// SCAN REPORT

IIITH Mess MCP

45 tools. 16 can modify or destroy data without limits.

4 destructive tools with no built-in limits. Policy required.

Last updated: 12 Jun 2026

16 can modify or destroy data

29 read-only

45 tools total

Community server · catalogue entry verified 12/06/2026

How to control IIITH Mess MCP ↓

TOOL MAP

What IIITH Mess MCP exposes to your agents

Read (29) Write / Execute (12) Destructive / Financial (4)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS

Critical Risk

The most dangerous IIITH Mess MCP tools

Destructive · High mess_cancel_registration The tool name strongly suggests it cancels (irreversibly removes) a meal registration. Destructive · High mess_delete_auth_key Deleting an auth key is a destructive, irreversible action. Destructive · High mess_delete_extra_registration This tool performs an irreversible deletion of a registration record. Destructive · High mess_delete_monthly_registration The tool performs an irreversible deletion of a monthly registration record.

16 of IIITH Mess MCP's 45 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control IIITH Mess MCP

PolicyLayer is an MCP gateway — it sits between your AI agents and IIITH Mess MCP, and nothing reaches the server without passing your rules. These are the rules we recommend:

Deny destructive operations

{
  "mess_cancel_registration": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Blocked by default. Requires approval."
      }
    ]
  }
}

Destructive tools should never be available to autonomous agents without human approval.

Rate limit write operations

{
  "mess_reset_qr_token": {
    "limits": [
      {
        "counter": "mess_reset_qr_token_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations

{
  "mess_get_all_bills": {
    "limits": [
      {
        "counter": "mess_get_all_bills_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

Create a free account and register IIITH Mess MCP — nothing to install.
Add these rules — paste them, or build them visually. Tune the limits to your setup.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

ENFORCE POLICY ON IIITH MESS →

Free to start. No card required.

FULL CATALOGUE

All 45 IIITH Mess MCP tools

DESTRUCTIVE 4 tools

Destructive mess_cancel_registration mess_cancel_registration Destructive mess_delete_auth_key Delete an auth key by its name (not its value). Identified by name in the URL path. Destructive mess_delete_extra_registration Delete an extra registration by its ID (passed as query param). Destructive mess_delete_monthly_registration Delete a monthly mess registration (individual meal registrations are kept).

EXECUTE 1 tools

Execute mess_login_msit Login as an MSIT student or intern using email + password.

WRITE 11 tools

Write mess_reset_qr_token Reset the user's QR code token (shown at the mess counter). Write mess_provide_feedback Submit anonymous feedback for a meal. User must have availed the meal. Write mess_skip_meal Mark a registration as skipped or unskipped. Write mess_uncancel_registration Restore a previously cancelled meal registration. Write mess_complete_password_reset Complete password reset with OTP + new password. Write mess_create_auth_key mess_create_auth_key Write mess_create_extra_registration mess_create_extra_registration Write mess_create_monthly_registration Register at a mess for an entire month. Write mess_create_registration mess_create_registration Write mess_generate_reset_password_otp Send a password reset OTP to the given email. Only for MSIT/intern accounts. Write mess_update_preferences mess_update_preferences

READ 29 tools

Read mess_get_all_bills mess_get_all_bills Read mess_get_all_windows Get all window times in seconds: cancellation, registration, feedback, extras, skip. Read mess_get_auth_key_info Get info about the auth key currently in use (passed in Authorization header). Read mess_get_auth_keys Get all auth keys for the current user (including expired ones). Read mess_get_bill mess_get_bill Read mess_get_cancellation_window Get the cancellation window time in seconds. Read mess_get_cancellations_count Get count of cancelled registrations for a meal in a month. Read mess_get_capacities Get mess capacities for a meal on a date, grouped by category. Read mess_get_extras_in_range Get all extra registrations in a date range (max 2 months, both inclusive). Read mess_get_extras_window Get the extra registration window time in seconds. Read mess_get_feedback_window Get the feedback window time in seconds (time after a meal to submit feedback). Read mess_get_info Get info about all messes (name, short_name, color, tags, rating, billing_id). No auth required. Read mess_get_max_cancellations Get the maximum free cancellations allowed per month for a meal. Read mess_get_me Get the currently logged-in user's profile. Read mess_get_meal_rating mess_get_meal_rating Read mess_get_meal_timings Get meal timings (start/end times) for each mess on a date. Read mess_get_menus mess_get_menus Read mess_get_monthly_registration Get the monthly mess registration for the current user. Read mess_get_preferences Get all user preferences. Read mess_get_rates Get mess rates (in paise) for a meal on a date, grouped by category. Read mess_get_registered_extras Get extra item registrations for the current user for a meal on a date. Read mess_get_registration mess_get_registration Read mess_get_registration_max_date Get the maximum future date allowed for meal registration. Read mess_get_registration_window Get the registration window time in seconds. Read mess_get_registrations mess_get_registrations Read mess_get_scans_count Get meal availment (scan) count for a mess on a date. No authentication required. Read mess_get_skip_window Get the skip window time in seconds. Read mess_list_extras mess_list_extras Read mess_cas_login_info Get instructions for IIIT student CAS login (browser-only, cannot be called via API/AJAX).

EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

FAQ

Questions about IIITH Mess MCP

Can an AI agent delete data through the IIITH Mess MCP server? +

Yes. The IIITH Mess MCP server exposes 4 destructive tools including mess_cancel_registration, mess_delete_auth_key, mess_delete_extra_registration. These permanently remove resources with no undo. PolicyLayer blocks destructive tools by default so they never reach the upstream server.

How do I prevent bulk modifications through IIITH Mess MCP? +

The IIITH Mess MCP server has 11 write tools including mess_reset_qr_token, mess_provide_feedback, mess_skip_meal. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach IIITH Mess MCP.

How many tools does the IIITH Mess MCP server expose? +

45 tools across 3 categories: Destructive, Read, Write. 29 are read-only. 16 can modify, create, or delete data.

How do I enforce a policy on IIITH Mess MCP? +

Register the IIITH Mess MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every IIITH Mess MCP tool call.

Deterministic rules across all 45 IIITH Mess MCP tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON IIITH MESS →

Free to start. No card required.

45 IIITH Mess MCP tools catalogued and risk-classified — across an index of 43,000+ MCP servers.