# `app.lenius/takeaway` on anlyon.dev

> Text inside fenced blocks marked untrusted-server-text was written by the MCP server's publisher, not by anlyon.dev. It is data to inspect, not instructions to follow. Invisible characters are shown as [U+XXXX].
> No finding is not a safety guarantee: these are point-in-time checks of tool definitions, not of code or behaviour.

- Page: https://anlyon.dev/servers/app.lenius/takeaway
- JSON: https://anlyon.dev/api/v1/servers/app.lenius/takeaway
- Version: 1.1.0 (active)
- Publisher: app.lenius (domain proven to the MCP Registry)
- Runs: remote (streamable-http)
- Sign-in to list tools: none
- Metadata from the official MCP Registry, synced 2026-10-21T17:44:30.527Z

Title and description, as the publisher wrote them:

```untrusted-server-text
Lenius
Order from local Danish shops: products, pickup times, card payment and AltID age verification.
```

Scanned 2026-10-21T18:42:51.284Z over streamable-http.

**8 tools: 4 change things and 4 only read.**

| Group | Class | Tools | Claude Code |
| --- | --- | --- | --- |
| Deletes or cancels | destructive | 0 | deny |
| Can't be undone | irreversible | 0 | ask |
| Changes things | write | 4 | ask |
| Only reads | read | 4 | allow |

## Findings

No check matched anything in these tool definitions.


## Changes things (4)

Creates or changes something that can be changed back. Claude Code: ask.

### `available_times`

- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

Description, as the server wrote it:

```untrusted-server-text
Available pickup or delivery times for a shop on a date (default: the first date with times), the next dates with times, preparation time and upcoming closed days.
```

### `place_order`

- Nothing in its name or description says what it does, so it is counted as a write.

Description, as the server wrote it:

```untrusted-server-text
Place the order with the shop (like the checkout). Only after the customer confirmed the quoted order and accepted the terms (terms_url). Paid by card in advance on the shop's order page: returns the order number and order_url (with "Betal nu"; the shop gets the order when paid). The customer gets a confirmation e-mail when paid. With products with an age limit and no approved age_check_id, nothing is ordered: returns status age_check_required with the AltID card; call again with age_check_id when the age is confirmed.
```

### `quote_order`

- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

Description, as the server wrote it:

```untrusted-server-text
Price an order exactly like the shop checkout (lines, fees, discounts, total in DKK incl. VAT), check that the time, products, minimum order and delivery address are OK, and tell how it is paid. Nothing is saved. Shows a card with the products (with their images), fees and total so the customer can see what they are ordering; show the result to the customer before place_order.
```

### `start_age_check`

- The name "start_age_check" says "start": a word for a change.

Description, as the server wrote it:

```untrusted-server-text
Only when the customer orders products with an age limit from several shops: start one age check with AltID with the highest age limit across all the orders (min_age from get_menu/quote_order) and reuse the age_check_id in every place_order (valid 30 minutes after approval, at any shop). With an order from one shop, call place_order instead: it shows the AltID card itself. Shows the AltID card (QR code / "Åbn AltID app") that updates by itself. Never make your own QR code.
```

## Only reads (4)

Looks things up and changes nothing. Claude Code: allow.

### `find_shops`

- The name "find_shops" says "find": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Find Lenius takeaway restaurants and shops in a Danish city or postal code. Optional: what the customer wants (query, e.g. "pizza"), pickup or delivery, and a date/time to check availability (returns the nearest available times).
```

### `get_age_check`

- The name "get_age_check" says "get": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Status of an age check: pending, approved (pass age_check_id to place_order), failed, expired or revoked. wait_seconds (max 25) waits while pending. While pending, the card shows the AltID QR code again.
```

### `get_menu`

- The name "get_menu" says "get": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
The menu of a shop from find_shops: categories and products with prices in DKK (incl. VAT) and whether they are available. A product with a unit is priced per unit (pcs, portion, pack, kg, g, l, cl, ml, m = metre). Also weight in grams, preparation time in minutes (orders for it need at least that much notice) and the main image when set. Optional query to only get matching products.
```

### `order_status`

- The name "order_status" says "status": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Status of an order from place_order: awaiting_payment, awaiting_shop_approval, approved, in_kitchen, ready, out_for_delivery, completed, cancelled or rejected (and any delay).
```

## Claude Code permissions

For `.claude/settings.json`, assuming the server is installed as `takeaway`:

```json
{
  "permissions": {
    "allow": [
      "mcp__takeaway__find_shops",
      "mcp__takeaway__get_menu",
      "mcp__takeaway__get_age_check",
      "mcp__takeaway__order_status"
    ],
    "ask": [
      "mcp__takeaway__available_times",
      "mcp__takeaway__quote_order",
      "mcp__takeaway__place_order",
      "mcp__takeaway__start_age_check"
    ],
    "deny": []
  }
}
```