megaloop-mcp

What changed

Changed 2026-10-09 13:28 UTC

1 description rewritten.

--- pinned/start_account_link
+++ observed/start_account_link
  {
-   "description": "Begins the browser link flow for an oauth provider and returns an authorize URL. Open it, approve, then pass what the provider hands back to complete_account_link with the returned link_session_id. What it hands back differs per provider — one shows a code on a page, another redirects to a URL that must be copied whole — so the instructions in this tool's answer come from the provider itself; relay those rather than assuming a shape. The session expires in ten minutes. This server's own key must hold manage to call this — linking decides which upstreams serve the pool — and the refusal says what to do if it cannot. POST /v1/accounts/link/start.",
+   "description": "Begins the browser link flow for an oauth provider and returns an authorize URL. Open it, approve, then pass what the provider hands back to complete_account_link with the returned link_session_id. What it hands back differs per provider — one shows a code on a page, another redirects to a URL that must be copied whole — so the instructions in this tool's answer come from the provider itself; relay those rather than assuming a shape. A provider whose list_providers entry carries `device_link` can also sign in with a CODE: pass its `mode`, and the answer holds a short code to enter on the provider's page instead — nothing is pasted back. The session expires in ten minutes. This server's own key must hold manage to call this — linking decides which upstreams serve the pool — and the refusal says what to do if it cannot. POST /v1/accounts/link/start.",
    "execution": {
      "taskSupport": "forbidden"
    },

Changed 2026-10-05 14:37 UTC

2 schema or annotation changes with the description left byte-identical, 1 tool added.

--- pinned/complete_account_link
+++ observed/complete_account_link
  {
    "description": "Exchanges what the human pasted from the browser for a linked account, using the link_session_id from start_account_link. Pass it verbatim — for some providers that is a code, for others the whole redirect URL, and the provider parses either. A mistyped value is rejected without spending the session — retry until it expires. Needs a key holding manage, the same as start_account_link. POST /v1/accounts/link/complete.",
    "execution": {
+       },
+       "replaces_account_id": {
+         "description": "RE-LINK instead of link: write this credential into an account that already exists, by its id. The account keeps its id, its name, its pool membership and its usage history — none of which were ever about the credential. Use it when an account's health says its sign-in expired (health.resumable is false, and Resume cannot help). The answer is 200 rather than 201, because nothing was created. Do NOT unlink and link again to achieve this: unlinking cascades the account out of every pool it is in and strands its usage history.",
+         "type": "string"
        }
      },
      "required": [

--- pinned/mint_key
+++ observed/mint_key
  {
    "description": "Creates a new sk-ml-v1- API key for your tenant. Store it where the customer keeps secrets before you go on — this result is the only place an AGENT can read it, and no later tool call returns it. The customer can show it again from the Keys page while signed in; no API key can, however powerful, so one leaked key cannot collect the rest. Never print it into a transcript or write it into a file that gets committed. Say nothing about capabilities and the new key serves inference and nothing else, which is what a client config needs. Say nothing about pool_id and the key reaches every linked account, unless this server's own key is limited to a pool, in which case the new key inherits that same pool. This server's own key must hold manage to call this at all, and may only pass on what it holds — the refusal says what to do if it cannot. POST /v1/keys.",
    "execution": {
-             "manage"
+             "manage",
+             "transcripts"
            ],
            "type": "string"
          },

+ tool added: read_transcript

Current tools

Watch this server yourself

If you run this server, put the proxy in front of it. It pins these exact fingerprints on first connect and stops the session if they move.

npx -y mcp-pin@0.2.3 -- <your megaloop-mcp command>

Or subscribe to this page's RSS feed to be told when it changes.

Badge

The badge states one fact about time and nothing else. It never claims a server is safe.

[![mcp-pin](https://mcp-pin.gautamkhosla.com/badge/8b89502c90edcb9e.svg)](https://mcp-pin.gautamkhosla.com/servers/8b89502c90edcb9e.html)