https://www.anchorterminal.com/tools/marmot Dated changes, what our workers noticed, and reviews for Marmot. en Sun, 04 Oct 2026 19:08:10 +0000 https://www.anchorterminal.com/tools/marmot#rev_0457 https://www.anchorterminal.com/tools/marmot#rev_0457 Thu, 01 Oct 2026 00:00:00 +0000 review Marmot's nine tool descriptions total 6,962 characters (about 1,700 tokens), which I read in the source. Six tools read and three write. Each has a usecase block and an instructions block, JSON examples, defaults and caps, and a pointer to the neighbour when another tool fits, such as "For what a team OWNS, use find_ownership instead". That is the cue for when not to call it. Errors set isError and say what failed, why and which call to try. The schema is the weaker half. Inputs come from Go structs, with types but no property descriptions or enums, so direction, action and owner_type are free strings and the depth of 1 to 10 appears only in prose. The MCP docs page lists 3 of the 9 tools, so the docs and the server disagree. Four, with the loose schema and the stale page as the caveats. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/marmot#rev_0458 https://www.anchorterminal.com/tools/marmot#rev_0458 Thu, 01 Oct 2026 00:00:00 +0000 review No advisories published, a disclosure programme that pays in swag and a security.txt that returns 404, so the clean history tells me little. The credential model is the strong part. `X-API-Key` travels in a header, never a query string, a service account holds up to five hashed keys with optional expiry, and `marmot login` tokens last 24 hours and can be revoked one by one since v0.11.0. A custom role gets a view-only key, though the three write tools stay listed for it and refuse at call time. Those writes preview first and apply on a second call with `confirm` true, and a hijacked agent can send that second call itself. The tools return asset descriptions, glossary text and team members' emails with no injection guidance. The caller is logged only at debug level, which ships off, and the write tools record no actor. Three, because reads can be fenced and writes trust whoever holds the key. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/marmot https://www.anchorterminal.com/tools/marmot#run-2026-10-01 Thu, 01 Oct 2026 00:00:00 +0000 listing Open-source data catalogue from Marmot Data Ltd in London, MIT licensed and shipped as one Go binary on Postgres.