
Description, as the server wrote it
Prepaid credit balance and recent usage. Spending tools return a 402 error at zero.
Annotations the server declares
- title: Credit balance
- readOnlyHint: true
- openWorldHint: false
whoamiThe workspace, member and role this API key acts as.No findings
Why it is in this group
- The name "whoami" says "whoami": a word for reading.
Description, as the server wrote it
The workspace, member and role this API key acts as.
Annotations the server declares
- title: Who am I
- readOnlyHint: true
- openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data.

Reads private data0: Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write9: Brings in text someone else can write: web pages, inbound email, messages, issues and comments.; ask_herman
bullpen_signup
confirm_herman_action
get_a_human
knock
send_email
send_text
top_up_credits
work_campaign
Can send data out5: Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.; get_a_human
knock
send_email
send_text
work_campaign

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

2 warn

Warnfind_companies
The server marks "find_companies" as not read-only (readOnlyHint: false), and its words say it reads.
Matched text
annotations: {"readOnlyHint":false,"destructiveHint":false,"openWorldHint":false}; The name "find_companies" says "find": a word for reading.
What this check looks for
Warnget_a_human
The server marks "get_a_human" as not read-only (readOnlyHint: false), and its words say it reads.
Matched text
annotations: {"readOnlyHint":false,"destructiveHint":false,"openWorldHint":true}; The name "get_a_human" says "get": a word for reading.
What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 1.0.2. Values in angle brackets are yours to fill in.

claude mcp add --transport http bullpen https://bullpen.sale/mcp

claude mcp add --transport http bullpen https://bullpen.sale/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__bullpen__whoami",
      "mcp__bullpen__credits_status"
    ],
    "ask": [
      "mcp__bullpen__bullpen_about",
      "mcp__bullpen__bullpen_signup",
      "mcp__bullpen__top_up_credits",
      "mcp__bullpen__ask_herman",
      "mcp__bullpen__confirm_herman_action",
      "mcp__bullpen__ask_brain",
      "mcp__bullpen__find_companies",
      "mcp__bullpen__research_company",
      "mcp__bullpen__get_a_human",
      "mcp__bullpen__knock",
      "mcp__bullpen__send_text",
      "mcp__bullpen__send_email",
      "mcp__bullpen__floor_state",
      "mcp__bullpen__create_campaign",
      "mcp__bullpen__import_campaign_contacts",
      "mcp__bullpen__work_campaign",
      "mcp__bullpen__watch_companies"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as bullpen. Review it before you use it.

Capability tags behind 9 rules

mcp__bullpen__bullpen_signup untrusted-input
mcp__bullpen__top_up_credits untrusted-input
mcp__bullpen__ask_herman untrusted-input
mcp__bullpen__confirm_herman_action untrusted-input
mcp__bullpen__get_a_human untrusted-input, outbound
mcp__bullpen__knock untrusted-input, outbound
mcp__bullpen__send_text untrusted-input, outbound
mcp__bullpen__send_email untrusted-input, outbound
mcp__bullpen__work_campaign untrusted-input, outbound

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/sale.bullpen/bullpen/verify?hash=2e04d4da3c9c9408fabc1044ff7ca28c5f39593c3a06c768747d894ae44089c8" | jq -e '.changed == false'

Pinned hash 2e04d4da3c9c, from Nov 5, 2026, 04:18 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/sale.bullpen/bullpen/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

[![anlyon.dev](https://anlyon.dev/badge/sale.bullpen/bullpen.svg)](https://anlyon.dev/servers/sale.bullpen/bullpen)

Source: MCP Registry · repository. Synced Nov 5, 2026, 05:18 UTC.