keyfo MCP server
xyz.keyfo/keyfokeyfo.xyzstreamable-httpv1.18.0Scanned
Stock token prices, P&L and trades you sign on Robinhood Chain, plus 300+ AI models on one key.
23 tools: 2 can delete or cancel things, 1 do something that can't be undone, 16 change things and 4 only read.
- Reads private data · 0
- Reads text others write · 17
- Can send data out · 0
- 5 findings
Tools listed without sign-in. Remote posture
With Anlyon
2 tools here can delete or cancel things and 1 does something that can't be undone. Govern them.
- Anlyon lists the tools and adopts none.
- Each tool you adopt gets approvals and receipts.
- Your agent never holds the key.
A tool your agent calls directly is not routed through Anlyon and is not governed by it. anlyon.dev only lists and labels, and these labels are the same either way.
What the keyfo MCP server can do
The keyfo MCP server is published by keyfo.xyz, a domain the MCP Registry verified. It has 23 tools. It can delete or cancel things (2 tools: build_revoke and cancel_schedule), do things that cannot be undone, such as sending, paying or publishing (fund_agent) and create or change data (16 tools: stock_quote, stock_movers, stock_portfolio, build_trade and 12 more). 4 tools only read.
17 tools bring in text other people can write (stock_quote, stock_movers, stock_portfolio and 14 more).
The fixed checks matched 5 findings (annotation-conflict). Each one comes with the text it matched.
Its remote endpoint lists its tools without sign-in.
Last scanned Nov 11, 2026, version 1.18.0.
Tools
Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.
23 tools
Deletes or cancels 2Claude Code: deny
build_revokeBuild an unsigned transaction that sets a token approval back to zero, so that spender can no longer move the token.Reads text others write2 findings
Why it is in this group
- The name "build_revoke" says "revoke": a word for removing or ending something.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
- The server marks it not destructive (destructiveHint: false), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Findings
- Warn
The server marks "build_revoke" read-only (readOnlyHint: true), and its own name, description or input give the class "destructive".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "build_revoke" says "revoke": a word for removing or ending something.
- Warn
The server marks "build_revoke" not destructive (destructiveHint: false), and its own name, description or input give the class "destructive".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "build_revoke" says "revoke": a word for removing or ending something.
Description, as the server wrote it Build an unsigned transaction that sets a token approval back to zero, so that spender can no longer move the token. Needs a key. Returns a call for the wallet owner to sign and send on Robinhood Chain (chain ID 4663). No keyfo tool signs. The answer also has sign_url: a keyfo page where the user checks the transaction and signs it in their own wallet. It stays open for 15 minutes and gets a new quote itself when the price is out of date. Show that link to the user, and never ask them to paste the transaction data anywhere.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: true
- title: Revoke approval
cancel_scheduleCancel a buy plan by its `id`.1 finding
Why it is in this group
- The name "cancel_schedule" says "cancel": a word for removing or ending something.
- The server marks it not destructive (destructiveHint: false), but an annotation never lowers a class.
Findings
- Warn
The server marks "cancel_schedule" not destructive (destructiveHint: false), and its own name, description or input give the class "destructive".
What this check looks forMatched text
annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":false}; The name "cancel_schedule" says "cancel": a word for removing or ending something.
Description, as the server wrote it Cancel a buy plan by its `id`. Nothing new is prepared for it; buys already signed stay as they are.
Annotations the server declares
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
- readOnlyHint: false
- title: Cancel schedule
Can't be undone 1Claude Code: ask
fund_agentQuote moving funds from another network (ethereum, base, arbitrum, optimism, bnb, polygon and others, 15 in all, or a chain ID) to an agent wallet on Robinhood Chain, arriving as E…Reads text others write1 finding
Why it is in this group
- The input carries an amount (input.amount) and a currency, so it moves money.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Findings
- Warn
The server marks "fund_agent" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The input carries an amount (input.amount) and a currency, so it moves money.
Description, as the server wrote it Quote moving funds from another network (ethereum, base, arbitrum, optimism, bnb, polygon and others, 15 in all, or a chain ID) to an agent wallet on Robinhood Chain, arriving as ETH. `payer` is the wallet that already holds the funds on the origin network: if the user did not name it, ask, do not reuse `wallet`. `amount` is in the smallest unit (wei for ETH), a number or a string of digits. Returns transactions for the payer to sign. The answer also has sign_url: a keyfo page where the user checks the transaction and signs it in their own wallet. It stays open for 15 minutes and gets a new quote itself when the price is out of date. Show that link to the user, and never ask them to paste the transaction data anywhere.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: true
- title: Fund agent wallet
Changes things 16Claude Code: ask
ask_modelAsk another AI model (GPT, Gemini, Grok and others) one question through keyfo and get its answer, for a second opinion.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Ask another AI model (GPT, Gemini, Grok and others) one question through keyfo and get its answer, for a second opinion. This is a paid model call: it needs a key and draws from the key’s daily allowance at the model’s price. A trial key can ask low-cost models only. The other model gets no tools.
Annotations the server declares
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
- readOnlyHint: false
- title: Ask another model
build_morpho_depositBuild unsigned transactions to deposit USDG into a Morpho vault on Robinhood Chain, or to withdraw it.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Build unsigned transactions to deposit USDG into a Morpho vault on Robinhood Chain, or to withdraw it. Without a vault, the largest USDG vault is used. Vaults carry smart contract, curator and market risk. Returns calls for the wallet owner to sign and send in order on Robinhood Chain (chain ID 4663). No keyfo tool signs. The answer also has sign_url: a keyfo page where the user checks the transaction and signs it in their own wallet. It stays open for 15 minutes and gets a new quote itself when the price is out of date. Show that link to the user, and never ask them to paste the transaction data anywhere.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: true
- title: Morpho deposit
build_tradeBuild unsigned transactions to buy a stock token on Robinhood Chain with ETH (`eth`, or `usd` worth of ETH) or sell `pct` percent of the wallet’s holding for ETH.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Build unsigned transactions to buy a stock token on Robinhood Chain with ETH (`eth`, or `usd` worth of ETH) or sell `pct` percent of the wallet’s holding for ETH. `token` is a ticker (TSLA) or the token address. A buy needs the ETH, plus gas, already in `wallet`; if it is short, fund it with fund_agent first. The calls expire at valid_until: sign and send before then, or build the trade again. Returns calls for the wallet owner to sign and send in order on Robinhood Chain (chain ID 4663). No keyfo tool signs. The answer also has sign_url: a keyfo page where the user checks the transaction and signs it in their own wallet. It stays open for 15 minutes and gets a new quote itself when the price is out of date. Show that link to the user, and never ask them to paste the transaction data anywhere.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: true
- title: Build trade
buy_at_pricePlan a buy of a stock token on Robinhood Chain for `wallet` that waits for a price: when the pool price goes `trigger` below or above `price_usd`, keyfo prepares a buy of `usd` or …Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Plan a buy of a stock token on Robinhood Chain for `wallet` that waits for a price: when the pool price goes `trigger` below or above `price_usd`, keyfo prepares a buy of `usd` or `eth` and a sign link. Nothing is bought or signed now. The plan starts after the wallet’s owner confirms it at https://keyfo.xyz/app. The price is the pool’s 5-minute median from at least 5 samples, and the level must hold for about 3 minutes. Only pools with at least $250000 of depth qualify, and no buy is prepared if the route costs more than 3% above the median. The owner then has 6 hours to sign. It is not a limit order: the buy goes at the market price when it is signed. One time by default; with `repeat`, it waits again after each buy. Limits as for scheduled buys: 5 plans per wallet, $500 per buy, $1000 a week.
Annotations the server declares
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
- readOnlyHint: false
- title: Buy at price
model_detailOne model in detail: prices, context, what it supports, and what a call of a given size would cost.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it One model in detail: prices, context, what it supports, and what a call of a given size would cost.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
- title: Model detail
morpho_loopWork out the net result over a year of borrowing USDG against a stock token on Morpho and putting it in a USDG vault, and the price at which the loan would be liquidated.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Work out the net result over a year of borrowing USDG against a stock token on Morpho and putting it in a USDG vault, and the price at which the loan would be liquidated. A calculation at current rates, not advice: nothing is built or sent.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: true
- title: Borrow and deposit math
morpho_ratesMorpho on Robinhood Chain: USDG vaults with their net APY, size and curator, and the lending markets that take stock tokens as collateral, with the borrow rate and LLTV.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Morpho on Robinhood Chain: USDG vaults with their net APY, size and curator, and the lending markets that take stock tokens as collateral, with the borrow rate and LLTV. Rates change; the numbers are a snapshot. Pass a ticker for one stock.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: true
- title: Morpho rates
my_keyWhat your keyfo key can still use: its allowance, what is left and when it resets.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it What your keyfo key can still use: its allowance, what is left and when it resets. Without a key: how many free read calls are left this hour.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
- title: My key
pending_signsScheduled buys of `wallet` that are ready to sign now, each with its sign_url and when its window closes.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Scheduled buys of `wallet` that are ready to sign now, each with its sign_url and when its window closes. Read only. Show the user every link.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
- title: Pending signs
portfolio_briefA short brief for one wallet on Robinhood Chain, read only: each stock token it holds with value and 24h change, the portfolio total, and today’s top three movers you can buy.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it A short brief for one wallet on Robinhood Chain, read only: each stock token it holds with value and 24h change, the portfolio total, and today’s top three movers you can buy. No key is needed for that. With a key for the same wallet, it adds what is left of today’s model allowance and the scheduled buys ready to sign, with their links; without one, it only counts the buys ready to sign and points to https://keyfo.xyz/app. It reads data on request; nothing is sent on a schedule.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: true
- title: Portfolio brief
portfolio_pnlProfit and loss for the stock tokens a wallet holds on Robinhood Chain, read only, no key needed: average entry price, unrealized P&L per token and in total.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Profit and loss for the stock tokens a wallet holds on Robinhood Chain, read only, no key needed: average entry price, unrealized P&L per token and in total. Entry prices come from the wallet’s buys in its transfer history on the chain. Tokens that arrived without a payment have no known cost and are left out of the average. Where the ETH price at the buy’s block is not known, the current one is used and the result is marked approximate. Gas is not counted, sales for ETH show their proceeds only when they went through LI.FI or OKX, and a swap from one stock token to another has no entry price.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: true
- title: Portfolio P&L
schedule_buyPlan a weekly buy of a stock token on Robinhood Chain for `wallet`: `usd` or `eth` each week on `weekday` at `hour` in `tz`.Reads text others writeNo findings
Why it is in this group
- The name "schedule_buy" says "schedule": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Plan a weekly buy of a stock token on Robinhood Chain for `wallet`: `usd` or `eth` each week on `weekday` at `hour` in `tz`. Nothing is bought or signed now. The plan starts only after the wallet’s owner confirms it at https://keyfo.xyz/app, signed in with that wallet. At each time keyfo prepares a fresh trade and a sign link; the owner signs it in their own wallet within 6 hours, or that buy is marked missed and the plan goes on. Limits: 5 plans per wallet, $500 per buy, $1000 a week per wallet.
Annotations the server declares
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
- readOnlyHint: false
- title: Schedule buy
stock_approvalsOpen token approvals of a wallet on Robinhood Chain: the stock tokens keyfo lists, USDG and WETH, checked against the spenders keyfo knows, such as LI.FI and Permit2.Reads text others write1 finding
Why it is in this group
- The description's first verb is "open": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Findings
- Warn
The server marks "stock_approvals" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The description's first verb is "open": a word for a change.
Description, as the server wrote it Open token approvals of a wallet on Robinhood Chain: the stock tokens keyfo lists, USDG and WETH, checked against the spenders keyfo knows, such as LI.FI and Permit2. It does not scan the wallet’s whole approval history. Unlimited approvals come first.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: true
- title: Token approvals
stock_moversToday’s movers among stock tokens on Robinhood Chain, ranked by the pool’s 24h change.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Today’s movers among stock tokens on Robinhood Chain, ranked by the pool’s 24h change. tradeable_only keeps the ones you can buy now.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: true
- title: Stock movers
stock_portfolioThe stock tokens and ETFs a wallet holds on Robinhood Chain, with amounts and value in dollars, plus its ETH.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it The stock tokens and ETFs a wallet holds on Robinhood Chain, with amounts and value in dollars, plus its ETH.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: true
- title: Stock portfolio
stock_quoteQuote stock tokens and ETFs on Robinhood Chain by ticker (NVDA, TSLA, SPY…) or token address, one or up to 20 at once.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Quote stock tokens and ETFs on Robinhood Chain by ticker (NVDA, TSLA, SPY…) or token address, one or up to 20 at once. Returns the pool price, 24h change and pool depth where a pool exists.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: true
- title: Stock quote
Only reads 4Show 4 read-only tools
chain_statusThe state of Robinhood Chain: the latest block and its age, the average block time, the gas price, and an estimate of what a transfer and a stock swap cost in dollars.Reads text others writeNo findings
Why it is in this group
- The name "chain_status" says "status": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it The state of Robinhood Chain: the latest block and its age, the average block time, the gas price, and an estimate of what a transfer and a stock swap cost in dollars.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: true
- title: Chain status
explain_txA Robinhood Chain transaction in parts: whether it succeeded, who sent it to what, the function it called, its fee, and every token transfer and approval it made.Reads text others writeNo findings
Why it is in this group
- The name "explain_tx" says "explain": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it A Robinhood Chain transaction in parts: whether it succeeded, who sent it to what, the function it called, its fee, and every token transfer and approval it made.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: true
- title: Explain transaction
list_modelsThe AI models a keyfo key can call: price per million tokens, context length and what each supports (tools, reasoning, vision, json).No findings
Why it is in this group
- The name "list_models" says "list": a word for reading.
Description, as the server wrote it The AI models a keyfo key can call: price per million tokens, context length and what each supports (tools, reasoning, vision, json). Filter by what the task needs; a trial key sees its low-cost list. Listing is free.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
- title: List models
list_schedulesThe buy plans of `wallet`: token, amount, day, hour and time zone, status and the next time.No findings
Why it is in this group
- The name "list_schedules" says "list": a word for reading.
Description, as the server wrote it The buy plans of `wallet`: token, amount, day, hour and time zone, status and the next time. Read only.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
- title: List schedules
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Exfil surface
Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.
No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data or outbound.
- Reads private data0
- Reads files, mail, messages, databases, secrets, calendars or repositories.
- Reads text others write17
- Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
- Can send data out0
- Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.
Remote posture
What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.
Looked at Nov 12, 2026, 10:20 UTC, unchanged since Nov 12, 2026. No credentials were sent and no tool was called. What is looked at.
- Reachable
- yes
- HTTP status of an anonymous initialize
- 200
- tools/list served without credentials
- yes
- Tools that change things, listed without credentials
- 19
- Protocol version
- 2025-06-18
- WWW-Authenticate on 401
- not observed
- resource_metadata in WWW-Authenticate
- not observed
- RFC 9728 protected resource metadata
- not observed
- Authorization servers
- not observed
- Legacy HTTP+SSE transport
- no
- Dynamic client registration
- not observed
- Client ID metadata documents
- not observed
- HighThe whole server
The endpoint served tools/list without credentials, and the list has 19 tools that change things (2 destructive, 1 irreversible, 16 write). Whether a call also works without credentials was not tested: tools are never called.
What this check looks forMatched text
https://keyfo.xyz/mcp: tools/list returned 23 tools to an anonymous client, including build_revoke (destructive), cancel_schedule (destructive), fund_agent (irreversible), stock_quote (write), stock_movers (write) and 14 more
Findings
Matches of fixed checks, with the text they matched.
- Warnfund_agent
The server marks "fund_agent" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The input carries an amount (input.amount) and a currency, so it moves money.
- Warnstock_approvals
The server marks "stock_approvals" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The description's first verb is "open": a word for a change.
- Warnbuild_revoke
The server marks "build_revoke" read-only (readOnlyHint: true), and its own name, description or input give the class "destructive".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "build_revoke" says "revoke": a word for removing or ending something.
- Warnbuild_revoke
The server marks "build_revoke" not destructive (destructiveHint: false), and its own name, description or input give the class "destructive".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "build_revoke" says "revoke": a word for removing or ending something.
- Warncancel_schedule
The server marks "cancel_schedule" not destructive (destructiveHint: false), and its own name, description or input give the class "destructive".
What this check looks forMatched text
annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":false}; The name "cancel_schedule" says "cancel": a word for removing or ending something.
History
Changes to its tool definitions and to its remote endpoint, newest first.
No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.
Install
Pinned to version 1.18.0. Values in angle brackets are yours to fill in.
claude mcp add --transport http keyfo https://keyfo.xyz/mcpclaude mcp add --transport http keyfo https://keyfo.xyz/mcpRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__keyfo__list_models",
"mcp__keyfo__chain_status",
"mcp__keyfo__explain_tx",
"mcp__keyfo__list_schedules"
],
"ask": [
"mcp__keyfo__stock_quote",
"mcp__keyfo__stock_movers",
"mcp__keyfo__stock_portfolio",
"mcp__keyfo__build_trade",
"mcp__keyfo__fund_agent",
"mcp__keyfo__my_key",
"mcp__keyfo__morpho_rates",
"mcp__keyfo__morpho_loop",
"mcp__keyfo__build_morpho_deposit",
"mcp__keyfo__model_detail",
"mcp__keyfo__ask_model",
"mcp__keyfo__stock_approvals",
"mcp__keyfo__schedule_buy",
"mcp__keyfo__pending_signs",
"mcp__keyfo__buy_at_price",
"mcp__keyfo__portfolio_pnl",
"mcp__keyfo__portfolio_brief"
],
"deny": [
"mcp__keyfo__build_revoke",
"mcp__keyfo__cancel_schedule"
]
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as keyfo. Review it before you use it.
Capability tags behind 17 rules
- mcp__keyfo__stock_quote untrusted-input
- mcp__keyfo__stock_movers untrusted-input
- mcp__keyfo__stock_portfolio untrusted-input
- mcp__keyfo__build_trade untrusted-input
- mcp__keyfo__fund_agent untrusted-input
- mcp__keyfo__morpho_rates untrusted-input
- mcp__keyfo__morpho_loop untrusted-input
- mcp__keyfo__build_morpho_deposit untrusted-input
- mcp__keyfo__ask_model untrusted-input
- mcp__keyfo__stock_approvals untrusted-input
- mcp__keyfo__build_revoke untrusted-input
- mcp__keyfo__chain_status untrusted-input
- mcp__keyfo__explain_tx untrusted-input
- mcp__keyfo__schedule_buy untrusted-input
- mcp__keyfo__buy_at_price untrusted-input
- mcp__keyfo__portfolio_pnl untrusted-input
- mcp__keyfo__portfolio_brief untrusted-input
Pin
Keep the decision: fail CI when the tools change, follow every change, or show a badge.
Pin in CI
Fail a build when the tools you reviewed are not the tools the server serves today.
curl -s "https://anlyon.dev/api/v1/servers/xyz.keyfo/keyfo/verify?hash=728867041a2562b89e8c8cc884053f0b7267627a792555decb78e410c74939cd" | jq -e '.changed == false'Pinned hash 728867041a25, from Nov 11, 2026, 16:18 UTC.
Watch
Get told when its tools change: a new tool, a new description, a new class.
https://anlyon.dev/servers/xyz.keyfo/keyfo/changes.xmlAn Atom feed. Works in any feed reader or Slack's RSS app.
Badge
[](https://anlyon.dev/servers/xyz.keyfo/keyfo)Source: MCP Registry. Synced Nov 11, 2026, 17:18 UTC.
keyfo MCP server: questions and answers
Answered from the scan above, not from the publisher's description.
Is the keyfo MCP server safe?
- No scan can promise that. What its definitions show: 23 tools, 19 of which can change, send or delete something, and 5 findings from fixed checks. Allow the reads, ask before each change, and deny the deletes; the permissions block on this page does that.
Can the keyfo MCP server delete data?
- Yes. 2 tools can delete, cancel or revoke something: build_revoke and cancel_schedule.
Can the keyfo MCP server do things that cannot be undone?
- Yes. 1 tool can send, pay, publish or merge: fund_agent.
What tools does the keyfo MCP server have?
- 23 tools: 2 destructive, 1 irreversible, 16 write, 4 read. build_revoke, cancel_schedule, fund_agent, stock_quote, stock_movers, stock_portfolio, build_trade, my_key and 15 more.
Does the keyfo MCP server need sign-in or OAuth?
- Its remote endpoint listed its tools to an anonymous client, without sign-in.
Does the keyfo MCP server send data to outside services?
- None of its tools sends, posts or publishes, or takes a recipient, channel or URL.
Has the keyfo MCP server changed its tools?
- Not since anlyon.dev started tracking it. Last scanned Nov 11, 2026.