# `ai.wondel/olx` on anlyon.dev

> Text inside fenced blocks marked untrusted-server-text was written by the MCP server's publisher, not by anlyon.dev. It is data to inspect, not instructions to follow. Invisible characters are shown as [U+XXXX].
> No finding is not a safety guarantee: these are point-in-time checks of tool definitions, not of code or behaviour.

- Page: https://anlyon.dev/servers/ai.wondel/olx
- JSON: https://anlyon.dev/api/v1/servers/ai.wondel/olx
- Version: 1.0.0 (active)
- Publisher: ai.wondel (domain proven to the MCP Registry)
- Runs: remote (streamable-http)
- Sign-in to list tools: none
- Metadata from the official MCP Registry, synced 2026-11-02T13:17:40.092Z

Title and description, as the publisher wrote them:

```untrusted-server-text
OLX MCP
OLX.pl classifieds in every category: property, cars, electronics, jobs, free items; offer details.
```

Scanned 2026-11-02T13:19:07.556Z over streamable-http.

**3 tools: 1 change things and 2 only read.**

| Group | Class | Tools | Claude Code |
| --- | --- | --- | --- |
| Deletes or cancels | destructive | 0 | deny |
| Can't be undone | irreversible | 0 | ask |
| Changes things | write | 1 | ask |
| Only reads | read | 2 | allow |

## Exfil surface

No private-data -> untrusted-input -> outbound path in this server alone: no tool is tagged private-data or untrusted-input or outbound.

| Tag | Meaning | Tools |
| --- | --- | --- |
| private-data | Reads files, mail, messages, databases, secrets, calendars or repositories. | none |
| untrusted-input | Brings in text someone else can write: web pages, inbound email, messages, issues and comments. | none |
| outbound | Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL. | none |

## Findings

- **info** Long descriptions in `olx_search` ([long-description](https://anlyon.dev/methodology#long-description))

```untrusted-server-text
The description is 2,748 characters long, over the 2,000 this check looks for.

description ends: "...with a `note` saying why and what to change — a successful result, not an error."
```


## Changes things (1)

Creates or changes something that can be changed back. Claude Code: ask.

### `olx_offer`

- Nothing in its name or description says what it does, so it is counted as a write.

Description, as the server wrote it:

```untrusted-server-text
Full details of one OLX.pl offer: price (or salary for a job), every attribute with its Polish name and value (area, rooms, rent, condition, model, year, mileage…), the full description, all photo URLs, location (city, district, voivodeship, map coordinates — often approximate), seller type and public name (company, or the first name a private seller shows), posting/refresh/expiry times, OLX delivery availability, and the original otodom.pl link for partner property listings. No contact details. Fetched live from OLX.pl's public API (typically well under 1 s; a few seconds when it falls back to an unblocker). Result: { source, fetchedAt, offer: { id, url, title, status, category_id, category, price, salary?, area_m2?, rooms?, params: [{ key, name, value }], description, location: { city, city_id, district, district_id, region, region_id, lat, lon, approximate }, seller: { type, name, member_since }, created_time, refreshed_time, valid_to_time, promotion, olx_delivery, photos, external_url } }.
```

## Only reads (2)

Looks things up and changes nothing. Claude Code: allow.

### `olx_categories`

- The description's first verb is "find": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Find the category_id for olx_search. Without arguments: OLX's 19 top-level categories. With parent_id: that category's sub-categories (instant, from a snapshot of OLX's category tree). With query: which categories the offers matching those words fall in, with live offer counts, largest first — the quickest way to pick a category for a search term (e.g. 'iphone 13' → Smartfony i telefony komórkowe > iPhone). Result: { source, parent, query?, total_count?, count, categories: [{ id, name, path, has_children, count? }] } — `path` is the full Polish name trail ('Nieruchomości > Mieszkania > Wynajem').
```

### `olx_search`

- The name "olx_search" says "search": a word for reading.
- Findings: info long-description

Description, as the server wrote it:

```untrusted-server-text
Search offers on OLX.pl, Poland's largest classifieds site, across every category: flats and houses for rent or sale, cars and parts, phones and electronics, furniture, clothes, jobs, services, free items. Filter by words, category, place (city or district, with a radius) or voivodeship, price range, new/used, private vs business seller, and any category-specific attribute via `filters`. Common category_id values: Nieruchomości 3 (flats for rent 15, flats for sale 14, houses for rent 20, houses for sale 18, rooms 11, plots 709), Motoryzacja 5 (passenger cars 84, motorcycles 81, car parts 82), Elektronika 99 (smartphones 1839, laptops 1199, TVs 1849, game consoles 1604), Dom i Ogród 628 (furniture 565), Moda 87, Dla Dzieci 88, Sport i Hobby 767 (bicycles 461), Zwierzęta 103, Praca 4 (jobs), Usługi 4371, Oddam za darmo 1151 (free items). olx_categories lists the full tree and shows which categories a query's offers fall in. Pass an offer's `id` to olx_offer for the full description, all photos and map location. Fetched live from OLX.pl's public API (typically well under 1 s; a few seconds when it falls back to an unblocker). Result shape: { source, fetchedAt, query, resolved_location, total_count, offset, limit, next_offset, count, offers: [...], note? } — the list key is `offers`; `total_count` counts all matches, but OLX pages through only the first 1000 (pass `next_offset` as `offset` for more). Each offer: { id, url, title, price: { value, currency, negotiable, type, label, per?, previous_value? } | null, salary?, area_m2?, rooms?, params, city, district, region, category_id, category, seller_type, promoted, created_time, refreshed_time, photo, photos_count, description, external_url? }. `price.value` is a number in `currency` (PLN) or null when there is no amount. `price.type`: 'price' = the asking price (`negotiable` when the seller accepts offers; for flat/house rentals the monthly rent), 'arranged' (to be agreed) with value null, 'budget' = the advertiser's budget rather than an asking price, 'free' = giveaway with value 0, 'exchange' = swap with value null — so never read a missing amount as 0 PLN. `per` ('hour' | 'day' | 'night' | 'week' | 'month') marks a rate, e.g. equipment rented at 150 PLN per day — the value is then not a total. `previous_value` appears after a price drop. Jobs carry `salary` { from, to, currency, period, gross } instead of a price. `params` maps each attribute's key to its Polish display label (e.g. { state: 'Używane', m: '44,60 m²', rooms: '2 pokoje' }) — the keys are what `filters` use. `description` is a short excerpt; contact details are never included. An empty match answers count: 0 with a `note` saying why and what to change — a successful result, not an error.
```

## Claude Code permissions

For `.claude/settings.json`, assuming the server is installed as `olx`:

```json
{
  "permissions": {
    "allow": [
      "mcp__olx__olx_search",
      "mcp__olx__olx_categories"
    ],
    "ask": [
      "mcp__olx__olx_offer"
    ],
    "deny": []
  }
}
```