Skip to content

Everyday agent tools

by fourzerotwo.si · remote · no sign-in to list tools · v1.0.1 · published by si.fourzerotwo

Time zones and world business days, VAT rates and maths, currency conversion, UK business days…

Final · 3Changes · 13

18 tools: 3 do something that can't be undone, 13 change things and 2 only read.

Scanned Oct 21, 2026

3 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http tools https://fourzerotwo.si/mcp/v/tools

Findings

Matches of fixed checks, with the text they matched.

3 warn
  • The server marks "calculators__postcode-distance" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The input addresses people (input.to): what it sends cannot be taken back.

    What this check looks for
  • The server marks "calculators__currency-convert" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "calculators__currency-convert" says "convert": a word for a change.

    What this check looks for
  • The server marks "time__convert" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "time__convert" says "convert": a word for a change.

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

18 tools

Can't be undone 3Claude Code: ask
  • calculators__currency-convertConvert between ~30 currencies at the ECB reference rate for today or any date in the last 90 days.Reads text others writeCan send data out1 finding

    Why it is in this group

    • The name "calculators__currency-convert" says "convert": a word for a change.
    • The input addresses people (input.to): what it sends cannot be taken back.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a destination (input.to): what the tool writes goes there.

    Findings

    • Warn

      The server marks "calculators__currency-convert" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "calculators__currency-convert" says "convert": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Convert between ~30 currencies at the ECB reference rate for today or any date in the last 90 days. Free within the daily allowance, then $0.001 USDC per call via x402.

    Annotations the server declares

    • title: Calculators: Currency conversion
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • calculators__postcode-distanceStraight-line distance (km and miles) and compass bearing between two UK postcodes.Reads text others writeCan send data out1 finding

    Why it is in this group

    • The input addresses people (input.to): what it sends cannot be taken back.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a destination (input.to): what the tool writes goes there.

    Findings

    • Warn

      The server marks "calculators__postcode-distance" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The input addresses people (input.to): what it sends cannot be taken back.

      What this check looks for
    Description, as the server wrote it
    Straight-line distance (km and miles) and compass bearing between two UK postcodes. Free within the daily allowance, then $0.002 USDC per call via x402.

    Annotations the server declares

    • title: Calculators: Distance between postcodes
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • time__convertConvert a wall-clock time from one IANA zone to another; says when it is ambiguous (clocks go back) or never happens (clocks go forward).Reads text others writeCan send data out1 finding

    Why it is in this group

    • The name "time__convert" says "convert": a word for a change.
    • The input addresses people (input.to): what it sends cannot be taken back.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a destination (input.to): what the tool writes goes there.

    Findings

    • Warn

      The server marks "time__convert" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "time__convert" says "convert": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Convert a wall-clock time from one IANA zone to another; says when it is ambiguous (clocks go back) or never happens (clocks go forward). Free within the daily allowance, then $0.001 USDC per call via x402.

    Annotations the server declares

    • title: Time Zones & Business Days: Convert a local time between zones
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
Changes things 13Claude Code: ask
  • calculators__uk-business-daysIs a date a UK business day; add or subtract N business days; count business days between dates.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Is a date a UK business day; add or subtract N business days; count business days between dates. Uses official bank holidays per nation. Free within the daily allowance, then $0.001 USDC per call via x402.

    Annotations the server declares

    • title: Calculators: UK business days
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • holidays__checkIs a date a public holiday or business day in a country; add N business days; next business day.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Is a date a public holiday or business day in a country; add N business days; next business day. Free within the daily allowance, then $0.001 USDC per call via x402.

    Annotations the server declares

    • title: World Public Holidays: Holiday & business-day check
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • holidays__countriesEvery country and regional provider supported.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Every country and regional provider supported. Free within the daily allowance, then $0.0005 USDC per call via x402.

    Annotations the server declares

    • title: World Public Holidays: Supported countries
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • holidays__yearOfficial public holidays for a country (or region provider, e.g.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Official public holidays for a country (or region provider, e.g. Germany/Bavaria) in a year. Free within the daily allowance, then $0.001 USDC per call via x402.

    Annotations the server declares

    • title: World Public Holidays: Holidays in a year
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • time__nowLocal time, UTC, offset, abbreviation, DST flag, weekday and ISO week for a zone.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Local time, UTC, offset, abbreviation, DST flag, weekday and ISO week for a zone. Free within the daily allowance, then $0.001 USDC per call via x402.

    Annotations the server declares

    • title: Time Zones & Business Days: Current time in a zone
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • time__signedServer UTC time and a request id.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Server UTC time and a request id. The cheapest paid endpoint: use it to test an x402 payment end to end. Costs $0.001 USDC per call via x402.

    Annotations the server declares

    • title: Time Zones & Business Days: Paid test call
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • time__zone-infoOffset, abbreviation and DST at a moment, plus the next clock change, for an IANA zone.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Offset, abbreviation and DST at a moment, plus the next clock change, for an IANA zone. Free within the daily allowance, then $0.001 USDC per call via x402.

    Annotations the server declares

    • title: Time Zones & Business Days: Time zone facts
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • uk-bank-holidays__allEvery published UK bank holiday by division.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Every published UK bank holiday by division. Free within the daily allowance, then $0.001 USDC per call via x402.

    Annotations the server declares

    • title: UK Bank Holidays: All bank holidays
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • uk-bank-holidays__england-and-walesBank holidays in England and Wales.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Bank holidays in England and Wales. Free within the daily allowance, then $0.001 USDC per call via x402.

    Annotations the server declares

    • title: UK Bank Holidays: England & Wales
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • uk-bank-holidays__northern-irelandBank holidays in Northern Ireland.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Bank holidays in Northern Ireland. Free within the daily allowance, then $0.001 USDC per call via x402.

    Annotations the server declares

    • title: UK Bank Holidays: Northern Ireland
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • uk-bank-holidays__scotlandBank holidays in Scotland.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Bank holidays in Scotland. Free within the daily allowance, then $0.001 USDC per call via x402.

    Annotations the server declares

    • title: UK Bank Holidays: Scotland
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • vat__calculateNet to gross or gross to net at a given rate, or at a country's standard rate.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Net to gross or gross to net at a given rate, or at a country's standard rate. Free within the daily allowance, then $0.001 USDC per call via x402.

    Annotations the server declares

    • title: VAT Rates & Checks: Add or remove VAT
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • vat__ratesStandard, reduced and super-reduced VAT rates for one country or all of EU27 + UK, with the date they were checked.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Standard, reduced and super-reduced VAT rates for one country or all of EU27 + UK, with the date they were checked. Free within the daily allowance, then $0.001 USDC per call via x402.

    Annotations the server declares

    • title: VAT Rates & Checks: VAT rates
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
Only reads 2Claude Code: allow
  • time__business-daysCount business days between two dates, or add business days to a date, skipping weekends and the country's public holidays.Reads text others writeNo findings

    Why it is in this group

    • The description's first verb is "count": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Count business days between two dates, or add business days to a date, skipping weekends and the country's public holidays. Free within the daily allowance, then $0.001 USDC per call via x402.

    Annotations the server declares

    • title: Time Zones & Business Days: Business days (any country)
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • vat__validate-formatCountry format and check digit for UK (GB/XI) and EU VAT numbers.Reads text others writeNo findings

    Why it is in this group

    • The name "vat__validate-format" says "validate": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Country format and check digit for UK (GB/XI) and EU VAT numbers. Does not confirm registration. Free within the daily allowance, then $0.001 USDC per call via x402.

    Annotations the server declares

    • title: VAT Rates & Checks: Validate a VAT number format
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data.

Reads private data0
Reads files, mail, messages, databases, secrets, calendars or repositories.
Can send data out3
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Install

Pinned to version 1.0.1. Values in angle brackets are yours to fill in.

claude mcp add --transport http tools https://fourzerotwo.si/mcp/v/tools

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__tools__time__business-days",
      "mcp__tools__vat__validate-format"
    ],
    "ask": [
      "mcp__tools__calculators__uk-business-days",
      "mcp__tools__calculators__postcode-distance",
      "mcp__tools__calculators__currency-convert",
      "mcp__tools__time__convert",
      "mcp__tools__time__now",
      "mcp__tools__time__zone-info",
      "mcp__tools__time__signed",
      "mcp__tools__uk-bank-holidays__all",
      "mcp__tools__uk-bank-holidays__england-and-wales",
      "mcp__tools__uk-bank-holidays__scotland",
      "mcp__tools__uk-bank-holidays__northern-ireland",
      "mcp__tools__vat__rates",
      "mcp__tools__vat__calculate",
      "mcp__tools__holidays__year",
      "mcp__tools__holidays__check",
      "mcp__tools__holidays__countries"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as tools. Review it before you use it.

Capability tags behind 18 rules
  • mcp__tools__calculators__uk-business-days untrusted-input
  • mcp__tools__calculators__postcode-distance untrusted-input, outbound
  • mcp__tools__calculators__currency-convert untrusted-input, outbound
  • mcp__tools__time__convert untrusted-input, outbound
  • mcp__tools__time__now untrusted-input
  • mcp__tools__time__zone-info untrusted-input
  • mcp__tools__time__business-days untrusted-input
  • mcp__tools__time__signed untrusted-input
  • mcp__tools__uk-bank-holidays__all untrusted-input
  • mcp__tools__uk-bank-holidays__england-and-wales untrusted-input
  • mcp__tools__uk-bank-holidays__scotland untrusted-input
  • mcp__tools__uk-bank-holidays__northern-ireland untrusted-input
  • mcp__tools__vat__rates untrusted-input
  • mcp__tools__vat__calculate untrusted-input
  • mcp__tools__vat__validate-format untrusted-input
  • mcp__tools__holidays__year untrusted-input
  • mcp__tools__holidays__check untrusted-input
  • mcp__tools__holidays__countries untrusted-input