Skip to content

FPL Cat

by fplcat.com · remote · no sign-in to list tools · v1.2.1 · published by com.fplcat

Fantasy Premier League tools: rate a team, captains, player points, fixtures, injuries. No login.

Changes · 14
CompareRegistry entry

15 tools: 14 change things and 1 only read.

Scanned Oct 21, 2026

1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http fpl-cat https://fplcat.com/mcp

Findings

Matches of fixed checks, with the text they matched.

1 warn
  • Warnset_piece_takers

    The server marks "set_piece_takers" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "set_piece_takers" says "set": a word for a change.

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

15 tools

Changes things 14Claude Code: ask
  • best_teamUse this when the user wants the best Fantasy Premier League squad from scratch: 'best team for £100m', 'wildcard team', 'free hit team for GW7', 'best team for £102.5m'.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Use this when the user wants the best Fantasy Premier League squad from scratch: 'best team for £100m', 'wildcard team', 'free hit team for GW7', 'best team for £102.5m'. Gives our model's best 15-man squad with the XI, bench and captain for next gameweek. Default: the £100.0m Wildcard squad (next 6 gameweeks), free. mode 'freehit' (best for next gameweek only) and any other budget are FPL Cat Pro: they need the user to sign in to FPL Cat (the client will ask), and a signed-in user without Pro gets the £100m Wildcard squad instead. Not a squad built from the user's own team.

    Annotations the server declares

    • title: Best FPL team (Wildcard or Free Hit)
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • captain_optionsUse this when the user asks who to captain in Fantasy Premier League: 'who should I captain?', 'best captain for GW7?', 'Haaland or Saka for captain?', 'differential captain?'.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Use this when the user asks who to captain in Fantasy Premier League: 'who should I captain?', 'best captain for GW7?', 'Haaland or Saka for captain?', 'differential captain?'. No team ID needed: without one it gives the best captains in the whole game by our model's predicted points next gameweek, so call it straight away rather than asking. If the user has given their team ID earlier in this conversation, pass it as team to get the best captains from their own squad.

    Annotations the server declares

    • title: FPL captain picks
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • chip_planUse this when the user asks about their Fantasy Premier League chips: 'should I bench boost this week?', 'when should I triple captain?', 'which chips do I have left?', 'should I w…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Use this when the user asks about their Fantasy Premier League chips: 'should I bench boost this week?', 'when should I triple captain?', 'which chips do I have left?', 'should I wildcard?'. Says which chips they have left in this window (GW1-19 or GW20-38), whether to play one this gameweek, and the best one coming up, by our model. Needs the team ID (for the chips already played; reuse it if the user gave it earlier in this conversation) or all 15 names.

    Annotations the server declares

    • title: FPL chip advice
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • deadlineUse this when the user asks when the Fantasy Premier League deadline is: 'when's the deadline?', 'how long until GW7?', 'what gameweek is it?'.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Use this when the user asks when the Fantasy Premier League deadline is: 'when's the deadline?', 'how long until GW7?', 'what gameweek is it?'.

    Annotations the server declares

    • title: FPL deadline
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • fixture_difficultyUse this when the user asks about Fantasy Premier League fixtures: 'which teams have the easiest fixtures?', 'Arsenal's next 5 fixtures', 'best fixture run for defenders', 'who to …No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Use this when the user asks about Fantasy Premier League fixtures: 'which teams have the easiest fixtures?', 'Arsenal's next 5 fixtures', 'best fixture run for defenders', 'who to target for GW7-10?'. Our difficulty rating (1 easiest to 5 hardest) for every club's next 1-6 gameweeks, with blanks and doubles.

    Annotations the server declares

    • title: FPL fixture difficulty
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • gameweek_reviewUse this when the user asks how their Fantasy Premier League gameweek went: 'how did my team do?', 'review my gameweek', 'was my captain right?', 'did my transfers work?', 'how man…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Use this when the user asks how their Fantasy Premier League gameweek went: 'how did my team do?', 'review my gameweek', 'was my captain right?', 'did my transfers work?', 'how many points did my bench score?'. Their points vs the average, gameweek and overall rank, captain vs the best captain they had, bench points, auto-subs, and each transfer's points in vs out. Live during a gameweek. Needs the team ID: if the user gives a number with 'my team', that's it; reuse it if they gave it earlier in this conversation.

    Annotations the server declares

    • title: Review my FPL gameweek
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • injuriesUse this when the user asks who is injured, doubtful or suspended in Fantasy Premier League, for one club or all: 'Arsenal injuries', 'is Saka injured?', 'who's out this week?', 'a…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Use this when the user asks who is injured, doubtful or suspended in Fantasy Premier League, for one club or all: 'Arsenal injuries', 'is Saka injured?', 'who's out this week?', 'any injury news?'. FPL's own flags with their news and chance of playing, plus unconfirmed injury reports for players FPL still lists as fit (say these are reported, not confirmed by FPL). For one player's full picture, player_projection is better.

    Annotations the server declares

    • title: FPL injuries and team news
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • live_bonusUse this when the user asks about Fantasy Premier League bonus points or BPS during or after Premier League matches: 'provisional bonus in Man Utd v Spurs', 'who's getting bonus?',…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Use this when the user asks about Fantasy Premier League bonus points or BPS during or after Premier League matches: 'provisional bonus in Man Utd v Spurs', 'who's getting bonus?', 'is Saka on bonus?', 'live BPS'. Provisional bonus (3-2-1) from the live Bonus Points System for matches in play or finished this gameweek, and the BPS gap to the next bonus. Only useful on match days.

    Annotations the server declares

    • title: FPL live bonus points
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • my_teamUse this when the user asks who to start, who to bench or who to captain in their own Fantasy Premier League team this gameweek: 'who should I start?', 'pick my team for GW7', 'sho…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Use this when the user asks who to start, who to bench or who to captain in their own Fantasy Premier League team this gameweek: 'who should I start?', 'pick my team for GW7', 'should I bench Gordon?', 'is my lineup right?'. Gives our model's best XI, bench order, captain and vice-captain from their 15 for the next gameweek, and what changes from the lineup they have now. Needs the team ID (reuse it if the user gave it earlier in this conversation) or all 15 player names. Doesn't suggest transfers (use rate_team) or plan later gameweeks.

    Annotations the server declares

    • title: Pick my FPL lineup
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • player_projectionUse this when the user asks about one to three Fantasy Premier League players: 'how many points will Saka get?', 'is Palmer worth buying?', 'Saka or Palmer?', 'is Isak fit?'.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Use this when the user asks about one to three Fantasy Premier League players: 'how many points will Saka get?', 'is Palmer worth buying?', 'Saka or Palmer?', 'is Isak fit?'. Gives our model's predicted points for the next gameweek with where they come from (minutes, goals, assists, clean sheet, bonus, defensive contributions), his chance of playing, news, fixtures, price and ownership. With 2-3 names, compares them on next gameweek. Pass all the names in one call.

    Annotations the server declares

    • title: FPL player points
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • price_changesUse this when the user asks about Fantasy Premier League price rises and falls: 'who's rising tonight?', 'will Saka drop in price?', 'price changes today', 'who went up this week?'…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Use this when the user asks about Fantasy Premier League price rises and falls: 'who's rising tonight?', 'will Saka drop in price?', 'price changes today', 'who went up this week?'. likely: players closest to a rise or fall by FPL's own progress figure, with net transfers this gameweek. changed: rises and falls already made this gameweek.

    Annotations the server declares

    • title: FPL price changes
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • rate_teamUse this when the user wants their Fantasy Premier League team rated or reviewed, or asks what to change: 'rate my team', 'how good is my team?', 'who should I transfer out?', 'who…Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Use this when the user wants their Fantasy Premier League team rated or reviewed, or asks what to change: 'rate my team', 'how good is my team?', 'who should I transfer out?', 'who should I bring in?', 'what's wrong with my team?'. Scores the squad 0-100 against the best squad the same money buys, by our model's predicted points over the next 6 gameweeks, and gives the 3 changes worth the most points, with 3 replacements each. Needs the team ID or all 15 player names.

    Annotations the server declares

    • title: Rate my FPL team
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • set_my_teamUse this when the user wants FPL Cat to remember their Fantasy Premier League team, change the saved one or forget it: 'remember my team 123456', 'my team ID is 123456', 'change my…No findings

    Why it is in this group

    • The name "set_my_team" says "set": a word for a change.
    Description, as the server wrote it
    Use this when the user wants FPL Cat to remember their Fantasy Premier League team, change the saved one or forget it: 'remember my team 123456', 'my team ID is 123456', 'change my saved team', 'forget my team'. Saves the team ID to their FPL Cat account (the client asks them to sign in first), so team tools work without it later. The first team ID a signed-in user gives any team tool is saved automatically; use this to change or forget it.

    Annotations the server declares

    • title: Save my FPL team
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • set_piece_takersUse this when the user asks who takes penalties, corners or free kicks for a Premier League club: 'who's on pens for Chelsea?', 'Arsenal set-piece takers', 'which defenders take co…1 finding

    Why it is in this group

    • The name "set_piece_takers" says "set": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "set_piece_takers" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "set_piece_takers" says "set": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Use this when the user asks who takes penalties, corners or free kicks for a Premier League club: 'who's on pens for Chelsea?', 'Arsenal set-piece takers', 'which defenders take corners?'. FPL's own order for penalties, corners and indirect free kicks, and direct free kicks.

    Annotations the server declares

    • title: FPL penalty and set-piece takers
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
Only reads 1Claude Code: allow
  • find_playersUse this when the user wants Fantasy Premier League players that fit a brief: 'best midfielders under £7m', 'cheap defenders for the next 3 gameweeks', 'differential forwards under…No findings

    Why it is in this group

    • The name "find_players" says "find": a word for reading.
    Description, as the server wrote it
    Use this when the user wants Fantasy Premier League players that fit a brief: 'best midfielders under £7m', 'cheap defenders for the next 3 gameweeks', 'differential forwards under 10% owned', 'best Arsenal players', 'replacement for Isak under £8m'. Ranks by our model's predicted points for next gameweek, or by price, form or ownership; horizon adds each player's fixtures for up to 6 gameweeks. Also finds a player by name. Ranking over several gameweeks is in FPL Cat Pro.

    Annotations the server declares

    • title: Find FPL players
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data or outbound.

Reads private data0
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write5
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out0
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Looked at Oct 22, 2026, 14:32 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable
yes
HTTP status of an anonymous initialize
200
tools/list served without credentials
yes
Tools that change things, listed without credentials
14
Protocol version
2025-06-18
WWW-Authenticate on 401
not observed
resource_metadata in WWW-Authenticate
none
RFC 9728 protected resource metadata
https://fplcat.com/.well-known/oauth-protected-resource/mcp
Authorization servers
https://fplcat.com/api/auth
Legacy HTTP+SSE transport
no
Dynamic client registration
yes
Client ID metadata documents
no
  • WarnThe whole server

    The endpoint served tools/list without credentials, and the list has 14 tools that change things (14 write). Whether a call also works without credentials was not tested: tools are never called.

    Matched text

    https://fplcat.com/mcp: tools/list returned 15 tools to an anonymous client, including rate_team (write), my_team (write), captain_options (write), chip_plan (write), set_my_team (write) and 9 more

    What this check looks for

Install

Pinned to version 1.2.1. Values in angle brackets are yours to fill in.

claude mcp add --transport http fpl-cat https://fplcat.com/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__fpl-cat__find_players"
    ],
    "ask": [
      "mcp__fpl-cat__rate_team",
      "mcp__fpl-cat__my_team",
      "mcp__fpl-cat__captain_options",
      "mcp__fpl-cat__chip_plan",
      "mcp__fpl-cat__set_my_team",
      "mcp__fpl-cat__player_projection",
      "mcp__fpl-cat__best_team",
      "mcp__fpl-cat__injuries",
      "mcp__fpl-cat__fixture_difficulty",
      "mcp__fpl-cat__price_changes",
      "mcp__fpl-cat__set_piece_takers",
      "mcp__fpl-cat__deadline",
      "mcp__fpl-cat__live_bonus",
      "mcp__fpl-cat__gameweek_review"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as fpl-cat. Review it before you use it.

Capability tags behind 5 rules
  • mcp__fpl-cat__rate_team untrusted-input
  • mcp__fpl-cat__my_team untrusted-input
  • mcp__fpl-cat__captain_options untrusted-input
  • mcp__fpl-cat__chip_plan untrusted-input
  • mcp__fpl-cat__gameweek_review untrusted-input