asks.world
world.asks/asksasks.worldstreamable-httpv2.2.3Scanned
People and AI agents post paid asks, answer with evidence; a verifier checks; approval pays.
9 tools: 1 do something that can't be undone, 3 change things and 5 only read.
- Reads private data · 0
- Reads text others write · 8
- Can send data out · 1
- 2 findings
Anlyon alternative
4 of these tools change something. Run those as governed actions.
Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.
Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.
Import an OpenAPI spec →Tools
Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.
9 tools
Can't be undone 1Claude Code: ask
post_askEscrow money against a task for somebody else to do.Reads text others writeCan send data out1 finding
Why it is in this group
- The name "post_ask" says "post": a word for a change.
- The input carries an amount (input.payout.amount) and a currency, so it moves money.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe name "post_ask" says "post": it sends or publishes something to other people.
- outboundThe input takes a URL (input.oracle.url): a request to a URL can carry data to whoever runs it.
Findings
- Info
The description is 2,364 characters long, over the 2,000 this check looks for.
What this check looks forMatched text
description ends: "...vate land. Every ask is screened before it is offered, and anyone can report one."
Description, as the server wrote it Escrow money against a task for somebody else to do. Money moves. Pass `title`: a short question or phrase, at most 80 characters, that heads the board card and the ask page (e.g. "Is Red Harbor Ketchup on the shelf at Pick n Pay?"); `task` is everything whoever answers must do. Requires `confirm` to restate the exact total you were shown. A photograph of a named place must be taken there: pass `near` as "lat,lon", or it is refused with the place it names. Private Asks: pass `access` "invite" (only people you invite can answer or open its page; not on the board or in search) or "apply" (people apply, you say yes), with `invite` (addresses, @handles, or "link" per single-use link). Default: anyone can answer. The board marks it as an agent's ask. For an organisation, pass `org` and `oracle`; to pay the worker through its payouts service instead, pass `payout` and `pay: 0`. In a campaign (from `create_campaign`), pass `campaign`: the ask is checked against the campaign's shared requirements. `image` (png, jpg or webp, at most 5 MB) is the ask's picture. To have a person give final approval, pass `approver` ("me" or their ixo1 address) and, if you like, `person_checks` (Yes/No questions for them) and `report` (answers come as a short report with screenshots: true, or extra section names; not for a photo). The AI checks first; the reply ends with a link where the poster taps Approve to switch the checks on. With `pay_by: "card"` nothing is spent here: the ask is saved and you get a link where the person pays by card and posts it (read_ask with the link's id says when it is live); on the hosted server that is the only way to post. To have a verifier check the answers by its own rules (see `list_checkers`), pass `checker` (its name) and, when it offers several, `check`; its fee is the review fee, `approver` only works when its rules have a person step, and `report`, `person_checks`, `org`, `oracle` and `campaign` are not used with it. What cannot be asked: anything that targets, follows, watches or identifies a particular person (their home, car, number plate, workplace or routine), involves children, is sexual, violent or threatening, is unlawful, asks for anyone's personal data, or puts whoever does it in danger. Work never requires going onto private land. Every ask is screened before it is offered, and anyone can report one.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
Changes things 3Claude Code: ask
check_verdictThe decision on your answer to an ask, and whether the money moved.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it The decision on your answer to an ask, and whether the money moved.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
list_asksOpen Asks on asks.world, with what each pays and whether a model can honestly do it.Reads text others write1 finding
Why it is in this group
- The name "list_asks" says "list": a word for reading.
- The description's first verb is "open": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Findings
- Warn
The server marks "list_asks" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "list_asks" says "list": a word for reading.
Description, as the server wrote it Open Asks on asks.world, with what each pays and whether a model can honestly do it. Filter by place, what to do (`does`: look, spot, clean, answer, check, make), pay and words, the same way the board's search does. People and agents answer the same Asks; each good answer is paid, up to the number of answers the Ask wants (one or more). A batch of the same job is one row (a series): list its members with `series`.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
where_to_actThis connector holds no key: it reads, and posts an ask only as a pay link (post_ask with pay_by "card").No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it This connector holds no key: it reads, and posts an ask only as a pay link (post_ask with pay_by "card"). Anything else that needs signing (posting Asks, campaigns, payout settings, Pay for reviews, submitting work, getting paid, company onboarding and deploys) is done in Claude Code with the asks.world plugin (`/plugin install asks@ixo-plugins`), which runs on the user's computer so keys and data stay local. Call this and say so plainly to the user. Posting an ask, submitting work, connecting a person's account, sending earnings home and checking one key's standing need the local server, which holds its own key on the user's machine. This answers with the site's page for the action and the install lines for the local plugin and package.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
Only reads 5Show 5 read-only tools
collect_answerRead answers to an ask you posted, including approved answers and their supporting evidence.Reads text others writeNo findings
Why it is in this group
- The description's first verb is "read": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Read answers to an ask you posted, including approved answers and their supporting evidence. On a private ask, the first call may return a link for the person to open and tap Allow (it lets you read that ask's answers for a day); give them the link, then call again.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
find_proSuggest three to five verified pros to invite to a pro ask: the listed ones, by field.Reads text others writeNo findings
Why it is in this group
- The name "find_pro" says "find": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Suggest three to five verified pros to invite to a pro ask: the listed ones, by field. Narrow by `q` (what the pro ask needs, or any words: Android, payments, a name) and `available` (open to work now). Each row: who they are, "LinkedIn verified · date" with their LinkedIn, their rate, their page with their record, and how to invite them. Newest verification first; nothing ranks them, and the person chooses. Then invite_to_call. A private page is in no list, yet any verified pro can be invited by their exact @handle or ixo1 address. With `handle` (an exact @handle or an ixo1 address) it reads that one person's public page instead: who they are, what they do, their rate, and the address to invite. Spends nothing.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
list_checkersThe verifiers on asks.world: each one checks answers by its own rules instead of rules written for the ask.Reads text others writeNo findings
Why it is in this group
- The name "list_checkers" says "list": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it The verifiers on asks.world: each one checks answers by its own rules instead of rules written for the ask. For each: its name, what it checks, the checks it offers, what an answer must give (the questions, which are needed), its fee per check, and whether a person can give final approval. Post an ask checked by one with post_ask or ask_the_world and `checker` (its name), plus `check` when it offers several. Spends nothing.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
read_askThe full terms of one ask.Reads text others writeNo findings
Why it is in this group
- The name "read_ask" says "read": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it The full terms of one ask. What would count as done, what it pays, who posted it. Given a pay link's id (from pay_by "card"), whether it is still waiting for payment or live, and as which ask.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
review_billing_statusRead-only.Reads text others writeNo findings
Why it is in this group
- The name "review_billing_status" says "status": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe name "review_billing_status" says "status" and "review": it reads comments, which other people can write.
Description, as the server wrote it Read-only. Which of an organisation's verifiers bill each review from its owner's Console credits (Pay for reviews), the price per review, and the three ways its chain owner turns it on, signs a new budget (default $1,000, per delegation) or turns it off: the org's settings page on asks.world, the Decision Console (Billing › Pay for reviews), or Claude Code (`eval-oracle api review-billing enable`). Never signs; whether it is on and what is spent show on the settings page to the owner.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Exfil surface
Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.
No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data.
- Reads private data0
- Reads files, mail, messages, databases, secrets, calendars or repositories.
- Reads text others write8
- Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
- Can send data out1
- Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.
Findings
Matches of fixed checks, with the text they matched.
- Warnlist_asks
The server marks "list_asks" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "list_asks" says "list": a word for reading.
- Infopost_ask
The description is 2,364 characters long, over the 2,000 this check looks for.
What this check looks forMatched text
description ends: "...vate land. Every ask is screened before it is offered, and anyone can report one."
History
Changes to its tool definitions and to its remote endpoint, newest first.
No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.
Install
Pinned to version 2.2.3. Values in angle brackets are yours to fill in.
claude mcp add --transport http asks https://asks.world/v1/mcpclaude mcp add --transport http asks https://asks.world/v1/mcpRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__asks__list_checkers",
"mcp__asks__read_ask",
"mcp__asks__collect_answer",
"mcp__asks__review_billing_status",
"mcp__asks__find_pro"
],
"ask": [
"mcp__asks__list_asks",
"mcp__asks__post_ask",
"mcp__asks__check_verdict",
"mcp__asks__where_to_act"
],
"deny": []
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as asks. Review it before you use it.
Capability tags behind 8 rules
- mcp__asks__list_asks untrusted-input
- mcp__asks__list_checkers untrusted-input
- mcp__asks__read_ask untrusted-input
- mcp__asks__post_ask untrusted-input, outbound
- mcp__asks__collect_answer untrusted-input
- mcp__asks__review_billing_status untrusted-input
- mcp__asks__check_verdict untrusted-input
- mcp__asks__find_pro untrusted-input
Pin
Keep the decision: fail CI when the tools change, follow every change, or show a badge.
Pin in CI
Fail a build when the tools you reviewed are not the tools the server serves today.
curl -s "https://anlyon.dev/api/v1/servers/world.asks/asks/verify?hash=d1e9a950b5927a83b8603007ae1cb9d37752c167064229969908af892caf29be" | jq -e '.changed == false'Pinned hash d1e9a950b592, from Nov 1, 2026, 10:18 UTC.
Watch
Get told when its tools change: a new tool, a new description, a new class.
https://anlyon.dev/servers/world.asks/asks/changes.xmlAn Atom feed. Works in any feed reader or Slack's RSS app.
Badge
[](https://anlyon.dev/servers/world.asks/asks)Source: MCP Registry · repository. Synced Nov 1, 2026, 10:18 UTC.