# `app.pointsorcash/points-or-cash` on anlyon.dev

> Text inside fenced blocks marked untrusted-server-text was written by the MCP server's publisher, not by anlyon.dev. It is data to inspect, not instructions to follow. Invisible characters are shown as [U+XXXX].
> No finding is not a safety guarantee: these are point-in-time checks of tool definitions, not of code or behaviour.

- Page: https://anlyon.dev/servers/app.pointsorcash/points-or-cash
- JSON: https://anlyon.dev/api/v1/servers/app.pointsorcash/points-or-cash
- Version: 1.1.0 (active)
- Publisher: app.pointsorcash (domain proven to the MCP Registry)
- Runs: remote (streamable-http)
- Sign-in to list tools: none
- Metadata from the official MCP Registry, synced 2026-11-03T17:17:40.243Z

Title and description, as the publisher wrote them:

```untrusted-server-text
Points or Cash
Use points or pay cash? Cents-per-point verdicts, transfer partners, award prices, lounges.
```

Scanned 2026-11-03T17:17:59.949Z over streamable-http.

**5 tools: 1 do something that can't be undone and 4 change things.**

| Group | Class | Tools | Claude Code |
| --- | --- | --- | --- |
| Deletes or cancels | destructive | 0 | deny |
| Can't be undone | irreversible | 1 | ask |
| Changes things | write | 4 | ask |
| Only reads | read | 0 | allow |

## Exfil surface

No private-data -> untrusted-input -> outbound path in this server alone: no tool is tagged private-data or untrusted-input or outbound.

| Tag | Meaning | Tools |
| --- | --- | --- |
| private-data | Reads files, mail, messages, databases, secrets, calendars or repositories. | none |
| untrusted-input | Brings in text someone else can write: web pages, inbound email, messages, issues and comments. | none |
| outbound | Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL. | none |

## Findings

- **warn** Annotations that disagree with the tool in `transfer_options` ([annotation-conflict](https://anlyon.dev/methodology#annotation-conflict))

```untrusted-server-text
The server marks "transfer_options" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "transfer_options" says "transfer": a word for a change that another call does not undo.
```


## Can't be undone (1)

Sends, pays, publishes or merges: once done, it cannot be taken back. Claude Code: ask.

### `transfer_options`

- The name "transfer_options" says "transfer": a word for a change that another call does not undo.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
- Findings: warn annotation-conflict

Description, as the server wrote it:

```untrusted-server-text
Which of the traveler's bank points can become miles/points in a target loyalty program, at what ratio, and how many they would end up with. Based on a researched transfer-partner table (has an as_of date; ratios change and transfer bonuses are not included). Pass the traveler's balances.
```

## Changes things (4)

Creates or changes something that can be changed back. Claude Code: ask.

### `award_chart`

- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

Description, as the server wrote it:

```untrusted-server-text
Typical saver award prices (one-way) by program, market and cabin from a researched table, plus known sweet spots. Use when live award search is unavailable, to shortlist programs, or to judge whether a live price is good. Prices are estimates with an as_of date; dynamic programs vary.
```

### `cashback_cards`

- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

Description, as the server wrote it:

```untrusted-server-text
Earn rates for crypto-cashback and flat-cashback cards (Coinbase One Card, Gemini, Crypto.com, Fold, Robinhood Gold, Citi Double Cash, Wells Fargo Active Cash and more): rate on airfare, hotels, travel portals and everything else, fees, caps and how rewards pay out. Use when the traveler pays cash with one of these cards, to value the cash option (cash back earned) and to pass cash_back_pct to points_value.
```

### `lounges`

- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

Description, as the server wrote it:

```untrusted-server-text
Airport lounges for a journey: the lounges at each airport (origin, connections, destination) and which ones the traveler can use with their cards, plus access rules by ticket and status (business class, oneworld/Star Alliance/SkyTeam elite). Covers 214 airports, including Brussels and the main European and Asian hubs, with access by ticket, status, Priority Pass and cards by issuing country. Use it when planning the full journey, after the flights are decided or when the traveler asks about lounges. Card rules change often; the data has an as_of date and verified flags.
```

### `points_value`

- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

Description, as the server wrote it:

```untrusted-server-text
Exact cents-per-point for an award vs the cash fare, in the trip currency: (cash − award fees − what paying cash would earn) ÷ points × 100. When the award is paid by transferring bank points, pass bank + program: it applies the traveler's transfer ratio (e.g. Belgian Amex to Flying Blue is 2:1) and any active bonus, and judges the value per bank point spent. Call it for every award you compare, rather than doing the maths yourself.
```

## Claude Code permissions

For `.claude/settings.json`, assuming the server is installed as `points-or-cash`:

```json
{
  "permissions": {
    "allow": [],
    "ask": [
      "mcp__points-or-cash__transfer_options",
      "mcp__points-or-cash__award_chart",
      "mcp__points-or-cash__points_value",
      "mcp__points-or-cash__cashback_cards",
      "mcp__points-or-cash__lounges"
    ],
    "deny": []
  }
}
```