Skip to content

Fordeal

ai.fordeal/price-hunterfordeal.aistreamable-httpv1.0.0Scanned

Price comparison for CZ/SK: product prices, shops, digital plans via Streamable HTTP.

55 tools: 10 can delete or cancel things, 2 do something that can't be undone, 24 change things and 19 only read.

Tools: 10 delete, 2 irreversible, 24 write, 19 read.
  • Reads private data · 9
  • Reads text others write · 14
  • Can send data out · 2
  • 3 findings

Anlyon alternative

36 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

55 tools

Deletes or cancels 10Claude Code: deny
  • cancel_energy_watchDeletes the watch behind a token from any watcher e-mail (confirmation or alert).No findings

    Why it is in this group

    • The name "cancel_energy_watch" says "cancel": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Deletes the watch behind a token from any watcher e-mail (confirmation or alert). The row is gone at once; the token stops working.

    Annotations the server declares

    • title: Cancel a fixation-end watch (deletes it)
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • delete_comparisonDeletes one of the signed-in person's saved comparisons; its share link stops working.No findings

    Why it is in this group

    • The name "delete_comparison" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Deletes one of the signed-in person's saved comparisons; its share link stops working.

    Annotations the server declares

    • title: Delete a saved comparison
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • delete_listDeletes one of the signed-in person's lists with its products; its share link stops working.No findings

    Why it is in this group

    • The name "delete_list" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Deletes one of the signed-in person's lists with its products; its share link stops working. Another id answers not_found.

    Annotations the server declares

    • title: Delete a named list
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • delete_price_watchDeletes one of the signed-in person's watches; no more mails for it.No findings

    Why it is in this group

    • The name "delete_price_watch" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Deletes one of the signed-in person's watches; no more mails for it. Only the token's own watches; another id answers not_found.

    Annotations the server declares

    • title: Cancel a price watch
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • remove_favoriteRemoves a product or a digital plan from the signed-in person's favourites.No findings

    Why it is in this group

    • The name "remove_favorite" says "remove": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Removes a product or a digital plan from the signed-in person's favourites. `removed: false` when it was not there.

    Annotations the server declares

    • title: Remove a favourite
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • remove_from_listRemoves a product from one of the signed-in person's lists; `removed: false` when it was not there.No findings

    Why it is in this group

    • The name "remove_from_list" says "remove": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Removes a product from one of the signed-in person's lists; `removed: false` when it was not there. Another person's list answers not_found.

    Annotations the server declares

    • title: Remove a product from a named list
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • set_price_watchCreates (or resets) the signed-in person's watch of one product (one per product).No findings

    Why it is in this group

    • The name "set_price_watch" says "set": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Creates (or resets) the signed-in person's watch of one product (one per product). Fordeal mails the person when the recommended total for `deliver_to_country` (goods + shipping, same meaning as on the website) falls under `target_total`, never twice for one price and at most once a day. Without `target_total` the target is today's total: the mail comes when the price really drops (by the currency's step, e.g. 50 CZK). Today's total is stored as saved_total. Needs the person's access token. Answers the watch as list_my_price_watches shows it.

    Annotations the server declares

    • title: Watch the total price of a product
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • share_comparison`shared: true` makes a read-only link (a new random token; an older link stops working); `shared: false` removes the link.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    `shared: true` makes a read-only link (a new random token; an older link stops working); `shared: false` removes the link. The link shows the plans at today's prices and the name, never the owner.

    Annotations the server declares

    • title: Share or stop sharing a saved comparison
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • update_listChanges one of the signed-in person's lists: `name` renames it; `shared: true` makes a read-only link (a new random token, an older link stops working), `shared: false` removes the…No findings

    Why it is in this group

    • The name "update_list" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Changes one of the signed-in person's lists: `name` renames it; `shared: true` makes a read-only link (a new random token, an older link stops working), `shared: false` removes the link. The link shows the list's name and products at today's prices, never the owner, the notes or the saved prices. Another id answers not_found.

    Annotations the server declares

    • title: Rename, share or stop sharing a named list
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • update_price_watchChanges one of the signed-in person's watches: `paused: true` stops the mails until `paused: false`; `target_total` sets a new limit (null = any real drop under the saved total).No findings

    Why it is in this group

    • The name "update_price_watch" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Changes one of the signed-in person's watches: `paused: true` stops the mails until `paused: false`; `target_total` sets a new limit (null = any real drop under the saved total). Only the token's own watches; another id answers not_found.

    Annotations the server declares

    • title: Pause, resume or change the target of a price watch
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
Can't be undone 2Claude Code: ask
  • send_contact_messageThe /kontakt form without the website: `name`, `email` (where the answer goes), `topic` general | support | cooperation | privacy and `message` (10 to 4 000 characters).Can send data outNo findings

    Why it is in this group

    • The name "send_contact_message" says "send": a word for sending, and what is sent cannot be taken back.

    What it can reach

    • outboundThe name "send_contact_message" says "send": it sends or publishes something to other people.
    Description, as the server wrote it
    The /kontakt form without the website: `name`, `email` (where the answer goes), `topic` general | support | cooperation | privacy and `message` (10 to 4 000 characters). The message goes as one notice to hello@fordeal.ai with the sender as Reply-To; a person answers by e-mail. The sender gets no automatic e-mail (the answer here is the confirmation of receipt, with `id`). The same message twice on one day answers the same id with `duplicate: true`. A shop that wants to be compared uses register_shop; a partner, the media or a creator may use send_cooperation_inquiry for a structured request. Public, no key; five messages a minute per caller.

    Annotations the server declares

    • title: Write a message to Fordeal (the contact form)
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • send_cooperation_inquiryThe cooperation forms (docs/texty/formulare.md 2–4) without the website.Can send data outNo findings

    Why it is in this group

    • The name "send_cooperation_inquiry" says "send": a word for sending, and what is sent cannot be taken back.

    What it can reach

    • outboundThe name "send_cooperation_inquiry" says "send": it sends or publishes something to other people.
    Description, as the server wrote it
    The cooperation forms (docs/texty/formulare.md 2–4) without the website. `kind` partner (an affiliate network, a feed provider or a technical integration: organization, website, markets as ISO codes, cooperation_type affiliate | feed | integration | other, message = the offer and its terms), media (name, organization = the newsroom, message = the topic or the information needed, optional deadline YYYY-MM-DD and links) or creator (name or channel, website = the main channel, topic = the content's topic and audience, message = the idea, optional links: other channels, media kit). A shop that wants to be compared uses register_shop instead. A person reads every message; the sender gets a confirmation of receipt (not an approval) and the operator one notice. The same message twice within a day answers the first id with duplicate true. Public, no key; five messages a minute per caller. 503 not_available until migration 0065 is applied.

    Annotations the server declares

    • title: Write to Fordeal about cooperation (partners, media, creators)
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
Changes things 24Claude Code: ask
  • add_to_listAdds a product (by slug) to one of the signed-in person's lists with an optional private note; the product's total for `deliver_to_country` today is kept as saved_total (for "the p…No findings

    Why it is in this group

    • The name "add_to_list" says "add": a word for a change.
    Description, as the server wrote it
    Adds a product (by slug) to one of the signed-in person's lists with an optional private note; the product's total for `deliver_to_country` today is kept as saved_total (for "the price changed since you saved it"). Adding it again only changes the note. At most 200 products per list. Another person's list answers not_found.

    Annotations the server declares

    • title: Add a product to a named list
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • api_price_breakdownWhat a month of AI API use costs per bill item for every model we compare (or one provider / chosen models): fresh input, input read from the cache, input written into the cache, o…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    What a month of AI API use costs per bill item for every model we compare (or one provider / chosen models): fresh input, input read from the cache, input written into the cache, output, and the total, per request and per month in the price list's currency (USD) and in the buyer's currency by the Czech National Bank rate (fx_date), each item's whole-percent share, every other item the price list names (batch discount and whether it applied, the dearer long-prompt band and whether the request is in it, the context window, cache_write_not_stated when the price list names no write price and writes were billed as ordinary input), what is included, and the official source_url with verified_on. Default scenario: 1 000 requests a month, 1 500 input and 600 output tokens each, 40 % of the input read from the cache and 10 % written; every field can be changed. Nothing is estimated beyond the stated prices.

    Annotations the server declares

    • title: Cost split of AI API models
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • cheaper_abroadProducts whose cheapest total (goods + shipping + FX to `deliver_to_country`) comes from a shop abroad and beats the cheapest domestic offer, with the saving in the deliver-to curr…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Products whose cheapest total (goods + shipping + FX to `deliver_to_country`) comes from a shop abroad and beats the cheapest domestic offer, with the saving in the deliver-to currency (`saving_kind: "estimate"`: the difference at the prices and shipping captured at `captured_at`, with `saving_basis`; present it as an estimate, never a guaranteed result). Cross-border offers carry EU warranty and returns but support may be in another language; find_best_price shows the `cross_border` block for one product.

    Annotations the server declares

    • title: Products cheaper from a shop in another country
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • check_shop_feedBefore or instead of registering: reads one product feed and answers whether Fordeal can use it.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Before or instead of registering: reads one product feed and answers whether Fordeal can use it. Give the feed's public address in `feed_url` (read through the SSRF guard: public hosts only, FordealBot, robots.txt respected, 20 s cap) or the file itself in `feed_content` (XML or CSV text, at most 8 MB) or `feed_base64` (a gzip-packed file; ZIP is refused), plus the shop's delivery `country` and, with a file, its `domain`. The answer: health ok | warn | fail, counts (items, skipped, with EAN, price, picture, availability, shipping, category), coded issues (no_items, items_skipped, feed_unreadable, price_zero, currency_mismatch, url_not_shop_host, duplicate_item_id, encoding_suspect, price_outlier, missing_ean, availability_unknown, shipping_missing, image_missing, category_missing, stale_feed) with the first affected items by the shop's own id and name, `blocking` = the error codes to fix first, `validation` = the required-field check (title, price, URL, EAN) in Czech sentences for Heureka, Zboží, Google and CSV feeds, and `preview.shown` = the first items as the comparison would show them (goods price, shipping to the country from the feed, total, stock, picture, what each lacks). Nothing is stored and nothing is mailed. A feed that cannot be read answers health fail with `read_error` {code, message, fix}. Next: register_shop with the same feed. Public; ten checks a minute per caller.

    Annotations the server declares

    • title: Check a shop's product feed and preview its offers
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • confirm_energy_watchThe double opt-in click: the confirmation token from the first watcher e-mail turns the watch on.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    The double opt-in click: the confirmation token from the first watcher e-mail turns the watch on. Only the person who received the e-mail holds the token.

    Annotations the server declares

    • title: Confirm a fixation-end watch (the person's click)
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • create_listCreates an empty private list (e.g.No findings

    Why it is in this group

    • The name "create_list" says "create": a word for a change.
    Description, as the server wrote it
    Creates an empty private list (e.g. Narozeniny, Nová kuchyň) in the signed-in person's account; add products with add_to_list. At most 50 lists per person.

    Annotations the server declares

    • title: Create a named list
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • daily_dealsDiscounts at rated shops today, biggest absolute saving first: with 30 days of our own history for the offer, the discount is measured only against its lowest price in the 30 days …No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Discounts at rated shops today, biggest absolute saving first: with 30 days of our own history for the offer, the discount is measured only against its lowest price in the 30 days before the reduction (EU Omnibus, CJEU C-330/23; discount_basis "lowest_30d", price_before = lowest_30d); until that history exists, only against the old price the shop itself states (discount_basis "shop_stated", not verified by us, at most 50 %). Never an average or other shops' prices. For one country, optionally one category of any level and a minimum percent. for one country and optionally one category slug (from the deal categories). Shops on a risk list and shops without a rating are never included. Each row carries the current price, the previous price, the drop, the shop with its trust label and the capture time. Next: find_best_price with the product name for the full comparison.

    Annotations the server declares

    • title: Biggest price drops of the last 24 hours
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • digital_price_historyEvery recorded change of a digital plan's price, newest first: plan_id, verified_on (the day it changed), from and to (price and currency), source (person = confirmed against the o…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Every recorded change of a digital plan's price, newest first: plan_id, verified_on (the day it changed), from and to (price and currency), source (person = confirmed against the official page in our review; catalog = the stored price list changed between two daily snapshots) and source_url. Recording started on tracking_since; nothing before it is known and nothing is back-filled, so an empty list means no change since tracking_since. An unchanged price renewed by the daily check is no change. Filter by plan (the id from /digital/plans).

    Annotations the server declares

    • title: Recorded price changes of digital plans
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • energy_price_historyDevelopment of household electricity and gas prices per kWh (Czechia), as published by Eurostat (semi-annual, all taxes and levies included, the most common consumption band), with…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Development of household electricity and gas prices per kWh (Czechia), as published by Eurostat (semi-annual, all taxes and levies included, the most common consumption band), with the dataset link and the day it was fetched; never interpolated. Our own price-list readings start on own_history_since and are not yet a series. Use energy_unit_prices for today's price from the current price lists.

    Annotations the server declares

    • title: Household electricity and gas prices over time
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • energy_suppliersFacts from the suppliers' official price lists (verified: false: the yearly calculation built on them is not yet checked by an independent expert; estimate_note gives the sentence …No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Facts from the suppliers' official price lists (verified: false: the yearly calculation built on them is not yet checked by an independent expert; estimate_note gives the sentence and the day of the price lists). Every household electricity and gas supplier of a country we know of (Czechia: 46), or one supplier with `id`: its official price-list page, whether we priced it (status priced | gap with the reason), its products with the prices of the official price lists (electricity: commodity price per MWh by rate and the monthly fee; gas: price and fee by consumption band; all without VAT, with source_url, valid_from and verified_on), whether each price is fixed and until when, and the bill guide (bill_guide: the customer portal and the steps to find and download the bill, from the supplier's own help page). Former suppliers (e.g. Bohemia Energy) are listed with what happened to their customers. No contract can be signed here and no link earns a commission.

    Annotations the server declares

    • title: Household energy suppliers with their products and where to find the bill
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • energy_unit_pricesAn indicative calculation, not yet checked by an independent expert (verified: false); show estimate_note with the result.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    An indicative calculation, not yet checked by an independent expert (verified: false); show estimate_note with the result. Price of one kWh with VAT for households of a country (Czechia for now), per distributor area, computed only from the energy regulator's tables and the suppliers' official price lists we read: regulated_kwh (variable regulated part: distribution of the rate, system services, renewables support, tax; the same with every supplier), supplier_kwh (commodity price: min, median, max over the priced offers), marginal_kwh (regulated + supplier: the cost of one more kWh, what an appliance costs to run) and all_in_kwh (the yearly total for `mwh` with every fixed fee spread over its kWh). Electricity for one rate (default D02d) and 2.5 MWh a year by default; gas for 9 MWh a year by default. Spot and formula prices are never counted. Use estimate_appliance_energy for an appliance's yearly cost.

    Annotations the server declares

    • title: Price of one kWh of electricity and gas
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • estimate_appliance_energyAn estimate (verified: false, estimate_note with the day of the prices).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    An estimate (verified: false, estimate_note with the day of the prices). kind fridge: label_kwh_year from the EU energy label (kWh/annum). kind washer: kwh_per_100_cycles from the EU energy label and washes_per_week (default 4). kind heating: area_m2 and heat_need_kwh_m2 (specific heat need for heating from the building's energy performance certificate; references: passive house 20, low-energy house 50 kWh/m² a year by ČSN 73 0540-2), source direct | heat_pump | gas_boiler with scop (heat pump, default 3) or efficiency (gas boiler, default 0.9). Answers kWh a year and the yearly and monthly cost at the price of one more kWh (median marginal price in the distributor area from energy_unit_prices, or price_per_kwh if given); `defaults` names every value that was assumed.

    Annotations the server declares

    • title: Yearly consumption and cost of a fridge, a washing machine or heating
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • insurance_guideAn information comparison, not a ranking (prices: false, ranking: false, score: null): Fordeal is not an insurance intermediary, sells no insurance, shows no premium and recommends…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    An information comparison, not a ranking (prices: false, ranking: false, score: null): Fordeal is not an insurance intermediary, sells no insurance, shows no premium and recommends no policy. For a country (CZ for now) it answers the kinds of insurance (motor third-party liability, comprehensive motor, home contents, property, travel, personal liability, accident, life, legal protection, health insurance for foreigners, other) with the four things to compare besides the price, and `cards`: one per insurer with the kinds its public site offers, the products in the insurer's words (products: name, kind, online), the kinds that can be concluded online on the official site (online_kinds; online_unknown_kinds = the site does not say), a nonstop assistance line, a mobile app and an online claim form, each a fact {value: true | false | null, note, source_url, checked_on} where null means the site does not state it (never a no), the IČO from the ČNB register (registry; cross_border: true for an offer without a Czech IČO), the public customer rating (source: Firmy.cz or Google Maps by its link; score, scale, count, source_url, fetched_on; only from 10 reviews, otherwise null = no rating yet), factual tags and the official website (commission: false, affiliate: false, no tracking parameters). Filters: kind, online (online for the asked kind), assistance, app, claim_online (true); filter_counts says how many insurers each option leaves. sort: name (default, alphabetical) | rating (public rating from the highest, insurers without a rating last) | kinds (number of kinds offered). compare = 2–3 insurer ids for `comparison` side by side. Tell the person to read the terms on the insurer's site; the premium and the contract are the insurer's.

    Annotations the server declares

    • title: Insurance: insurers' facts, public ratings and official websites (no prices, no ranking)
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • price_historyDaily lowest price of a product across compared shops for up to 365 days (the last point, today, is the product price the product page shows as its main price), plus every current …No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Daily lowest price of a product across compared shops for up to 365 days (the last point, today, is the product price the product page shows as its main price), plus every current offer with its capture time. `product` is the slug from find_best_price (`product.slug`) or a product id. Use it to say whether today's price is a low, and how much it moved. `price_verdict` {level low|usual|high|short_history|stale, percentile, days, basis} rates the latest price against the last 90 days of our own captured daily lows (no judgement under 14 days; never a discount claim); find_best_price carries the same object. Next: find_best_price for the current recommendation.

    Annotations the server declares

    • title: Price history of a product
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • product_rowsThe rows the website shows above the full product list (/produkty) for a buyer country, each a list of up to 12 products with the same summary fields as search_products: `deals` (t…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    The rows the website shows above the full product list (/produkty) for a buyer country, each a list of up to 12 products with the same summary fields as search_products: `deals` (today's price drops; discount against the offer's lowest price of the 30 days before the drop when 30 days of its history exist, else against the shop's own stated price; never an average), `trending` (trend = (1 + interest) × 0.5^(age_days / 14), interest = searches, product-page views and shop clicks of the last 30 days, age = days since the product entered the catalogue; 2+ shops only) and the seasonal rows of the buyer country's calendar (Black Friday, Christmas gifts by budget and for whom, Valentine's, Mother's Day, Father's Day, back to school, summer), e.g. `christmas:budget-500` or `christmas:for_her`. No product stands in two rows, one shop is behind at most 3 cards of a row, a row under 4 products is left out. `formulas` states every rule; `seasons` the active windows. `date` (YYYY-MM-DD) reads the calendar of another day with today's products. Next: get_product with a product slug for the full comparison.

    Annotations the server declares

    • title: Today's product rows: deals of the day, trending, seasonal gift tips
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • product_variantsThe variants of one product, each with a stable `id` (its product slug), `current` (true for the one asked for, always listed), storage, size, colour and `color_id`, its lowest tot…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    The variants of one product, each with a stable `id` (its product slug), `current` (true for the one asked for, always listed), storage, size, colour and `color_id`, its lowest total for `deliver_to_country` and stock. `family_id` names the set (a garment's item group, or the model line `line:<words>`), `axes` says what tells them apart. Use it to switch from a card to the exact variant the buyer asked for, then get_product with that id. A product without siblings answers itself only. Mirrors GET /api/v1/deals/products/{slug}/variants.

    Annotations the server declares

    • title: Other capacities, colours and sizes of a product
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • register_shopOne call registers a shop (P01): name, domain, delivery country, contact e-mail, the feed (its address in `feed_url`, or the file in `feed_content` / `feed_base64`), how commission…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    One call registers a shop (P01): name, domain, delivery country, contact e-mail, the feed (its address in `feed_url`, or the file in `feed_content` / `feed_base64`), how commission is paid and the accepted partner terms version. An address is read at once through the SSRF guard (public hosts only, 422 url_rejected otherwise) with a 12 s cap; a file is decoded (at most 8 MB, gzip allowed, ZIP refused: 422 upload_zip_unsupported, 413 upload_too_large) and only its sha-256 and size are kept. Either way the feed is diagnosed (P04) and the 202 answer carries `feed.health` ok | warn | fail with the top three issues; the full report is stored on the request, `feed_source` says url or upload. One open request per domain: a second call updates it and answers the same id with `duplicate: true`; a declined domain may register again. The contact gets the `shop_registration_received` mail (its language: `locale`, else the country's default) with the confirmation link and the status page; the operator gets one notice. `verification.ownership` carries the token for the meta tag or file proof (verify_shop_domain). A shop on the ČOI / SOI risk list is refused (403). A registration never lists a shop by itself: the operator decides. A shop registered with a file only is listed as still being added until it sends a feed address. Follow it with get_shop_registration. Six calls a minute per caller.

    Annotations the server declares

    • title: Register a shop for the comparison
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • report_illegal_contentA notice under Article 16 of the Digital Services Act that content on fordeal.ai is illegal (a user review, product information, an offer, an image or anything else).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    A notice under Article 16 of the Digital Services Act that content on fordeal.ai is illegal (a user review, product information, an offer, an image or anything else). Give `content_kind` review | product_info | offer | image | other, the `page_url` of the content (and the `product_slug` when it is on a product page), an `explanation` of why the content is illegal (20–4000 characters), the notifier's `name` and `email`, and `good_faith: true` confirming the notice is accurate and complete to the best of the notifier's knowledge. A person reviews every notice; the e-mail gets a confirmation of receipt at once and the decision later. For a wrong price or variant use report_issue instead. Public, no key; the anonymous rate limit applies.

    Annotations the server declares

    • title: Report illegal content (DSA Art. 16)
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • report_issueWhen an offer on a product page is wrong (the shop's page shows another price, the offer is another variant or product, the link leads to the wrong shop or page, or anything else),…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    When an offer on a product page is wrong (the shop's page shows another price, the offer is another variant or product, the link leads to the wrong shop or page, or anything else), file a report: `kind` price | variant | category | shop | other, `product_slug` (the stable product id from find_best_price or search_products), the `offer_id` of the offer (from the card's offers; optional) and a `message` saying what you saw (at most 1000 characters). An optional `email` gets the founder's answer; it is never shown. Every report goes to a queue a person reads; the same report sent twice within a day answers the first id with duplicate true. Public, no key; the anonymous rate limit applies.

    Annotations the server declares

    • title: Report a wrong price, variant or shop
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • save_comparisonSaves 2 to 4 digital plans (plan ids from compare_digital / compare_mobile) as a private comparison in the signed-in person's account.No findings

    Why it is in this group

    • The name "save_comparison" says "save": a word for a change.
    Description, as the server wrote it
    Saves 2 to 4 digital plans (plan ids from compare_digital / compare_mobile) as a private comparison in the signed-in person's account. Private: nobody else can open it until share_comparison makes a link.

    Annotations the server declares

    • title: Save a comparison of digital plans
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • save_favoriteAdds a product (kind product, `id` = slug) or a digital plan (kind digital, `id` = plan id from compare_digital or compare_mobile) to the signed-in person's favourites.No findings

    Why it is in this group

    • The name "save_favorite" says "save": a word for a change.
    Description, as the server wrote it
    Adds a product (kind product, `id` = slug) or a digital plan (kind digital, `id` = plan id from compare_digital or compare_mobile) to the signed-in person's favourites. Saving twice changes nothing.

    Annotations the server declares

    • title: Save a product or a digital plan to favourites
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • verify_shop_domainAfter register_shop: publish <meta name="fordeal-verification" content="TOKEN"> on the shop's home page, or the token as the whole content of https://DOMAIN/fordeal-verification.tx…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    After register_shop: publish <meta name="fordeal-verification" content="TOKEN"> on the shop's home page, or the token as the whole content of https://DOMAIN/fordeal-verification.txt, then call this with the domain and the token from `verification.ownership`. One request to each address with Fordeal's identified bot (www. and the bare host). The answer: ok with the method (meta | file, or already), or `error.code` not_found (no request with this domain and token) | not_verified (neither place carries the token; a CDN cache may take minutes). Proving the domain marks the request as confirmed, like the e-mail link; the operator still decides. Public.

    Annotations the server declares

    • title: Prove a shop's domain with a meta tag or a file
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • watch_energy_fixationA household gives its e-mail and the last day of its fixed electricity or gas price (fixation_end YYYY-MM-DD, today to 5 years ahead); optionally the distributor area, today's supp…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    A household gives its e-mail and the last day of its fixed electricity or gas price (fixation_end YYYY-MM-DD, today to 5 years ahead); optionally the distributor area, today's supplier (supplier_id from energy_suppliers) or product (current_offer_id from compare_energy products) and the consumption. Double opt-in: the e-mail first gets a confirmation link and nothing else is sent before the person clicks it (an agent cannot confirm for the person). A confirmed watch gets one e-mail 45 days before the end with the offers cheaper for its need (from the official price lists; an estimate). Every mail has a cancel link. Unconfirmed watches are deleted after 7 days, every watch 30 days after its end date. No account, no contract, no commission. At most 5 watches per e-mail. Ask the person for consent before passing their e-mail.

    Annotations the server declares

    • title: Watch the end of a fixed energy price (e-mail before it ends)
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
Only reads 19Show 19 read-only tools
  • compare_digitalPrices of digital services for a buyer's country, cheapest first, from the providers' official price lists (each row has source_url and verified_on) converted to the buyer's curren…Reads text others write1 finding

    Why it is in this group

    • The name "compare_digital" says "compare": a word for reading.

    What it can reach

    • untrusted-inputThe description's first sentence says "url": it reads web pages, which anyone can write.

    Findings

    • Info

      The description is 3,189 characters long, over the 2,000 this check looks for.

      Matched text

      description ends: "...resent a non-regular plan as the generic cheapest without saying who is eligible."

      What this check looks for
    Description, as the server wrote it
    Prices of digital services for a buyer's country, cheapest first, from the providers' official price lists (each row has source_url and verified_on) converted to the buyer's currency by the Czech National Bank rate (fx_date). Categories: ai-chat (ChatGPT, Claude, Gemini, Copilot, Perplexity, Grok, Mistral Vibe, GitHub Copilot, Cursor, Jasper, DeepL… subscriptions), ai-api (price per 1M input and output tokens of the main models: OpenAI, Anthropic, Google, Mistral, xAI, DeepSeek, AI21, Amazon Nova), ai-creative (Midjourney, Runway, Kling, Leonardo, Canva, Firefly, ElevenLabs, Suno… per month, per picture or second of video when stated), streaming, music, vpn, cloud, office (Microsoft 365, Google Workspace, Zoho, Notion, Slack, Zoom… personal, family and business per user; business prices usually exclude VAT), creative (Adobe Creative Cloud, Canva, Figma, CapCut, DaVinci Resolve Studio… monthly, yearly or a one-time purchase: such a row has oneTimeLocal instead of a monthly price), passwords (1Password, Bitwarden, Dashlane). `usage` turns the list into a cost of that use: for ai-api messages_per_month (+ input_tokens and output_tokens per message, default 1 500 and 600) (+ cache_share 0–1 and batch) gives usage_cost a month, usage_breakdown (input, cached input, output; whether the long-prompt band or the batch discount applied) and break_even_messages (below it the API is cheaper than the provider's cheapest paid chat plan); for ai-creative images_per_month and video_seconds_per_month. A null price means the official page did not show one; it is never guessed. Each row carries data_location from the provider's own privacy policy (controller, storedIn country codes, inChina, authoritiesClause, quote, url, checked), null when we have not read it. Where the same plan is also sold inside the app (inAppPrices: the App Store's price for the buyer's country, with VAT, verifiedOn and sourceUrl), inApp compares a month on the web (the price list's price, plus the country's VAT when the list excludes it: web.vatAdded) with a month in the app, both in the buyer's currency: cheaper (web | app | same) and difference a month; inAppYearly does the same for yearly billing. Say both prices and which is cheaper; a plan without inApp has no store price read (never assume the app costs the same). Every row carries price, the one amount to show (the same as fordeal.ai shows): price.monthly and price.yearly (12 × monthly; yearlyWhenYearly = 12 × the month paid yearly) in the buyer currency with the buyer country VAT added where the price list excludes it (price.vat: included | by_law | added | excluded | unknown, price.vatRate), price.billing, price.channel (web) and price.rateDate; rows are ranked by price.monthly. promo (an open promotion) has monthlyLocal as converted and monthlyLocalGross on the same VAT basis as price: show the gross one, then price.monthly after it, both with the VAT word of price.vat. kind says who can buy the plan: regular (anyone), student (verified students or educators), business (companies and teams) or promo (only under the offer terms); never present a non-regular plan as the generic cheapest without saying who is eligible.

    Annotations the server declares

    • title: Compare digital services by price per month
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • compare_energyAn indicative calculation, not yet checked by an independent expert (verified: false): present the result as an estimate, never as a guaranteed price; show estimate_note (the sente…Reads private data1 finding

    Why it is in this group

    • The name "compare_energy" says "compare": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "note": it reads notes.

    Findings

    • Info

      The description is 3,622 characters long, over the 2,000 this check looks for.

      Matched text

      description ends: "...nings (e.g. nt_mwh_missing for a two-tariff rate without low-tariff consumption)."

      What this check looks for
    Description, as the server wrote it
    An indicative calculation, not yet checked by an independent expert (verified: false): present the result as an estimate, never as a guaranteed price; show estimate_note (the sentence with the day of the data, in `locale` cs | sk | en) with every result. Household electricity and gas offers (Czechia for now) ranked by the yearly bill for a stated consumption in one distributor's area, with VAT. The bill is split into the regulated part (distribution, system services, renewables support, market operator, tax: set by the energy regulator for the distributor, the same with every supplier) and the supplier part (commodity price and monthly fee: what switching changes). Every offer has the supplier's official price list (source_url, verified_on, valid_from) and says whether the price is fixed (fixed_months or fixed_until) or variable. Spot and formula prices are never ranked; they are listed in not_ranked. Offers whose price list was read only for another distributor's area are left out. Electricity: distributor (cez-distribuce | egd | pre-distribuce), rate (D01d, D02d, D25d, D26d, D27d, D35d, D45d, D56d, D57d, D61d), mwh = yearly high-tariff (or all) consumption, nt_mwh = low-tariff consumption; breaker = main breaker (1x25, 3x10, 3x16, 3x20, 3x25 default, 3x32, 3x40, 3x50, 3x63; it sets the fixed monthly distribution price from the regulator's table); postcode (5 digits) instead of distributor picks the distributor area as an estimate (area.estimate = true; two candidates when the postcode spans an area boundary: then pass distributor). Every result is an estimate (result_type: estimate, guaranteed: false): the binding bill depends on the actual consumption, the distributor stated on the bill and the contract. Gas: distributor (gasnet | gas-distribution | ppd), mwh = yearly consumption up to 63 MWh; postcode instead of distributor picks the gas area the same way (estimate; two candidates around Prague or on an area boundary: then pass distributor). Call without a distributor to get the distributors, rates (rate_info: low-tariff hours a day), products and the regulated price tables. COMPARISON TEMPLATE (20 Oct 2026): every ranked offer carries the forDeal score 0–10 (score, score_parts price / conditions / rating, score_weights as used, score_missing when a part is absent), labels (cheapest = lowest total of the list; best_value = highest score), a one-sentence reason, conditions (fixation months and bucket, term indefinite | fixed_term, notice_months, termination_fee none | stated, green; null = the price list does not state it) and the supplier's public rating (source, score, scale, count, source_url, fetched_on; counted only from 10 reviews; null = we have none, and the weights are renormalised, the answer says so). Filters: fixation none | 12 | 24 | 36 (variable price, or fixed up to 1 / 2 / 3+ years), pricing fixed | variable | spot (spot = market-price products, listed without a total), green true, no_penalty true (no fee for leaving stated); filter_counts says how many offers each chip would leave. sort score (default) | price. compare = up to 3 offer ids: the answer adds comparison with the same parameters side by side. Method and weights: scoring. What the household pays today, best first: current_offer (an id from products), or its own prices current_vt_price + current_nt_price + current_fee_month (current_prices_vat), or current_monthly (the advance); each offer then carries saving_year against it and the answer states saving_basis (offer | own_prices | advance) and warnings (e.g. nt_mwh_missing for a two-tariff rate without low-tariff consumption).

    Annotations the server declares

    • title: Household electricity and gas by yearly cost
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • compare_energy_from_billAn indicative calculation (verified: false, with estimate_note like compare_energy).Reads private dataNo findings

    Why it is in this group

    • The name "compare_energy_from_bill" says "compare": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "note": it reads notes.
    Description, as the server wrote it
    An indicative calculation (verified: false, with estimate_note like compare_energy). Pass the values from the household's electricity or gas bill (as read by POST /api/v1/digital/energy/bill, by yourself from the document, or typed by a person) and get the same ranked answer as compare_energy: yearly totals of every priced offer for that distributor area, rate and breaker, with the saving against the bill's own prices (saving_basis: own_prices) or against the monthly advance. Consumption of a billed period other than a year is scaled to 365 days by period_days. Confirm the values with the person before calling; nothing is stored.

    Annotations the server declares

    • title: Household electricity or gas from the values on a bill
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • compare_internetCompare provider-level home internet summaries from docs/data/internet.json.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "compare_internet" says "compare": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "compare" and "doc": it reads documents.
    • untrusted-inputThe name "compare_internet" says "compare" and "internet": it reads web pages, which anyone can write.
    • untrusted-inputThe description's first sentence says "compare" and "internet": it reads web pages, which anyone can write.
    Description, as the server wrote it
    Compare provider-level home internet summaries from docs/data/internet.json. Filter by country, technology, advertised speed, listed monthly price, commitment duration, or provider; sort by price, indicative price per advertised Mbps, or speed. Each result includes the provider's address-availability checker and source links. This source contains summarized ranges, not individual address quotes; unknown values stay null, and availability must be confirmed with the provider.

    Annotations the server declares

    • title: Compare home internet providers
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • compare_mobileCompare the sourced CZ and SK mobile tariff records in docs/data/mobilni-tarify.json.Reads private dataNo findings

    Why it is in this group

    • The name "compare_mobile" says "compare": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "compare" and "doc": it reads documents.
    Description, as the server wrote it
    Compare the sourced CZ and SK mobile tariff records in docs/data/mobilni-tarify.json. Filter by country (required), operator, minimum data, unlimited calls, commitment, eSIM and 5G; legacy needs filters for minutes, SMS, no commitment and EU roaming also work. Sort by listed monthly price or the sourced price per GB. Every result includes its source URL, checked date and quote. Unknown values remain null and never satisfy positive filters.

    Annotations the server declares

    • title: Mobile tariffs by what you need
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • energy_watch_statusThe watch behind a token from a watcher e-mail (the `t` of the link): status pending | confirmed, the end date, the day of the alert, the e-mail masked.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "energy_watch_status" says "status": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "mail": it reads mail.
    • untrusted-inputThe description's first sentence says "mail": it reads inbound email, which other people can write.
    Description, as the server wrote it
    The watch behind a token from a watcher e-mail (the `t` of the link): status pending | confirmed, the end date, the day of the alert, the e-mail masked. Answers not_found when the watch was cancelled or deleted.

    Annotations the server declares

    • title: State of a fixation-end watch from its e-mail link
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • find_best_priceWhere to buy a product cheapest today: offers ranked by the real product price (converted to the buyer's currency with a dated rate), the shipping to the buyer's country shown as i…Reads text others write1 finding

    Why it is in this group

    • The name "find_best_price" says "find": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Info

      The description is 2,465 characters long, over the 2,000 this check looks for.

      Matched text

      description ends: "...t: price_history for the trend, or find_best_price again with verified_only=true."

      What this check looks for
    Description, as the server wrote it
    Where to buy a product cheapest today: offers ranked by the real product price (converted to the buyer's currency with a dated rate), the shipping to the buyer's country shown as its own value on every offer, and whether the shop can be trusted. `sort=total` (or include_shipping=true) orders by goods + shipping instead. `query` is free text ("washing machine under 12 000, 60 cm"), a model name, an EAN, or a product URL from any e-shop. Returns one card: `match` (exact | close: close means the nearest product is another variant than the query names, e.g. iPhone 16 Plus for "iPhone 16 256 GB"; `match_note` says how, `warnings` opens with it and `reasons` carries close_match; never present a close card as the asked-for item), verdict (buy_now | wait | buy_alternative | no_offer) with a headline and explanation in `locale`, the recommended offer `best` (shop, trust label verified | rated | unknown, rating 0-1, total.goods = the product price and total.shipping in the deliver-to currency, total.total = their sum, FX date, capture time), `cheapest_total` (the offer with the lowest total including shipping), three alternatives (cheapest domestic, cheapest cross-border, best rated), every shown offer with its blockers and `price_status` (verified = goods + stated shipping, the sum the buyer pays; estimate = the shop states only its lowest "from" shipping rate; incomplete = shipping to the country unknown or import duties open, a lower bound that is never the cheapest), a 90-day price history, and `commission_disclosure`. Every offer carries `labels` (lowest_price = the lowest product price; recommended = `best` when it is dearer than that, never call it the cheapest; lowest_verified_total = the cheapest total with a stated, not "from", shipping), `shipping_is_estimate` (a "from" or unknown shipping: the total is a lower bound) and `saving_is_estimate` (its `savings_vs_best` rests on such a shipping: say estimated, never a certain saving). Rules: a shop on a consumer-protection risk list is never shown; a shop without a rating is never `best`; an offer with unknown shipping or a price older than 36 hours is never `best`. Cross-border offers carry `cross_border` (EU warranty, returns, support languages). Send the buyer to `best.url` (Fordeal's click URL, which forwards to the shop) and tell them the product price, the shipping and the capture time. Next: price_history for the trend, or find_best_price again with verified_only=true.

    Annotations the server declares

    • title: Find the best price for a product
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • get_productThe same card as find_best_price and the website's product page /{locale}/p/{product}, for a product id you already hold (`product.slug` / `product.variant.id` from search_products…Reads text others writeNo findings

    Why it is in this group

    • The name "get_product" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe description's first sentence says "website": it reads web pages, which anyone can write.
    Description, as the server wrote it
    The same card as find_best_price and the website's product page /{locale}/p/{product}, for a product id you already hold (`product.slug` / `product.variant.id` from search_products, find_best_price or product_variants), without reading a query: no risk of landing on another variant. `product.variant` names the variant (storage, colour, model words, connectivity, size, `family_id` shared by its siblings). Answers from stored prices with the rule-based verdict; every offer carries `source_name`, `captured_at`, `blockers`, and the card `reasons` and `warnings`. An unknown id is `error.code` not_found. Next: product_variants for the other capacities or colours, price_history for the trend.

    Annotations the server declares

    • title: Today's card for a known product id
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_shop_feed_diagnosticsThe report of a compared shop's last feed read (P04): health ok | warn | fail, counts (items, with EAN, price, picture, availability, shipping, category), and coded issues (no_item…Reads text others writeNo findings

    Why it is in this group

    • The name "get_shop_feed_diagnostics" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe description's first sentence says "issue": it reads issues, which other people can write.
    Description, as the server wrote it
    The report of a compared shop's last feed read (P04): health ok | warn | fail, counts (items, with EAN, price, picture, availability, shipping, category), and coded issues (no_items, items_skipped, feed_unreadable, price_zero, currency_mismatch, url_not_shop_host, duplicate_item_id, encoding_suspect, price_outlier, missing_ean, availability_unknown, shipping_missing, image_missing, category_missing, stale_feed) each with a count, a share and the first five affected items by the shop's own item id and name. Public: no feed address, no item links (the partner's signed-in view at GET /api/v1/partner/feed-diagnostics carries the item links). `error.code` not_found when the shop is unknown or has no feed run yet. For a feed that is not compared yet use check_shop_feed.

    Annotations the server declares

    • title: Feed diagnostics of a compared shop
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_shop_registrationWhat happened to a registration (register_shop answers `id`; the id is the key, nothing else is needed): status diagnosing | received | approved | rejected | active, whether the co…Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "get_shop_registration" says "get": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "contact": it reads contacts.
    • untrusted-inputThe description's first sentence says "url": it reads web pages, which anyone can write.
    Description, as the server wrote it
    What happened to a registration (register_shop answers `id`; the id is the key, nothing else is needed): status diagnosing | received | approved | rejected | active, whether the contact confirmed, the decision with its reason and when, where the feed came from (`feed_source` url | upload, and the upload's fingerprint), the public feed report (health, summary, counts, the first issues without item links), `next` = what happens now, and the shop's page once it exists. The contact e-mail and the feed address are never returned. Older requests of the feeds-job flow answer their own statuses (pending, feed_found, …). Public.

    Annotations the server declares

    • title: Status of a shop registration
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_shop_statisticsHow many people Fordeal sent to the shop in a window of UTC days (`from`/`to` YYYY-MM-DD, both included; the last 30 days by default, at most 366): the total, every day (zero days …Reads text others writeNo findings

    Why it is in this group

    • The name "get_shop_statistics" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe description's first sentence says "web": it reads web pages, which anyone can write.
    Description, as the server wrote it
    How many people Fordeal sent to the shop in a window of UTC days (`from`/`to` YYYY-MM-DD, both included; the last 30 days by default, at most 366): the total, every day (zero days included), per delivery country and per channel (web | mcp | api | social). Only counted clicks of people from click_log: robots and the partner's test clicks are left out and reported in `excluded`; no orders or revenue are estimated (own-programme orders are in the partner portal). `truncated: true` when the window held more than 50 000 rows (the numbers are then a lower bound). Needs the signed-in person's Supabase access token and a shop of list_my_shops; another shop answers 403.

    Annotations the server declares

    • title: Clicks Fordeal sent to a shop
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_couponsCoupon codes and promotions of compared shops, valid today, from the affiliate network eHUB (refreshed every 3 hours; never from newsletters or e-mails, never a shop on a risk list…Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "list_coupons" says "list": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "mail": it reads mail.
    • untrusted-inputThe description's first sentence says "mail": it reads inbound email, which other people can write.
    Description, as the server wrote it
    Coupon codes and promotions of compared shops, valid today, from the affiliate network eHUB (refreshed every 3 hours; never from newsletters or e-mails, never a shop on a risk list). For one country (the shop's country), the soonest ending first. Each row: the shop, `type` voucher (has a `code`) | action (no code), the advertiser's `title`, `discount` read from it (percent or amount with currency; `up_to` = "up to"; null when the text states no size of the discount, never a guess), `min_order` {amount, currency} when the text names a minimum order ("nákup nad 1 000 Kč"; it is never the discount), `valid_from`, `valid_until` (a date = the whole day), `url` the network's tracked link (Fordeal earns a commission on a purchase through it; the ranking never depends on it), `image` the card photo with `image_source` "shop_product" (a product of the shop's own offers in its main `category`) or "category" (our picture of that category; null = none, show `logo_url`), and `fetched_at` of the list. Next: find_best_price with a product name to compare the shop's prices.

    Annotations the server declares

    • title: Shop coupons and promotions valid today
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_my_comparisonsComparisons the person saved (2 to 4 digital plans each), newest first, with the page address and, when the person chose to share one, its share link.No findings

    Why it is in this group

    • The name "list_my_comparisons" says "list": a word for reading.
    Description, as the server wrote it
    Comparisons the person saved (2 to 4 digital plans each), newest first, with the page address and, when the person chose to share one, its share link. Private unless `shared: true`.

    Annotations the server declares

    • title: The signed-in person's saved comparisons
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_my_favoritesProducts (kind product, by slug, with the total saved at that time) and digital plans (kind digital, by plan id) the person saved with the heart, newest first.No findings

    Why it is in this group

    • The name "list_my_favorites" says "list": a word for reading.
    Description, as the server wrote it
    Products (kind product, by slug, with the total saved at that time) and digital plans (kind digital, by plan id) the person saved with the heart, newest first. Needs the person's access token. Live prices: search_products / compare_digital.

    Annotations the server declares

    • title: The signed-in person's favourites
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_my_listsEvery named list of the person whose Supabase access token is sent (Authorization: Bearer <token>; an agent API key is refused), oldest first, each with its products (newest first,…Reads private dataNo findings

    Why it is in this group

    • The name "list_my_lists" says "list": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "note": it reads notes.
    Description, as the server wrote it
    Every named list of the person whose Supabase access token is sent (Authorization: Bearer <token>; an agent API key is refused), oldest first, each with its products (newest first, the private note and the total saved at that time), and the share link when the person chose to share it. The heart's favourites are separate: list_my_favorites. Live prices: GET /api/v1/deals/products?slugs=.

    Annotations the server declares

    • title: The signed-in person's named lists
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_my_price_watchesEvery price watch of the person whose Supabase access token is sent (Authorization: Bearer <token>; an agent API key is refused).No findings

    Why it is in this group

    • The name "list_my_price_watches" says "list": a word for reading.
    Description, as the server wrote it
    Every price watch of the person whose Supabase access token is sent (Authorization: Bearer <token>; an agent API key is refused). Each row: id, product, status (active | paused), target_total and saved_total (the total when the watch was set or of the last alert; alerts fire only below it), the delivery country and currency, last_alert_at and `current` = today's total for that country (goods + shipping, shop, captured_at; recommended: false when no offer passes the trust rules). Next: update_price_watch to pause, resume or change the target, delete_price_watch to cancel.

    Annotations the server declares

    • title: The signed-in person's price watches with today's price
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_my_shopsThe shops whose numbers the signed-in person may read: a contact of a shop in Fordeal's own affiliate programme whose partnership the operator approved and whose domain is proven (…Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "list_my_shops" says "list": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "contact": it reads contacts.
    • untrusted-inputThe description's first sentence says "mail": it reads inbound email, which other people can write.
    Description, as the server wrote it
    The shops whose numbers the signed-in person may read: a contact of a shop in Fordeal's own affiliate programme whose partnership the operator approved and whose domain is proven (`access: partner`; a pending partner sees nothing here), or the contact e-mail of a registration the operator approved (`access: registration`). Needs that person's Supabase access token (Authorization: Bearer <token>, the website holds it after the e-mail sign-in link); an agent API key is refused. Each row: slug, name, domain, country, status, access, the shop's page. Next: get_shop_statistics with a slug.

    Annotations the server declares

    • title: Shops the signed-in person looks after
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_shopsThe shops whose prices flow today for a delivery country (with their rating 0..1, rating source and trust label) and the shops still waiting for their feed.No findings

    Why it is in this group

    • The name "list_shops" says "list": a word for reading.
    Description, as the server wrote it
    The shops whose prices flow today for a delivery country (with their rating 0..1, rating source and trust label) and the shops still waiting for their feed. Use it to answer "can I trust shop X" or "do you compare shop Y".

    Annotations the server declares

    • title: Which shops are compared, with ratings
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • search_productsThe website's category and search grid for an agent: products with the product price of their shown offer (`lowest_goods`, in the `deliver_to_country` currency; its shipping `lowes…Reads text others writeNo findings

    Why it is in this group

    • The name "search_products" says "search": a word for reading.

    What it can reach

    • untrusted-inputThe description's first sentence says "website": it reads web pages, which anyone can write.
    Description, as the server wrote it
    The website's category and search grid for an agent: products with the product price of their shown offer (`lowest_goods`, in the `deliver_to_country` currency; its shipping `lowest_shipping` and the total `lowest_total` beside it, with capture time and `price_status` verified | estimate | incomplete), number of shops, best shop and trust label. Give `query` (free text, every word must match; 8 to 14 digits are an EAN, matched exactly) and/or `category` (a slug from GET /api/v1/deals/categories, e.g. letni-pneumatiky, mobilni-telefony), or neither to browse the whole catalogue (the website's /produkty page), or `slugs` (product slugs) to compare named products side by side; then any filters: price_min/price_max, brand, shops, shop_country (e.g. DE for offers from Germany), in_stock, on_sale, free_shipping, min_shop_rating, min_product_rating, attr (key:value pairs); sort price (lowest product price first, the default), price_desc, total (lowest total with shipping, opt-in; or include_shipping=true), total_desc, discount, shops, popular, rating, score, name. Answers at most `limit` products (default 20) from `offset`; `total_matches` counts every match, and `facets: true` adds the brands, shops, price range and attribute values with counts over the whole filtered list. Next: find_best_price with a product name for the full card with every offer, or price_history with `slug`.

    Annotations the server declares

    • title: Search and filter compared products
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

252 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 2 outbound tools breaks every one.

Reads text others write14
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out2
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
deny to break every path
{
  "permissions": {
    "deny": [
      "mcp__price-hunter__send_contact_message",
      "mcp__price-hunter__send_cooperation_inquiry"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

3 info
  • The description is 2,465 characters long, over the 2,000 this check looks for.

    Matched text

    description ends: "...t: price_history for the trend, or find_best_price again with verified_only=true."

    What this check looks for
  • The description is 3,622 characters long, over the 2,000 this check looks for.

    Matched text

    description ends: "...nings (e.g. nt_mwh_missing for a two-tariff rate without low-tariff consumption)."

    What this check looks for
  • The description is 3,189 characters long, over the 2,000 this check looks for.

    Matched text

    description ends: "...resent a non-regular plan as the generic cheapest without saying who is eligible."

    What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http price-hunter https://fordeal.ai/mcp
claude mcp add --transport http price-hunter https://fordeal.ai/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__price-hunter__compare_internet",
      "mcp__price-hunter__search_products",
      "mcp__price-hunter__list_shops",
      "mcp__price-hunter__find_best_price",
      "mcp__price-hunter__get_product",
      "mcp__price-hunter__list_coupons",
      "mcp__price-hunter__compare_mobile",
      "mcp__price-hunter__compare_energy",
      "mcp__price-hunter__compare_digital",
      "mcp__price-hunter__compare_energy_from_bill",
      "mcp__price-hunter__energy_watch_status",
      "mcp__price-hunter__list_my_price_watches",
      "mcp__price-hunter__list_my_favorites",
      "mcp__price-hunter__list_my_comparisons",
      "mcp__price-hunter__list_my_lists",
      "mcp__price-hunter__get_shop_registration",
      "mcp__price-hunter__get_shop_feed_diagnostics",
      "mcp__price-hunter__list_my_shops",
      "mcp__price-hunter__get_shop_statistics"
    ],
    "ask": [
      "mcp__price-hunter__cheaper_abroad",
      "mcp__price-hunter__product_variants",
      "mcp__price-hunter__price_history",
      "mcp__price-hunter__daily_deals",
      "mcp__price-hunter__product_rows",
      "mcp__price-hunter__trending_new_products",
      "mcp__price-hunter__report_issue",
      "mcp__price-hunter__report_illegal_content",
      "mcp__price-hunter__api_price_breakdown",
      "mcp__price-hunter__digital_price_history",
      "mcp__price-hunter__energy_unit_prices",
      "mcp__price-hunter__energy_price_history",
      "mcp__price-hunter__energy_suppliers",
      "mcp__price-hunter__estimate_appliance_energy",
      "mcp__price-hunter__watch_energy_fixation",
      "mcp__price-hunter__confirm_energy_watch",
      "mcp__price-hunter__insurance_guide",
      "mcp__price-hunter__save_favorite",
      "mcp__price-hunter__save_comparison",
      "mcp__price-hunter__create_list",
      "mcp__price-hunter__add_to_list",
      "mcp__price-hunter__check_shop_feed",
      "mcp__price-hunter__register_shop",
      "mcp__price-hunter__verify_shop_domain",
      "mcp__price-hunter__send_cooperation_inquiry",
      "mcp__price-hunter__send_contact_message"
    ],
    "deny": [
      "mcp__price-hunter__cancel_energy_watch",
      "mcp__price-hunter__set_price_watch",
      "mcp__price-hunter__update_price_watch",
      "mcp__price-hunter__delete_price_watch",
      "mcp__price-hunter__remove_favorite",
      "mcp__price-hunter__share_comparison",
      "mcp__price-hunter__delete_comparison",
      "mcp__price-hunter__update_list",
      "mcp__price-hunter__delete_list",
      "mcp__price-hunter__remove_from_list"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as price-hunter. Review it before you use it.

Capability tags behind 20 rules
  • mcp__price-hunter__compare_internet private-data, untrusted-input
  • mcp__price-hunter__search_products untrusted-input
  • mcp__price-hunter__find_best_price untrusted-input
  • mcp__price-hunter__get_product untrusted-input
  • mcp__price-hunter__list_coupons private-data, untrusted-input
  • mcp__price-hunter__compare_mobile private-data
  • mcp__price-hunter__compare_energy private-data
  • mcp__price-hunter__compare_digital untrusted-input
  • mcp__price-hunter__compare_energy_from_bill private-data
  • mcp__price-hunter__energy_watch_status private-data, untrusted-input
  • mcp__price-hunter__list_my_lists private-data
  • mcp__price-hunter__check_shop_feed untrusted-input
  • mcp__price-hunter__register_shop untrusted-input
  • mcp__price-hunter__get_shop_registration private-data, untrusted-input
  • mcp__price-hunter__verify_shop_domain untrusted-input
  • mcp__price-hunter__get_shop_feed_diagnostics untrusted-input
  • mcp__price-hunter__list_my_shops private-data, untrusted-input
  • mcp__price-hunter__get_shop_statistics untrusted-input
  • mcp__price-hunter__send_cooperation_inquiry outbound
  • mcp__price-hunter__send_contact_message outbound

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/ai.fordeal/price-hunter/verify?hash=a20c6998b3fddabc818fa98b145e39d9ff984da717a371b8789dc1c444139691" | jq -e '.changed == false'

Pinned hash a20c6998b3fd, from Oct 30, 2026, 08:18 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/ai.fordeal/price-hunter/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for ai.fordeal/price-hunter
[![anlyon.dev](https://anlyon.dev/badge/ai.fordeal/price-hunter.svg)](https://anlyon.dev/servers/ai.fordeal/price-hunter)

Source: MCP Registry · repository. Synced Oct 30, 2026, 08:17 UTC.