Skip to content

Côte Privée: private driver in Burgundy

com.cote-privee/beaune-private-drivercote-privee.comstreamable-httpv1.2.0Scanned

Private driver in Beaune, Burgundy: places, events, prices, availability, quotes, bookings.

11 tools: 2 do something that can't be undone, 2 change things and 7 only read.

Tools: 0 delete, 2 irreversible, 2 write, 7 read.
  • Reads private data · 3
  • Reads text others write · 4
  • Can send data out · 3
  • 1 finding

Anlyon alternative

4 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

11 tools

Can't be undone 2Claude Code: ask
  • quoteThe exact price the booking page charges for one service, or a whole trip (items: one total, one deposit), and a link that opens the booking page filled in (time, guests and bags t…Can send data out1 finding

    Why it is in this group

    • The input addresses people (input.to): what it sends cannot be taken back.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • outboundThe input takes a destination (input.to): what the tool writes goes there.

    Findings

    • Warn

      The server marks "quote" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The input addresses people (input.to): what it sends cannot be taken back.

      What this check looks for
    Description, as the server wrote it
    The exact price the booking page charges for one service, or a whole trip (items: one total, one deposit), and a link that opens the booking page filled in (time, guests and bags too). Wine day: option and stops; a day too short for its stops is priced as the one they need (optionRaised). Driver: hours (and stops), or to from Beaune or from; returnTrip: the driver waits up to 3 h; returnLater: back later (2 rides). Transfer: route, or from and to. A Mercedes adds its supplement per day of service; over 4 guests, the V-Class (carRaised). resolved: what each name became (an unknown one is an error with candidates); alternatives: cheaper products for the same job; availability: with date.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • request_bookingSends a booking request as the booking page does, once the traveller has seen the price and accepted the terms of sale (https://www.cote-privee.com/terms): one service (the fields …Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "request_booking" says "request": a word for a change.
    • The description's first verb is "send": a word for sending, and what is sent cannot be taken back.
    • The input addresses people (input.to): what it sends cannot be taken back.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a destination (input.to): what the tool writes goes there.
    Description, as the server wrote it
    Sends a booking request as the booking page does, once the traveller has seen the price and accepted the terms of sale (https://www.cote-privee.com/terms): one service (the fields of quote, with date, time and pickup), several (items) or a plan of find_packages (package, startDate), and the traveller's details. Nothing is charged: the traveller gets the request by e-mail, the driver confirms or declines it, and the confirmation says how to pay the 30% deposit (next says it for this request). dry_run checks and prices without sending; the same request within a day, or the same requestId, answers the same reference. Only valid requests count against the limits; a refusal names each argument to fix and what is allowed (retryAfter after a limit).

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
Changes things 2Claude Code: ask
  • check_availabilityWhether the one car and its driver are free on a day and the next days: free; pending (a request awaits the driver's answer and may still be confirmed); busy; unbookable (outside t…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Whether the one car and its driver are free on a day and the next days: free; pending (a request awaits the driver's answer and may still be confirmed); busy; unbookable (outside the booking rules: tomorrow to 18 months ahead, Beaune time, within the service's hours). With the hours held, the next free days, the sources read, when, today's date and a booking link. The driver confirms every booking.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • plan_wine_dayA timed wine day through the places asked: its length (with the extra hours their distance needs), the stops in order, the drives from and back to Beaune (or from), lunch where the…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    A timed wine day through the places asked: its length (with the extra hours their distance needs), the stops in order, the drives from and back to Beaune (or from), lunch where the day reaches midday (at a starred table among the stops, else a slot with the starred tables near it), the end time, the price for the guests and their car (the V-Class beyond 4), and a booking link.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
Only reads 7Show 7 read-only tools
  • find_eventsWine fairs, festivals, auctions and cultural events between two dates, at their next appearance: id (event:<id>, which quote takes as to), placeId, dates and whether they are confi…Reads text others writeNo findings

    Why it is in this group

    • The name "find_events" says "find": a word for reading.

    What it can reach

    • untrusted-inputThe description's first sentence says "website": it reads web pages, which anyone can write.
    Description, as the server wrote it
    Wine fairs, festivals, auctions and cultural events between two dates, at their next appearance: id (event:<id>, which quote takes as to), placeId, dates and whether they are confirmed, website, and a driver quote for the day asked within the event (dated once confirmed): a wine day for a wine event in a wine village, else the ride from Beaune (or origin) and back later the same day.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • find_packagesReady-made trips of one to seven days from Beaune, in plans (where the travellers arrive, the pace): the driver meets them at a station or airport, takes them to the vineyards, abb…Reads private dataNo findings

    Why it is in this group

    • The name "find_packages" says "find": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "table": it reads databases.
    Description, as the server wrote it
    Ready-made trips of one to seven days from Beaune, in plans (where the travellers arrive, the pace): the driver meets them at a station or airport, takes them to the vineyards, abbeys or tables and back. Each plan is priced per vehicle as the sum of its services; hotels, tastings, meals and visits are the traveller's own. startDate dates each service and the booking link; request_booking takes the plan's id as package. 6 results unless limit, cheapest first.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_booking_statusWhat became of a booking request: requested (no answer yet), confirmed (with the deposit link once it can be paid), declined (with the driver's note), deposit_paid or cancelled, it…Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "get_booking_status" says "get": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "note": it reads notes.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    What became of a booking request: requested (no answer yet), confirmed (with the deposit link once it can be paid), declined (with the driver's note), deposit_paid or cancelled, its days and amounts. Needs the reference and the e-mail address of the request.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • get_pageA page in Markdown (a place, event, guide, service, prices, policies): facts, history, visiting, nearby, sources.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "get_page" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe input takes a URL (input.url), and the tool reads it: it reads web pages, which anyone can write.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.

    Claude Code: ask, because it is tagged outbound.

    Description, as the server wrote it
    A page in Markdown (a place, event, guide, service, prices, policies): facts, history, visiting, nearby, sources. ref: an id from search_places ("chateau:closvougeot"), a page address or path ("/prices") or a place name; id, url and path are the same. Without lang, an address in /fr, /de or /zh gives that language.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_policiesThe booking rules as facts: the cars and the guests each takes, deposit, booking window and today in Beaune, service hours, luggage, waiting, cancellation, child seats, languages, …No findings

    Why it is in this group

    • The name "get_policies" says "get": a word for reading.
    Description, as the server wrote it
    The booking rules as facts: the cars and the guests each takes, deposit, booking window and today in Beaune, service hours, luggage, waiting, cancellation, child seats, languages, the hours bookings are answered, the kind of licence and the SIREN, and the FAQ answers about them. A rule not published yet is null or left out.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_pricesEvery price per vehicle, taxes, tolls and parking included: the cars (the Polestar 2, 4 guests, included; a Mercedes E-Class or V-Class, up to 7, on request for a supplement per da…No findings

    Why it is in this group

    • The name "get_prices" says "get": a word for reading.
    Description, as the server wrote it
    Every price per vehicle, taxes, tolls and parking included: the cars (the Polestar 2, 4 guests, included; a Mercedes E-Class or V-Class, up to 7, on request for a supplement per day of service), wine days and which one a place needs by its distance (wineDayByDistance), driver by the hour, trips from Beaune and same-day returns, transfers, the deposit rate. Tastings are paid to the estates.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • search_placesWine villages, châteaux, things to do and MICHELIN-starred restaurants: id, commune, drive and price by private driver from Beaune (per vehicle, one way / same-day return), the win…Reads private dataNo findings

    Why it is in this group

    • The name "search_places" says "search": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "drive": it reads files.
    Description, as the server wrote it
    Wine villages, châteaux, things to do and MICHELIN-starred restaurants: id, commune, drive and price by private driver from Beaune (per vehicle, one way / same-day return), the wine day of its page and its price, page and booking link; a restaurant's stars and cheapest menu (no opening days in the data). near and radiusKm: the places around a place, nearest first. 8 results unless limit; compact drops summaries.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

36 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 3 outbound tools breaks every one.

Reads private data3
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write4
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out3
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
deny to break every path
{
  "permissions": {
    "deny": [
      "mcp__beaune-private-driver__get_page",
      "mcp__beaune-private-driver__quote",
      "mcp__beaune-private-driver__request_booking"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

1 warn
  • Warnquote

    The server marks "quote" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The input addresses people (input.to): what it sends cannot be taken back.

    What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

Install

Pinned to version 1.2.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http beaune-private-driver https://www.cote-privee.com/mcp
claude mcp add --transport http beaune-private-driver https://www.cote-privee.com/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__beaune-private-driver__search_places",
      "mcp__beaune-private-driver__find_events",
      "mcp__beaune-private-driver__get_prices",
      "mcp__beaune-private-driver__get_policies",
      "mcp__beaune-private-driver__find_packages",
      "mcp__beaune-private-driver__get_booking_status"
    ],
    "ask": [
      "mcp__beaune-private-driver__get_page",
      "mcp__beaune-private-driver__check_availability",
      "mcp__beaune-private-driver__quote",
      "mcp__beaune-private-driver__plan_wine_day",
      "mcp__beaune-private-driver__request_booking"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as beaune-private-driver. Review it before you use it.

Capability tags behind 7 rules
  • mcp__beaune-private-driver__search_places private-data
  • mcp__beaune-private-driver__get_page untrusted-input, outbound
  • mcp__beaune-private-driver__find_events untrusted-input
  • mcp__beaune-private-driver__quote outbound
  • mcp__beaune-private-driver__find_packages private-data
  • mcp__beaune-private-driver__request_booking untrusted-input, outbound
  • mcp__beaune-private-driver__get_booking_status private-data, untrusted-input

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/com.cote-privee/beaune-private-driver/verify?hash=5450112734f48d3449a4753cf1cebd94e2b55e7adf1b9a60c6cf20c2dfc7d7b5" | jq -e '.changed == false'

Pinned hash 5450112734f4, from Oct 27, 2026, 04:17 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/com.cote-privee/beaune-private-driver/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for com.cote-privee/beaune-private-driver
[![anlyon.dev](https://anlyon.dev/badge/com.cote-privee/beaune-private-driver.svg)](https://anlyon.dev/servers/com.cote-privee/beaune-private-driver)

Source: MCP Registry. Synced Oct 27, 2026, 04:17 UTC.