Home / MCP registry index / co.ainumbers/tools
AINumbers Fintech Intelligence Suite
co.ainumbers/tools in the official MCP registry.
Endpoint https://mcp.ainumbers.co/mcp. Source: github.com/PostOakLabs/ainumbers-mcp-apps.
The registry describes it as: 746 MCP tools across 1209 fintech tools: ChainGraph AP2 decisions, execution_hash. Zero PII.
We read its 74 tools on 2026-10-22. Nothing in them matched our tool-poisoning rules. It also sets server instructions, text a client puts in front of the model on connect; those were read too.
A clean read means these rules found nothing, not that the server is harmless. A server can change its tools at any time, which is why the index reads it again every week.
Tools it advertises
list_ainumbers_tools build_workflow_links verify_execution_hash build_chaingraph emit_chaingraph_artifact build_session_receipt find_tool find_chain run_chain suite_howto describe_tool run_chain_batch call_tool baas_provider_comparator validate_ap2_mcp_policy build_google_ap2_mandate score_mcp_readiness agentic_mandate_sandbox customer_risk_rating ap2_aml_mandate_builder lint_mcp_tool_definition validate_mcp_server_json compare_agentic_payment_protocols decode_x402_payment audit_mcp_oauth scan_tool_poisoning validate_a2a_agent_card inspect_visa_tap_signature run_kernel_vm validate_input_attestations validate_private_inputs build_disclosure_manifest verify_disclosure_inclusion suggest_tool_idea export_artifact vc_issue sdjwt_issue sdjwt_present checklist_validate_definition checklist_step_receipt checklist_verify_run ha_record_validate ha_gate_status ha_bundle_export intoto_record_chain_run build_evidence_pack anchor_stamp otlp_validate otlp_span_receipt redline_diff redline_verify lei_kyb_check acdc_said_check workbook_evaluate workbook_range_digest workbook_csv_parse workbook_roundtrip_verify pain001_validate camt053_parse recon_match and 14 more
Run this server? Show the check in your README
The badge reflects the latest weekly read: 
[](https://lazaretto.dev/mcp-registry/co-ainumbers-tools)How this was checked
Lazaretto connects to the endpoint the way any MCP client does, asks the server to introduce itself and list its tools, and reads every name, description, parameter schema and server instruction for tool poisoning: hidden directive blocks, orders to read local secrets, parameters built to carry secrets or the conversation out, orders that redirect another server's tools, and invisible characters. It never calls a tool. What we found across the registry.
To run the same check every time Claude Code adds a server, install the free lazaretto-guard plugin. Browse every server in the index.