An MCP server for a live directory

What it is

An MCP server that lets AI agents read and run the directory through the same routes and permission checks as the website. A tool never touches the database: it sends the app the request a person would, as the key's owner, so an agent can do nothing its owner couldn't do in a browser.

The safety model

• Dry runs by default. A write shows the change, the exact request it would send and whether this account may make it, and changes nothing.
• Confirmation for destructive changes. Deleting, merging or blocking is refused unless confirm names the exact target the dry run named: the entry's ID, the account's ID, or for a site-wide change the site's own host, so a call written for staging fails on production.
• Never above its user's role. A key acts at the lower of its own ceiling and its owner's current role, so demoting someone limits their keys from the next request.
• Every write audited, with the key and the tool that made it.
• Limits and an off switch. Keys expire within 90 days, requests are rate-limited, and a kill switch takes the site offline.

Using it

I run the live directory through it. In 10/2026 a dry run and one confirmed call fixed the Goodreads link template, repairing dead links on 5,624 handles, and an agent merged a duplicate entry after its dry run named the entry to confirm.

The guards hold. When an agent using a key tried to approve a change on staging, it was refused, because keys can't approve changes, and nothing was written.

In numbers

190 tests for the MCP layer. 76 releases in its first month, from 1.0.0 in 09/2026 to 1.73.0 in 10/2026. Listed in the MCP Registry since 10/2026.

How agents connect

Public reads need no key. Keys can be read-only or capped at a role, and expire within 90 days. Claude, ChatGPT, VS Code and Cursor can sign in with OAuth instead of a key, and there's a Claude Desktop extension.