Name: Ephemeral
Author: ephemer

Ephemeral MCP

Run AI agent tasks in isolated sandboxes with a cost cap, saved workflows and scoped connections.

Tool-list grade B Remote · Streamable HTTP OAuth 2.1 19 tools v1.0.0

No reviews yet by ephemer The publisher’s own endpoint — this marketplace is not in the path

88/100

tool-list score

tools declared

remote

at its publisher

—

calls last 7d

What it does

Run AI agent tasks in isolated sandboxes with a cost cap, saved workflows and scoped connections.

Quickstart

# 1 — add it to Claude Code
claude mcp add --scope user --transport http ephemeral-mcp https://app.ephemer.al/mcp

# 2 — ask your agent for something these tools do
#   create_run, get_run, wait_for_run and 16 more

Ephemeral costs nothing on mcprush: there is no plan to choose here, no cap to set and nothing mcprush can bill you for.

Publishernot claimed

ephemer1 server

1 category

All 1 server

Collected from a public index. Nobody has claimed this account, so nothing here was written by its author — claim it if it is yours.

Installation

Where are you running it?

Every route below installs the same thing and ends at the same approval screen. Nothing here runs on your machine and nothing runs on ours: this server answers at its publisher’s own address, and what you install is the connection straight to it.

Claude Codedeclared by this listing

This is a public server: it answers at its publisher’s own address and this marketplace is not in the path. Claude Code registers it in one command; --scope user makes it available in every project. The transport below is http, as the publisher's own manifest declares it. Its publisher asks you to sign in with OAuth: run /mcp in Claude Code and pick this server, and it opens a browser for that once.

claude mcp add --scope user --transport http ephemeral-mcp https://app.ephemer.al/mcp

Reconnect, or start a new session, and the tools appear in the model’s tool list.

Free on mcprush, and it answers at its publisher’s own address: this marketplace is not in the path, so there is no key of ours to hold and no card to add — the only sign-in is its publisher’s own, with OAuth.

What it asks of you

Nothing is required, but it can take Authorization header (An Ephemeral API key as a bearer token, for clients that do not sign in with OAuth (those need only the URL). Create one under Keys in the dashboard; use a member key for agents.) if you want to set it.

What it writes

One config entry pointing straight at the publisher’s own address — this marketplace is not in the path, and nothing from this listing executes on your machine.

What you approve

19 tools, with what each one reads, writes and reaches shown before you agree — the same list on every route above. Read the tool surface.

Tool surface

What the model actually sees. Descriptions are diffed on every release — see version history.

Only tools that write or reach the network

Start an AI agent run in an isolated sandbox and return the run (status queued) at once. Give a prompt, or the name of a saved workflow. Poll with get_run or block with wait_for_run for the result. Every run has a cost cap (max_cost_micros) and a timeout, and is billed to the organization of the API key. Connections must already be saved in the organization; reference them by name. Use idempotency

Parameter	Type	Required	Notes
connections	object	no	Saved connections the agent may use, keyed by the name the agent sees. Each refers to a connection saved in the organization and can only narrow it.
description	string	no	What the workflow does and what input it expects, in a sentence or two, for people and agents. At most 500 characters.
files	array	no	Files placed in the sandbox: inline content, or a file saved in the organization.
idempotency_key	string	no	A retry with the same key returns the original run instead of starting another.
input		no	Any JSON the agent receives as its input. If the workflow has an input_schema, it must match.
input_schema	object	no	A JSON Schema (draft 2020-12 or 7, at most 32 KiB, no references to other documents) that this run's input must match. A run whose input does not match is refused with the path and the reason, such as
max_cost_micros	integer	no	Cost cap in millionths of a dollar. The run stops at the cap.
model	string	no	A model id from list_models. Omit for the default.
output_schema	object	no	A JSON Schema (draft 2020-12 or 7, at most 32 KiB, no references to other documents) that this run's output must match. The agent is told the schema and asked to reply with JSON only; the output is th
prompt	string	no	What the agent should do. Required unless workflow is set.
shell	boolean	no	Whether the agent may run shell commands in its sandbox.
timeout_seconds	integer	no	Wall-clock limit for the run.
web		no	Web access: true, false, or an object limiting it.
workflow	string	no	Name of a saved workflow to run instead of a prompt (see list_workflows).
zero_data_retention	boolean	no	Record nothing of the run's content; the output is kept only briefly and released on first retrieval.

Read a run: status, output, error, cost and billing_pending. COST: while billing_pending is true (or the run is still going), cost_micros is PROVISIONAL and usually higher than the final cost; the result then has cost_final:false and a cost_note. Quote a cost only when cost_final is true (the run is finished and billing_pending is false); otherwise call get_run again in a few seconds. For a zero-d

Parameter	Type	Required	Notes
id	string	yes	The run's id, as returned by create_run.

Wait until a run finishes (succeeded, failed, cancelled, interrupted or timed_out) or the wait ends, then return the run. After the run finishes it keeps waiting, within the same time, until billing has settled (billing_pending false, normally a few seconds to about 20), so the cost is final. Waits at most 60 seconds; if the run is still going, the returned status says so and you can call it again

Parameter	Type	Required	Notes
id	string	yes	The run's id, as returned by create_run.
timeout_seconds	integer	no	How long to wait, 1 to 60 (default 30).

List the organization's runs, newest first, with a cursor for the next page. Each run has cost_final: when false, cost_micros is provisional (usually above the final cost) and billing is still settling.

Parameter	Type	Required	Notes
cursor	string	no	next_cursor from the previous page.
limit	integer	no	Page size (default 20).
status	string	no	—

Cancel a run that has not finished. Work already done is billed. Cancelling a finished run changes nothing.

Parameter	Type	Required	Notes
id	string	yes	The run's id, as returned by create_run.

List the organization's saved workflows (reusable run definitions). Each entry has the workflow's name and, when set, its description, input_schema (the shape of the input create_run expects) and output_schema (the shape of the JSON it returns), so you can call a workflow without reading its prompt. Run one with create_run and its name.

No parameter schema on file.

Read a saved workflow's definition: description, prompt, model, files, connections, limits and its input_schema and output_schema. Credentials are never included.

Parameter	Type	Required	Notes
name	string	yes	The workflow's name.

Find models. Returns a compact list (id, name, context_length, input and output USD per million tokens, zero_data_retention where known), the total count and the default model. There are hundreds of models, so filter with query (case-insensitive part of the id or name, e.g. "claude", "gpt") and read the hint when the list is truncated (default 25, at most 100). Pass model for one model's full deta

Parameter	Type	Required	Notes
id	string	no	Same as model.
limit	integer	no	How many models to return (default 25).
model	string	no	A model id: return the full details of exactly that model.
query	string	no	Case-insensitive text to find in the model id or name, e.g. "claude".
zero_data_retention	boolean	no	true: only models that have a zero-data-retention endpoint.

The organization's saved connections that a run may use, with type, allowed methods and tools. No URLs or secrets are returned. Reference one in create_run by name.

No parameter schema on file.

Create a workflow, or replace the one with this name (saving the same definition again changes nothing more). A workflow is a reusable run definition: start it with create_run and its name, or on a timetable with create_schedule. Connections must already be saved in the organization; reference them by name, never with a URL or a credential. Read the current definition with get_workflow first when

Parameter	Type	Required	Notes
connections	object	no	Saved connections the agent may use (at most 16), keyed by the name the agent sees. Each refers to a connection saved in the organization and can only narrow it.
description	string	no	What the workflow does and what input it expects, in a sentence or two, for people and agents. At most 500 characters.
files	array	no	Files placed in the sandbox (at most 32): inline content, or a file saved in the organization.
input_schema	object	no	A JSON Schema (draft 2020-12 or 7, at most 32 KiB, no references to other documents) that each run of this workflow's input must match. A run whose input does not match is refused with the path and th
model	string	no	A model id from list_models. Omit for the default.
name	string	yes	The workflow's name: letters, digits, dots, dashes and underscores.
output_schema	object	no	A JSON Schema (draft 2020-12 or 7, at most 32 KiB, no references to other documents) that each run of this workflow's output must match. The agent is told the schema and asked to reply with JSON only;
prompt	string	yes	What the agent should do (maximum 128 KiB).
shell	boolean	no	Whether the agent may run shell commands in its sandbox.
timeout_seconds	integer	no	Wall-clock limit for each run.
web		no	Web access: true, false, or an object limiting it.
zero_data_retention	boolean	no	Record nothing of the runs' content; the output is kept only briefly and released on first retrieval.

Permanently delete a saved workflow. Runs already started are not affected; schedules that use it stop being able to start runs until it is saved again.

Parameter	Type	Required	Notes
name	string	yes	The workflow's name.

List the organization's schedules: each starts a saved workflow on a cron timetable. Includes the next start, the last run and the last error.

Parameter	Type	Required	Notes
workflow	string	no	Only the schedules of this workflow.

Read a schedule: timetable, time zone, input, cost cap, whether it is enabled, its next start and the outcome of its last start.

Parameter	Type	Required	Notes
id	string	yes	The schedule's id (sch_…), as returned by create_schedule or list_schedules.

Start a saved workflow on a timetable. Needs an administrator key. Each start is a run billed to the organization, with the cost cap given here (or the default). Use preview_schedule first to check the timetable. A schedule pauses itself after repeated failed starts. An organization can have 50 schedules.

Parameter	Type	Required	Notes
cron	string	yes	Five fields (minute hour day-of-month month day-of-week), such as "0 9 * * 1-5", or a descriptor such as @daily or @every 15m. At most once a minute.
enabled	boolean	no	Whether the schedule starts runs (default true).
input		no	Any JSON the agent receives as its input on every start (maximum 1 MiB).
max_cost_micros	integer	no	Cost cap of each run, in millionths of a dollar.
name	string	no	A label for the schedule.
skip_if_running	boolean	no	Skip a start while the previous run is still going (default true).
timezone	string	no	IANA time zone name, such as Europe/Madrid (default UTC).
workflow	string	yes	Name of the saved workflow to run (see list_workflows).

Change a schedule; only the fields you give change. Needs an administrator key. Set enabled to false to pause it and to true to resume it (resuming clears the failures that paused it). A new timetable counts from now.

Parameter	Type	Required	Notes
cron	string	no	Five fields (minute hour day-of-month month day-of-week) or a descriptor such as @daily or @every 15m.
enabled	boolean	no	false pauses the schedule, true resumes it.
id	string	yes	The schedule's id (sch_…), as returned by create_schedule or list_schedules.
input		no	Any JSON the agent receives as its input on every start (maximum 1 MiB).
max_cost_micros	integer	no	Cost cap of each run, in millionths of a dollar.
name	string	no	A label for the schedule.
skip_if_running	boolean	no	Skip a start while the previous run is still going.
timezone	string	no	IANA time zone name, such as Europe/Madrid.
workflow	string	no	Name of the saved workflow to run.

Permanently delete a schedule. Needs an administrator key. Runs it already started are not affected. To stop it for a while, pause it with update_schedule instead.

Parameter	Type	Required	Notes
id	string	yes	The schedule's id (sch_…), as returned by create_schedule or list_schedules.

Check a cron expression and time zone and return the next five start times (UTC), without saving anything.

Parameter	Type	Required	Notes
cron	string	yes	Five fields (minute hour day-of-month month day-of-week) or a descriptor such as @daily or @every 15m.
timezone	string	no	IANA time zone name, such as Europe/Madrid (default UTC).

Start the schedule's workflow now, outside its timetable, with the schedule's input and cost cap. Returns the queued run (follow it with wait_for_run); each call starts another run and is billed like any run.

Parameter	Type	Required	Notes
id	string	yes	The schedule's id (sch_…), as returned by create_schedule or list_schedules.

List the files saved in the organization: id, name, size, content type and creation time. Reference a file by id in a run's or workflow's files. Read-only; upload and delete files through the REST API.

No parameter schema on file.

Free

$0 forever

Every tool — any call limit is its publisher’s, not ours
No card, and mcprush charges nothing for it
Runs at its publisher’s own address — this marketplace is not in the path
Nothing to cap, because mcprush bills nothing

Nothing here is billable: mcprush charges nothing to install Ephemeral or to call it, at any volume.

BTool-list grade · score 88 / 100

Release 1.0.0 · scanned 27 Oct 2026

Graded from the tools this server lists, not from its source code.

Two independent axes, because powerful and malicious are different questions. The grade is threat only. The capability level is blast radius, and it is never a penalty on the grade — it is priced as one subtract-only term in the score, where you can see it.

Threat score98

Client score88

Findings2 threat · 3 capability

Capabilityhigh

Coveragemanifest

Verificationnot in this report

Surface digest32aeab1a8e826d1e52c255f65e4271809cf0aa1115d53475af72e4dc33871a15

Score vectorthreat 98 → client 88

Term	Level	What it prices	Points
capability-exposure	high	capability blast radius (high) — client exposure if the model is manipulated	−6
coverage-honesty	manifest	inspection depth (manifest) — how much of the target the scan could see	−4

score = clamp(round(threatScore − E_cap − E_ver − E_cov), 0, 100). No model, no opinion, no network call at scoring time: the same methodology version against the same bytes always produces this number, and every line above is a field of the report rather than a summary of it.

What the scan could actually read

A grade is only as meaningful as its coverage, so the scanner publishes its own depth before it publishes its result.

The scan read each tool’s name, description, input schema and annotations exactly as the server listed them the last time it answered us; no code was reviewed. We ask the server again about once a month, and a list that changed is graded again.

Tool surfaceread

Implementation sourcenot available

Package metadatanot available

Live transportnot available

The implementation source was not read — this reflects the declared tool metadata only.

Capability — what it could do if the model were manipulated

Tags derived from each tool’s schema and the implementation, not from what the tool calls itself. high is the level these add up to.

Tool	Capability tags	Why the tag was assigned
create_run	code-execexternal-sink	code-exec: parameter "shell"; external-sink: declares readOnlyHint: false, openWorldHint: true
get_run	no tags
wait_for_run	no tags
list_runs	no tags
cancel_run	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
list_workflows	no tags
get_workflow	no tags
list_models	no tags
list_connections	no tags
save_workflow	code-execstate-write	code-exec: parameter "shell"; state-write: declares readOnlyHint: false
delete_workflow	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
list_schedules	no tags
get_schedule	no tags
create_schedule	state-write	state-write: declares readOnlyHint: false
update_schedule	state-write	state-write: declares readOnlyHint: false
delete_schedule	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
preview_schedule	no tags
run_schedule	external-sink	external-sink: declares readOnlyHint: false, openWorldHint: true
list_files	sensitive-source	sensitive-source: keyword "list_files"

Toxic-flow graph

The lethal trifecta, checked as a graph rather than as a checklist: untrusted input, a sensitive source and an external sink have to meet before there is a path worth worrying about.

list_files → create_run

A sensitive-source → external-sink chain exists: list_files ⇒ create_run.

Supply chain and provenance

Integrityfirst-seen

Surface digest32aeab1a8e826d1e

Scanned2026-10-27

This is the first scan of this surface here, so there is nothing yet to compare it against.

Every result on this tab comes from one deterministic pass over the published package — offline, rule by rule, and auditable line by line above. Same methodology version, same bytes, same score.

Ephemeral MCP

What it does

Quickstart

Where are you running it?

Tool surface

What counts against your monthly calls

What the scan could actually read

Capability — what it could do if the model were manipulated

Toxic-flow graph

Supply chain and provenance

Release history

See also