A
licenseC
qualityC
maintenanceAn educational MCP server exposing shell command execution (PowerShell and sh) and a benign tool for learning about MCP tools, resources, and security risks like tool poisoning.
3
3
MIT
Permissioned MCP Server
by sn0bored
This server provides a minimal, permissioned note-taking system over MCP, supporting listing, reading, creating, and deleting notes with scope-based access control. Tools are hidden or rejected based on granted scopes.
List notes (
notes.list): Retrieve metadata for all notes (no bodies). Read-only and idempotent. Requiresnotes:readscope.Read a note (
notes.get): Get full content by UUID. Read-only and idempotent. Requiresnotes:readscope.Create a note (
notes.create): Add a note with a title (max 120 characters) and body (max 10,000 characters). Requiresnotes:writescope.Delete a note (
notes.delete): Permanently remove a note by UUID. Requiresnotes:adminscope (not exposed in schema by default). Destructive operations require a confirmation step.
Additional safety and persistence features: Unauthorized tools are omitted from discovery and rejected at execution; audit logs exclude sensitive content; notes are stored locally with atomic writes and restrictive file permissions.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Permissioned MCP Serverlist my notes"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Permissioned MCP Server
A compact Model Context Protocol server that demonstrates the parts usually missing from quickstarts: explicit tool boundaries, least-privilege discovery, execution-time authorization, destructive-action confirmation, and metadata-only audit logs.
The domain is deliberately boring: a local note store. The reference is about designing a safe boundary between an AI agent and real side effects.
What it demonstrates
JavaScript on Node.js with the official MCP SDK v2
Narrow read, write, and destructive tools
Separate
notes:read,notes:write, andnotes:adminscopesUnauthorized tools omitted from
tools/listand rejected again at executionIdentifier-bound confirmation for destructive actions
Structured tool results and MCP behavior annotations
Audit events that never log arguments, content, or credentials
Atomic local persistence with restrictive file permissions
Tests for policy, handlers, persistence, and failure cases
Related MCP server: mcp-tools-server
Run it
Requires Node.js twenty or newer.
npm install
cp .env.example .env
MCP_SCOPES=notes:read,notes:write npm startExample client configuration:
{
"mcpServers": {
"permissioned-notes": {
"command": "node",
"args": ["/absolute/path/to/permissioned-mcp-server/src/server.js"],
"env": {
"MCP_SCOPES": "notes:read,notes:write",
"MCP_DATA_FILE": "/absolute/path/to/notes.json",
"MCP_ACTOR": "local-agent"
}
}
}
}Start read-only. Grant notes:write only when mutation is necessary. Keep notes:admin out of the default configuration.
Tool boundary
Tool | Scope | Side effect |
|
| Returns metadata only |
|
| Reads one note |
|
| Creates one note |
|
| Permanently deletes one note |
See the decision record for the reasoning behind discovery filtering, double authorization, confirmation design, audit redaction, transport choice, and storage isolation.
Verify it
npm run check
npm testThe test suite never starts a model or calls a paid API.
Production notes
This is a local stdio reference, not a turnkey hosted authorization server. Before exposing an MCP server over Streamable HTTP, add OAuth-based authorization, token audience validation, HTTPS, rate limits, tenant isolation, durable audit storage, and client-specific consent.
License
MIT
Built by Lanier, an applied AI studio. More free tools at lanierdev.com/tools.
Available Tools
3 toolsnotes.createA
Create a local note. Requires the notes:write scope.
ParametersJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| body | Yes | ||
| title | Yes |
TDQS
A3.8/5.0
Behavior4/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate readOnlyHint=false and destructiveHint=false, so the description correctly implies a non-destructive write operation. It adds transparency by specifying the required scope, which is not covered by annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no extraneous information. It is concise and immediately communicates the tool's core purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness3/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simplicity of the tool (2 parameters, no output schema, no nested objects), the description is minimally adequate. However, it lacks information about success responses, error conditions, or side effects, which would be helpful for complete context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters2/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description does not mention or explain the parameters (title and body) despite 0% schema description coverage. While the schema itself is clear, the description misses an opportunity to add meaning, such as expected format or examples.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's action ('Create a local note') using a specific verb and resource, distinguishing it from sibling tools like 'notes.list' and 'notes.get'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines3/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description includes a prerequisite ('Requires the notes:write scope') but does not provide explicit guidance on when to use this tool versus alternatives, such as when creation is appropriate or not.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
notes.getARead-onlyIdempotent
Read one note by its opaque identifier.
ParametersJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes |
TDQS
A3.8/5.0
Behavior3/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and idempotentHint=true, so the description adds minimal behavioral context beyond confirming it's a read operation by opaque identifier.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence of 7 words, perfectly clear, no wasted text.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness4/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read tool with one parameter and no output schema, the description combined with annotations and siblings is nearly complete; could optionally mention return format.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0% from description, but the schema itself is rich (required, format uuid, pattern). The phrase 'opaque identifier' adds minor context. Baseline 3 due to high schema quality.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses the specific verb 'Read' and resource 'one note', clearly distinguishing it from sibling tools notes.list (list) and notes.create (create).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines3/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies that to get a single note by ID you use this, but does not explicitly state when not to use it or mention alternatives like notes.list for multiple notes.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
notes.listARead-onlyIdempotent
List note metadata without returning note bodies.
ParametersJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
A4.4/5.0
Behavior4/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and destructiveHint false. The description adds value by specifying that only metadata is returned (no bodies), which is not evident from annotations alone. No contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no wasted words. Every element ('List note metadata', 'without returning note bodies') carries essential information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness4/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a parameterless list tool with no output schema, the description is adequate: it conveys purpose and a key constraint (no bodies). However, it could be improved by clarifying what metadata fields are included (e.g., title, date). Still, given simplicity and sibling tools, it is sufficiently complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters4/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters with 100% schema coverage. The description does not need to explain parameters. With no parameters, baseline score is 4, and the description adds no parameter-related confusion.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool lists note metadata and explicitly excludes returning bodies, distinguishing it from notes.get (likely returns full content) and notes.create. Verb 'List' and resource 'note metadata' are specific and unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines4/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use (when only metadata needed) vs. alternatives (notes.get for bodies), but does not explicitly state the alternative or provide exclusion criteria. The context is clear but lacks explicit when-not-to-use guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
3 tool updates
v1.0.0- First observed
notes.create - First observed
notes.get - First observed
notes.list
TDQS
A4.1/5.0
Scored across 3 tools
Disambiguation5/5
Each tool has a clearly distinct purpose: list returns metadata, get returns a full note, and create adds a new note. No overlap in functionality.
Naming Consistency5/5
All tools follow the consistent pattern 'notes.<verb>', using simple, descriptive verbs (list, get, create). No naming style deviations.
Tool Count5/5
Three tools is a reasonable scope for a basic note management server. It covers core operations without being too sparse or excessive.
Completeness3/5
The set supports listing, reading, and creating notes but lacks update and delete operations. While a minimal viable set, these missing operations are notable gaps for typical CRUD coverage.
Maintenance
ActivityMaintained
ResponsivenessUnresponsive
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
MCP server for mandates, delegation, policy-gated execution, credential grants, and audit.
Nifty's MCP server — exposes tasks, projects, messages, and files as tools for AI agents.
The MCP server that vets MCP servers: identity, risk grade and per-tool risk before you install.
Independent trust scores, tool surfaces and change history for MCP servers.
Related MCP Servers
- AlicenseNot gradedqualityAmaintenanceA portfolio MCP server demonstrating four tools (web search, database query, file reading, directory listing) with read-only SQL, filesystem sandbox, and both stdio and HTTP transports.MIT
- AlicenseBqualityBmaintenanceA deliberately small MCP server that demonstrates security hardening against the OWASP MCP Top 10 with tools for file search, record queries, and document fetching, each defended against path traversal, SQL injection, and SSRF.4MIT
- FlicenseNot gradedqualityDmaintenanceA governed MCP server exposing 37 risk-checked tools with signed Ed25519 receipts on a Bitcoin-anchored ledger, failing closed if governance or receipt writing fails.-