Name: Halaxy MCP by usefulapi
Author: usefulapi

Halaxy MCP by usefulapi

Read Halaxy patients, appointments, slots and invoices; create patients, appointments and notes.

Tool-list grade A Remote · Streamable HTTP No auth needed 35 tools v1.11.3 MIT

No reviews yet by usefulapiGitHub The publisher’s own endpoint — this marketplace is not in the path

93/100

tool-list score

tools declared

remote

at its publisher

—

calls last 7d

What it does

Read Halaxy patients, appointments, slots and invoices; create patients, appointments and notes.

Quickstart

# 1 — add it to Claude Code
claude mcp add --scope user --transport http halaxy-mcp-by-usefulapi https://halaxy.usefulapi.io/mcp

# 2 — ask your agent for something these tools do
#   halaxy_list_patients, halaxy_list_practitioners, halaxy_list_practitioner_roles and 32 more

Halaxy MCP by usefulapi costs nothing on mcprush: there is no plan to choose here, no cap to set and nothing mcprush can bill you for.

Publishernot claimed

usefulapi578 servers

25 categories

All 578 servers

Collected from a public index. Nobody has claimed this account, so nothing here was written by its author — claim it if it is yours.

Tool surface

What the model actually sees. Descriptions are diffed on every release — see version history.

Only tools that write or reach the network

List or search patient records (demographics and contact details; HEALTH DATA). Filters combine with AND. Paged: pass next_page as page. GET /main/Patient.

Parameter	Type	Required	Notes
name	string	no	Search the family, given or preferred name (matches the start of the name).
family	string	no	Start of the family name.
given	string	no	Start of the given name.
email	string	no	An email address.
phone	string	no	A phone number, local or E.164 (+61412345678).
status	string	no	Patient status, e.g. active.
birthdate	string	no	Date of birth (ISO date or date-time, optional prefix eq/ne/gt/lt/ge/le).
created	string	no	Created (ISO date or date-time, optional prefix eq/ne/gt/lt/ge/le).
general_practitioner	string	no	A Practitioner/PractitionerRole the patient has records with.
id	string	no	One id or several separated by commas, for example 1,2,3.
last_updated	string	no	Only records last updated at this time (ISO date or date-time, optional prefix eq/ne/gt/lt/ge/le).
sort	string	no	Sort order: _lastUpdated, name, created, -_lastUpdated, -name, -created ("-" = descending).
include	array	no	Also return related resources in "included": any of Patient:general-practitioner.
page	integer	no	Page number, 1-based (default 1). Use next_page from the previous reply.
count	integer	no	Results per page, 1-100 (default 30).

List or search practitioners and administrators of the practice group (ids look like PR-12345). Filters combine with AND. Paged: pass next_page as page. GET /main/Practitioner.

Parameter	Type	Required	Notes
name	string	no	Family, given or preferred name.
family	string	no	Family name.
given	string	no	Given name.
email	string	no	An email address.
active	boolean	no	Only active (true) or inactive (false) practitioners.
profile	string	no	hx-practitioner = staff, hx-external-practitioner = professional contacts.
id	string	no	One id or several separated by commas, for example 1,2,3.
last_updated	string	no	Only records last updated at this time (ISO date or date-time, optional prefix eq/ne/gt/lt/ge/le).
sort	string	no	Sort order: name, -name ("-" = descending).
page	integer	no	Page number, 1-based (default 1). Use next_page from the previous reply.
count	integer	no	Results per page, 1-100 (default 30).

List or search practitioner roles: a practitioner's association with one clinic location (the id used when booking and for clinical notes). Filters combine with AND. Paged: pass next_page as page. GET /main/PractitionerRole.

Parameter	Type	Required	Notes
practitioner	string	no	Practitioner id, e.g. PR-123.
organization	string	no	Organization (clinic) id.
provider_number	string	no	Provider number.
profile	string	no	Staff roles or external professional-contact roles.
id	string	no	One id or several separated by commas, for example 1,2,3.
last_updated	string	no	Only records last updated at this time (ISO date or date-time, optional prefix eq/ne/gt/lt/ge/le).
include	array	no	Also return related resources in "included": any of PractitionerRole:practitioner, PractitionerRole:organization.
page	integer	no	Page number, 1-based (default 1). Use next_page from the previous reply.
count	integer	no	Results per page, 1-100 (default 30).

List or search the practice group, its clinic locations, funders and external practices (practice group ids look like PG-12345). Filters combine with AND. Paged: pass next_page as page. GET /main/Organization.

Parameter	Type	Required	Notes
name	string	no	Organization name.
profile	string	no	Only one kind of organization.
id	string	no	One id or several separated by commas, for example 1,2,3.
last_updated	string	no	Only records last updated at this time (ISO date or date-time, optional prefix eq/ne/gt/lt/ge/le).
page	integer	no	Page number, 1-based (default 1). Use next_page from the previous reply.
count	integer	no	Results per page, 1-100 (default 30).

List or search appointments (HEALTH DATA: names the patient). Filters combine with AND. Paged: pass next_page as page. GET /main/Appointment.

Parameter	Type	Required	Notes
date	string	no	Appointment date/time (ISO date or date-time, optional prefix eq/ne/gt/lt/ge/le).
created	string	no	Created (ISO date or date-time, optional prefix eq/ne/gt/lt/ge/le).
part_status	string	no	The patient's participation status, e.g. booked, arrived, cancelled.
patient	string	no	Patient id.
practitioner	string	no	Practitioner id, e.g. PR-123.
practitioner_role	string	no	PractitionerRole id.
organization	string	no	The clinic (Organization) id including its prefix.
id	string	no	One id or several separated by commas, for example 1,2,3.
last_updated	string	no	Only records last updated at this time (ISO date or date-time, optional prefix eq/ne/gt/lt/ge/le).
sort	string	no	Sort order: date, -date ("-" = descending).
include	array	no	Also return related resources in "included": any of Appointment:patient, Appointment:practitioner-role.
include_iterate	array	no	Also return resources related to an included one (needs the matching include): any of PractitionerRole:practitioner, PractitionerRole:organization.
page	integer	no	Page number, 1-based (default 1). Use next_page from the previous reply.
count	integer	no	Results per page, 1-100 (default 30).

List or search schedules: containers of bookable time slots per practitioner. Filters combine with AND. Paged: pass next_page as page. GET /main/Schedule.

Parameter	Type	Required	Notes
active	boolean	no	Only active (true) or inactive schedules.
actor	string	no	The practitioner/role the schedule belongs to.
id	string	no	One id or several separated by commas, for example 1,2,3.
last_updated	string	no	Only records last updated at this time (ISO date or date-time, optional prefix eq/ne/gt/lt/ge/le).
include	array	no	Also return related resources in "included": any of Schedule:actor.
page	integer	no	Page number, 1-based (default 1). Use next_page from the previous reply.
count	integer	no	Results per page, 1-100 (default 30).

List or search time slots of practitioner schedules (free or busy). Filters combine with AND. Paged: pass next_page as page. GET /main/Slot.

Parameter	Type	Required	Notes
duration	string	no	Slot duration in minutes.
status	string	no	free or busy.
practitioner	string	no	Practitioner id.
organization	string	no	Organization (clinic) id.
practitioner_role	string	no	PractitionerRole id.
start	string	no	Slot start (ISO date or date-time, optional prefix eq/ne/gt/lt/ge/le).
end	string	no	Slot end (ISO date or date-time, optional prefix eq/ne/gt/lt/ge/le).
schedule	string	no	Schedule id.
id	string	no	One id or several separated by commas, for example 1,2,3.
last_updated	string	no	Only records last updated at this time (ISO date or date-time, optional prefix eq/ne/gt/lt/ge/le).
include	array	no	Also return related resources in "included": any of Slot:practitioner, Slot:organization, Slot:practitioner-role.
page	integer	no	Page number, 1-based (default 1). Use next_page from the previous reply.
count	integer	no	Results per page, 1-100 (default 30).

List or search appointment types used by the practice group, clinics and practitioners. Filters combine with AND. Paged: pass next_page as page. GET /main/HealthcareService.

Parameter	Type	Required	Notes
active	boolean	no	Only active (true) or inactive appointment types.
name	string	no	Appointment type name.
id	string	no	One id or several separated by commas, for example 1,2,3.
last_updated	string	no	Only records last updated at this time (ISO date or date-time, optional prefix eq/ne/gt/lt/ge/le).
page	integer	no	Page number, 1-based (default 1). Use next_page from the previous reply.
count	integer	no	Results per page, 1-100 (default 30).

List or search fees (ChargeItemDefinition): the services and products a practice charges for. Filters combine with AND. Paged: pass next_page as page. GET /main/ChargeItemDefinition.

Parameter	Type	Required	Notes
context_type	string	no	Fee type: 0 = appointment, 1 = item, 2 = pro-rata.
property_group_status	string	no	Fee pricing status: 1 = current, 2 = archived.
created	string	no	Created (ISO date or date-time, optional prefix eq/ne/gt/lt/ge/le).
title	string	no	Fee name.
publisher	string	no	Funder name.
code	string	no	Fee item number.
id	string	no	One id or several separated by commas, for example 1,2,3.
last_updated	string	no	Only records last updated at this time (ISO date or date-time, optional prefix eq/ne/gt/lt/ge/le).
page	integer	no	Page number, 1-based (default 1). Use next_page from the previous reply.
count	integer	no	Results per page, 1-100 (default 30).

List or search patients' health fund membership and claim details (HEALTH DATA). Filters combine with AND. Paged: pass next_page as page. GET /main/Coverage.

Parameter	Type	Required	Notes
beneficiary	string	no	The primary beneficiary (a Patient id).
subscriber	string	no	The subscriber to the policy.
payor	string	no	The funder.
coverage_organization	string	no	The coverage organization.
subscriber_id	string	no	Subscriber (membership) number.
created	string	no	Created (ISO date or date-time, optional prefix eq/ne/gt/lt/ge/le).
id	string	no	One id or several separated by commas, for example 1,2,3.
last_updated	string	no	Only records last updated at this time (ISO date or date-time, optional prefix eq/ne/gt/lt/ge/le).
sort	string	no	Sort order: _lastUpdated, created, -_lastUpdated, -created ("-" = descending).
include	array	no	Also return related resources in "included": any of Coverage:beneficiary, Coverage:subscriber, Coverage:payor.
page	integer	no	Page number, 1-based (default 1). Use next_page from the previous reply.
count	integer	no	Results per page, 1-100 (default 30).

List or search invoices of the practice group. Filters combine with AND. Paged: pass next_page as page. GET /main/Invoice.

Parameter	Type	Required	Notes
created	string	no	Created (ISO date or date-time, optional prefix eq/ne/gt/lt/ge/le).
recipient	string	no	The invoice recipient (a Patient or Organization id).
practitioner	string	no	Practitioner id.
practitioner_role	string	no	PractitionerRole id.
organization	string	no	The clinic the invoice was created at.
status	string	no	Invoice status.
total_paid	string	no	Total paid amount, optionally with a prefix such as gt0.
total_balance	string	no	Balance owing, optionally with a prefix such as gt0 (finds unpaid invoices).
id	string	no	One id or several separated by commas, for example 1,2,3.
last_updated	string	no	Only records last updated at this time (ISO date or date-time, optional prefix eq/ne/gt/lt/ge/le).
include	array	no	Also return related resources in "included": any of Invoice:recipient, Invoice:practitioner.
include_iterate	array	no	Also return resources related to an included one (needs the matching include): any of PractitionerRole:practitioner, PractitionerRole:organization.
page	integer	no	Page number, 1-based (default 1). Use next_page from the previous reply.
count	integer	no	Results per page, 1-100 (default 30).

List or search invoice lines: single fees on invoices. Filters combine with AND. Paged: pass next_page as page. GET /main/InvoiceLine.

Parameter	Type	Required	Notes
created	string	no	Created (ISO date or date-time, optional prefix eq/ne/gt/lt/ge/le).
subject	string	no	The patient the line is for.
performer	string	no	The performer of the service.
invoice	string	no	The invoice the line belongs to.
funder	string	no	The funder.
referral	string	no	The referral.
coverage	string	no	The coverage (claim details).
amount	string	no	The line amount, optionally with a prefix such as gt100.
id	string	no	One id or several separated by commas, for example 1,2,3.
last_updated	string	no	Only records last updated at this time (ISO date or date-time, optional prefix eq/ne/gt/lt/ge/le).
include	array	no	Also return related resources in "included": any of InvoiceLine:subject, InvoiceLine:performer, InvoiceLine:invoice.
page	integer	no	Page number, 1-based (default 1). Use next_page from the previous reply.
count	integer	no	Results per page, 1-100 (default 30).

List or search payment transactions recorded on invoices. Filters combine with AND. Paged: pass next_page as page. GET /main/PaymentTransaction.

Parameter	Type	Required	Notes
created	string	no	Created (ISO date or date-time, optional prefix eq/ne/gt/lt/ge/le).
id	string	no	One id or several separated by commas, for example 1,2,3.
last_updated	string	no	Only records last updated at this time (ISO date or date-time, optional prefix eq/ne/gt/lt/ge/le).
page	integer	no	Page number, 1-based (default 1). Use next_page from the previous reply.
count	integer	no	Results per page, 1-100 (default 30).

List or search referrals from one healthcare provider to another (HEALTH DATA). Filters combine with AND. Paged: pass next_page as page. GET /main/Referral.

Parameter	Type	Required	Notes
subject	string	no	The patient the referral is for.
coverage	string	no	The coverage (claim details) of the referral.
created	string	no	Created (ISO date or date-time, optional prefix eq/ne/gt/lt/ge/le).
id	string	no	One id or several separated by commas, for example 1,2,3.
last_updated	string	no	Only records last updated at this time (ISO date or date-time, optional prefix eq/ne/gt/lt/ge/le).
sort	string	no	Sort order: _lastUpdated, created, -_lastUpdated, -created ("-" = descending).
include	array	no	Also return related resources in "included": any of Referral:subject, Referral:coverage.
page	integer	no	Page number, 1-based (default 1). Use next_page from the previous reply.
count	integer	no	Results per page, 1-100 (default 30).

List or search referral templates with preset properties. Filters combine with AND. Paged: pass next_page as page. GET /main/ReferralDefinition.

Parameter	Type	Required	Notes
funding_organization	string	no	The funder.
id	string	no	One id or several separated by commas, for example 1,2,3.
last_updated	string	no	Only records last updated at this time (ISO date or date-time, optional prefix eq/ne/gt/lt/ge/le).
page	integer	no	Page number, 1-based (default 1). Use next_page from the previous reply.
count	integer	no	Results per page, 1-100 (default 30).

Fetch a patient record (HEALTH DATA) by id. GET /main/Patient/{id}.

Parameter	Type	Required	Notes
id	string	yes	The Patient id (from the matching list tool).

Fetch a practitioner or administrator by id. GET /main/Practitioner/{id}.

Parameter	Type	Required	Notes
id	string	yes	The Practitioner id (from the matching list tool).

Fetch a practitioner role at a clinic location by id. GET /main/PractitionerRole/{id}.

Parameter	Type	Required	Notes
id	string	yes	The PractitionerRole id (from the matching list tool).

Fetch a practice group, clinic, funder or external practice by id. GET /main/Organization/{id}.

Parameter	Type	Required	Notes
id	string	yes	The Organization id (from the matching list tool).

Fetch an appointment with its participants and statuses (HEALTH DATA) by id. GET /main/Appointment/{id}.

Parameter	Type	Required	Notes
id	string	yes	The Appointment id (from the matching list tool).

Fetch a practitioner schedule by id. GET /main/Schedule/{id}.

Parameter	Type	Required	Notes
id	string	yes	The Schedule id (from the matching list tool).

Fetch a time slot by id. GET /main/Slot/{id}.

Parameter	Type	Required	Notes
id	string	yes	The Slot id (from the matching list tool).

Fetch an appointment type by id. GET /main/HealthcareService/{id}.

Parameter	Type	Required	Notes
id	string	yes	The HealthcareService id (from the matching list tool).

Fetch a fee (ChargeItemDefinition) by id. GET /main/ChargeItemDefinition/{id}.

Parameter	Type	Required	Notes
id	string	yes	The ChargeItemDefinition id (from the matching list tool).

Fetch a patient's coverage (claim details) record by id. GET /main/Coverage/{id}.

Parameter	Type	Required	Notes
id	string	yes	The Coverage id (from the matching list tool).

Fetch an invoice by id. GET /main/Invoice/{id}.

Parameter	Type	Required	Notes
id	string	yes	The Invoice id (from the matching list tool).

Fetch an invoice line by id. GET /main/InvoiceLine/{id}.

Parameter	Type	Required	Notes
id	string	yes	The InvoiceLine id (from the matching list tool).

Fetch a payment transaction by id. GET /main/PaymentTransaction/{id}.

Parameter	Type	Required	Notes
id	string	yes	The PaymentTransaction id (from the matching list tool).

Fetch a referral (HEALTH DATA) by id. GET /main/Referral/{id}.

Parameter	Type	Required	Notes
id	string	yes	The Referral id (from the matching list tool).

Fetch a referral template by id. GET /main/ReferralDefinition/{id}.

Parameter	Type	Required	Notes
id	string	yes	The ReferralDefinition id (from the matching list tool).

Find free appointment times between start and end for a given duration, respecting each practitioner's online booking preferences (buffer time, lead time, advance booking limit). Narrow it with practitioner, practitioner_role or organization. GET /main/Appointment/$find.

Parameter	Type	Required	Notes
start	string	yes	Start of the search window, e.g. 2027-01-12T00:00:00.
end	string	yes	End of the search window, e.g. 2027-01-12T23:59:59.
duration	integer	yes	Appointment length in minutes.
practitioner	string	no	Practitioner id.
practitioner_role	string	no	PractitionerRole id.
organization	string	no	Organization (clinic) id.
show	string	no	first-available = only the first available time.
emergency	boolean	no	true ignores lead time, to show all times for emergency appointments.
apply_buffer_time	boolean	no	true applies buffer time to show all available times.
sort	string	no	start or -start.

Writes to the live Halaxy account. Creates a new patient record (always a new one: search with halaxy_list_patients first to avoid a duplicate). Pass managing_organization (the practice group id, e.g. PG-12345, from halaxy_list_organizations) if Halaxy asks for it. POST /main/Patient.

Parameter	Type	Required	Notes
family	string	yes	Legal family name (surname).
given	string	yes	Legal given name.
preferred_name	string	no	Preferred (usual) given name.
email	string	no	Email address.
mobile	string	no	Mobile number as +{country code}{number}, no spaces.
gender	string	no	Gender as registered in government records.
birth_date	string	no	Date of birth, YYYY-MM-DD.
address	object	no	Mailing address.
managing_organization	string	no	The practice group id, e.g. PG-12345.

Writes to the live Halaxy account. Books an appointment for a patient with a practitioner at a clinic (the practitioner role). Halaxy also creates the invoice, clinical note and reminder. Use halaxy_find_available_appointments for free times. By default a double booking is refused (HTTP 409, nothing created). POST /main/Appointment/$book.

Parameter	Type	Required	Notes
patient_id	string	yes	The patient id.
practitioner_role_id	string	yes	The PractitionerRole id (practitioner at a clinic), e.g. PR-1234567.
start	string	yes	Start with the time zone offset, e.g. 2027-06-15T15:00:00+10:00.
end	string	yes	End with the time zone offset, e.g. 2027-06-15T16:00:00+10:00.
healthcare_service_id	string	no	The appointment type id (halaxy_list_healthcare_services).
charge_item_definition_id	string	no	The fee id (halaxy_list_fees) booked for the appointment.
status	string	no	Initial status (default booked).
fail_on_double_booking	boolean	no	Refuse if the practitioner already has an appointment then (default true).

Writes to the live Halaxy account. Sets the patient's status on an appointment (shown in the Halaxy calendar), for example arrived, attended, confirmed or cancelled. "cancelled (no charge)" also sets the invoice to $0. For a group appointment pass patient_id to say whose status changes. PATCH /main/Appointment/{id}.

Parameter	Type	Required	Notes
appointment_id	string	yes	The appointment id.
status	string	yes	The new status.
patient_id	string	no	The patient whose status changes (needed only when the appointment has several patients).

Writes to the live Halaxy account. Adds a clinical note to a patient's record as a DRAFT (preliminary); the practitioner reviews and publishes it in Halaxy. The author is a PractitionerRole (practitioner at a clinic). Only HTML text is supported. POST /main/DocumentReference.

Parameter	Type	Required	Notes
patient_id	string	yes	The patient the note is for.
practitioner_role_id	string	yes	The PractitionerRole id of the author, e.g. PR-1234567.
title	string	yes	The note title.
html	string	yes	The note body as HTML.

Free

$0 forever

Every tool — any call limit is its publisher’s, not ours
No card, and mcprush charges nothing for it
Runs at its publisher’s own address — this marketplace is not in the path
Nothing to cap, because mcprush bills nothing

Nothing here is billable: mcprush charges nothing to install Halaxy MCP by usefulapi or to call it, at any volume.

ATool-list grade · score 93 / 100

Release 1.11.3 · scanned 6 Nov 2026

Graded from the tools this server lists, not from its source code.

Two independent axes, because powerful and malicious are different questions. The grade is threat only. The capability level is blast radius, and it is never a penalty on the grade — it is priced as one subtract-only term in the score, where you can see it.

Threat score100

Client score93

Findings0 threat · 1 capability

Capabilitymoderate

Coveragemanifest

Verificationnot in this report

Surface digestab7de5cab85f8bceb218c62d50bcb8d3bc923ea75fc44803c809ff0db9f6216c

Score vectorthreat 100 → client 93

Term	Level	What it prices	Points
capability-exposure	moderate	capability blast radius (moderate) — client exposure if the model is manipulated	−3
coverage-honesty	manifest	inspection depth (manifest) — how much of the target the scan could see	−4

score = clamp(round(threatScore − E_cap − E_ver − E_cov), 0, 100). No model, no opinion, no network call at scoring time: the same methodology version against the same bytes always produces this number, and every line above is a field of the report rather than a summary of it.

What the scan could actually read

A grade is only as meaningful as its coverage, so the scanner publishes its own depth before it publishes its result.

The scan read each tool’s name, description, input schema and annotations exactly as the server listed them the last time it answered us; no code was reviewed. We ask the server again about once a month, and a list that changed is graded again.

Tool surfaceread

Implementation sourcenot available

Package metadatanot available

Live transportnot available

The implementation source was not read — this reflects the declared tool metadata only.

Capability — what it could do if the model were manipulated

Tags derived from each tool’s schema and the implementation, not from what the tool calls itself. moderate is the level these add up to.

Tool	Capability tags	Why the tag was assigned
halaxy_list_patients	no tags
halaxy_list_practitioners	no tags
halaxy_list_practitioner_roles	no tags
halaxy_list_organizations	no tags
halaxy_list_appointments	no tags
halaxy_list_schedules	no tags
halaxy_list_slots	no tags
halaxy_list_healthcare_services	no tags
halaxy_list_fees	no tags
halaxy_list_coverage	no tags
halaxy_list_invoices	external-sink	external-sink: parameter "recipient"
halaxy_list_invoice_lines	no tags
halaxy_list_payment_transactions	no tags
halaxy_list_referrals	no tags
halaxy_list_referral_definitions	no tags
halaxy_get_patient	untrusted-input	untrusted-input: keyword "fetch"
halaxy_get_practitioner	untrusted-input	untrusted-input: keyword "fetch"
halaxy_get_practitioner_role	untrusted-input	untrusted-input: keyword "fetch"
halaxy_get_organization	untrusted-input	untrusted-input: keyword "fetch"
halaxy_get_appointment	untrusted-input	untrusted-input: keyword "fetch"
halaxy_get_schedule	untrusted-input	untrusted-input: keyword "fetch"
halaxy_get_slot	untrusted-input	untrusted-input: keyword "fetch"
halaxy_get_healthcare_service	untrusted-input	untrusted-input: keyword "fetch"
halaxy_get_fee	untrusted-input	untrusted-input: keyword "fetch"
halaxy_get_coverage	untrusted-input	untrusted-input: keyword "fetch"
halaxy_get_invoice	untrusted-input	untrusted-input: keyword "fetch"
halaxy_get_invoice_line	untrusted-input	untrusted-input: keyword "fetch"
halaxy_get_payment_transaction	untrusted-input	untrusted-input: keyword "fetch"
halaxy_get_referral	untrusted-input	untrusted-input: keyword "fetch"
halaxy_get_referral_definition	untrusted-input	untrusted-input: keyword "fetch"
halaxy_find_available_appointments	no tags
halaxy_create_patient	state-write	state-write: declares readOnlyHint: false
halaxy_create_appointment	state-write	state-write: declares readOnlyHint: false
halaxy_update_appointment_status	state-write	state-write: declares destructiveHint: true
halaxy_create_clinical_note	state-write	state-write: declares readOnlyHint: false

Toxic-flow graph

The lethal trifecta, checked as a graph rather than as a checklist: untrusted input, a sensitive source and an external sink have to meet before there is a path worth worrying about.

flow-1

Untrusted input can drive an external action even though no sensitive source is exposed.

Supply chain and provenance

Integrityfirst-seen

Surface digestab7de5cab85f8bce

Scanned2026-11-06

This is the first scan of this surface here, so there is nothing yet to compare it against.

Every result on this tab comes from one deterministic pass over the published package — offline, rule by rule, and auditable line by line above. Same methodology version, same bytes, same score.

Where are you running it?

Tool surface

Release history

Halaxy MCP by usefulapi

What it does

Quickstart

Where are you running it?

Tool surface

What counts against your monthly calls

What the scan could actually read

Capability — what it could do if the model were manipulated

Toxic-flow graph

Supply chain and provenance

Release history

See also