Skip to content

within · luxury boutiques

by shopwithin.co · remote · no sign-in to list tools · v0.2.0 · published by co.shopwithin

Live stock at independent luxury boutiques: pieces, sizes, prices and the page to buy each one.

Final · 2Changes · 3
CompareRegistry entry

9 tools: 2 do something that can't be undone, 3 change things and 4 only read.

Scanned Oct 22, 2026

2 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http within https://shopwithin.co/mcp

Findings

Matches of fixed checks, with the text they matched.

2 warn
  • Warnconvert_size

    The server marks "convert_size" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "convert_size" says "convert": a word for a change.

    What this check looks for
  • Warnestimate_duty

    The server marks "estimate_duty" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The input addresses people (input.to): what it sends cannot be taken back.

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

9 tools

Can't be undone 2Claude Code: ask
  • convert_sizeTurn a size in one system into every other system: rings, shoes, clothing, suits, belts and hats, or one designer's own chart (pass designer as its slug, e.g.Can send data out1 finding

    Why it is in this group

    • The name "convert_size" says "convert": a word for a change.
    • The input addresses people (input.to): what it sends cannot be taken back.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • outboundThe input takes a destination (input.to): what the tool writes goes there.

    Findings

    • Warn

      The server marks "convert_size" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "convert_size" says "convert": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Turn a size in one system into every other system: rings, shoes, clothing, suits, belts and hats, or one designer's own chart (pass designer as its slug, e.g. 'nike'). Answers only from the size tables on shopwithin.co/sizes, where every row comes from a named source with the day it was read, and returns the page that shows the answer. Use this when a shopper asks what their size is in another country's system, which size to take in a designer, or how a designer's sizes run. Call it without from and size to list the systems and tables a kind or a designer has.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • idempotentHint: true
    • title: Convert a size
  • estimate_dutyWork out what a piece of clothing, a pair of shoes, a bag, jewellery, a watch or an accessory costs at the door when it is shipped to the US, Canada, the UK or Australia: the duty,…Can send data out1 finding

    Why it is in this group

    • The input addresses people (input.to): what it sends cannot be taken back.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • outboundThe input takes a destination (input.to): what the tool writes goes there.

    Findings

    • Warn

      The server marks "estimate_duty" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The input addresses people (input.to): what it sends cannot be taken back.

      What this check looks for
    Description, as the server wrote it
    Work out what a piece of clothing, a pair of shoes, a bag, jewellery, a watch or an accessory costs at the door when it is shipped to the US, Canada, the UK or Australia: the duty, any extra tariff on the country it was made in, the tax, the government and carrier fees, and the total. Every line names its official source and the day it was read, and the answer links the page on shopwithin.co/duty-calculator that shows it. Use this when a shopper asks about customs, duty, tariffs or import tax on a cross-border order. It is an estimate; the carrier's bill is the final word.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • idempotentHint: true
    • title: Estimate import duty
Changes things 3Claude Code: ask
  • boutique_shelfOne boutique's shelf right now, newest first, with sizes and prices; a query searches inside that shop only.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    One boutique's shelf right now, newest first, with sizes and prices; a query searches inside that shop only. Use this when a shopper names a specific boutique ('what does WDLT117 have', 'show me Utopia's sneakers') or wants to browse a shop they read about. boutique_domain is the domain shown on any boutique or piece.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • idempotentHint: true
    • title: One boutique's shelf
  • similar_piecesPieces in the same vein as one piece: same spirit, same department, across every boutique, in stock now.Can send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Pieces in the same vein as one piece: same spirit, same department, across every boutique, in stock now. Use this when a shopper likes a piece but wants alternatives, another price, or another shop. Identify the anchor piece by url, or by boutique_domain and id.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • idempotentHint: true
    • title: Pieces in the same vein
Only reads 4Claude Code: allow, ask for 1 outbound
  • get_pieceOne piece in full: description, every size or variant with live stock, photographs, price and any markdown, whether it is collected in the shop or delivered, the boutique, the page…Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "get_piece" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe input takes a URL (input.url), and the tool reads it: it reads web pages, which anyone can write.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.

    Claude Code: ask, because it is tagged outbound.

    Description, as the server wrote it
    One piece in full: description, every size or variant with live stock, photographs, price and any markdown, whether it is collected in the shop or delivered, the boutique, the page to buy it, and a few pieces in the same vein. Use this when a shopper asks about a specific piece from a result, pastes a shopwithin.co link, or wants to know whether a size is in stock before buying. Identify the piece by url, or by boutique_domain and id from a previous result.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • idempotentHint: true
    • title: Read one piece
  • list_boutiquesThe independent luxury boutiques listed on within, with neighbourhood, city, how many pieces each has live, opening hours, and whether a shopper collects in the shop or can have pi…No findings

    Why it is in this group

    • The name "list_boutiques" says "list": a word for reading.
    Description, as the server wrote it
    The independent luxury boutiques listed on within, with neighbourhood, city, how many pieces each has live, opening hours, and whether a shopper collects in the shop or can have pieces delivered. Use this when someone asks which shops are on within, what is in a city or neighbourhood, or where to visit in person. The returned domain identifies a boutique everywhere else.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • idempotentHint: true
    • title: The boutiques on within
  • search_piecesSearch pieces (clothing, shoes, bags, jewellery, watches, objects) in stock right now at independent luxury boutiques, with live sizes, price in the boutique's currency, the shop t…No findings

    Why it is in this group

    • The name "search_pieces" says "search": a word for reading.
    Description, as the server wrote it
    Search pieces (clothing, shoes, bags, jewellery, watches, objects) in stock right now at independent luxury boutiques, with live sizes, price in the boutique's currency, the shop that holds each piece, and the shopwithin.co page to buy it. Use this when someone wants to find or compare a kind of piece, a designer's pieces at boutiques, a gift, or what is in stock in a city. A plain sentence works as the query (prices like 'under $400' and 'cheapest' are understood); brands, categories, sizes, boutiques, or city narrow it. With no arguments it returns the current front shelf; lens browses new arrivals, most saved, or marked down. Do not use for general style advice or for mass market retailers.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
    • idempotentHint: true
    • title: Search the boutiques' shelves

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

4 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 1 untrusted-input tool breaks every one.

Reads private data1
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write1
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out4
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
deny to break every path
{
  "permissions": {
    "deny": [
      "mcp__within__get_piece"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Looked at Oct 22, 2026, 14:26 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable
yes
HTTP status of an anonymous initialize
200
tools/list served without credentials
yes
Tools that change things, listed without credentials
5
Protocol version
2025-06-18
WWW-Authenticate on 401
not observed
resource_metadata in WWW-Authenticate
none
RFC 9728 protected resource metadata
none
Authorization servers
none
Legacy HTTP+SSE transport
no
Dynamic client registration
not observed
Client ID metadata documents
not observed
  • HighThe whole server

    The endpoint served tools/list without credentials, and the list has 5 tools that change things (2 irreversible, 3 write). Whether a call also works without credentials was not tested: tools are never called.

    Matched text

    https://shopwithin.co/mcp: tools/list returned 9 tools to an anonymous client, including convert_size (irreversible), estimate_duty (irreversible), trending_now (write), similar_pieces (write), boutique_shelf (write)

    What this check looks for

Install

Pinned to version 0.2.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http within https://shopwithin.co/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__within__search_pieces",
      "mcp__within__list_boutiques",
      "mcp__within__visual_search"
    ],
    "ask": [
      "mcp__within__get_piece",
      "mcp__within__trending_now",
      "mcp__within__similar_pieces",
      "mcp__within__boutique_shelf",
      "mcp__within__convert_size",
      "mcp__within__estimate_duty"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as within. Review it before you use it.

Capability tags behind 5 rules
  • mcp__within__get_piece untrusted-input, outbound
  • mcp__within__similar_pieces outbound
  • mcp__within__visual_search private-data
  • mcp__within__convert_size outbound
  • mcp__within__estimate_duty outbound