Ouro Tools

by ouro.tools · remote · no sign-in to list tools · v0.1.0 · published by tools.ouro

Tools for charts, PDFs, tables, webpages, temporary sharing, webhooks, forms, and feeds.

Deletes · 3Final · 1Changes · 9

Compare Registry entry

19 tools: 3 can delete or cancel things, 1 do something that can't be undone, 9 change things and 6 only read.

Scanned Oct 21, 2026

Deletes or cancels3Claude Code: deny: see these tools
Can't be undone1Claude Code: ask: see these tools
Changes things9Claude Code: ask: see these tools
Only reads6Claude Code: allow: see these tools

1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http ouro-tools https://ouro.tools/mcp

Findings

Matches of fixed checks, with the text they matched.

1 info

Infocollect_read_form
The description mentions "credentials".
Matched text
description: "...ility. Does not expose answers or owner credentials."
What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

19 tools

Deletes or cancels 3Removes, cancels or revokes something.Claude Code: deny

collect_delete_formDelete a form and its responses using the owner token.No findings
Why it is in this group
- The name "collect_delete_form" says "delete": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Delete a form and its responses using the owner token.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- openWorldHint: false
droplink_delete_documentDelete a published DropLink immediately using its private deletion token.No findings
Why it is in this group
- The name "droplink_delete_document" says "delete": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Delete a published DropLink immediately using its private deletion token.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- openWorldHint: false
hookbox_delete_inboxDelete a webhook inbox and all its stored events.No findings
Why it is in this group
- The name "hookbox_delete_inbox" says "delete": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Delete a webhook inbox and all its stored events.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- openWorldHint: false

Can't be undone 1Sends, pays, publishes or merges: once done, it cannot be taken back.Claude Code: ask

droplink_publish_documentPublish a Markdown report or CSV table as a readable, publicly shareable page for 24 hours.Can send data outNo findings
Why it is in this group
- The name "droplink_publish_document" says "publish": a word for a change that another call does not undo.
What it can reach
- outboundThe name "droplink_publish_document" says "publish": it sends or publishes something to other people.
Description, as the server wrote it
Publish a Markdown report or CSV table as a readable, publicly shareable page for 24 hours. Returns a private deletion token only once. Scripts, images, and embeds are removed. Limits: 80,000 bytes, 500 CSV rows, 30 columns.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: false

Changes things 9Creates or changes something that can be changed back.Claude Code: ask

chartlink_create_chartCreate a bar, line, or stacked bar chart from numbers.No findings
Why it is in this group
- The name "chartlink_create_chart" says "create": a word for a change.
Description, as the server wrote it
Create a bar, line, or stacked bar chart from numbers. Returns SVG and PNG files plus a hosted result for 24 hours.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: false
collect_close_formStop accepting responses.No findings
Why it is in this group
- The name "collect_close_form" says "close": a word for a change.
Description, as the server wrote it
Stop accepting responses. Answers remain privately accessible until expiry.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: false
collect_create_formCreate a form for 30 days and up to 100 responses.No findings
Why it is in this group
- The name "collect_create_form" says "create": a word for a change.
Description, as the server wrote it
Create a form for 30 days and up to 100 responses. Costs $1 in credits after the trial. Returns a public form link and a private owner token.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: false
collect_submit_responseSubmit answers keyed by question ID to an open form.No findings
Why it is in this group
- The name "collect_submit_response" says "submit": a word for a change.
Description, as the server wrote it
Submit answers keyed by question ID to an open form. Text is limited to 2,000 characters per answer and 32 KB total.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: false
feedform_normalize_feedNormalize one RSS 2.0 or Atom XML feed to stable JSON.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Normalize one RSS 2.0 or Atom XML feed to stable JSON. Free; 1 MiB input, up to 100 returned items. Does not fetch URLs or retain feed content.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: false
hookbox_create_inboxCreate a 24-hour webhook inbox with independent incoming and private reading capabilities.No findings
Why it is in this group
- The name "hookbox_create_inbox" says "create": a word for a change.
Description, as the server wrote it
Create a 24-hour webhook inbox with independent incoming and private reading capabilities. Accepts 100 events up to 16 KB each.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: false
printkit_create_pdfCreate a PDF using a report, proposal, or briefing layout.No findings
Why it is in this group
- The name "printkit_create_pdf" says "create": a word for a change.
Description, as the server wrote it
Create a PDF using a report, proposal, or briefing layout. Provide Markdown or structured sections. Maximum 10 pages. Files expire after 24 hours. Limited trial usage, then 10 cents per document from prepaid credit.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: false
sourcecheck_check_sourcesCheck up to ten public source URLs for successful HTTP responses, final URLs, titles, and optional quotation matches in fetched text.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Check up to ten public source URLs for successful HTTP responses, final URLs, titles, and optional quotation matches in fetched text. Reports blocked and unreadable sources honestly. Does not verify factual truth.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
tablelift_extract_tablesExtract bordered tables from a text-based PDF into CSV and JSON with source page numbers.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Extract bordered tables from a text-based PDF into CSV and JSON with source page numbers. Maximum 3 MB and 10 pages. Scans and borderless tables are unsupported. Costs 10 cents per document page after the trial allowance; no charge when no useful tables are found.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: false

Only reads 6Looks things up and changes nothing.Claude Code: allow, ask for 1 outbound

chartlink_get_chartRetrieve a chart and download URLs before its 24-hour expiry.No findings
Why it is in this group
- The name "chartlink_get_chart" says "get": a word for reading.
Description, as the server wrote it
Retrieve a chart and download URLs before its 24-hour expiry.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: false
cleanread_read_pageExtract readable text, Markdown, headings, HTTP links, and tables from one accessible public webpage.Reads private dataReads text others writeCan send data outNo findings
Why it is in this group
- The name "cleanread_read_page" says "read": a word for reading.
What it can reach
- private-dataThe description's first sentence says "table": it reads databases.
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe description's first sentence says "http": it reads web pages, which anyone can write.
- untrusted-inputThe input takes a URL (input.url), and the tool reads it: it reads web pages, which anyone can write.
- outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
Claude Code: ask, because it is tagged outbound.
Description, as the server wrote it
Extract readable text, Markdown, headings, HTTP links, and tables from one accessible public webpage. Does not execute JavaScript or bypass access restrictions.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
collect_read_formRead public form questions and availability.1 finding
Why it is in this group
- The name "collect_read_form" says "read": a word for reading.
Findings
- Info
  The description mentions "credentials".
  Matched text
  description: "...ility. Does not expose answers or owner credentials."
  What this check looks for
Description, as the server wrote it
Read public form questions and availability. Does not expose answers or owner credentials.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: false
collect_read_responsesPrivately retrieve a form and its answers with its owner token.No findings
Why it is in this group
- The name "collect_read_responses" says "read": a word for reading.
Description, as the server wrote it
Privately retrieve a form and its answers with its owner token.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: false
droplink_read_documentRead a published DropLink document and its expiry.Reads private dataNo findings
Why it is in this group
- The name "droplink_read_document" says "read": a word for reading.
What it can reach
- private-dataThe name "droplink_read_document" says "read" and "document": it reads documents.
- private-dataThe description's first sentence says "read" and "document": it reads documents.
Description, as the server wrote it
Read a published DropLink document and its expiry. Expired links return 404.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: false
hookbox_read_inboxRead a webhook inbox using its private read token.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "hookbox_read_inbox" says "read": a word for reading.
What it can reach
- private-dataThe name "hookbox_read_inbox" says "read" and "inbox": it reads mail.
- private-dataThe description's first sentence says "read" and "inbox": it reads mail.
- untrusted-inputThe name "hookbox_read_inbox" says "read" and "inbox": it reads inbound email, which other people can write.
- untrusted-inputThe description's first sentence says "read" and "inbox": it reads inbound email, which other people can write.
Description, as the server wrote it
Read a webhook inbox using its private read token.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

18 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 2 outbound tools breaks every one.

Reads private data3: Reads files, mail, messages, databases, secrets, calendars or repositories.; cleanread_read_page
droplink_read_document
hookbox_read_inbox
Reads text others write3: Brings in text someone else can write: web pages, inbound email, messages, issues and comments.; cleanread_read_page
hookbox_read_inbox
sourcecheck_check_sources
Can send data out2: Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.; cleanread_read_page
droplink_publish_document

deny to break every path

{
  "permissions": {
    "deny": [
      "mcp__ouro-tools__cleanread_read_page",
      "mcp__ouro-tools__droplink_publish_document"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Install

Pinned to version 0.1.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http ouro-tools https://ouro.tools/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__ouro-tools__droplink_read_document",
      "mcp__ouro-tools__hookbox_read_inbox",
      "mcp__ouro-tools__chartlink_get_chart",
      "mcp__ouro-tools__collect_read_form",
      "mcp__ouro-tools__collect_read_responses"
    ],
    "ask": [
      "mcp__ouro-tools__droplink_publish_document",
      "mcp__ouro-tools__hookbox_create_inbox",
      "mcp__ouro-tools__chartlink_create_chart",
      "mcp__ouro-tools__cleanread_read_page",
      "mcp__ouro-tools__sourcecheck_check_sources",
      "mcp__ouro-tools__printkit_create_pdf",
      "mcp__ouro-tools__tablelift_extract_tables",
      "mcp__ouro-tools__collect_create_form",
      "mcp__ouro-tools__collect_submit_response",
      "mcp__ouro-tools__collect_close_form",
      "mcp__ouro-tools__feedform_normalize_feed"
    ],
    "deny": [
      "mcp__ouro-tools__droplink_delete_document",
      "mcp__ouro-tools__hookbox_delete_inbox",
      "mcp__ouro-tools__collect_delete_form"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as ouro-tools. Review it before you use it.

Capability tags behind 5 rules

mcp__ouro-tools__droplink_publish_document outbound
mcp__ouro-tools__droplink_read_document private-data
mcp__ouro-tools__hookbox_read_inbox private-data, untrusted-input
mcp__ouro-tools__cleanread_read_page private-data, untrusted-input, outbound
mcp__ouro-tools__sourcecheck_check_sources untrusted-input

Keep track

Get told when this server's tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/tools.ouro/ouro-tools/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Anlyon alternative

13 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Compare with other servers for the same product.

Source: MCP Registry · repository. Synced Oct 21, 2026, 18:55 UTC.

For agents: Markdown · JSON · report this listing