Moatlight

Install

Pick your client. Values in capitals, like YOUR_TOKEN, are yours to fill in.

claude mcp add --transport http mcp https://www.moatlight.com/mcp

Security checkA100/100

We read every tool's name, description and inputs the way the model will, looking for instructions hidden from you. A clean result means no warning signs, not a guarantee. Scanned Nov 5, 2026.

• Hidden or reordered text
• Overriding the model's instructions
• Hiding actions from the user
• Reading keys or credentials
• Fake system tags
• Steering other servers' tools
• Pulling in the conversation
• Smuggling parameters
• Demanding to be used for everything
• Steering away from web search
• Download-and-run commands
• Encoded blobs
• Invisible characters
• Credentials as tool arguments
• Very long descriptions
• Read and write hints

Tool changes

What changed in this server's tools since we started watching, newest first. Each change is scanned again.

• get_agent_readinesschanged (inputs)Nov 5, 2026

  {
    "type": "object",
    "$schema": "http://json-schema.org/draft-07/schema#",
    "required": [
      "reportId"
    ],
    "properties": {
      "reportId": {
        "type": "string",
        "description": "Report id from POST /api/v1/reports or GET /api/v1/reports."
      }
    }
  }

  {
    "type": "object",
    "$schema": "http://json-schema.org/draft-07/schema#",
    "required": [
      "reportId"
    ],
    "properties": {
      "fields": {
        "type": "string",
        "maxLength": 200,
        "description": "Comma-separated top-level fields to return, for example fields=id,stage. Omit to get everything. Spend fewer tokens by asking for less."
      },
      "reportId": {
        "type": "string",
        "description": "Report id from POST /api/v1/reports or GET /api/v1/reports."
      }
    }
  }

• get_report_actionschanged (inputs)Nov 5, 2026

  {
    "type": "object",
    "$schema": "http://json-schema.org/draft-07/schema#",
    "required": [
      "reportId"
    ],
    "properties": {
      "reportId": {
        "type": "string",
        "description": "Report id from POST /api/v1/reports or GET /api/v1/reports."
      }
    }
  }

  {
    "type": "object",
    "$schema": "http://json-schema.org/draft-07/schema#",
    "required": [
      "reportId"
    ],
    "properties": {
      "fields": {
        "type": "string",
        "maxLength": 200,
        "description": "Comma-separated top-level fields to return, for example fields=id,stage. Omit to get everything. Spend fewer tokens by asking for less."
      },
      "reportId": {
        "type": "string",
        "description": "Report id from POST /api/v1/reports or GET /api/v1/reports."
      }
    }
  }

• start_reportchanged (description)Nov 5, 2026

  Accepts the proposed business profile and buyer questions (optionally a chosen subset of 3 to 6 question ids) and starts asking the AI engines. Takes about two minutes.minutes: answers 202 Accepted with a Location header to poll untilSafe to Needs login with scope reports:write.

• get_reportchanged (inputs)Nov 5, 2026

  {
    "type": "object",
    "$schema": "http://json-schema.org/draft-07/schema#",
    "required": [
      "reportId"
    ],
    "properties": {
      "reportId": {
        "type": "string",
        "description": "Report id from POST /api/v1/reports or GET /api/v1/reports."
      }
    }
  }

  {
    "type": "object",
    "$schema": "http://json-schema.org/draft-07/schema#",
    "required": [
      "reportId"
    ],
    "properties": {
      "fields": {
        "type": "string",
        "maxLength": 200,
        "description": "Comma-separated top-level fields to return, for example fields=id,stage. Omit to get everything. Spend fewer tokens by asking for less."
      },
      "reportId": {
        "type": "string",
        "description": "Report id from POST /api/v1/reports or GET /api/v1/reports."
      }
    }
  }

• batch_get_reportsaddedNov 5, 2026

  Batch read: send a list of report ids and get each report (or its error) in one answer, instead of one call per report. Each result has its own status, so one unknown id does not fail the rest. Read-only. Needs login with scope reports:read.

• create_reportchanged (description)Nov 5, 2026

  Creates a report draft for a website and starts reading it. Free plan: one website, one report every 30 days. Returns 202 Accepted with the report;report, a job object and a Location header: poll GETthat /api/v1/reports/{reportId}URL until stage is needs_confirmation, then call the start endpoint. Needs login with scope reports:write.

• list_reportschanged (description, inputs)Nov 5, 2026

  The user's reports, newest first, eachpaged with a cursor. Each has its stage (analyzing, needs_confirmation, running, finished, failed). Needs login with scope reports:read.

  {
    "type": "object",
    "$schema": "http://json-schema.org/draft-07/schema#",
    "properties": {}
  }

  {
    "type": "object",
    "$schema": "http://json-schema.org/draft-07/schema#",
    "properties": {
      "limit": {
        "type": "integer",
        "maximum": 50,
        "minimum": 1,
        "description": "Items per page, 1 to 50. Default 20."
      },
      "cursor": {
        "type": "string",
        "maxLength": 500,
        "description": "Opaque cursor: send next_cursor from the previous page unchanged. Omit for the first page."
      }
    }
  }

• get_accountchanged (inputs)Nov 5, 2026

  {
    "type": "object",
    "$schema": "http://json-schema.org/draft-07/schema#",
    "properties": {}
  }

  {
    "type": "object",
    "$schema": "http://json-schema.org/draft-07/schema#",
    "properties": {
      "fields": {
        "type": "string",
        "maxLength": 200,
        "description": "Comma-separated top-level fields to return, for example fields=id,stage. Omit to get everything. Spend fewer tokens by asking for less."
      }
    }
  }

• get_sample_reportchanged (inputs)Nov 5, 2026

  {
    "type": "object",
    "$schema": "http://json-schema.org/draft-07/schema#",
    "properties": {}
  }

  {
    "type": "object",
    "$schema": "http://json-schema.org/draft-07/schema#",
    "properties": {
      "fields": {
        "type": "string",
        "maxLength": 200,
        "description": "Comma-separated top-level fields to return, for example fields=id,stage. Omit to get everything. Spend fewer tokens by asking for less."
      }
    }
  }

• list_faqchanged (description, inputs)Nov 5, 2026

  Every FAQ question and answer from the home page.page, paged. No login. No login needed.

  {
    "type": "object",
    "$schema": "http://json-schema.org/draft-07/schema#",
    "properties": {}
  }

  {
    "type": "object",
    "$schema": "http://json-schema.org/draft-07/schema#",
    "properties": {
      "limit": {
        "type": "integer",
        "maximum": 50,
        "minimum": 1,
        "description": "Items per page, 1 to 50. Default 20."
      },
      "cursor": {
        "type": "string",
        "maxLength": 500,
        "description": "Opaque cursor: send next_cursor from the previous page unchanged. Omit for the first page."
      }
    }
  }

• get_pricingchanged (inputs)Nov 5, 2026

  {
    "type": "object",
    "$schema": "http://json-schema.org/draft-07/schema#",
    "properties": {}
  }

  {
    "type": "object",
    "$schema": "http://json-schema.org/draft-07/schema#",
    "properties": {
      "fields": {
        "type": "string",
        "maxLength": 200,
        "description": "Comma-separated top-level fields to return, for example fields=id,stage. Omit to get everything. Spend fewer tokens by asking for less."
      }
    }
  }

• get_productchanged (inputs)Nov 5, 2026

  {
    "type": "object",
    "$schema": "http://json-schema.org/draft-07/schema#",
    "properties": {}
  }

  {
    "type": "object",
    "$schema": "http://json-schema.org/draft-07/schema#",
    "properties": {
      "fields": {
        "type": "string",
        "maxLength": 200,
        "description": "Comma-separated top-level fields to return, for example fields=id,stage. Omit to get everything. Spend fewer tokens by asking for less."
      }
    }
  }