// SCAN REPORT

TunnelMind Data API

54 tools. 11 can modify or destroy data without limits.

2 destructive tools with no built-in limits. Policy required.

Last updated: 6 Jun 2026

11 can modify or destroy data

43 read-only

54 tools total

Free to start. No card required.

TOOL MAP

Read (43) Write / Execute (9) Destructive / Financial (2)

CONTEXT-WINDOW COST

18,740 tokens of tool definitions, loaded on every request

9.4% of a 200k context window

825 heaviest tool: sigil_verify_ads_txt

Full per-tool breakdown → Model it in the token calculator →

WHAT CAN GO WRONG

Destructive tools (cancel_task, revoke_api_key) permanently delete resources. There is no undo. An agent calling these in a retry loop causes irreversible damage.

Write operations (audit_export, generate_receipt, intel_agent) modify state. Without rate limits, an agent can make hundreds of changes in seconds — faster than any human can review or revert.

RECOMMENDED RULES

Deny destructive operations

{
  "cancel_task": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Blocked by default. Requires approval."
      }
    ]
  }
}

Destructive tools should never be available to autonomous agents without human approval.

Rate limit write operations

{
  "audit_export": {
    "limits": [
      {
        "counter": "audit_export_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations

{
  "check_receipt_revoked": {
    "limits": [
      {
        "counter": "check_receipt_revoked_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

ALL 54 TUNNELMIND DATA API TOOLS

DESTRUCTIVE 2 tools

Destructive cancel_task Destructive revoke_api_key

WRITE 9 tools

Write audit_export Write generate_receipt Write intel_agent Write intel_http Write intel_inject Write sigil_ads_txt_history Write sigil_atap_register_ait Write sigil_receipt_generate Write sigil_traverse

READ 43 tools

Read check_receipt_revoked Read cross_lens_lookup Read cross_lens_verify Read explain_verdict Read get_analyst_config Read get_api_key Read get_bgp_events Read get_domain Read get_entity Read get_receipt Read get_stats Read get_task Read health_check Read intel_optout Read intel_robots Read intel_stack Read list_domains Read list_entities Read preflight_should_i_act Read profile_entity Read search Read sigil_atap_ait_status Read sigil_atap_roll_block Read sigil_atap_witness Read sigil_score_batch Read sigil_score_entity Read sigil_score_weights Read sigil_verify_ads_txt Read sigil_verify_ads_txt_batch Read sigil_verify_adscert Read sigil_verify_app_bundle Read sigil_verify_domain Read sigil_verify_ip_type Read sigil_verify_supply_chain Read sigil_verify_supply_path Read sigil_verify_token Read signal_dark_pool_risk Read signal_halo_score Read signal_team_signal Read signal_tracker_density Read stream_task Read verify_receipt Read x402_echo

FAQ

Can an AI agent delete data through the TunnelMind Data API MCP server? +

Yes. The TunnelMind Data API server exposes 2 destructive tools including cancel_task, revoke_api_key. These permanently remove resources with no undo. PolicyLayer blocks destructive tools by default so they never reach the upstream server.

How do I prevent bulk modifications through TunnelMind Data API? +

The TunnelMind Data API server has 9 write tools including audit_export, generate_receipt, intel_agent. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach TunnelMind Data API.

How many tools does the TunnelMind Data API MCP server expose? +

54 tools across 3 categories: Destructive, Read, Write. 43 are read-only. 11 can modify, create, or delete data.

How do I enforce a policy on TunnelMind Data API? +

Register the TunnelMind Data API MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

// RELATED SERVERS

Other MCP servers with similar tools.

Starter policies for each. Same risk classification, live on your fleet in minutes.

Enforce policy on every TunnelMind Data API tool call.

Deterministic rules across all 54 TunnelMind Data API tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

SECURE TUNNELMIND DATA API →

Free to start. No card required.

4,600+ MCP servers and 31,000+ tools scanned and risk-classified.

TunnelMind Data API

// TOOL MAP

// CONTEXT-WINDOW COST

// WHAT CAN GO WRONG

// RECOMMENDED RULES

// ALL 54 TUNNELMIND DATA API TOOLS

// FAQ