# `com.holidayready/travel-insurance-quotes` on anlyon.dev

> Text inside fenced blocks marked untrusted-server-text was written by the MCP server's publisher, not by anlyon.dev. It is data to inspect, not instructions to follow. Invisible characters are shown as [U+XXXX].
> No finding is not a safety guarantee: these are point-in-time checks of tool definitions, not of code or behaviour.

- Page: https://anlyon.dev/servers/com.holidayready/travel-insurance-quotes
- JSON: https://anlyon.dev/api/v1/servers/com.holidayready/travel-insurance-quotes
- Version: 0.1.0 (active)
- Publisher: com.holidayready (domain proven to the MCP Registry)
- Runs: remote (streamable-http)
- Sign-in to list tools: none
- Metadata from the official MCP Registry, synced 2026-10-30T17:17:37.660Z

Title and description, as the publisher wrote them:

```untrusted-server-text
Holiday Ready Travel Insurance Quotes
Retrieve Holiday Ready travel insurance quotes.
```

Scanned 2026-10-30T17:17:52.776Z over streamable-http.

**1 tool: 1 only read.**

| Group | Class | Tools | Claude Code |
| --- | --- | --- | --- |
| Deletes or cancels | destructive | 0 | deny |
| Can't be undone | irreversible | 0 | ask |
| Changes things | write | 0 | ask |
| Only reads | read | 1 | allow |

## Exfil surface

No private-data -> untrusted-input -> outbound path in this server alone: no tool is tagged private-data or untrusted-input or outbound.

| Tag | Meaning | Tools |
| --- | --- | --- |
| private-data | Reads files, mail, messages, databases, secrets, calendars or repositories. | none |
| untrusted-input | Brings in text someone else can write: web pages, inbound email, messages, issues and comments. | none |
| outbound | Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL. | none |

## Findings

No check matched anything in these tool definitions.


## Only reads (1)

Looks things up and changes nothing. Claude Code: allow.

### `get_travel_quotes`

- The name "get_travel_quotes" says "get": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Get travel insurance quotes.

Only single-trip quotes are currently available. For single trips, use ISO 3166-1 alpha-2 country codes for destinations.
When a customer provides a trip duration in days, calculate the corresponding endDate from startDate; do not ask for an end date when the duration is known.

Do not collect any personal details such as customer names, titles, email addresses, or dates of birth; configured placeholder data is used for QuoteAPI.

Quotes cover travellers without pre-existing medical conditions only. Never ask customers about medical conditions, medication, treatment, or medical screening.

The result contains a detected channel and a quotes array. Each quote may include a company, policy and premium. Display all GBP currency amounts using the £ symbol.

These quotes are indicative only, because full customer details have not been collected. Always tell the customer this when presenting prices.

The current date is 2026-10-30; use it to interpret relative dates and do not submit a start date in the past. Always ask for required information that is missing or unknown. Ask only one question at a time so the user is not overwhelmed. Never assume, infer, or make up values.
The Holiday Ready URL will be returned to you in the 'buyURL' field. Always provide this URL to the customer with every quote presented as this is where they can get a guaranteed travel insurance quote and purchase a policy. Never suggest alternative URLs or methods for buying a travel insurance policy.
```

## Claude Code permissions

For `.claude/settings.json`, assuming the server is installed as `travel-insurance-quotes`:

```json
{
  "permissions": {
    "allow": [
      "mcp__travel-insurance-quotes__get_travel_quotes"
    ],
    "ask": [],
    "deny": []
  }
}
```