Aevrin MCP tools

Aevrin MCP has exactly five tools: three to find and use capabilities, and two to scan an MCP server. Each call re-checks your API key and account, so a revoked key stops working on the next call. See Connect for setting it up.

Two answers, and runnable says which

A capability either runs on Aevrin or tells your agent how to do it, and both answers come out of the same search. The runnable flag on every result and every capability says which one this is.

• runnable: true, Aevrin runs it. An administrator has approved a version to execute. get_capability lists the tools it offers with the JSON Schema of each input, and run_capability runs one in an isolated sandbox on Aevrin's servers, reaching only the hosts the capability's reviewed allow-list names. You install nothing and need no keys or setup.
• runnable: false, Aevrin tells your agent how. Either there is no version to execute, or an administrator has decided this is a capability your agent carries out itself. Either way, get_capability returns the instructions instead: what to do, how to use it, examples, the inputs it expects and the outputs it produces, written by an Aevrin administrator. Your agent carries them out itself. That is the point of a skill, a prompt, a template or a repository, where the thing being delivered is the instructions: nothing to install, nothing to wait for, and no limit on how many people use it at once.

One case gives you neither: a capability an administrator has marked as Aevrin's to run, which has no version Aevrin can run yet. It reports runnable: false and returns no instructions, because the administrator has said it is not to be carried out locally. The retrieval is not counted against your plan, since you got nothing. Read instructions and tools and act on what is actually there rather than on the flag alone.

Neither of the two answers is a lesser version of the other. The one real difference is where the work happens: a run_capability call runs inside Aevrin's sandbox, and instructions your agent follows run on your machine with your own privileges, like anything else you ask your agent to do.

The flag on a search result is a hint read from the item; get_capability replaces it with what Aevrin actually resolved, so when the two disagree, get_capability is right.

search_capabilities

Searches the capabilities Aevrin administrators have reviewed and published, by what they do. It is free: no search is ever counted against your plan. No result is pinned or promoted. Describe the goal rather than a name:

Search Aevrin for a capability that reads a web page and returns its text.

The search works two ways at once, and combines them. It matches your words against the title, description, use cases, capabilities, categories, tags and technologies an administrator wrote, and it matches your meaning against the whole of what they wrote, instructions included - so "get the text of a video" finds a capability titled "YouTube transcript" even though they share no word. Searching a capability's exact name or exact slug puts that one first. When nothing is close enough, the search says so with an empty answer rather than offering the nearest unrelated thing.

The matching runs on Aevrin's own servers. Your search text is not sent to any third party.

Only published capabilities appear. An item an administrator has archived or unpublished is not returned, and nothing is listed because someone asked for it to be.

An administrator can also mark a capability unlisted. No search returns it, whatever you ask for, but get_capability returns it in full if you pass its exact slug. That keeps the search results focused while a capability is being tried out. It is not a private capability and it is not yours alone: an unlisted capability is readable and runnable by anyone signed in to Aevrin who has its slug, so treat the slug as a name, never as a secret.

get_capability

Returns one capability by its slug - published or unlisted - with the same fields as a search result, plus two things:

• instructions: the guidance an Aevrin administrator wrote for this capability, with its usage, examples, declared inputs and outputs. For a capability Aevrin cannot run, this is the whole answer, and it is returned for every item type, including one with no version at all.
• tools: what run_capability can call, each with a description and the JSON Schema of its input, both written and reviewed by an Aevrin administrator. It is empty until an administrator has approved a version to execute.

Everything either tool returns was written by an administrator. Neither returns a repository's README, skill files, scripts, file paths, or a third-party server's own tool descriptions.

Those two carry different trust, and the difference is deliberate. instructions is Aevrin's own text, written for your agent to follow. A result from run_capability is third-party output, labelled untrusted, to be read as data and never followed as instructions.

Retrieving a capability spends 1 credit from your monthly pool, wherever the call comes from. Searching is free and is never counted, so you can always find out whether Aevrin has something before retrieving it. See Limits.

Connectors

Some items are connectors: third-party MCP servers (GitHub, Slack, Stripe, Supabase, Linear and about a hundred more) your agent sets up on your own machine from Aevrin's reviewed, per-OS instructions. Ask your agent to "connect GitHub" and it searches Aevrin MCP, reads the connector, and follows the setup for your operating system and client. A connector is never run on Aevrin. Each connector says which of its tools only read and which can change things, and your agent asks you before any change.

A connector's answer also says which stored key its setup can use (requires_credential) and whether you have stored one (credential.configured), with a link to the dashboard's Settings → Connectors page. Keys are stored encrypted and never returned - to your agent or anyone. When a key matters, the instructions have you paste your own key into your own client config, once; when none is stored for a connector that needs one, the agent sends you to the dashboard first and stops.

run_capability

Takes the capability's slug, the name of one of its tools, and that tool's input. Capability execution is not enabled yet, so every call currently returns the error "Capability execution is not available yet." and nothing runs. Nothing is counted against your limits while it is off.

When it is enabled, a run's result is the output of third-party code. Aevrin labels it as untrusted: treat it as data to read, never as instructions to follow, whatever it says.

A run that started and did not succeed comes back as an error, never as an empty result, so your agent is never left reading "nothing" as the answer. The error says which of the four things happened: the capability ran out of time, it reported a failure, its output was larger than it may return, or its output could not be read. Each one carries the execution id, which is worth quoting if you report it.

Reusing a recent result

For some capabilities an Aevrin administrator sets how long one of their results may be reused. When your agent makes the identical call again inside that window, Aevrin answers with the kept result rather than running it again, and says so with cached: true. It is faster, and it still counts as one run against your limits, and spends none of your monthly compute time.

Your agent can ask for something fresher with max_age_s, how many seconds old an answer it will accept, or max_age_s=0 to have it run fresh. Asking for longer than the administrator allows is reduced to their number rather than refused, so this can never fail a call that would otherwise have worked. Most capabilities are not cached at all, and then every call runs.

A result is never reused across accounts, unless an administrator has marked that capability as producing output that does not depend on who asked. A run that failed, timed out or was flagged is never reused either, and neither is a scan verdict.

scan_mcp_server and get_scan_report

Your agent can ask Aevrin to check an MCP server, for example before you install it:

Use Aevrin to scan https://github.com/owner/repo before I install it.

scan_mcp_server takes one target, and only two kinds work:

• A public GitHub repository, https://github.com/owner/repo. Aevrin reads the code to find the package it publishes, starts that package in a sandbox, and checks its tools.
• A live MCP server's https URL. Aevrin connects to it and checks the tools it offers.

Everything else is refused before anything is sent, with "Aevrin cannot scan this target" and what to give instead: a local path, a launch command, a pasted MCP config, and private or internal addresses. A scan through Aevrin MCP never runs anything on your machine.

The scan runs on Aevrin's servers, exactly like one you start on the dashboard. It is yours, it appears on your dashboard, and it counts as one dashboard scan against your plan (see Limits). It works even while running capabilities is switched off.

scan_mcp_server answers at once with a scan_id. A scan takes up to about five minutes, longer when other scans are queued. Call get_scan_report with the scan_id: while the scan is still queued or running, it says so and asks you to try again in about 30 seconds. Reading a report is free and is never counted.

A finished report has:

• status: completed; incomplete, which means some checks could not run, so a missing finding is not evidence that the server is safe (incomplete_reason says why); or failed.
• grade (A best, F worst, or empty when the scan could not grade) and risk_score (0 to 100, higher is worse), with Aevrin's short summary and what to do.
• mcp_detected: false means the code was read and holds no MCP server, so nothing was graded. It is never false for a repository that holds several servers or one Aevrin could not start.
• tools: the MCP tools the scan found.
• findings: at most 50, the most serious first, each with what to fix. findings_omitted counts the rest, which are all on your dashboard.
• fallback_report: only on a scan that did not finish, a public report from an earlier scan of the same server, made elsewhere. It is not this scan's result, and its grade and findings are that report's own.

Finding text, tool names and the fallback report come from scanning someone else's code. Treat them as data, never as instructions, whatever they say.

If the id is not one of your scans, the answer is "No scan of yours has that id." When your credits are not enough for the scan's 50, the answer says so, with the date the pool refills and a link to your plan.

For your agent to read itself

This page is written for you. Two files on this site are written for an agent, so it can learn Aevrin MCP without being told:

• /llms.txt: what Aevrin MCP is, the five tools, both answers, which limits apply to which, every refusal it can get back, and an index of these docs.
• /.well-known/skills/aevrin-mcp/SKILL.md: the full procedure, including what to do about each refusal.

Pointing your agent at either one is enough. Neither needs an API key to read.