MCP server for AnalyticDB MySQL via OpenAPI and direct SQL connection
Free
Nothing to run from here
Key Value is installed from its publisher's own source and answers where it runs, so this marketplace is not in the path of a single call. There is no address here to send one to, and a panel that pretended otherwise would be showing you an answer we made up. Install it and call it from your own client — the Installation tab has the entry for each one.
Open Installation—
p95 latency
—
call success
local
runs on your machine
—
calls last 7d
What it does
MCP tools for Heroku Key-Value Store (Redis): admin, credentials, config, and stats.
Quickstart
# 1 — run it from where its publisher ships it
npx -y @heroku-mcp/key-value
# 2 — ask your agent something
> MCP tools for Heroku Key-Value Store (Redis): admin, credentials, config, and stats.
Key Value is free: there is no plan to choose, no cap to set and nothing that can bill you.
Publishernot claimed
HEAll 2 servers
@heroku-mcp2 servers
2 categories
Collected from a public index. Nobody has claimed this account, so nothing here was written by its author — claim it if it is yours.
Installation
Where are you running it?
Every route below installs the same thing and ends at the same approval screen. This one runs on your machine: your client starts Key Value as a process under your own user, with your files and your network, so the tool surface below is what it can do to your computer rather than to a server somewhere else. It is scanned, signed and pinned to the version you choose — read the surface before you approve it.
Claude Codedeclared by this listing
This is a public server: you run it yourself and this marketplace is not in the path. Claude Code registers it in one command.
claude mcp add key-value-mcp -- npx -y @heroku-mcp/key-valueReconnect, or start a new session, and the tools appear in the model’s tool list.
Free to install, and it runs from its publisher’s own package: no account, no key, no card.
What it writes
One config entry your client uses to start the process locally. A local server runs with your file system and your network, which is why it is priced without metering.
What you approve
150 tools, with what each one reads, writes and reaches shown before you agree — the same list on every route above. Read the tool surface.
Tool surface
What the model actually sees. Descriptions are diffed on every release — see version history.
List Heroku apps the authenticated user has direct access to (personal + explicit collaborator), paginated. For the full union across every team use apps_list_all; for a single team use team_apps_list. Wraps GET /apps.
Takes no parameters.
Example callreturns →
Return the union of every Heroku app the authenticated user can access — personal apps, collaborator apps, AND apps owned by every team the user belongs to. Equivalent to
Takes no parameters.
Example callreturns →
List apps owned by the authenticated user (excludes apps the user has access to but doesn
Takes no parameters.
Example callreturns →
Return one app by id or name. Wraps GET /apps/{id_or_name}.
Takes no parameters.
Example callreturns →
Return multiple apps in one call, filtered by id. Wraps POST /filters/apps. This is a read filter despite the POST verb — body is a query, not a mutation.
Takes no parameters.
Example callreturns →
List feature flags on an app. Wraps GET /apps/{id_or_name}/features.
Takes no parameters.
Example callreturns →
Return one app feature flag. Wraps GET /apps/{id_or_name}/features/{feature}.
Takes no parameters.
Example callreturns →
Return the current config vars for an app. Values are returned in cleartext per Heroku — this tool intentionally bypasses redaction so callers can read their own secrets. Wraps GET /apps/{id_or_name}/config-vars.
Takes no parameters.
Example callreturns →
Return the config vars as they were at a specific release. Values are returned in cleartext per Heroku — this tool intentionally bypasses redaction so callers can read their own secrets. Wraps GET /apps/{id_or_name}/releases/{release}/config-vars.
Takes no parameters.
Example callreturns →
List an app
Takes no parameters.
Example callreturns →
Return one process type formation. Wraps GET /apps/{id_or_name}/formation/{type}.
Takes no parameters.
Example callreturns →
List the dyno sizes Heroku exposes. Wraps GET /dyno-sizes.
Takes no parameters.
Example callreturns →
List running dynos for an app. Wraps GET /apps/{id_or_name}/dynos.
Takes no parameters.
Example callreturns →
Return one dyno by id or name. Wraps GET /apps/{id_or_name}/dynos/{id_or_name}.
Takes no parameters.
Example callreturns →
List releases on an app. Wraps GET /apps/{id_or_name}/releases.
Takes no parameters.
Example callreturns →
Return one release by id or version. Wraps GET /apps/{id_or_name}/releases/{id_or_version}.
Takes no parameters.
Example callreturns →
List builds on an app. Wraps GET /apps/{id_or_name}/builds.
Takes no parameters.
Example callreturns →
Return one build. Wraps GET /apps/{id_or_name}/builds/{id}.
Takes no parameters.
Example callreturns →
List an app
Takes no parameters.
Example callreturns →
Return one slug. Wraps GET /apps/{id_or_name}/slugs/{id}.
Takes no parameters.
Example callreturns →
List custom domains on an app. Wraps GET /apps/{id_or_name}/domains.
Takes no parameters.
Example callreturns →
Return one custom domain by id or hostname. Wraps GET /apps/{id_or_name}/domains/{id_or_hostname}.
Takes no parameters.
Example callreturns →
List SNI endpoints on an app. Wraps GET /apps/{id_or_name}/sni-endpoints.
Takes no parameters.
Example callreturns →
Return one SNI endpoint. Wraps GET /apps/{id_or_name}/sni-endpoints/{id_or_name}.
Takes no parameters.
Example callreturns →
List log drains on an app. Wraps GET /apps/{id_or_name}/log-drains.
Takes no parameters.
Example callreturns →
Return one log drain by id, URL, or token. Wraps GET /apps/{id_or_name}/log-drains/{id_or_url_or_token}.
Takes no parameters.
Example callreturns →
List telemetry drains visible to the caller. Wraps GET /telemetry-drains. Note: Heroku scopes telemetry drains globally rather than per-app, hence no
Takes no parameters.
Example callreturns →
List webhooks on an app. Wraps GET /apps/{id_or_name}/webhooks.
Takes no parameters.
Example callreturns →
Return one app webhook. Wraps GET /apps/{id_or_name}/webhooks/{id}.
Takes no parameters.
Example callreturns →
List webhook deliveries for an app. Wraps GET /apps/{id_or_name}/webhook-deliveries.
Takes no parameters.
Example callreturns →
Return one webhook delivery. Wraps GET /apps/{id_or_name}/webhook-deliveries/{id}.
Takes no parameters.
Example callreturns →
List webhook events for an app. Wraps GET /apps/{id_or_name}/webhook-events.
Takes no parameters.
Example callreturns →
Return one webhook event. Wraps GET /apps/{id_or_name}/webhook-events/{id}.
Takes no parameters.
Example callreturns →
List collaborators on an app. Wraps GET /apps/{id_or_name}/collaborators.
Takes no parameters.
Example callreturns →
Return one collaborator by id or email. Wraps GET /apps/{id_or_name}/collaborators/{id_or_email}.
Takes no parameters.
Example callreturns →
List pending app transfers on the account. Wraps GET /account/app-transfers.
Takes no parameters.
Example callreturns →
Return one app transfer by id or app name. Wraps GET /account/app-transfers/{id_or_name}.
Takes no parameters.
Example callreturns →
Update a team. Wraps PATCH /teams/{id_or_name}.
Takes no parameters.
Example callreturns →
Delete a standalone (non-enterprise) team. Apps owned by the team survive under their original creators but lose team membership; enterprise-owned teams must be deleted via the enterprise account, not this tool. Wraps DELETE /teams/{id}. Destructive: pass confirm matching the team name.
Takes no parameters.
Example callreturns →
Add or update a member of a team (PUT semantics: creates if absent, updates if present). Wraps PUT /teams/{id_or_name}/members.
Takes no parameters.
Example callreturns →
Remove a member from a team. Wraps DELETE /teams/{id_or_name}/members/{email_or_id}. Destructive: pass confirm matching the member email.
Takes no parameters.
Example callreturns →
Create a new app owned by a team. Wraps POST /teams/apps. Pass
Takes no parameters.
Example callreturns →
Lock or unlock a team-owned app. When locked, only team admins can modify the app. Wraps PATCH /teams/apps/{id_or_name} with the
Takes no parameters.
Example callreturns →
Transfer ownership of a team-owned app to a different team or user. Wraps PATCH /teams/apps/{id_or_name} with the
Takes no parameters.
Example callreturns →
Add a collaborator to a team-owned app. Wraps POST /teams/apps/{id_or_name}/collaborators.
Takes no parameters.
Example callreturns →
Update a team-app collaborator
Takes no parameters.
Example callreturns →
Remove a collaborator from a team-owned app. Wraps DELETE /teams/apps/{id_or_name}/collaborators/{email}. Destructive: pass confirm matching the collaborator email.
Takes no parameters.
Example callreturns →
Invite a user to a team (PUT semantics — re-issuing for the same email updates the role on the pending invite). Wraps PUT /teams/{id_or_name}/invitations.
Takes no parameters.
Example callreturns →
Accept a pending team invitation using its opaque token. Wraps POST /teams/invitations/{token}/accept.
Takes no parameters.
Example callreturns →
Revoke a pending team invitation. Wraps DELETE /teams/{id_or_name}/invitations/{user}. Destructive: pass confirm matching the invited email. There is no individual GET for invitations — the dry-run pre-fetch lists invitations and filters by email.
Takes no parameters.
Example callreturns →
Toggle a team feature flag. Wraps PATCH /teams/{id_or_name}/features/{id_or_name}.
Takes no parameters.
Example callreturns →
Update team preferences (whitelisting-enabled, addons-controls, etc.). Pass only the keys you want to change. Wraps PATCH /teams/{id_or_name}/preferences.
Takes no parameters.
Example callreturns →
Allow a specific add-on service for a team. Wraps POST /teams/{id_or_name}/allowed-addon-services.
Takes no parameters.
Example callreturns →
Remove an allowed add-on service from a team. Wraps DELETE /teams/{id_or_name}/allowed-addon-services/{id_or_name}. Destructive: pass confirm matching the service name. There is no individual GET — the dry-run pre-fetch lists allowed services and filters by name.
Takes no parameters.
Example callreturns →
Return the authenticated Heroku account record. Wraps GET /account.
Takes no parameters.
Example callreturns →
Return the authenticated account
Takes no parameters.
Example callreturns →
List feature flags on the authenticated account. Paginated. Wraps GET /account/features.
Takes no parameters.
Example callreturns →
Return the SMS number for 2FA. Wraps GET /account/sms-number.
Takes no parameters.
Example callreturns →
List the SSH keys on the account. Paginated. Wraps GET /account/keys.
Takes no parameters.
Example callreturns →
Return a single SSH key by id or fingerprint. Wraps GET /account/keys/{id}.
Takes no parameters.
Example callreturns →
List the OAuth authorizations for the account. Wraps GET /oauth/authorizations.
Takes no parameters.
Example callreturns →
Return one OAuth authorization. Wraps GET /oauth/authorizations/{id}.
Takes no parameters.
Example callreturns →
List the OAuth clients registered on the account. The client
Takes no parameters.
Example callreturns →
Return one OAuth client. The client
Takes no parameters.
Example callreturns →
List invoices on the account. Paginated. Wraps GET /account/invoices.
Takes no parameters.
Example callreturns →
Return one invoice. Wraps GET /account/invoices/{number}.
Takes no parameters.
Example callreturns →
Return the invoice billing address. Wraps GET /account/invoice-address.
Takes no parameters.
Example callreturns →
List Heroku credits on the account. Wraps GET /account/credits.
Takes no parameters.
Example callreturns →
Return the authenticated user preferences. Wraps GET /users/~/preferences.
Takes no parameters.
Example callreturns →
Update the authenticated Heroku account. Wraps PATCH /account. To delete the account itself, use the Heroku Dashboard — account deletion is intentionally not exposed by this MCP.
Takes no parameters.
Example callreturns →
Toggle an account feature flag. Wraps PATCH /account/features/{id_or_name}.
Takes no parameters.
Example callreturns →
Recover the SMS number used for 2FA on the account. The phone number is stripped from the response. Wraps POST /account/sms-number/actions/recover.
Takes no parameters.
Example callreturns →
Upload an SSH public key to the authenticated account. Wraps POST /account/keys. Heroku has been gradually deprecating SSH-key-based deploys, but the endpoint works for users who still rely on it.
Takes no parameters.
Example callreturns →
Remove an SSH key from the authenticated account. Wraps DELETE /account/keys/{id_or_fingerprint}. Destructive: pass confirm matching the key fingerprint.
Takes no parameters.
Example callreturns →
Create a new OAuth authorization (and underlying access token) on the authenticated account. Wraps POST /oauth/authorizations. The returned token is a real credential — handle carefully.
Takes no parameters.
Example callreturns →
Revoke an OAuth authorization. Wraps DELETE /oauth/authorizations/{id}. Destructive: pass confirm matching the authorization id or its description.
Takes no parameters.
Example callreturns →
Regenerate the access/refresh tokens for an OAuth authorization. Old tokens stop working immediately. Wraps POST /oauth/authorizations/{id}/actions/regenerate-tokens. Destructive: pass confirm matching the authorization id.
Takes no parameters.
Example callreturns →
Update the invoice billing address on the authenticated account. Wraps PUT /account/invoice-address.
Takes no parameters.
Example callreturns →
Apply a credit code to the authenticated account. Wraps POST /account/credits.
Takes no parameters.
Example callreturns →
Update the authenticated user preferences (timezone, default region, etc.). Pass-through: only the keys you supply are updated. Wraps PATCH /users/~/preferences.
Takes no parameters.
Example callreturns →
Provision a new add-on on an app. Wraps POST /apps/{id_or_name}/addons. Pass
Takes no parameters.
Example callreturns →
Change the plan of an existing add-on (upgrade or downgrade). Wraps PATCH /apps/{id_or_name}/addons/{id_or_name}. Plan changes may trigger data migration on data-store add-ons — review the service vendor docs first.
Takes no parameters.
Example callreturns →
Destroy an add-on attached to an app. Irreversible: data stored by the add-on is removed per the service vendor policy. Wraps DELETE /apps/{id_or_name}/addons/{id_or_name}. Destructive: pass confirm matching the add-on name (e.g.
Takes no parameters.
Example callreturns →
Provision a release-tier-test resource for an add-on (creates a temporary copy used to validate releases). Wraps POST /apps/{id_or_name}/addons/{id_or_name}/actions/provision-release-test-resource.
Takes no parameters.
Example callreturns →
Promote a release-test resource so it becomes the active production add-on. Wraps POST /apps/{id_or_name}/addons/{id_or_name}/actions/promote-to-release.
Takes no parameters.
Example callreturns →
Attach an existing add-on to an additional app (with an optional new config-var name). Wraps POST /addon-attachments.
Takes no parameters.
Example callreturns →
Detach an add-on from an app. Removes the attachment but does NOT destroy the underlying add-on. Wraps DELETE /addon-attachments/{id}. Destructive: pass confirm matching the attachment name (e.g.
Takes no parameters.
Example callreturns →
Update the config-var pairs the add-on service publishes to its parent app. Wraps PATCH /addons/{id_or_name}/config. Pass {name, value} pairs; pass null on the value to remove.
Takes no parameters.
Example callreturns →
Run a custom action published by an add-on service. Actions are per-service — only services that publish actions support this; most add-ons return 404. Use
Takes no parameters.
Example callreturns →
Subscribe a webhook endpoint to events from an add-on. Wraps POST /addons/{id_or_name}/webhooks.
Takes no parameters.
Example callreturns →
Update an add-on webhook subscription. Wraps PATCH /addons/{id_or_name}/webhooks/{id}.
Takes no parameters.
Example callreturns →
Delete an add-on webhook subscription. Wraps DELETE /addons/{id_or_name}/webhooks/{id}. Destructive: pass confirm matching the parent add-on name (webhook URLs are not user-friendly identifiers, so confirm targets the add-on instead).
Takes no parameters.
Example callreturns →
Create a new app. All fields are optional — Heroku generates a name when omitted. Wraps POST /apps.
Takes no parameters.
Example callreturns →
Update an app. Patches name, maintenance mode, or build_stack. Optimistic concurrency: pass expected_etag to require that the server-side ETag matches before applying the change. Wraps PATCH /apps/{id_or_name}.
Takes no parameters.
Example callreturns →
Destroy an app. Irreversible: all dynos, add-ons, config vars, and releases are removed. Wraps DELETE /apps/{id_or_name}. Destructive: pass confirm matching the app name.
Takes no parameters.
Example callreturns →
Enable Automated Certificate Management on an app. Wraps POST /apps/{id_or_name}/acm.
Takes no parameters.
Example callreturns →
Disable Automated Certificate Management on an app. Wraps DELETE /apps/{id_or_name}/acm. Destructive: pass confirm matching the app name.
Takes no parameters.
Example callreturns →
Refresh Automated Certificate Management on an app (re-issues certificates). Wraps PATCH /apps/{id_or_name}/acm.
Takes no parameters.
Example callreturns →
Add a collaborator to an app. Wraps POST /apps/{id_or_name}/collaborators.
Takes no parameters.
Example callreturns →
Remove a collaborator from an app. Wraps DELETE /apps/{id_or_name}/collaborators/{id_or_email}. Destructive: pass confirm matching the collaborator email.
Takes no parameters.
Example callreturns →
Offer ownership of an app to another user or team. The recipient must accept via app_transfers_update. Wraps POST /account/app-transfers.
Takes no parameters.
Example callreturns →
Change the state of a pending app transfer (accept or decline). Wraps PATCH /account/app-transfers/{id_or_name}. Destructive: pass confirm matching the app name — accepting transfers ownership of the live app.
Takes no parameters.
Example callreturns →
Cancel a pending app transfer offer. Wraps DELETE /account/app-transfers/{id_or_name}. Destructive: pass confirm matching the app name.
Takes no parameters.
Example callreturns →
Return the Heroku account associated with the configured token (email, id, federated status, default team). Wraps GET /account.
Takes no parameters.
Example callreturns →
Re-run the capability probe matrix against Heroku. Updates the on-disk capability cache and emits notifications/tools/list_changed so MCP hosts re-fetch the tool list.
Takes no parameters.
Example callreturns →
Return the current per-hour Heroku rate-limit remaining count. Doesn
Takes no parameters.
Example callreturns →
Read the last N entries from today
Takes no parameters.
Example callreturns →
Report metadata about the cached Heroku JSON schema (definitions count, when it was last fetched). Does not contact Heroku.
Takes no parameters.
Example callreturns →
Add a custom domain to an app. Wraps POST /apps/{id_or_name}/domains. The user is responsible for the matching DNS CNAME.
Takes no parameters.
Example callreturns →
Update a custom domain. Today this is mostly used to (re)attach or detach an SNI endpoint. Wraps PATCH /apps/{id_or_name}/domains/{id_or_hostname}.
Takes no parameters.
Example callreturns →
Remove a custom domain from an app. Wraps DELETE /apps/{id_or_name}/domains/{id_or_hostname}. Destructive: pass confirm matching the hostname.
Takes no parameters.
Example callreturns →
Upload a TLS certificate + private key as an SNI endpoint. Wraps POST /apps/{id_or_name}/sni-endpoints. Certificate material is sent verbatim to Heroku and not stored locally.
Takes no parameters.
Example callreturns →
Replace the certificate + key on an existing SNI endpoint. Wraps PATCH /apps/{id_or_name}/sni-endpoints/{id_or_name}.
Takes no parameters.
Example callreturns →
Remove an SNI endpoint from an app. Wraps DELETE /apps/{id_or_name}/sni-endpoints/{id_or_name}. Destructive: pass confirm matching the endpoint name.
Takes no parameters.
Example callreturns →
List enterprise accounts the authenticated user has access to. Paginated. Wraps GET /enterprise-accounts.
Takes no parameters.
Example callreturns →
Return one enterprise account by id or name. Wraps GET /enterprise-accounts/{id_or_name}.
Takes no parameters.
Example callreturns →
Return a daily usage breakdown for an enterprise account across a date window. Wraps GET /enterprise-accounts/{id_or_name}/usage/daily.
Takes no parameters.
Example callreturns →
Return a monthly usage breakdown for an enterprise account across a date window. Wraps GET /enterprise-accounts/{id_or_name}/usage/monthly.
Takes no parameters.
Example callreturns →
List members of an enterprise account. Paginated. Wraps GET /enterprise-accounts/{id_or_name}/members.
Takes no parameters.
Example callreturns →
List apps a specific enterprise account member has access to. Wraps GET /enterprise-accounts/{id_or_name}/members/{user_email_or_id}/apps. Returns 404 if the member is not found.
Takes no parameters.
Example callreturns →
List the permission entities defined on an enterprise account. Paginated. Wraps GET /enterprise-accounts/{id_or_name}/permissions.
Takes no parameters.
Example callreturns →
List add-ons attached to apps across all teams owned by an enterprise account. Paginated. Wraps GET /enterprise-accounts/{id_or_name}/addons. The endpoint may not be exposed on every enterprise plan — Heroku returns 404 if the rollup is not available.
Takes no parameters.
Example callreturns →
List teams owned by an enterprise account. Paginated. Wraps GET /enterprise-accounts/{id_or_name}/teams. Enterprise-owned teams are the recommended Heroku organisational unit (the deprecated standalone teams API still works via the
Takes no parameters.
Example callreturns →
Return the credit pool record for an enterprise account, if exposed on this plan. Wraps GET /enterprise-accounts/{id_or_name}/credit-pool. Heroku returns 404 when the credit-pool resource is not enabled — the tool surfaces that as a not_found envelope rather than throwing.
Takes no parameters.
Example callreturns →
Allocate an ephemeral log-session URL for an app. The returned URL is a short-lived HTTPS endpoint the caller can stream. Wraps POST /apps/{id_or_name}/log-sessions.
Takes no parameters.
Example callreturns →
Forward an app
Takes no parameters.
Example callreturns →
Remove a log drain from an app. Wraps DELETE /apps/{id_or_name}/log-drains/{id_or_url_or_token}. Destructive: pass confirm matching the app name.
Takes no parameters.
Example callreturns →
Add a telemetry drain to an app. Heroku exports the configured signals to the exporter URL. Wraps POST /apps/{id_or_name}/telemetry-drains.
Takes no parameters.
Example callreturns →
Update a telemetry drain configuration. The drain is account-scoped — addressed by id, not app. Wraps PATCH /telemetry-drains/{id}.
Takes no parameters.
Example callreturns →
Remove a telemetry drain. Wraps DELETE /telemetry-drains/{id}. Destructive: pass confirm matching the drain id.
Takes no parameters.
Example callreturns →
List teams the authenticated user is a member of. Paginated — Heroku defaults to page size 25, so pass
Takes no parameters.
Example callreturns →
Return one team by id or name. Wraps GET /teams/{id_or_name}.
Takes no parameters.
Example callreturns →
List members of a team. Paginated. Wraps GET /teams/{id_or_name}/members.
Takes no parameters.
Example callreturns →
List apps a specific team member has access to within the team. Paginated. Wraps GET /teams/{id_or_name}/members/{email_or_id}/apps.
Takes no parameters.
Example callreturns →
List apps owned by a team. Paginated. Wraps GET /teams/{id_or_name}/apps.
Takes no parameters.
Example callreturns →
Return one team-owned app by id or name. Wraps GET /teams/apps/{id_or_name}. The endpoint enforces team-ownership; personal apps return 404.
Takes no parameters.
Example callreturns →
List collaborators on a team-owned app. Paginated. Wraps GET /teams/apps/{id_or_name}/collaborators.
Takes no parameters.
Example callreturns →
List the permission names that team apps support (e.g. view, deploy, manage). Account-scoped — does not require a specific team. Wraps GET /teams/permissions.
Takes no parameters.
Example callreturns →
List outstanding invitations on a team. Paginated. Wraps GET /teams/{id_or_name}/invitations.
Takes no parameters.
Example callreturns →
List invoices for a team. Paginated. Wraps GET /teams/{id_or_name}/invoices.
Takes no parameters.
Example callreturns →
Return one team invoice by number. Wraps GET /teams/{id_or_name}/invoices/{number}.
Takes no parameters.
Example callreturns →
Return a daily usage breakdown for a team across a date window. Wraps GET /teams/{id_or_name}/usage/daily.
Takes no parameters.
Example callreturns →
Return a monthly usage breakdown for a team across a date window. Wraps GET /teams/{id_or_name}/usage/monthly.
Takes no parameters.
Example callreturns →
List feature flags on a team. Paginated. Wraps GET /teams/{id_or_name}/features.
Takes no parameters.
Example callreturns →
Return one team feature flag. Wraps GET /teams/{id_or_name}/features/{id_or_name}.
Takes no parameters.
Example callreturns →
List add-ons attached to apps owned by a team. Paginated. Wraps GET /teams/{id_or_name}/addons.
Takes no parameters.
Example callreturns →
List add-on services a team is allowed to install. Paginated. Wraps GET /teams/{id_or_name}/allowed-addon-services.
Takes no parameters.
Example callreturns →
Return team preferences. Wraps GET /teams/{id_or_name}/preferences.
Takes no parameters.
Example callreturns →
List Private Spaces owned by a team. Paginated. Wraps GET /teams/{id_or_name}/spaces. Returns an empty list (or 403) when the team has no spaces — spaces are an enterprise feature.
Takes no parameters.
Example callreturns →
Return a team
Takes no parameters.
Example callreturns →
Freeyour plan
$0 forever
- Every tool, no call limit
- No card, no account needed
- Source published under a licence you can read
- Runs on your machine — nothing of it reaches our gateway
- Nothing to cap, because nothing bills
What counts against your monthly calls
| Tool | Unit | Calls used | Out of the allowance |
|---|
Nothing here is billable. Key Value costs nothing to install and nothing to call, at any volume.
Call allowance · this installenforced at the gateway
Monthly allowance, in calls
—
—
Alert at 80% · then the tool returns a normal MCP error
Used this month: $8.42
$16.58 left
ATrust score 99 / 100
Release 1.0.1 · scanned 25 Aug 2026
Two independent axes, because powerful and malicious are different questions. The grade is threat only. The capability level is blast radius, and it is never a penalty on the grade — it is priced as one subtract-only term in the score, where you can see it.
Threat score100
Client score99
Findings0 threat · 0 capability
Capabilityminimal
Coveragesource
Verificationrepo
Surface digestcdc08472c21b221a5b2f7233ce2dc31542e9f0304b90080f086d6397062e4b7c
Score vectorthreat 100 → client 99
| Term | Level | What it prices | Points |
|---|---|---|---|
| capability-exposure | minimal | capability blast radius (minimal) — client exposure if the model is manipulated | −0 |
| verification-discount | repo | publisher verification (public source) — no provenance, but the source is public and inspectable | −1 |
| coverage-honesty | source | inspection depth (source) — how much of the target the scan could see | −0 |
score = clamp(round(threatScore − E_cap − E_ver − E_cov), 0, 100). No model, no opinion, no network call at scoring time: the same methodology version against the same bytes always produces this number, and every line above is a field of the report rather than a summary of it.
What the scan could actually read
A grade is only as meaningful as its coverage, so the scanner publishes its own depth before it publishes its result.
Tool surfaceread
Implementation sourceread
Package metadataread
Live transportnot available
Tools were statically extracted from the published source (8 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
Capability — what it could do if the model were manipulated
Tags derived from each tool’s schema and the implementation, not from what the tool calls itself. minimal is the level these add up to.
| Tool | Capability tags | Why the tag was assigned |
|---|---|---|
| kv_maxmemory_set | no tags | |
| kv_timeout_set | no tags | |
| kv_keyspace_notifications_set | no tags | |
| kv_stats_reset | no tags | |
| kv_credentials | no tags | |
| kv_credentials_reset | no tags | |
| kv_list | no tags | |
| kv_info | no tags |
Toxic-flow graph
The lethal trifecta, checked as a graph rather than as a checklist: untrusted input, a sensitive source and an external sink have to meet before there is a path worth worrying about.
The public result for this release does not print the flow graph, so there is nothing to show here. That is not the same as "no paths were found": what the scan did read is above, under coverage.
Supply chain and provenance
Integrityfirst-seen
Surface digestcdc08472c21b221a
Scanned2026-08-25
This is the first scan of this surface here, so there is nothing yet to compare it against.
Every result on this tab comes from one deterministic pass over the published package — offline, rule by rule, and auditable line by line above. Same methodology version, same bytes, same score.
Release history
Pinned to 1.0.1 — the install command below asks for that release. A pin is part of an install, so it is kept for this visit and written down when you install.
1.0.1
undated
installedNo release note was published with this version.
—
no reviews yet
Reviews are earned
Only accounts with at least 50 real tool calls against this server in the last 90 days can post. Ratings are weighted by how much the reviewer actually uses it, and publishers can reply once per review.
Reviews are earned
Writing one takes an account with at least 50 real tool calls against Key Value in the last 90 days. That is the whole gate — there is no other way to post, which is why the counts beside each review are worth reading.
No reviews yet
Nobody has reviewed this listing. The rating on the card is the mean of the reviews written here and nothing else, so there is no rating until somebody writes the first — which takes an account with 50 real tool calls against it.