Skip to content

Hustle Got Real

com.hustlegotreal/mcphustlegotreal.comstreamable-httpv2026.10.29Scanned

Dropshipping for eBay, Amazon and Shopify: products, listings, prices, stock, orders and analytics.

170 tools: 78 can delete or cancel things, 23 change things and 69 only read.

Tools: 78 delete, 0 irreversible, 23 write, 69 read.
  • Reads private data · 0
  • Reads text others write · 170
  • Can send data out · 61
  • 36 findings

Anlyon alternative

101 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

170 tools

Deletes or cancels 78Claude Code: deny
  • hgr_add_pricing_ruleAdds a pricing rule for one visible store.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_add_pricing_rule" says "add": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Adds a pricing rule for one visible store. Requires confirmed=true and impactConfirmed=true because pricing rules can affect many listings. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_add_virtual_assistantAdds a Virtual Assistant / VA profile.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_add_virtual_assistant" says "add": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Adds a Virtual Assistant / VA profile. Requires confirmed=true.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_change_ai_publisher_statusChanges AI Publisher automation status for one visible store.Reads text others write1 finding

    Why it is in this group

    • The name "hgr_change_ai_publisher_status" says "status": a word for reading.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "hgr_change_ai_publisher_status" destructive (destructiveHint: true), and its name says "status", a word for reading.

      Matched text

      annotations: {"readOnlyHint":false,"destructiveHint":true,"idempotentHint":false,"openWorldHint":true}; The name "hgr_change_ai_publisher_status" says "status": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Changes AI Publisher automation status for one visible store. Requires confirmed=true and impactConfirmed=true. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_create_ai_publisher_agentCreates/activates the default AI Publisher automation for one visible store.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_create_ai_publisher_agent" says "create": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Creates/activates the default AI Publisher automation for one visible store. Requires confirmed=true and impactConfirmed=true. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_create_support_ticketCreates a text-only support ticket.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_create_support_ticket" says "create": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Creates a text-only support ticket. File attachments are blocked by MCP policy. Requires confirmed=true.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_delete_pricing_ruleDeletes/deactivates a pricing rule for one visible store.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_delete_pricing_rule" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Deletes/deactivates a pricing rule for one visible store. Requires confirmed=true and impactConfirmed=true because pricing rules can affect many listings. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_force_process_order_linesForces processing for orders resolved from visible order Reference.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Forces processing for orders resolved from visible order Reference. Requires confirmed=true. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_force_refresh_listingsRequests ForceRefresh for visible Product IDs.Reads text others writeNo findings

    Why it is in this group

    • The description's first verb is "request": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Requests ForceRefresh for visible Product IDs. This confirms the request, not an immediate visible stock or price update. Requires confirmed=true. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_generate_tracking_idGenerates HGR tracking for exact order lines when WAPI allows it.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_generate_tracking_id" says "generate": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Generates HGR tracking for exact order lines when WAPI allows it. The MCP checks current WAPI order status and current WAPI fee data before executing. Requires confirmed=true. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_list_pending_nowPublishes one pending listing immediately by its visible pending listing id.Reads text others write1 finding

    Why it is in this group

    • The name "hgr_list_pending_now" says "list": a word for reading.
    • The description's first verb is "publish": a word for a change that another call does not undo.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "hgr_list_pending_now" destructive (destructiveHint: true), and its name says "list", a word for reading.

      Matched text

      annotations: {"readOnlyHint":false,"destructiveHint":true,"idempotentHint":false,"openWorldHint":true}; The name "hgr_list_pending_now" says "list": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Publishes one pending listing immediately by its visible pending listing id. Requires confirmed=true. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_make_default_templateMarks a listing template as default for one visible store/channel.Reads text others writeNo findings

    Why it is in this group

    • The description's first verb is "mark": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Marks a listing template as default for one visible store/channel. Requires HGRApi Header channel / ChannelOAuthId resolved internally, confirmed=true and impactConfirmed=true because templates can affect publishing flows.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_manually_dispatch_order_linesMarks orders resolved from visible order Reference as manually dispatched.Reads text others writeNo findings

    Why it is in this group

    • The description's first verb is "mark": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Marks orders resolved from visible order Reference as manually dispatched. Requires confirmed=true. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_mark_order_lines_as_purchasedMarks exact order lines as purchased in HGR.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_mark_order_lines_as_purchased" says "mark": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Marks exact order lines as purchased in HGR. The MCP resolves current WAPI status and uses FixedOrderLine only for CompletedAutoOrderPending. Requires confirmed=true after showing the full HGRWeb warning. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_mark_order_lines_fixedMarks orders resolved from visible order Reference as fixed/resolved.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_mark_order_lines_fixed" says "mark": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Marks orders resolved from visible order Reference as fixed/resolved. Requires confirmed=true. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_pause_pending_to_reviewMoves one pending listing to manual review by its visible pending listing id.Reads text others writeNo findings

    Why it is in this group

    • The description's first verb is "move": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Moves one pending listing to manual review by its visible pending listing id. Requires confirmed=true. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_post_ai_createtaskDedicated HGRApi tool for POST api/AI/CreateTask.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "hgr_post_ai_createtask" says "post": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "hgr_post_ai_createtask" says "post": it sends or publishes something to other people.
    Description, as the server wrote it
    Dedicated HGRApi tool for POST api/AI/CreateTask. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Provides the POST create task operation in AI optimization task management. Use when: Use it when a client needs to run the create task operation for AI optimization task management. Input: rq: Data.CreateTaskRequest. Main fields: Action: AIActionType, AutoPublish: bool, Listings: int[], Settings: CreateTaskRequestSetting[]. Header channel: current ChannelOAuthId. Output: Returns the result or applies the effect of the create task operation. Search terms: ai createtask. Send the exact request payload in body. Requires confirmed=true before execution. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_post_ai_publishnowDedicated HGRApi tool for POST api/AI/PublishNow.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "hgr_post_ai_publishnow" says "post": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "hgr_post_ai_publishnow" says "post": it sends or publishes something to other people.
    Description, as the server wrote it
    Dedicated HGRApi tool for POST api/AI/PublishNow. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Provides the POST publish now operation in AI optimization task management. Use when: Use it when a client needs to run the publish now operation for AI optimization task management. Input: rq: PublishNowRequest. Main fields: TaskId: int, ListingId: int. Header channel: current ChannelOAuthId. Output: Returns the result or applies the effect of the publish now operation. Search terms: ai publishnow. Send the exact request payload in body. Requires confirmed=true and impactConfirmed=true before execution. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_post_analytics_addworkDedicated HGRApi tool for POST api/Analytics/AddWork.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "hgr_post_analytics_addwork" says "post": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "hgr_post_analytics_addwork" says "post": it sends or publishes something to other people.
    Description, as the server wrote it
    Dedicated HGRApi tool for POST api/Analytics/AddWork. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Provides the POST add work operation in current-channel watcher analytics. Use when: Use it when a client needs to run the add work operation for current-channel watcher analytics. Input: rq: AddWorkRequest. Main fields: Ids: int[]. Header channel: current ChannelOAuthId. Output: Returns the result or applies the effect of the add work operation. Search terms: analytics addwork. Send the exact request payload in body. Requires confirmed=true before execution. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_post_catalog_submitcatalogDedicated HGRApi tool for POST api/Catalog/SubmitCatalog.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "hgr_post_catalog_submitcatalog" says "post": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "hgr_post_catalog_submitcatalog" says "post": it sends or publishes something to other people.
    Description, as the server wrote it
    Dedicated HGRApi tool for POST api/Catalog/SubmitCatalog. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Queues selected catalog candidates for publication or review. ownerAgent: publication. Use when: Use after selecting real candidates from Catalog/GetProducts. Not for discovering products, importing existing store inventory, or publishing ad-hoc URLs; use Listing/SaveBulkPublish for general URL publication. Input: CatalogSubmitRequest. Header channel is required. Each ProductsToList item contains the exact Url, Title, SubOrigin (CatalogSelection=1 or CatalogSearch=2) and optional PublishOn for individual scheduling. Optimization/review options and Origin remain supported. Legacy Id and DelaysMap remain accepted for existing first-steps clients. UserDevice is optional web telemetry; AI chat and MCP omit it. Output: Creates URL-based bulk jobs, records SubOrigin while preserving Origin=Catalog, and returns BatchId. Token/quota validation applies. Search terms: catalog submitcatalog. Send the exact request payload in body. Requires confirmed=true and impactConfirmed=true before execution. Requires HGRApi Header channel / ChannelOAuthId resolved internally. Internal-only request fields are removed automatically before the HGRApi request is sent.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_post_channellisting_clearonevariationDedicated HGRApi tool for POST api/ChannelListing/ClearOneVariation.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "hgr_post_channellisting_clearonevariation" says "post": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "hgr_post_channellisting_clearonevariation" says "post": it sends or publishes something to other people.
    Description, as the server wrote it
    Dedicated HGRApi tool for POST api/ChannelListing/ClearOneVariation. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Provides the POST clear one variation operation in published product creation and optimization. Use when: Use it when a client needs to run the clear one variation operation for published product creation and optimization. Input: rq: ClearVariationsRequest. Main fields: ChannelListingId: int. Header channel: current ChannelOAuthId. Output: Returns the result or applies the effect of the clear one variation operation. Search terms: channellisting clearonevariation. Send the exact request payload in body. Requires confirmed=true and impactConfirmed=true before execution. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_post_channellisting_clearvariationsDedicated HGRApi tool for POST api/ChannelListing/ClearVariations.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "hgr_post_channellisting_clearvariations" says "post": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "hgr_post_channellisting_clearvariations" says "post": it sends or publishes something to other people.
    Description, as the server wrote it
    Dedicated HGRApi tool for POST api/ChannelListing/ClearVariations. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Provides the POST clear variations operation in published product creation and optimization. Use when: Use it when a client needs to run the clear variations operation for published product creation and optimization. Input: Header channel: current ChannelOAuthId. Output: Returns the result or applies the effect of the clear variations operation. Search terms: channellisting clearvariations. Send the exact request payload in body. Requires confirmed=true and impactConfirmed=true before execution. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_post_channellisting_monitorexistinglistingDedicated HGRApi tool for POST api/ChannelListing/MonitorExistingListing.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "hgr_post_channellisting_monitorexistinglisting" says "post": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "hgr_post_channellisting_monitorexistinglisting" says "post": it sends or publishes something to other people.
    Description, as the server wrote it
    Dedicated HGRApi tool for POST api/ChannelListing/MonitorExistingListing. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Imports or monitors existing channel listings in HGR. Imported listings are always activated. ownerAgent: publication. Use when: Use when concrete existing store listing/product ids and source URLs are already selected and the user wants HGR to monitor/import those existing listings. Input: [FromBody] model: AddListingModel. Main fields: OAuthId: int, Listings: ListingToMonitor[]. Header channel: current ChannelOAuthId. ToRelist is currently ignored. UserDevice is optional HGRWeb client telemetry; AI chat and MCP must omit it and must not invent a device value. Output: Returns import/monitoring results with inserted, invalid, repeated and quota-related entries. Imported eBay API variations preserve VAT when the store supplies it; unknown VAT is not inferred from the publication default. Search terms: channellisting monitorexistinglisting. Send the exact request payload in body. Requires confirmed=true before execution. Requires HGRApi Header channel / ChannelOAuthId resolved internally. Internal-only request fields are removed automatically before the HGRApi request is sent.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_post_channellisting_monitorexistinglisting2Dedicated HGRApi tool for POST api/ChannelListing/MonitorExistingListing2.Reads text others writeCan send data out2 findings

    Why it is in this group

    • The name "hgr_post_channellisting_monitorexistinglisting2" says "post": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "hgr_post_channellisting_monitorexistinglisting2" says "post": it sends or publishes something to other people.

    Findings

    • Warn

      The description contains a 42-character base64 string.

      Matched text

      description: "...GRApi tool for POST api/ChannelListing/MonitorExistingListing2. This is an explici..."

      What this check looks for
    • Warn

      The input schema at properties.body.description contains a 43-character base64 string.

      Matched text

      inputSchema.properties.body.description: "HGRApi POST /api/ChannelListing/MonitorExistingListing2 request body."

      What this check looks for
    Description, as the server wrote it
    Dedicated HGRApi tool for POST api/ChannelListing/MonitorExistingListing2. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Imports existing store products into HGR with live progress over one HTTP stream. Imported products are activated; no new marketplace adverts are published. ownerAgent: publication. Use when: Use when exact existing store product ids and supplier URLs are selected and the caller can keep an SSE response open. Send the entire selection in one request. Do not use for catalog discovery or new marketplace publication. Input: Authenticated, not admin-only. Body: AddListingModel with Listings containing Id, SourceURL and optional VariationSku, VariationAttributes, SourceVariation, SourceWarehouse, Markup and Title. Requires Header channel: authorized ChannelOAuthId; the body OAuthId does not override it. ToRelist is ignored. UserDevice is optional web telemetry; AI and MCP must omit it. Output: SSE progress events contain phase, total, processed, imported, alreadyExisting, rejected, failed and optional itemId, error, pages, totalPages and cachedProducts. The terminal completed event contains inserted, wereInYourHGR, repeated, emptyUrl, notValidUrl, failed (id, variationSku, error), total, processed, ok and error. Inspect ok, failed and processed/total; a terminal event alone does not mean all products were imported. An unexpected stream failure emits error. Search terms: monitorexistinglisting 2, channellisting monitorexistinglisting 2. Send the exact request payload in body. Requires confirmed=true before execution. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_post_channellisting_optimizeimageDedicated HGRApi tool for POST api/ChannelListing/OptimizeImage.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "hgr_post_channellisting_optimizeimage" says "post": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "hgr_post_channellisting_optimizeimage" says "post": it sends or publishes something to other people.
    Description, as the server wrote it
    Dedicated HGRApi tool for POST api/ChannelListing/OptimizeImage. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Provides the POST optimize image operation in published product creation and optimization. Use when: Use it when a client needs to run the optimize image operation for published product creation and optimization. Input: rq: OptimizeImageRequest. Main fields: ImageUrl: string, Action: AIActionType, Settings: Setting[]. Header channel: current ChannelOAuthId. Output: Returns the result or applies the effect of the optimize image operation. Search terms: channellisting optimizeimage. Send the exact request payload in body. Requires confirmed=true before execution. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_post_channellisting_optimizespecificfieldsDedicated HGRApi tool for POST api/ChannelListing/OptimizeSpecificFields.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "hgr_post_channellisting_optimizespecificfields" says "post": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "hgr_post_channellisting_optimizespecificfields" says "post": it sends or publishes something to other people.
    Description, as the server wrote it
    Dedicated HGRApi tool for POST api/ChannelListing/OptimizeSpecificFields. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Provides the POST optimize specific fields operation in published product creation and optimization. Use when: Use it when a client needs to run the optimize specific fields operation for published product creation and optimization. Input: rq: OptimizeSpecificFieldsRequest. Main fields: ProductSourceId: int, Fields: ChannelSpecificField[]. Header channel: current ChannelOAuthId. Output: Returns the result or applies the effect of the optimize specific fields operation. Search terms: channellisting optimizespecificfields. Send the exact request payload in body. Requires confirmed=true before execution. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_post_dispatch_updateshipmentdetailsDedicated HGRApi tool for POST api/Dispatch/UpdateShipmentDetails.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "hgr_post_dispatch_updateshipmentdetails" says "post": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "hgr_post_dispatch_updateshipmentdetails" says "post": it sends or publishes something to other people.
    Description, as the server wrote it
    Dedicated HGRApi tool for POST api/Dispatch/UpdateShipmentDetails. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Provides the POST update shipment details operation in shipping and dispatch operations. Use when: Use it when a client needs to run the update shipment details operation for shipping and dispatch operations. Input: [FromBody] request: VelociPackerShipmentUpdateRequest. Main fields: TrackingCode: string, OrderReference: string, DeliveredOn: DateTime. Output: Returns the result or applies the effect of the update shipment details operation. Search terms: dispatch updateshipmentdetails. Send the exact request payload in body. Requires confirmed=true before execution.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_post_helpcentre_contactDedicated HGRApi tool for POST api/HelpCentre/Contact.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "hgr_post_helpcentre_contact" says "post": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "hgr_post_helpcentre_contact" says "post": it sends or publishes something to other people.
    Description, as the server wrote it
    Dedicated HGRApi tool for POST api/HelpCentre/Contact. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Creates a legacy authenticated help-centre contact ticket. Domain: support. Entity: support_ticket. Operation: create. Scope: authenticated_user. Use when: Use for legacy contact form submissions where a visible ticket id is not required. AIChat must prefer Contact2 when it needs to show the created ticket reference/link. Input: rq: ContactModel. Main fields: Message: string, Attachments: Attachment[]. Optional X-HGR-Client: ai_chat identifies the HGR AI chat gateway; normal web requests omit it. Output: Boolean success flag only. It does not return a visible ticket id. The creation event actor is human for web submissions or ai_chat for HGR AI chat; the first message remains an inbound customer message. Search terms: helpcentre contact. Send the exact request payload in body. Requires confirmed=true before execution.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_post_listing_autolistDedicated HGRApi tool for POST api/Listing/AutoList.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "hgr_post_listing_autolist" says "post": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "hgr_post_listing_autolist" says "post": it sends or publishes something to other people.
    Description, as the server wrote it
    Dedicated HGRApi tool for POST api/Listing/AutoList. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Provides the POST auto list operation in bulk publication and publication tracking. Use when: Use it when a client needs to run the auto list operation for bulk publication and publication tracking. Input: request: AutoListRequest. Main fields: WeListForYou: bool. Header channel: current ChannelOAuthId. Output: Returns the result or applies the effect of the auto list operation. Search terms: listing autolist. Send the exact request payload in body. Requires confirmed=true before execution. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_post_listing_migratebulkDedicated HGRApi tool for POST api/Listing/MigrateBulk.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "hgr_post_listing_migratebulk" says "post": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "hgr_post_listing_migratebulk" says "post": it sends or publishes something to other people.
    Description, as the server wrote it
    Dedicated HGRApi tool for POST api/Listing/MigrateBulk. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Queues selected listings for migration to a target channel in bulk. ownerAgent: publication. Use when: Use when concrete listing ids and a target channel are already selected and the user wants to migrate/copy them in bulk. Input: data: MigrateBulkRequest. Main fields: ListingIds: int[], TargetId: int, listFrequencyMinutes: int, dontListUntil: DateTime?, reviewBeforePublishing: bool, createdBy: int, ignoreVero: bool, ignoreOOS: bool, optimizeTitle: bool, optimizeDescription: bool, optimizeFields: bool. Header channel: current ChannelOAuthId. UserDevice is optional HGRWeb client telemetry; AI chat and MCP must omit it and must not invent a device value. Output: Creates migration bulk jobs for the selected listing ids. Search terms: listing migratebulk. Send the exact request payload in body. Requires confirmed=true and impactConfirmed=true before execution. Requires HGRApi Header channel / ChannelOAuthId resolved internally. Internal-only request fields are removed automatically before the HGRApi request is sent.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_post_listing_partnerDedicated HGRApi tool for POST api/Listing/Partner.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "hgr_post_listing_partner" says "post": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "hgr_post_listing_partner" says "post": it sends or publishes something to other people.
    Description, as the server wrote it
    Dedicated HGRApi tool for POST api/Listing/Partner. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Provides the POST partner operation in bulk publication and publication tracking. Use when: Use it when a client needs to run the partner operation for bulk publication and publication tracking. Input: request: AutoListRequest. Main fields: WeListForYou: bool. Header channel: current ChannelOAuthId. Output: Returns the result or applies the effect of the partner operation. Search terms: listing partner. Send the exact request payload in body. Requires confirmed=true before execution. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_post_listing_relistedbulk2Dedicated HGRApi tool for POST api/Listing/RelistedBulk2.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "hgr_post_listing_relistedbulk2" says "post": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "hgr_post_listing_relistedbulk2" says "post": it sends or publishes something to other people.
    Description, as the server wrote it
    Dedicated HGRApi tool for POST api/Listing/RelistedBulk2. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Queues selected existing listings for relisting in bulk. ownerAgent: publication. Use when: Use when concrete listing ids are already selected and the user wants to relist them in bulk. Input: data: RelistedBulk2Request. Main fields: ListingIds: int[], listFrequencyMinutes: int, dontListUntil: DateTime?, reviewBeforePublishing: bool, createdBy: int, ignoreVero: bool, ignoreOOS: bool, optimizeTitle: bool, optimizeDescription: bool, optimizeFields: bool. Header channel: current ChannelOAuthId. UserDevice is optional HGRWeb client telemetry; AI chat and MCP must omit it and must not invent a device value. Output: Creates relist bulk jobs for the selected listing ids. Search terms: relistedbulk 2, listing relistedbulk 2. Send the exact request payload in body. Requires confirmed=true before execution. Requires HGRApi Header channel / ChannelOAuthId resolved internally. Internal-only request fields are removed automatically before the HGRApi request is sent.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_post_listing_saveautolistDedicated HGRApi tool for POST api/Listing/SaveAutolist.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "hgr_post_listing_saveautolist" says "post": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "hgr_post_listing_saveautolist" says "post": it sends or publishes something to other people.
    Description, as the server wrote it
    Dedicated HGRApi tool for POST api/Listing/SaveAutolist. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Saves a bulk/autolist publication batch. ownerAgent: publication. Use when: Use when the user wants to queue multiple source URLs for publication or review through the autolist/bulk listing flow. Input: data: SaveAutolistRequest. Main fields: listings: string[][], listFrequencyMinutes: int, dontListUntil: DateTime?, reviewBeforePublishing: bool, createdBy: int, ignoreVero: bool, ignoreOOS: bool, optimizeTitle: bool, optimizeDescription: bool, optimizeFields: bool, publishVariations: bool, WeListForYou: bool, GeneratorId: int?. Each listings row is [sourceUrl] or [sourceUrl, optionalTitle]. sourceUrl is required; an omitted, null or empty title means no custom title is supplied. A supplied title is preserved. Header channel: current ChannelOAuthId. UserDevice is optional HGRWeb client telemetry; AI chat and MCP must omit it and must not invent a device value. Output: Creates bulk listing jobs and returns an AutolistSummaryViewModel with processed, duplicated, invalid and quota-related counts. Search terms: listing saveautolist. Send the exact request payload in body. Requires confirmed=true before execution. Requires HGRApi Header channel / ChannelOAuthId resolved internally. Internal-only request fields are removed automatically before the HGRApi request is sent.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_post_listing_savebulkpublishDedicated HGRApi tool for POST api/Listing/SaveBulkPublish.Reads text others writeCan send data out1 finding

    Why it is in this group

    • The name "hgr_post_listing_savebulkpublish" says "post": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "hgr_post_listing_savebulkpublish" says "post": it sends or publishes something to other people.

    Findings

    • Info

      The description is 2,046 characters long, over the 2,000 this check looks for.

      Matched text

      description ends: "...-only request fields are removed automatically before the HGRApi request is sent."

      What this check looks for
    Description, as the server wrote it
    Dedicated HGRApi tool for POST api/Listing/SaveBulkPublish. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Saves a batch of URLs for bulk publication and returns one result per line. ownerAgent: publication. SearchTerms: save bulk publish, bulk publish, bulk publishing, mass publication, publicar en bulk. Use when: Use it when the client needs to know exactly which line was processed and which line was rejected without summarizing only by counts. Use it when selected products are source product URLs, Amazon URLs, ASIN URLs converted to source URLs, or source-page URLs. Do not use it to get existing listings or search candidates. Input: data: SaveAutolistRequest. Main fields: listings: string[][], listFrequencyMinutes: int, dontListUntil: DateTime?, reviewBeforePublishing: bool, createdBy: int, ignoreVero: bool, ignoreOOS: bool, optimizeTitle: bool, optimizeDescription: bool, optimizeFields: bool, publishVariations: bool, WeListForYou: bool. listings is string[][] where each row is [sourceUrl, optionalTitle]; sourceUrl is the supplier/source product URL to publish. Use reviewBeforePublishing for pending review, optimizeTitle/optimizeDescription/optimizeFields for optimization choices, and listFrequencyMinutes/dontListUntil for delayed publication. Do not send CatalogSubmitRequest.ProductsToList here. Header channel: current ChannelOAuthId. Internal client fields are managed by the tool and are not tool inputs. Output: Returns SaveBulkPublishLineStatus[] in the same order as listings. Values: Processed, ForbiddenWordsUrl, DuplicatedUrl, InvalidUrl, InvalidSourceUrl, ExistingListing, NoQuota, InvalidGenerator or DuplicatedProductSource. Search terms: listing savebulkpublish. Send the exact request payload in body. Requires confirmed=true and impactConfirmed=true before execution. Requires HGRApi Header channel / ChannelOAuthId resolved internally. Internal-only request fields are removed automatically before the HGRApi request is sent.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_post_listingcreate_editpendingDedicated HGRApi tool for POST api/ListingCreate/EditPending.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "hgr_post_listingcreate_editpending" says "post": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "hgr_post_listingcreate_editpending" says "post": it sends or publishes something to other people.
    Description, as the server wrote it
    Dedicated HGRApi tool for POST api/ListingCreate/EditPending. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Provides the POST edit pending operation in manual product creation. Use when: Use it when a client needs to run the edit pending operation for manual product creation. Input: [FromBody] rq: EditPendingRequest. Main fields: ListingId: int. Header channel: current ChannelOAuthId. Output: Returns the result or applies the effect of the edit pending operation. Search terms: listingcreate editpending. Send the exact request payload in body. Requires confirmed=true before execution. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_post_listingcreate_submitDedicated HGRApi tool for POST api/ListingCreate/Submit.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "hgr_post_listingcreate_submit" says "post": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "hgr_post_listingcreate_submit" says "post": it sends or publishes something to other people.
    Description, as the server wrote it
    Dedicated HGRApi tool for POST api/ListingCreate/Submit. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Submits a manually prepared listing for creation. ownerAgent: publication. Use when: Use only after manual listing creation data has already been prepared and the user wants to create or queue that exact listing. Input: [FromBody] rq: SubmitCreateRequest, compatible with CreateRequest. Variation Markup settings are rounded to the nearest integer, with midpoint values rounded away from zero. Non-finite, malformed or out-of-range Markup values are ignored without deleting an existing override. For eBay API only, a missing VAT variation setting is initialized from the saved draft VAT or the store's PublishVAT default. Explicit product VAT, including zero, is preserved. VAT must be an integer from 0 to 100. UserDevice is optional HGRWeb client telemetry; AI chat and MCP must omit it and must not invent a device value. Output: Creates the listing through ListingService and returns success. Search terms: listingcreate submit. Send the exact request payload in body. Requires confirmed=true and impactConfirmed=true before execution. Requires HGRApi Header channel / ChannelOAuthId resolved internally. Internal-only request fields are removed automatically before the HGRApi request is sent.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_post_notificationcenter_markallasreadDedicated HGRApi tool for POST api/NotificationCenter/MarkAllAsRead.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "hgr_post_notificationcenter_markallasread" says "post": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "hgr_post_notificationcenter_markallasread" says "post": it sends or publishes something to other people.
    Description, as the server wrote it
    Dedicated HGRApi tool for POST api/NotificationCenter/MarkAllAsRead. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Provides the POST mark all as read operation in notification centre operations. Use when: Use it when a client needs to run the mark all as read operation for notification centre operations. Input: No explicit input parameters required. Output: Returns the result or applies the effect of the mark all as read operation. Search terms: notificationcenter markallasread. Send the exact request payload in body. Requires confirmed=true before execution. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_post_notificationcenter_markallchannelasreadDedicated HGRApi tool for POST api/NotificationCenter/MarkAllChannelAsRead.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "hgr_post_notificationcenter_markallchannelasread" says "post": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "hgr_post_notificationcenter_markallchannelasread" says "post": it sends or publishes something to other people.
    Description, as the server wrote it
    Dedicated HGRApi tool for POST api/NotificationCenter/MarkAllChannelAsRead. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Provides the POST mark all channel as read operation in notification centre operations. Use when: Use it when a client needs to run the mark all channel as read operation for notification centre operations. Input: Header channel: current ChannelOAuthId. Output: Returns the result or applies the effect of the mark all channel as read operation. Search terms: notificationcenter markallchannelasread. Send the exact request payload in body. Requires confirmed=true before execution. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_post_notificationcenter_markasreadDedicated HGRApi tool for POST api/NotificationCenter/MarkAsRead.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "hgr_post_notificationcenter_markasread" says "post": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "hgr_post_notificationcenter_markasread" says "post": it sends or publishes something to other people.
    Description, as the server wrote it
    Dedicated HGRApi tool for POST api/NotificationCenter/MarkAsRead. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Provides the POST mark as read operation in notification centre operations. Use when: Use it when a client needs to run the mark as read operation for notification centre operations. Input: rq: MarkAsReadRequest. Header channel: current ChannelOAuthId. Output: Returns the result or applies the effect of the mark as read operation. Search terms: notificationcenter markasread. Send the exact request payload in body. Requires confirmed=true before execution. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_post_sales_fixedorderlineDedicated HGRApi tool for POST api/Sales/FixedOrderLine.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "hgr_post_sales_fixedorderline" says "post": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "hgr_post_sales_fixedorderline" says "post": it sends or publishes something to other people.
    Description, as the server wrote it
    Dedicated HGRApi tool for POST api/Sales/FixedOrderLine. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Completes an exact order line that is in CompletedAutoOrderPending. ownerAgent: orders-autoordering. Domain: orders. Entity: order_line. Operation: complete_pending_autoorder. Scope: current_store. Use when: Use only for an exact order line whose current state is CompletedAutoOrderPending and the user confirms the corresponding visible Mark as Purchased action. Input: [FromBody] rq: LoadAddressesFromOrderLineRequest. Main fields: OrderLineIds: int[]. Required Header channel: current ChannelOAuthId. Output: Moves eligible CompletedAutoOrderPending lines to CompletedAutoOrder and returns refreshed order data. Search terms: sales fixedorderline. Send the exact request payload in body. Requires confirmed=true before execution. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_post_sales_forceprocessorderlineDedicated HGRApi tool for POST api/Sales/ForceProcessOrderLine.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "hgr_post_sales_forceprocessorderline" says "post": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "hgr_post_sales_forceprocessorderline" says "post": it sends or publishes something to other people.
    Description, as the server wrote it
    Dedicated HGRApi tool for POST api/Sales/ForceProcessOrderLine. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Provides the POST force process order line operation in sales/order operations. Use when: Use it when a client needs to run the force process order line operation for sales/order operations. Input: [FromBody] rq: LoadAddressesFromOrderLineRequest. Main fields: OrderLineIds: int[]. Header channel: current ChannelOAuthId. Output: Returns the result or applies the effect of the force process order line operation. Search terms: sales forceprocessorderline. Send the exact request payload in body. Requires confirmed=true and impactConfirmed=true before execution. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_post_sales_generatetrackingidDedicated HGRApi tool for POST api/Sales/GenerateTrackingId.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "hgr_post_sales_generatetrackingid" says "post": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "hgr_post_sales_generatetrackingid" says "post": it sends or publishes something to other people.
    Description, as the server wrote it
    Dedicated HGRApi tool for POST api/Sales/GenerateTrackingId. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Generates an HGR/VelociPacker tracking number for exact existing order lines that have already been processed or marked as purchased. ownerAgent: orders-autoordering. Domain: orders. Entity: order_line. Operation: generate_tracking. Scope: current_store. Use when: Use it when the user explicitly asks HGR to generate tracking for an existing order. A manually purchased supplier order must first be marked as purchased in HGR; in HGRWeb the user then clicks Generate it in Orders. Input: [FromBody] rq: LoadAddressesFromOrderLineRequest. Main fields: OrderLineIds: int[]. Required Header channel: current ChannelOAuthId. Output: Queues HGR/VelociPacker tracking generation for each supplied order line and returns refreshed order data on success or the processing result when generation cannot start. Search terms: sales generatetrackingid. Send the exact request payload in body. Requires confirmed=true before execution. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_post_sales_manuallydispatchorderlineDedicated HGRApi tool for POST api/Sales/ManuallyDispatchOrderLine.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "hgr_post_sales_manuallydispatchorderline" says "post": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "hgr_post_sales_manuallydispatchorderline" says "post": it sends or publishes something to other people.
    Description, as the server wrote it
    Dedicated HGRApi tool for POST api/Sales/ManuallyDispatchOrderLine. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Records exact existing order lines as manually purchased in HGR. This is the HGRWeb Mark as Purchased action for normal manual-purchase states. ownerAgent: orders-autoordering. Domain: orders. Entity: order_line. Operation: mark_purchased. Scope: current_store. Use when: Use only after the user confirms that they already placed the real supplier order manually and wants to record that purchase in HGR before generating HGR/VelociPacker tracking. Input: [FromBody] rq: LoadAddressesFromOrderLineRequest. Main fields: OrderLineIds: int[]. Required Header channel: current ChannelOAuthId. Output: Changes eligible order lines to the manually purchased state and returns refreshed order data. Search terms: sales manuallydispatchorderline. Send the exact request payload in body. Requires confirmed=true before execution. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_post_sales_markasdispatchedDedicated HGRApi tool for POST api/Sales/MarkAsDispatched.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "hgr_post_sales_markasdispatched" says "post": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "hgr_post_sales_markasdispatched" says "post": it sends or publishes something to other people.
    Description, as the server wrote it
    Dedicated HGRApi tool for POST api/Sales/MarkAsDispatched. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Acknowledges in HGR that an order-dispatch warning was handled manually for one exact order line. ownerAgent: orders-autoordering. Domain: orders. Entity: order_line. Operation: acknowledge_manual_dispatch. Scope: current_store. Use when: Use only when the user explicitly wants to clear the HGR warning after manually handling dispatch in the marketplace. Input: [FromBody] rq: AddAutoOrderReferenceRequest. Main field: OrderLineId: int. Required Header channel: current ChannelOAuthId. Output: Marks the dispatch warning as acknowledged in HGR and returns whether the order line was updated. Search terms: sales markasdispatched. Send the exact request payload in body. Requires confirmed=true before execution. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_post_sales_processorderlineDedicated HGRApi tool for POST api/Sales/ProcessOrderLine.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "hgr_post_sales_processorderline" says "post": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "hgr_post_sales_processorderline" says "post": it sends or publishes something to other people.
    Description, as the server wrote it
    Dedicated HGRApi tool for POST api/Sales/ProcessOrderLine. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Starts automatic supplier purchase processing for exact existing order lines using the current saved auto-ordering settings. ownerAgent: orders-autoordering. Use when: Use it when the user explicitly wants to process or retry an existing order after correcting a payment card or another auto-ordering setting. Input: [FromBody] rq: LoadAddressesFromOrderLineRequest. Main fields: OrderLineIds: int[]. Required Header channel: current ChannelOAuthId. Output: Attempts normal processing for each supplied order line and returns refreshed order data on success or the processing error result. Search terms: sales processorderline. Send the exact request payload in body. Requires confirmed=true before execution. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_post_sales_stoporderlineDedicated HGRApi tool for POST api/Sales/StopOrderLine.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "hgr_post_sales_stoporderline" says "post": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "hgr_post_sales_stoporderline" says "post": it sends or publishes something to other people.
    Description, as the server wrote it
    Dedicated HGRApi tool for POST api/Sales/StopOrderLine. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Provides the POST stop order line operation in sales/order operations. Use when: Use it when a client needs to run the stop order line operation for sales/order operations. Input: [FromBody] rq: LoadAddressesFromOrderLineRequest. Main fields: OrderLineIds: int[]. Header channel: current ChannelOAuthId. Output: Returns the result or applies the effect of the stop order line operation. Search terms: sales stoporderline. Send the exact request payload in body. Requires confirmed=true before execution. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_post_searchproduct_defaultsettingsmultipleDedicated HGRApi tool for POST api/SearchProduct/DefaultSettingsMultiple.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "hgr_post_searchproduct_defaultsettingsmultiple" says "post": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "hgr_post_searchproduct_defaultsettingsmultiple" says "post": it sends or publishes something to other people.
    Description, as the server wrote it
    Dedicated HGRApi tool for POST api/SearchProduct/DefaultSettingsMultiple. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Provides the POST default settings multiple operation in existing published product/listing management. Use when: Use it when a client needs to run the default settings multiple operation for existing published product/listing management. Input: [FromBody] rq: RemoveMultipleListingRequest. Main fields: Ids: int[]. Header channel: current ChannelOAuthId. Output: Returns the result or applies the effect of the default settings multiple operation. Search terms: searchproduct defaultsettingsmultiple. Send the exact request payload in body. Requires confirmed=true before execution. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_post_searchproduct_listnowDedicated HGRApi tool for POST api/SearchProduct/ListNow.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "hgr_post_searchproduct_listnow" says "post": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "hgr_post_searchproduct_listnow" says "post": it sends or publishes something to other people.
    Description, as the server wrote it
    Dedicated HGRApi tool for POST api/SearchProduct/ListNow. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Retries a failed pending publication or submits a pending product now. Domain: listings. Entity: pending_listing. Operation: retry_or_publish. Scope: current_store. State: pending. RequiredInputs: confirmed. ownerAgent: publication. SupportingAgents: listings, support. AllowedIntents: retry_pending_publication, publish_pending_listing. ReadOnly: false. RequiresConfirmation: true. RequiresChannel: true. Use when: The user asks to retry or resubmit an existing pending product after fixing a marketplace error, or explicitly asks to publish a pending product now. Use this action instead of telling the user to click Retry in HGRWeb. SearchTerms: retry pending listing, retry publishing, publish pending listing now, resubmit pending product, retry failed publication, retry ebay publication. NegativeUseCases: Do not retry automatically merely because the user asks what the error means; Do not use for relisting an active or terminated product. Input: [FromBody] rq: Request.ListNowRequest. Id is the first variation ID, not its parent ListingId. Resolve the attached product or GetPending listingId through Listing/GetListings with ListingIds and Projection=Identifiers in the selected channel, then use variations[0].id, as HGRWeb Retry does. Header channel: current ChannelOAuthId. Output: BaseResponse.Success reports whether the retry or scheduling request was accepted, not whether marketplace publication has completed. Search terms: searchproduct listnow. Send the exact request payload in body. Requires confirmed=true before execution. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_post_searchproduct_optimizeDedicated HGRApi tool for POST api/SearchProduct/Optimize.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "hgr_post_searchproduct_optimize" says "post": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "hgr_post_searchproduct_optimize" says "post": it sends or publishes something to other people.
    Description, as the server wrote it
    Dedicated HGRApi tool for POST api/SearchProduct/Optimize. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Provides the POST optimize operation in existing published product/listing management. Use when: Use it when a client needs to run the optimize operation for existing published product/listing management. Input: [FromBody] data: OptimizeRequest. Main fields: ListingId: int?, ProductSourceId: int?, CurrentTitle: string, OptimizeTitle: bool, OptimizeDescription: bool, OptimizeFields: bool. Header channel: current ChannelOAuthId. Output: Returns the result or applies the effect of the optimize operation. Search terms: searchproduct optimize. Send the exact request payload in body. Requires confirmed=true before execution. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_post_searchproduct_pausetoreviewDedicated HGRApi tool for POST api/SearchProduct/PauseToReview.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "hgr_post_searchproduct_pausetoreview" says "post": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "hgr_post_searchproduct_pausetoreview" says "post": it sends or publishes something to other people.
    Description, as the server wrote it
    Dedicated HGRApi tool for POST api/SearchProduct/PauseToReview. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Moves a scheduled pending product to manual review so it is not published at its scheduled time. ReadOnly: false. RequiresConfirmation: true. RequiresChannel: true. Use when: The user asks to pause, hold or stop a scheduled pending product so it is reviewed before publication. SearchTerms: pause pending listing, move pending listing to review, hold scheduled publication, stop scheduled listing. NegativeUseCases: Do not use for active or terminated listings. Input: [FromBody] rq: Request.ListNowRequest. Id is the first variation ID, not its parent ListingId. Resolve the attached product or GetPending listingId through Listing/GetListings with ListingIds and Projection=Identifiers in the selected channel, then use variations[0].id, as HGRWeb Pause does. Header channel: current ChannelOAuthId. Output: BaseResponse.Success is true when the product moved to review. It is false when the variation belongs to another channel, the product is not scheduled for its first listing, or its scheduled time is less than 3 minutes away. Search terms: searchproduct pausetoreview. Send the exact request payload in body. Requires confirmed=true before execution. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_post_searchproduct_relistDedicated HGRApi tool for POST api/SearchProduct/Relist.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "hgr_post_searchproduct_relist" says "post": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "hgr_post_searchproduct_relist" says "post": it sends or publishes something to other people.
    Description, as the server wrote it
    Dedicated HGRApi tool for POST api/SearchProduct/Relist. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Provides the POST relist operation in existing published product/listing management. Use when: Use it when a client needs to run the relist operation for existing published product/listing management. Input: [FromBody] rq: RelistRequest. Main fields: Id: int. Header channel: current ChannelOAuthId. Output: Returns the result or applies the effect of the relist operation. Search terms: searchproduct relist. Send the exact request payload in body. Requires confirmed=true before execution. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_post_searchproduct_removelistingDedicated HGRApi tool for POST api/SearchProduct/RemoveListing.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "hgr_post_searchproduct_removelisting" says "post": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "hgr_post_searchproduct_removelisting" says "post": it sends or publishes something to other people.
    Description, as the server wrote it
    Dedicated HGRApi tool for POST api/SearchProduct/RemoveListing. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Removes one listing from HGR. HGRWeb uses it to delete pending listings in review or error so they are never published. ReadOnly: false. RequiresConfirmation: true. RequiresChannel: true. Use when: The user explicitly asks to remove or delete a pending listing so it is never published. SearchTerms: remove pending listing, delete pending listing, remove listing from HGR. Input: [FromBody] rq: Request.ListNowRequest. Id is a variation ID of the listing to remove, not its parent ListingId. Resolve the attached product or GetPending listingId through Listing/GetListings with ListingIds and Projection=Identifiers in the selected channel, then use variations[0].id, as HGRWeb Remove does. The whole listing that owns that variation is removed. Header channel: current ChannelOAuthId, used to resolve the variation; the endpoint itself does not check it. Output: BaseResponse.Success is true when the listing was marked removed and false when no listing in the authenticated user's stores owns that variation ID. Search terms: searchproduct removelisting. Send the exact request payload in body. Requires confirmed=true and impactConfirmed=true before execution. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_post_searchproduct_savemultipleproductchangesDedicated HGRApi tool for POST api/SearchProduct/SaveMultipleProductChanges.Reads text others writeCan send data out1 finding

    Why it is in this group

    • The name "hgr_post_searchproduct_savemultipleproductchanges" says "post": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "hgr_post_searchproduct_savemultipleproductchanges" says "post": it sends or publishes something to other people.

    Findings

    • Info

      The description is 2,091 characters long, over the 2,000 this check looks for.

      Matched text

      description ends: "...e execution. Requires HGRApi Header channel / ChannelOAuthId resolved internally."

      What this check looks for
    Description, as the server wrote it
    Dedicated HGRApi tool for POST api/SearchProduct/SaveMultipleProductChanges. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Provides the POST save multiple product changes operation in existing published product/listing management. Use when: Use it when a client needs to run the save multiple product changes operation for existing published product/listing management. Input: [FromBody] changes: SaveMultipleProductChangesRequest. Main fields: ListingIds: int[], DataByListing: Dictionary<int, SaveMultipleProductChangesRequestD>, Markup: SaveProductChangeNumber, IncreaseMarkup: SaveProductChangeNumber, Price: SaveProductChangeDecimal, Quantity: SaveProductChangeNumber, Profit: SaveProductChangeNumber, MonitorPrice: SaveProductChangeBoolean, MonitorStock: SaveProductChangeBoolean, MonitorPriceDecrease: SaveProductChangeBoolean, PriceDecreasePercentage: SaveProductChangeNumber, IgnoreRules: SaveProductChangeBoolean, MinQuantity: SaveProductChangeNumber, PrimeOnly: SaveProductChangeBoolean, ShippingPolicy: SaveProductChangeLong, ReturnPolicy: SaveProductChangeLong, PaymentPolicy: SaveProductChangeLong, DispatchTimeDays: SaveProductChangeNumber. Header channel: current ChannelOAuthId. VAT is optional and only supported for eBay API: omit to leave unchanged, use {value: integer} from 0 to 100 to set, or {value: null} to remove the override and send zero to eBay. VAT applies to every variation of the affected eBay listing. Output: Returns the result or applies the effect of the save multiple product changes operation. Side effect: when a new channel stock quantity is applied to a listing variation, its previous channel stock quantity is recorded in the stock history (author: user), so it appears in the stock changes history. VAT settings are saved only for provider-accepted changes. Search terms: searchproduct savemultipleproductchanges. Send the exact request payload in body. Requires confirmed=true before execution. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_post_searchproduct_terminatelisting2Dedicated HGRApi tool for POST api/SearchProduct/TerminateListing2.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "hgr_post_searchproduct_terminatelisting2" says "post": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "hgr_post_searchproduct_terminatelisting2" says "post": it sends or publishes something to other people.
    Description, as the server wrote it
    Dedicated HGRApi tool for POST api/SearchProduct/TerminateListing2. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Provides the POST terminate listing2 operation in existing published product/listing management. Use when: Use it when a client needs to run the terminate listing2 operation for existing published product/listing management. Input: [FromBody] item: TerminateItemRequest. Main fields: Id: int. Header channel: current ChannelOAuthId. Output: Ends the listing in the store. Marks it terminated in HGR and returns success=true only when the store confirms the end or reports that the item was already ended. When the store refuses the end, returns success=false and the listing stays active in HGR. Search terms: terminatelisting 2, searchproduct terminatelisting 2. Send the exact request payload in body. Requires confirmed=true and impactConfirmed=true before execution. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_post_smartlister_filters_newDedicated HGRApi tool for POST ai publisher filters new.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "hgr_post_smartlister_filters_new" says "post": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "hgr_post_smartlister_filters_new" says "post": it sends or publishes something to other people.
    Description, as the server wrote it
    Dedicated HGRApi tool for POST ai publisher filters new. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Creates a scheduled AI Publisher publication order for the selected store, including search conditions copied from the catalog. ownerAgent: ai-publisher. Use when: Use to create an order with product conditions, quantity, schedule and optimization preferences. Input: NewFiltersRequest.Filter: supplier Sources, OnlyPrime, optional Criteria (the free-text search prompt, up to 4000 characters; not a literal title substring), PriceMin/PriceMax, ProfitMin/ProfitMax and optional Tags (array of separate integer IDs, not bit flags). Tag IDs: 1 Valentine's Day, 2 Mother's Day, 3 Father's Day, 4 Back to school, 5 Halloween, 6 Black Friday, 7 Cyber Monday, 8 Christmas, 9 New Year's Eve, 10 Prime Day, 11 Trending, 12 Home and garden, 13 Electronics, 14 Toys and games, 15 Health and beauty, 16 Sports, 17 Pet supplies. Header channel: current ChannelOAuthId; the selected store determines ChannelOauthId. Output: Returns the identifier of the created order. Search terms: ai publisher filters new. Send the exact request payload in body. Requires confirmed=true before execution. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_process_order_linesStarts normal processing for orders resolved from visible order Reference.Reads text others writeNo findings

    Why it is in this group

    • The description's first verb is "start": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Starts normal processing for orders resolved from visible order Reference. Requires confirmed=true. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_refresh_business_policiesRefreshes marketplace business policies for one visible store.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Refreshes marketplace business policies for one visible store. Requires confirmed=true. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_relist_listingRelists one terminated listing by visible Product ID.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Relists one terminated listing by visible Product ID. Requires confirmed=true and impactConfirmed=true after warning about consequences. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_remove_autoordering_configurationRemoves an auto-ordering configuration by autoOrderingAccountRef returned by hgr_get_autoordering_configuration for one visible store/channel.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_remove_autoordering_configuration" says "remove": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Removes an auto-ordering configuration by autoOrderingAccountRef returned by hgr_get_autoordering_configuration for one visible store/channel. Requires HGRApi Header channel / ChannelOAuthId resolved internally, confirmed=true and impactConfirmed=true after warning about consequences.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_remove_listingRemoves or retires one listing by visible Product ID, or a pending listing by the visible pending listing id.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_remove_listing" says "remove": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Removes or retires one listing by visible Product ID, or a pending listing by the visible pending listing id. Requires confirmed=true and impactConfirmed=true after warning about consequences. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_reply_support_ticketReplies to a support ticket with text only.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "hgr_reply_support_ticket" says "reply": a word for sending, and what is sent cannot be taken back.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "hgr_reply_support_ticket" says "reply": it sends or publishes something to other people.
    Description, as the server wrote it
    Replies to a support ticket with text only. File attachments are blocked by MCP policy. Requires confirmed=true.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_request_noapi_codeRequests a No-API Server verification code for a visible store.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_request_noapi_code" says "request": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Requests a No-API Server verification code for a visible store. Requires confirmed=true. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_save_ai_agent_configurationSaves AI Agent configuration.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_save_ai_agent_configuration" says "save": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Saves AI Agent configuration. Requires confirmed=true and impactConfirmed=true; activation requires acceptedAiAgentTerms=true and disabling requires disableWarningConfirmed=true. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_save_autoordering_configurationSaves auto-ordering configuration with the exact WAPI request body for one visible store/channel.Reads text others write1 finding

    Why it is in this group

    • The name "hgr_save_autoordering_configuration" says "save": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Info

      The description mentions "credential".

      Matched text

      description: "...e and impactConfirmed=true for supplier credential/configuration changes. Secret fields ar..."

      What this check looks for
    Description, as the server wrote it
    Saves auto-ordering configuration with the exact WAPI request body for one visible store/channel. Requires HGRApi Header channel / ChannelOAuthId resolved internally, confirmed=true and impactConfirmed=true for supplier credential/configuration changes. Secret fields are redacted in the response.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_save_channel_settingSaves one channel setting using WAPI SaveOne.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_save_channel_setting" says "save": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Saves one channel setting using WAPI SaveOne. Requires confirmed=true and impactConfirmed=true because channel settings can affect many listings. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_save_source_settingSaves one exact setting exposed by HGRWeb Supplier configuration.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_save_source_setting" says "save": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Saves one exact setting exposed by HGRWeb Supplier configuration. No supported setting enables, disables, suspends or re-enables a supplier. Requires confirmed=true and impactConfirmed=true because source settings can affect many listings. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_send_noapi_answerSends a No-API Server security answer.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "hgr_send_noapi_answer" says "send": a word for sending, and what is sent cannot be taken back.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "hgr_send_noapi_answer" says "send": it sends or publishes something to other people.
    Description, as the server wrote it
    Sends a No-API Server security answer. Requires confirmed=true. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_send_noapi_codeSends a No-API Server verification code.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "hgr_send_noapi_code" says "send": a word for sending, and what is sent cannot be taken back.
    • The input takes a statement or command to run (input.code), which can change anything it can reach.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "hgr_send_noapi_code" says "send": it sends or publishes something to other people.
    Description, as the server wrote it
    Sends a No-API Server verification code. Requires confirmed=true. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_set_manual_tracking_idSets the manual tracking/reference state for one exact order line using WAPI ManualTrackingIdSet.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_set_manual_tracking_id" says "set": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Sets the manual tracking/reference state for one exact order line using WAPI ManualTrackingIdSet. Requires confirmed=true. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_set_shipping_addressSets/corrects the shipping address for an order resolved from the visible order Reference.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_set_shipping_address" says "set": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Sets/corrects the shipping address for an order resolved from the visible order Reference. Requires confirmed=true. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_stop_order_linesStops orders resolved from visible order Reference.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_stop_order_lines" says "stop": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Stops orders resolved from visible order Reference. Requires confirmed=true. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_terminate_listingTerminates one active listing by visible Product ID.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_terminate_listing" says "terminate": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Terminates one active listing by visible Product ID. Requires confirmed=true and impactConfirmed=true after warning about consequences. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_update_ai_publisher_optimizationUpdates AI Publisher optimization columns.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_update_ai_publisher_optimization" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Updates AI Publisher optimization columns. Requires confirmed=true and impactConfirmed=true. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_update_listingChanges editable fields of one exact listing variation using HGRApi SaveProductChanges.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_update_listing" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Changes editable fields of one exact listing variation using HGRApi SaveProductChanges. Call only after the listing is exact and the user explicitly confirmed the action. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_update_noapi_serversUpdates No-API Server credentials/configuration with the exact WAPI credentials array for one visible store/channel.Reads text others write4 findings

    Why it is in this group

    • The name "hgr_update_noapi_servers" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Info

      The description mentions "credentials".

      Matched text

      description: "Updates No-API Server credentials/configuration with the exact WAPI crede..."

      What this check looks for
    • Info

      The input schema at properties.confirmed.description mentions "credential".

      Matched text

      inputSchema.properties.confirmed.description: "...icitly requested or confirmed the exact credential/configuration change."

      What this check looks for
    • Info

      The input schema at properties.impactConfirmed.description mentions "credential".

      Matched text

      inputSchema.properties.impactConfirmed.description: "...user explicitly confirmed the concrete credential/configuration consequences."

      What this check looks for
    • Info

      The input schema at required[0] mentions "credentials".

      Matched text

      inputSchema.required[0]: "credentials"

      What this check looks for
    Description, as the server wrote it
    Updates No-API Server credentials/configuration with the exact WAPI credentials array for one visible store/channel. Requires HGRApi Header channel / ChannelOAuthId resolved internally, confirmed=true and impactConfirmed=true. Never returns passwords.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_update_price_warrior_settingsUpdates Price Warrior settings for one visible store.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_update_price_warrior_settings" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Updates Price Warrior settings for one visible store. Requires confirmed=true and impactConfirmed=true because repricing can affect many listings. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_update_pricing_ruleUpdates a pricing rule for one visible store.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_update_pricing_rule" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Updates a pricing rule for one visible store. Requires confirmed=true and impactConfirmed=true because pricing rules can affect many listings. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_update_templateUpdates a listing template for one visible store/channel.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_update_template" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Updates a listing template for one visible store/channel. Requires HGRApi Header channel / ChannelOAuthId resolved internally, confirmed=true and impactConfirmed=true because templates can affect publishing flows.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • hgr_update_virtual_assistantUpdates or deactivates a Virtual Assistant / VA profile.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_update_virtual_assistant" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Updates or deactivates a Virtual Assistant / VA profile. Requires confirmed=true.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
Changes things 23Claude Code: ask
  • hgr_generate_limited_products_csvGenerates the only product CSV allowed by MCP policy.Reads text others write1 finding

    Why it is in this group

    • The name "hgr_generate_limited_products_csv" says "generate": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "hgr_generate_limited_products_csv" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "hgr_generate_limited_products_csv" says "generate": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Generates the only product CSV allowed by MCP policy. It returns plain CSV text, not a downloadable file, and only includes the HGRWeb report columns: eBay item ID, sku, stock, cost price and selling price. Requires explicit productIds and confirmed=true. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_load_business_policiesLoads marketplace business policies for one visible store.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Loads marketplace business policies for one visible store. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_load_order_addressesLoads available shipping addresses for an order resolved from visible order Reference.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Loads available shipping addresses for an order resolved from visible order Reference. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_load_shipping_optionsLoads marketplace shipping options for one visible store.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Loads marketplace shipping options for one visible store. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_post_ai_getimageinfoDedicated HGRApi tool for POST api/AI/GetImageInfo.Reads text others writeCan send data out1 finding

    Why it is in this group

    • The name "hgr_post_ai_getimageinfo" says "post": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "hgr_post_ai_getimageinfo" says "post": it sends or publishes something to other people.

    Findings

    • Warn

      The server marks "hgr_post_ai_getimageinfo" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "hgr_post_ai_getimageinfo" says "post": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Dedicated HGRApi tool for POST api/AI/GetImageInfo. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Provides the POST get image info operation in AI optimization task management. Use when: Use it when a client needs to run the get image info operation for AI optimization task management. Input: rq: GetImageInfoRequest. Main fields: Ids: int[]. Header channel: current ChannelOAuthId. Output: Returns the result or applies the effect of the get image info operation. Search terms: ai getimageinfo. Send the exact request payload in body. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_post_ai_gettaskresultDedicated HGRApi tool for POST api/AI/GetTaskResult.Reads text others writeCan send data out1 finding

    Why it is in this group

    • The name "hgr_post_ai_gettaskresult" says "post": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "hgr_post_ai_gettaskresult" says "post": it sends or publishes something to other people.

    Findings

    • Warn

      The server marks "hgr_post_ai_gettaskresult" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "hgr_post_ai_gettaskresult" says "post": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Dedicated HGRApi tool for POST api/AI/GetTaskResult. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Provides the POST get task result operation in AI optimization task management. Use when: Use it when a client needs to run the get task result operation for AI optimization task management. Input: rq: GetTaskResultRequest. Main fields: TaskId: int, ListingId: int. Header channel: current ChannelOAuthId. Output: Returns the result or applies the effect of the get task result operation. Search terms: ai gettaskresult. Send the exact request payload in body. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_post_catalog_getproductsDedicated HGRApi tool for POST api/Catalog/GetProducts.Reads text others writeCan send data out2 findings

    Why it is in this group

    • The name "hgr_post_catalog_getproducts" says "post": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "hgr_post_catalog_getproducts" says "post": it sends or publishes something to other people.

    Findings

    • Info

      The description is 2,842 characters long, over the 2,000 this check looks for.

      Matched text

      description ends: "...oad in body. Requires HGRApi Header channel / ChannelOAuthId resolved internally."

      What this check looks for
    • Warn

      The server marks "hgr_post_catalog_getproducts" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "hgr_post_catalog_getproducts" says "post": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Dedicated HGRApi tool for POST api/Catalog/GetProducts. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Provides supplier candidates for publication. ownerAgent: catalog-sources. Opening the catalog returns stored recommendations; explicit web, AI chat and MCP searches discover products through a deep internet search that may take several minutes. Use when: Use for catalog/source candidate discovery, not existing store inventory, importing store products, stock checks or ranking active listings. AI chat and MCP may search and apply the documented catalog filters, including themes, seasons and occasions such as Mother's Day gifts. Warn the user in their language before starting that a deep internet search may take several minutes; do not require confirmation for this read-only search. Input: CatalogProductsRequest. Header channel identifies the selected store and country. Search=false or omitted returns all type-0 country recommendations; SessionId preserves random order. For explicit searches from the web, AI chat or MCP set Search=true. Search accepts SourceIds, PriceFrom/PriceTo, ProfitFrom/ProfitTo, Prime options, Criteria as only the human-written free-text product search prompt (not a literal title substring) and optional Tags (selected theme/category integer IDs, using the same IDs as AI Publisher orders). When SourceIds is omitted or empty, searches use up to four distinct eligible supplier domains with the highest priority for the store's country and channel; source ID ascending breaks priority ties. Explicit supplier inclusions or exclusions retain their existing behavior. Theme, category, trending and store exclusion filters remain separate from Criteria. When Criteria is empty, categories and seasonal themes are expanded into related product families before searching; a human-written Criteria skips this expansion. Trending remains a search requirement. Price/profit requirements use effective channel/supplier settings and fees. For example, a Mother's Day product search uses {"search":true,"criteria":"Mother's Day gifts"}. Do not invent a quantity parameter; show the requested number from the returned candidates. Output: Returns Products with SourceId, Url, Title, ImageUrl, SourcePrice, ChannelPrice, Profit and SubOrigin. Initial candidates have CatalogSelection=1; search candidates have CatalogSearch=2. Publish by URL rather than ProductSourceId. Initial mode returns the complete stored country collection. Search returns at most 50 candidates total and can return fewer or none when no eligible products are found. TotalResults and PageSize are the returned count. Search terms: catalog getproducts. Send the exact request payload in body. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_post_channellisting_getcategoriesbytextDedicated HGRApi tool for POST api/ChannelListing/getCategoriesByText.Reads text others writeCan send data out1 finding

    Why it is in this group

    • The name "hgr_post_channellisting_getcategoriesbytext" says "post": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "hgr_post_channellisting_getcategoriesbytext" says "post": it sends or publishes something to other people.

    Findings

    • Warn

      The server marks "hgr_post_channellisting_getcategoriesbytext" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "hgr_post_channellisting_getcategoriesbytext" says "post": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Dedicated HGRApi tool for POST api/ChannelListing/getCategoriesByText. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Provides the POST get categories by text operation in published product creation and optimization. Use when: Use it when a client needs to run the get categories by text operation for published product creation and optimization. Input: [FromBody] rq: GetCategoriesByTextRequest. Main fields: Text: string. Header channel: current ChannelOAuthId. Output: Returns the categories whose name contains the text. When no category name contains it, returns suggested categories for the text: for eBay and TikTok stores the first one is the HGR suggestion for that text, followed by the marketplace suggestions. Search terms: channellisting getcategoriesbytext. Send the exact request payload in body. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_post_channellisting_getcategoryspecificsDedicated HGRApi tool for POST api/ChannelListing/GetCategorySpecifics.Reads text others writeCan send data out1 finding

    Why it is in this group

    • The name "hgr_post_channellisting_getcategoryspecifics" says "post": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "hgr_post_channellisting_getcategoryspecifics" says "post": it sends or publishes something to other people.

    Findings

    • Warn

      The server marks "hgr_post_channellisting_getcategoryspecifics" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "hgr_post_channellisting_getcategoryspecifics" says "post": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Dedicated HGRApi tool for POST api/ChannelListing/GetCategorySpecifics. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Returns category field definitions and populated values for manual product preparation. ownerAgent: publication. Use when: Use when the manual product form needs fields for its selected category and supplier product data. Input: GetCategorySpecificsRequest: SourceId, Price, CategoryId, Title, Paragraphs, Features, TableValues. Header channel: current ChannelOAuthId. Admin: false. Output: response_data remains the category field collection. Admin or impersonated sessions additionally receive debug alongside response_data, with actual product inputs and returned definitions, restrictions and values. Missing initial values, internal filling decisions and browser-side changes are explicitly marked as unavailable, never inferred. A failed category-field request includes admin debug with its trace ID in the error response. Search terms: channellisting getcategoryspecifics. Send the exact request payload in body. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_post_channellisting_getsuggestedcategoriesDedicated HGRApi tool for POST api/ChannelListing/getSuggestedCategories.Reads text others writeCan send data out1 finding

    Why it is in this group

    • The name "hgr_post_channellisting_getsuggestedcategories" says "post": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "hgr_post_channellisting_getsuggestedcategories" says "post": it sends or publishes something to other people.

    Findings

    • Warn

      The server marks "hgr_post_channellisting_getsuggestedcategories" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "hgr_post_channellisting_getsuggestedcategories" says "post": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Dedicated HGRApi tool for POST api/ChannelListing/getSuggestedCategories. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Provides the POST get suggested categories operation in published product creation and optimization. Use when: Use it when a client needs to run the get suggested categories operation for published product creation and optimization. Input: [FromBody] rq: Request.GetSuggestedCategoriesRequest. Main fields: Url: string, Text: string. Header channel: current ChannelOAuthId. Output: Returns the result or applies the effect of the get suggested categories operation. Search terms: channellisting getsuggestedcategories. Send the exact request payload in body. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_post_channellisting_getsuggestedtitlesDedicated HGRApi tool for POST api/ChannelListing/GetSuggestedTitles.Reads text others writeCan send data out1 finding

    Why it is in this group

    • The name "hgr_post_channellisting_getsuggestedtitles" says "post": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "hgr_post_channellisting_getsuggestedtitles" says "post": it sends or publishes something to other people.

    Findings

    • Warn

      The server marks "hgr_post_channellisting_getsuggestedtitles" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "hgr_post_channellisting_getsuggestedtitles" says "post": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Dedicated HGRApi tool for POST api/ChannelListing/GetSuggestedTitles. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Provides the POST get suggested titles operation in published product creation and optimization. Use when: Use it when a client needs to run the get suggested titles operation for published product creation and optimization. Input: [FromBody] request: SuggestedTitles. Main fields: CategoryId: int, Product: SourceProduct. Output: Returns the result or applies the effect of the get suggested titles operation. Search terms: channellisting getsuggestedtitles. Send the exact request payload in body. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_post_channellisting_listDedicated HGRApi tool for POST api/ChannelListing/List.Reads text others writeCan send data out1 finding

    Why it is in this group

    • The name "hgr_post_channellisting_list" says "post": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "hgr_post_channellisting_list" says "post": it sends or publishes something to other people.

    Findings

    • Warn

      The server marks "hgr_post_channellisting_list" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "hgr_post_channellisting_list" says "post": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Dedicated HGRApi tool for POST api/ChannelListing/List. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Resolves one supplier product URL into validated product data for listing creation. ownerAgent: publication. Use when: Use when a user has submitted one concrete supplier product URL and needs the product data required to prepare a listing. Input: ListRequest body with Url and optional extension ExtraData. Header channel: current ChannelOAuthId. Output: Returns ComListing with validated product data when details can be obtained. A successful product response may also include OtherUrls so compatible extension clients can offer an optional switch to bulk publish. For a recognized product URL whose details cannot be obtained, returns Success=false with ErrorType=UnknownProduct without OtherUrls. Non-product pages may return OtherUrls for bulk discovery. Search terms: channellisting list. Send the exact request payload in body. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_post_dispatch_getshipmentdetailsDedicated HGRApi tool for POST api/Dispatch/GetShipmentDetails.Reads text others writeCan send data out1 finding

    Why it is in this group

    • The name "hgr_post_dispatch_getshipmentdetails" says "post": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "hgr_post_dispatch_getshipmentdetails" says "post": it sends or publishes something to other people.

    Findings

    • Warn

      The server marks "hgr_post_dispatch_getshipmentdetails" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "hgr_post_dispatch_getshipmentdetails" says "post": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Dedicated HGRApi tool for POST api/Dispatch/GetShipmentDetails. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Provides the POST get shipment details operation in shipping and dispatch operations. Use when: Use it when a client needs to run the get shipment details operation for shipping and dispatch operations. Input: [FromBody] request: GetShipmentDetailsRequest. Main fields: TrackingCode: string. Output: Returns the result or applies the effect of the get shipment details operation. Search terms: dispatch getshipmentdetails. Send the exact request payload in body.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_post_listing_getbulkhistoryDedicated HGRApi tool for POST api/Listing/GetBulkHistory.Reads text others writeCan send data out1 finding

    Why it is in this group

    • The name "hgr_post_listing_getbulkhistory" says "post": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "hgr_post_listing_getbulkhistory" says "post": it sends or publishes something to other people.

    Findings

    • Warn

      The server marks "hgr_post_listing_getbulkhistory" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "hgr_post_listing_getbulkhistory" says "post": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Dedicated HGRApi tool for POST api/Listing/GetBulkHistory. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Returns recent bulk publication jobs and their recorded status/errors for the selected store. ownerAgent: publication. Use when: Use it to inspect bulk publication history and diagnose a job's recorded error. Input: Optional AutoListRequest. Header channel: current ChannelOAuthId. Output: Returns logs with job status, error code, listing status and origin. EnumValues maps the numeric codes. ChannelListingStatusFlags is a bitmask: decode every set bit, not the whole number as one ordinal. Search terms: listing getbulkhistory. Send the exact request payload in body. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_post_listing_getscrapingconfigDedicated HGRApi tool for POST api/Listing/GetScrapingConfig.Reads text others writeCan send data out1 finding

    Why it is in this group

    • The name "hgr_post_listing_getscrapingconfig" says "post": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "hgr_post_listing_getscrapingconfig" says "post": it sends or publishes something to other people.

    Findings

    • Warn

      The server marks "hgr_post_listing_getscrapingconfig" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "hgr_post_listing_getscrapingconfig" says "post": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Dedicated HGRApi tool for POST api/Listing/GetScrapingConfig. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Returns supplier page extraction settings for the listing extension and bulk publication. Use when: Use it to identify product details and product links from a supported supplier page. Input: rq: GetScrapingConfigRequest. Main fields: Url: string, Site: eCountry?. Header channel: current ChannelOAuthId; Site defaults to the current store country. Output: Returns supplier-specific extraction settings. Keeps a configured product-link selector; uses all page links only when no link selector is configured. Search terms: listing getscrapingconfig. Send the exact request payload in body. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_post_listingcreate_getdataDedicated HGRApi tool for POST api/ListingCreate/GetData.Reads text others writeCan send data out2 findings

    Why it is in this group

    • The name "hgr_post_listingcreate_getdata" says "post": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "hgr_post_listingcreate_getdata" says "post": it sends or publishes something to other people.

    Findings

    • Info

      The description is 2,276 characters long, over the 2,000 this check looks for.

      Matched text

      description ends: "...oad in body. Requires HGRApi Header channel / ChannelOAuthId resolved internally."

      What this check looks for
    • Warn

      The server marks "hgr_post_listingcreate_getdata" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "hgr_post_listingcreate_getdata" says "post": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Dedicated HGRApi tool for POST api/ListingCreate/GetData. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Resolves one supplier URL into validated product and draft-listing data for the extension's manual product flow. ownerAgent: publication. Use when: Use when the extension submits one supplier URL and needs the product details required to prepare a manual product. Input: GetDataRequest body with Url and optional extension ExtraData. AliExpress URLs may include selected variation labels and a native skuId. Header channel: current ChannelOAuthId. Admin: false. Output: Returns ProductInformation and Listing when complete product details can be obtained. AliExpress manual imports refresh the selected SKU and full variation family from the supplier even when cached product details exist. ASOS UK, Matalan and Home Bargains imports refresh supplier data when the cached or browser-extracted product has no variations; the returned product uses its selected size identity to avoid an empty parent option and retain a stable size-specific URL. Explicit ASOS UK product URLs with a selected variant preserve that exact size and avoid adding a duplicate selected-size option when the same size is already present in the variation family. Explicit AliExpress SKU selections are preserved; invalid or conflicting selections return an error instead of substituting the first variation. Variation labels remain separate from other URL parameters. A successful product response may also include OtherUrls so the client can offer an optional switch to bulk publish. A recognized product whose details cannot be obtained returns ErrorType=UnknownProduct without OtherUrls; non-product pages may return OtherUrls for bulk discovery. Admin or impersonated sessions additionally receive Debug with extraction configuration excluding cookies, intermediate product snapshots, data-source decisions and final product/draft fields. Category filling is diagnosed separately through ChannelListing/GetCategorySpecifics; browser-side changes are not observed here. Search terms: listingcreate getdata. Send the exact request payload in body. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_post_listingcreate_getdatabypsidsDedicated HGRApi tool for POST api/ListingCreate/GetDataByPSIds.Reads text others writeCan send data out2 findings

    Why it is in this group

    • The name "hgr_post_listingcreate_getdatabypsids" says "post": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "hgr_post_listingcreate_getdatabypsids" says "post": it sends or publishes something to other people.

    Findings

    • Info

      The description is 2,135 characters long, over the 2,000 this check looks for.

      Matched text

      description ends: "...oad in body. Requires HGRApi Header channel / ChannelOAuthId resolved internally."

      What this check looks for
    • Warn

      The server marks "hgr_post_listingcreate_getdatabypsids" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "hgr_post_listingcreate_getdatabypsids" says "post": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Dedicated HGRApi tool for POST api/ListingCreate/GetDataByPSIds. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Loads current supplier data for the exact product-source variations used during manual multi-variation product creation. ownerAgent: publication. Domain: publication. Entity: product_source_variation_data. Operation: read_and_refresh. Scope: selected_channel. Use when: Use it when the manual product form needs price, stock, EAN and source images for a known set of exact ProductSourceIds, especially before displaying or publishing all supplier variations. Do not use it to discover products or variations without exact ProductSourceIds, or for existing store-listing collection or ranking. Input: [FromBody] rq: GetDataByPSIdsRequest. Main fields: ProductSourceIds: int[]. Header channel: current ChannelOAuthId. Admin: false. Output: Returns ProductSources keyed by the requested ProductSourceId, with available images, price, stock and EAN. Cached stock is read from saved supplier stock options. Matalan and Home Bargains sizes are refreshed with live stock information, including zero stock for unavailable sizes. Sources configured for live refresh return non-empty freshly scraped images immediately; cached images are retained only when the refresh supplies no images. Requested AliExpress variation URLs using a readable selection, a numeric skuId/sku_id, or both together, without a saved supplier SKU are refreshed to resolve that exact variation and load its images. These AliExpress child refreshes obtain stock information and return refreshed data only after the supplier identity, price and available stock have been saved. If the supplier identity, price or available stock cannot be confirmed, or saving fails, the response retains cached data. Bare AliExpress product URLs are not refreshed by this recovery rule. The refresh can also update stored product-source data. Search terms: listingcreate getdatabypsids. Send the exact request payload in body. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_post_notificationcenter_getallDedicated HGRApi tool for POST api/NotificationCenter/GetAll.Reads text others writeCan send data out1 finding

    Why it is in this group

    • The name "hgr_post_notificationcenter_getall" says "post": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "hgr_post_notificationcenter_getall" says "post": it sends or publishes something to other people.

    Findings

    • Warn

      The server marks "hgr_post_notificationcenter_getall" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "hgr_post_notificationcenter_getall" says "post": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Dedicated HGRApi tool for POST api/NotificationCenter/GetAll. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Provides the POST get all operation in notification centre operations. Use when: Use it when a client needs to run the get all operation for notification centre operations. Input: rq: GetAllRequest. Main fields: Page: int. Header channel: current ChannelOAuthId. Output: Returns the result or applies the effect of the get all operation. Search terms: notificationcenter getall. Send the exact request payload in body. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_post_sales_loadaddressesfromorderlineDedicated HGRApi tool for POST api/Sales/LoadAddressesFromOrderLine.Reads text others writeCan send data out1 finding

    Why it is in this group

    • The name "hgr_post_sales_loadaddressesfromorderline" says "post": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "hgr_post_sales_loadaddressesfromorderline" says "post": it sends or publishes something to other people.

    Findings

    • Warn

      The server marks "hgr_post_sales_loadaddressesfromorderline" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "hgr_post_sales_loadaddressesfromorderline" says "post": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Dedicated HGRApi tool for POST api/Sales/LoadAddressesFromOrderLine. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Provides the POST load addresses from order line operation in sales/order operations. Use when: Use it when a client needs to run the load addresses from order line operation for sales/order operations. Input: [FromBody] rq: LoadAddressFromOrderLineRequest. Main fields: OrderLineId: int. Header channel: current ChannelOAuthId. Output: Returns the result or applies the effect of the load addresses from order line operation. Search terms: sales loadaddressesfromorderline. Send the exact request payload in body. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_post_sales_loadprogressDedicated HGRApi tool for POST api/Sales/LoadProgress.Reads text others writeCan send data out1 finding

    Why it is in this group

    • The name "hgr_post_sales_loadprogress" says "post": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "hgr_post_sales_loadprogress" says "post": it sends or publishes something to other people.

    Findings

    • Warn

      The server marks "hgr_post_sales_loadprogress" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "hgr_post_sales_loadprogress" says "post": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Dedicated HGRApi tool for POST api/Sales/LoadProgress. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Provides the POST load progress operation in sales/order operations. Use when: Use it when a client needs to run the load progress operation for sales/order operations. Input: [FromBody] rq: LoadProgressRequest. Main fields: Id: int. Header channel: current ChannelOAuthId. Output: Returns the result or applies the effect of the load progress operation. Search terms: sales loadprogress. Send the exact request payload in body. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_post_searchproduct_getlistingsimagesDedicated HGRApi tool for POST api/SearchProduct/getListingsImages.Reads text others writeCan send data out1 finding

    Why it is in this group

    • The name "hgr_post_searchproduct_getlistingsimages" says "post": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "hgr_post_searchproduct_getlistingsimages" says "post": it sends or publishes something to other people.

    Findings

    • Warn

      The server marks "hgr_post_searchproduct_getlistingsimages" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "hgr_post_searchproduct_getlistingsimages" says "post": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Dedicated HGRApi tool for POST api/SearchProduct/getListingsImages. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Returns the first image of active listings for concrete publication ids. ownerAgent: listings. Domain: listings. Entity: exact_listing. Operation: get_exact. Scope: current_store. Use when: Use it only when concrete listingIds are already known and thumbnails are needed for those exact listings. Input: Header channel: current ChannelOAuthId and body int[] with concrete listingIds. Does not accept free search or store scans. Output: Returns a map from published product id to image URLs. Search terms: searchproduct getlistingsimages. Send the exact request payload in body. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_post_searchproduct_getpendinglistingsimages2Dedicated HGRApi tool for POST api/SearchProduct/getPendingListingsImages2.Reads text others writeCan send data out3 findings

    Why it is in this group

    • The name "hgr_post_searchproduct_getpendinglistingsimages2" says "post": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "hgr_post_searchproduct_getpendinglistingsimages2" says "post": it sends or publishes something to other people.

    Findings

    • Warn

      The description contains a 43-character base64 string.

      Matched text

      description: "...GRApi tool for POST api/SearchProduct/getPendingListingsImages2. This is an explici..."

      What this check looks for
    • Warn

      The input schema at properties.body.description contains a 44-character base64 string.

      Matched text

      inputSchema.properties.body.description: "HGRApi POST /api/SearchProduct/getPendingListingsImages2 request body."

      What this check looks for
    • Warn

      The server marks "hgr_post_searchproduct_getpendinglistingsimages2" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "hgr_post_searchproduct_getpendinglistingsimages2" says "post": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Dedicated HGRApi tool for POST api/SearchProduct/getPendingListingsImages2. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Provides the POST get pending listings images2 operation in existing published product/listing management. Use when: Use it when a client needs to run the get pending listings images2 operation for existing published product/listing management. Input: [FromBody] listings: GetPendingListingsImages2Request[]. Main fields: Id: int, SourceId: int. Header channel: current ChannelOAuthId. Output: Returns the result or applies the effect of the get pending listings images2 operation. Search terms: getpendinglistingsimages 2, searchproduct getpendinglistingsimages 2. Send the exact request payload in body. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_post_smartlister_filters_checknewDedicated HGRApi tool for POST ai publisher filters checknew.Reads text others writeCan send data out1 finding

    Why it is in this group

    • The name "hgr_post_smartlister_filters_checknew" says "post": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "hgr_post_smartlister_filters_checknew" says "post": it sends or publishes something to other people.

    Findings

    • Warn

      The server marks "hgr_post_smartlister_filters_checknew" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "hgr_post_smartlister_filters_checknew" says "post": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Dedicated HGRApi tool for POST ai publisher filters checknew. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Checks whether a proposed AI Publisher order returns enough current product candidates. ownerAgent: ai-publisher. Use when: Use to check candidate availability without saving an order or publishing products. Input: NewFiltersRequest. Filter.Criteria is the optional free-text product search prompt, not a literal title substring. Supplier, price, profit, Prime and tag filters apply. Header channel: current ChannelOAuthId. Output: Returns GOOD, INSUFFICIENT or BAD based on up to 50 search results. Search terms: ai publisher filters checknew. Send the exact request payload in body. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
Only reads 69Show 69 read-only tools
  • hgr_get_active_listingsLists active listings for the selected visible store/channel.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_get_active_listings" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Lists active listings for the selected visible store/channel. Use this for store-wide active listing/product questions, including most expensive products/listings, cheapest products/listings, stock checks, price ranking, source/supplier usage and other active listing aggregation. First resolve the store with hgr_list_channels, then call this tool using channelOAuthId from the selected store. For rankings, filtering and summaries, pass fields/sortBy/sortDirection/limit directly to this tool and answer from its response. For product source/supplier questions, request the source field when available; source means supplier/source marketplace. Use sourceId only to resolve visible supplier/source names. Do not use origin for source/supplier questions: origin means listing creation mechanism such as Catalog, BulkLister, WeListForYou, Extension, AI Publisher or AI Agent. The response can be a compact schema/data payload: interpret each data row by matching positions with schema; this is not an error and does not require a second pass. Public replies use visible product ids and marketplace references. Do not use this tool to construct CSV, XML, XLSX, feed or bulk export files. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_get_affiliate_dashboardReads affiliate dashboard summary.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_get_affiliate_dashboard" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Reads affiliate dashboard summary.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_get_affiliate_dashboard_monthlyReads affiliate monthly dashboard summary.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_get_affiliate_dashboard_monthly" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Reads affiliate monthly dashboard summary.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_get_affiliate_withdrawalsReads affiliate withdrawal history.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_get_affiliate_withdrawals" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Reads affiliate withdrawal history. Changing withdrawal method must be done in HGRWeb.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_get_ai_agent_configurationReads AI Agent configuration for one visible store.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_get_ai_agent_configuration" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Reads AI Agent configuration for one visible store. AI Agent is distinct from AI Publisher. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_get_ai_agent_dashboardReads AI Agent dashboard and maturity metrics for one visible store.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_get_ai_agent_dashboard" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Reads AI Agent dashboard and maturity metrics for one visible store. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_get_ai_gettasksDedicated HGRApi tool for GET api/AI/GetTasks.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_get_ai_gettasks" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Dedicated HGRApi tool for GET api/AI/GetTasks. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Provides the GET get tasks operation in AI optimization task management. Use when: Use it when a client needs to run the get tasks operation for AI optimization task management. Input: No explicit input parameters required. Header channel: current ChannelOAuthId. Output: Returns the result or applies the effect of the get tasks operation. Search terms: ai gettasks. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_get_ai_publisher_filtersReads AI Publisher filters/automation configuration for one visible store.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_get_ai_publisher_filters" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Reads AI Publisher filters/automation configuration for one visible store. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_get_ai_publisher_historyReads AI Publisher history for one visible store.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_get_ai_publisher_history" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Reads AI Publisher history for one visible store. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_get_analytics_beingwatchedDedicated HGRApi tool for GET api/Analytics/BeingWatched.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_get_analytics_beingwatched" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Dedicated HGRApi tool for GET api/Analytics/BeingWatched. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Provides the GET being watched operation in current-channel watcher analytics. Use when: Use it when a client needs to run the being watched operation for current-channel watcher analytics. Input: Header channel: current ChannelOAuthId. Output: Returns the result or applies the effect of the being watched operation. Search terms: analytics beingwatched. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_get_analytics_getwatchersDedicated HGRApi tool for GET api/Analytics/GetWatchers.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_get_analytics_getwatchers" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Dedicated HGRApi tool for GET api/Analytics/GetWatchers. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Provides the GET get watchers operation in current-channel watcher analytics. Use when: Use it when a client needs to run the get watchers operation for current-channel watcher analytics. Input: [FromQuery] minutes: int?. Header channel: current ChannelOAuthId. Output: Returns the result or applies the effect of the get watchers operation. Search terms: analytics getwatchers. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_get_analytics_productsnotbeingwatchedDedicated HGRApi tool for GET api/Analytics/ProductsNotBeingWatched.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_get_analytics_productsnotbeingwatched" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Dedicated HGRApi tool for GET api/Analytics/ProductsNotBeingWatched. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Provides the GET products not being watched operation in current-channel watcher analytics. Use when: Use it when a client needs to run the products not being watched operation for current-channel watcher analytics. Input: Header channel: current ChannelOAuthId. Output: Returns the result or applies the effect of the products not being watched operation. Search terms: analytics productsnotbeingwatched. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_get_authenticated_userReads the authenticated HGR user profile visible to the web app.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_get_authenticated_user" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe description's first sentence says "read" and "web": it reads web pages, which anyone can write.
    Description, as the server wrote it
    Reads the authenticated HGR user profile visible to the web app.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_get_autoorder_feesReads current auto-ordering fees from WAPI.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_get_autoorder_fees" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Reads current auto-ordering fees from WAPI.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_get_autoordering_configurationReads auto-ordering configuration from WAPI for one visible store/channel.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_get_autoordering_configuration" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Reads auto-ordering configuration from WAPI for one visible store/channel. Requires HGRApi Header channel / ChannelOAuthId resolved internally. Secret fields are redacted before returning.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_get_catalog_getproductsourceDedicated HGRApi tool for GET api/Catalog/GetProductSource.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_get_catalog_getproductsource" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Dedicated HGRApi tool for GET api/Catalog/GetProductSource. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Provides the GET get product source operation in catalog/source candidate discovery or publication. Use when: Use it when a client needs to run the get product source operation for catalog/source candidate discovery or publication. Input: id: int. Output: Returns the result or applies the effect of the get product source operation. Search terms: catalog getproductsource. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_get_catalog_newgetlistingstatusDedicated HGRApi tool for GET api/Catalog/NewGetListingStatus.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_get_catalog_newgetlistingstatus" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Dedicated HGRApi tool for GET api/Catalog/NewGetListingStatus. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Returns recent catalog publication jobs and their listing results. ownerAgent: publication. Use when: Use to inspect recorded publication status or errors, not to discover supplier products. Input: Header channel identifies the selected store. No body. Output: Returns job status and listing status/error data with EnumValues. Url identifies new publications even before ProductSourceId resolution; ProductSourceId remains available for legacy clients. ListingStatus.Status is a bitmask and can combine flags. Search terms: catalog newgetlistingstatus. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_get_channel_configurationReads store/channel configuration for one visible store.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_get_channel_configuration" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Reads store/channel configuration for one visible store. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_get_channellisting_getcategoryinfoDedicated HGRApi tool for GET api/ChannelListing/getCategoryInfo.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_get_channellisting_getcategoryinfo" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Dedicated HGRApi tool for GET api/ChannelListing/getCategoryInfo. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Provides the GET get category info operation in published product creation and optimization. Use when: Use it when a client needs to run the get category info operation for published product creation and optimization. Input: [FromQuery] id: string. Header channel: current ChannelOAuthId. Output: Returns the result or applies the effect of the get category info operation. Search terms: channellisting getcategoryinfo. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_get_channellisting_getcustomcategoriesDedicated HGRApi tool for GET api/ChannelListing/getCustomCategories.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_get_channellisting_getcustomcategories" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Dedicated HGRApi tool for GET api/ChannelListing/getCustomCategories. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Provides the GET get custom categories operation in published product creation and optimization. Use when: Use it when a client needs to run the get custom categories operation for published product creation and optimization. Input: Header channel: current ChannelOAuthId. Output: Returns the result or applies the effect of the get custom categories operation. Search terms: channellisting getcustomcategories. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_get_channellisting_getsettingsDedicated HGRApi tool for GET api/ChannelListing/getSettings.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_get_channellisting_getsettings" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Dedicated HGRApi tool for GET api/ChannelListing/getSettings. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Provides the GET get settings operation in published product creation and optimization. Use when: Use it when a client needs to run the get settings operation for published product creation and optimization. Input: [FromQuery] sourceId: int. [FromQuery] sourcePrice: decimal. Header channel: current ChannelOAuthId. Output: Returns the result or applies the effect of the get settings operation. Search terms: channellisting getsettings. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_get_channellisting_isbrandinverolistDedicated HGRApi tool for GET api/ChannelListing/isBrandInVeRoList.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_get_channellisting_isbrandinverolist" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Dedicated HGRApi tool for GET api/ChannelListing/isBrandInVeRoList. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Provides the GET is brand in ve ro list operation in published product creation and optimization. Use when: Use it when a client needs to run the is brand in ve ro list operation for published product creation and optimization. Input: [FromQuery] brand: string. Header channel: current ChannelOAuthId. Output: Returns the result or applies the effect of the is brand in ve ro list operation. Search terms: channellisting isbrandinverolist. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_get_computed_source_configurationReads effective supplier settings after store defaults and supplier overrides.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_get_computed_source_configuration" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Reads effective supplier settings after store defaults and supplier overrides. This is settings data, not supplier availability or listing usage data. Boolean monitoring settings do not enable or disable a supplier. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_get_dashboard_getaffiliatestatistics_period_from_toDedicated HGRApi tool for GET api/Dashboard/GetAffiliateStatistics/{period}/{from}/{to}.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_get_dashboard_getaffiliatestatistics_period_from_to" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Dedicated HGRApi tool for GET api/Dashboard/GetAffiliateStatistics/{period}/{from}/{to}. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Provides the GET get affiliate statistics operation in dashboard data. Use when: Use it when a client needs to run the get affiliate statistics operation for dashboard data. Input: [FromRoute] period: ePeriod. [FromRoute] from: DateTime?. [FromRoute] to: DateTime?. Output: Returns the result or applies the effect of the get affiliate statistics operation. Search terms: dashboard getaffiliatestatistics period from to.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_get_dashboard_getlistingservicesDedicated HGRApi tool for GET api/Dashboard/GetListingServices.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_get_dashboard_getlistingservices" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Dedicated HGRApi tool for GET api/Dashboard/GetListingServices. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Lists publication services purchased by the user. ownerAgent: account-metrics. Domain: services. Entity: listing_service. Operation: list. Scope: all_user_stores. Use when: Use it to show pending or purchased We List For You orders/services. Input: No explicit input parameters required. Does not use concrete listing ids. Output: Returns publication services and their status. Search terms: dashboard getlistingservices.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_get_dashboard_getlistingsummaryDedicated HGRApi tool for GET api/Dashboard/GetListingSummary.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_get_dashboard_getlistingsummary" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Dedicated HGRApi tool for GET api/Dashboard/GetListingSummary. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Returns an aggregate summary of published products, recent products and average price for the current channel. ownerAgent: account-metrics. Domain: listings. Entity: listing_summary. Operation: aggregate. Scope: current_store. Use when: Use it for dashboard views or aggregate metrics for the selected channel. Input: Header channel: current ChannelOAuthId. Does not use concrete listing ids. Output: Returns listing counters and aggregates. Search terms: dashboard getlistingsummary. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_get_dashboard_getnoapiserversDedicated HGRApi tool for GET api/Dashboard/GetNoApiServers.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_get_dashboard_getnoapiservers" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Dedicated HGRApi tool for GET api/Dashboard/GetNoApiServers. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Provides the GET get no api servers operation in dashboard data. Use when: Use it when a client needs to run the get no api servers operation for dashboard data. Input: No explicit input parameters required. Output: Returns the result or applies the effect of the get no api servers operation. Search terms: dashboard getnoapiservers.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_get_dashboard_getoptimizedcountDedicated HGRApi tool for GET api/Dashboard/GetOptimizedCount.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_get_dashboard_getoptimizedcount" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Dedicated HGRApi tool for GET api/Dashboard/GetOptimizedCount. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Provides the GET get optimized count operation in dashboard data. Use when: Use it when a client needs to run the get optimized count operation for dashboard data. Input: Header channel: current ChannelOAuthId. Output: Returns the result or applies the effect of the get optimized count operation. Search terms: dashboard getoptimizedcount. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_get_dashboard_getpendingstatisticsDedicated HGRApi tool for GET api/Dashboard/GetPendingStatistics.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_get_dashboard_getpendingstatistics" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Dedicated HGRApi tool for GET api/Dashboard/GetPendingStatistics. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Provides the GET get pending statistics operation in dashboard data. Use when: Use it when a client needs to run the get pending statistics operation for dashboard data. Input: Header channel: current ChannelOAuthId. Output: Returns the result or applies the effect of the get pending statistics operation. Search terms: dashboard getpendingstatistics. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_get_dashboard_getupcomingwebinarDedicated HGRApi tool for GET api/Dashboard/GetUpcomingWebinar.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_get_dashboard_getupcomingwebinar" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Dedicated HGRApi tool for GET api/Dashboard/GetUpcomingWebinar. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Provides the GET get upcoming webinar operation in dashboard data. Use when: Use it when a client needs to run the get upcoming webinar operation for dashboard data. Input: No explicit input parameters required. Output: Returns the result or applies the effect of the get upcoming webinar operation. Search terms: dashboard getupcomingwebinar.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_get_dashboard_requestcodeDedicated HGRApi tool for GET api/Dashboard/RequestCode.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_get_dashboard_requestcode" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Dedicated HGRApi tool for GET api/Dashboard/RequestCode. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Provides the GET request code operation in dashboard data. Use when: Use it when a client needs to run the request code operation for dashboard data. Input: [FromQuery] id: int. Output: Returns the result or applies the effect of the request code operation. Search terms: dashboard requestcode.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_get_dashboard_taskpendingautoorder2Dedicated HGRApi tool for GET api/Dashboard/TaskPendingAutoOrder2.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_get_dashboard_taskpendingautoorder2" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Dedicated HGRApi tool for GET api/Dashboard/TaskPendingAutoOrder2. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Provides the GET task pending auto order2 operation in dashboard data. Use when: Use it when a client needs to run the task pending auto order2 operation for dashboard data. Input: Header channel: current ChannelOAuthId. Output: Returns the result or applies the effect of the task pending auto order2 operation. Search terms: taskpendingautoorder 2, dashboard taskpendingautoorder 2. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_get_dispatch_getDedicated HGRApi tool for GET api/Dispatch/Get.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_get_dispatch_get" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Dedicated HGRApi tool for GET api/Dispatch/Get. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Provides the GET get operation in shipping and dispatch operations. Use when: Use it when a client needs to run the get operation for shipping and dispatch operations. Input: Header channel: current ChannelOAuthId. Output: Returns the result or applies the effect of the get operation. Search terms: dispatch get. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_get_helpcentre_getticket_idDedicated HGRApi tool for GET api/HelpCentre/GetTicket/{id}.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_get_helpcentre_getticket_id" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe description's first sentence says "ticket": it reads issues, which other people can write.
    Description, as the server wrote it
    Dedicated HGRApi tool for GET api/HelpCentre/GetTicket/{id}. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Reads one authenticated CRM support ticket by visible ticket id. Domain: support. Entity: support_ticket. Operation: get_exact. Scope: authenticated_user. Use when: Use when the user asks about an existing support ticket and provides the visible TCK-* ticket reference. Input: [FromRoute] id: string. Legacy numeric ids are not supported. Output: Returns ticket detail including visible id/number, state, priority, dates, customer and messages. Search terms: helpcentre getticket id.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_get_listing_didlistDedicated HGRApi tool for GET api/Listing/DidList.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_get_listing_didlist" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Dedicated HGRApi tool for GET api/Listing/DidList. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Provides the GET did list operation in bulk publication and publication tracking. Use when: Use it when a client needs to run the did list operation for bulk publication and publication tracking. Input: No explicit input parameters required. Output: Returns the result or applies the effect of the did list operation. Search terms: listing didlist. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_get_listing_listingscountperchannelDedicated HGRApi tool for GET api/Listing/ListingsCountPerChannel.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_get_listing_listingscountperchannel" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Dedicated HGRApi tool for GET api/Listing/ListingsCountPerChannel. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Provides the GET listings count per channel operation in bulk publication and publication tracking. Use when: Use it when a client needs to run the listings count per channel operation for bulk publication and publication tracking. Input: Header channel: current ChannelOAuthId. Output: Returns the result or applies the effect of the listings count per channel operation. Search terms: listing listingscountperchannel. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_get_listing_price_historyReads price history for one exact listing variation.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_get_listing_price_history" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Reads price history for one exact listing variation. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_get_listing_stock_historyReads stock history for one exact listing variation.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_get_listing_stock_history" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Reads stock history for one exact listing variation. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_get_listingsGets exact listings only by concrete HGR listing ids or visible marketplace primary ids.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_get_listings" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Gets exact listings only by concrete HGR listing ids or visible marketplace primary ids. Do not use this tool to discover, scan, rank, filter or aggregate a store's listings. For bulk/global listing queries use active, pending or terminated listings instead. Do not use this tool to construct CSV, XML, XLSX, feed or bulk export files. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_get_noapi_serversReads No-API Server configuration/status.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_get_noapi_servers" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Reads No-API Server configuration/status. Passwords and secrets are redacted, and connection states are translated to human language.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_get_noapi_solution_stateReads No-API Server verification/connection state for a visible store and translates it to human language.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_get_noapi_solution_state" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Reads No-API Server verification/connection state for a visible store and translates it to human language. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_get_pending_listingsLists pending listings for one visible store.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_get_pending_listings" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Lists pending listings for one visible store. First resolve the store with hgr_list_channels, then call this tool using channelOAuthId from the selected store. For rankings, filtering and summaries, pass fields/sortBy/sortDirection/limit directly to this tool and answer from its response. Pending listing ids may be shown only where HGRWeb shows them. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_get_price_warriorReads Price Warrior dashboard/settings for one visible store.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_get_price_warrior" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Reads Price Warrior dashboard/settings for one visible store. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_get_pricing_rulesReads pricing rules for one visible store.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_get_pricing_rules" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Reads pricing rules for one visible store. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_get_products_subscriptions_getDedicated HGRApi tool for GET Api/Products/Subscriptions/Get.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_get_products_subscriptions_get" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Dedicated HGRApi tool for GET Api/Products/Subscriptions/Get. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Lists the HGR listing-subscription plans and prices available to the requesting account. ownerAgent: account-metrics. supportingAgents: support, orchestrator. Domain: account_metrics. Entity: subscription_plan. Operation: list. Scope: product_catalog. AllowedIntents: subscription_plan_catalog. Use when: Use to quote monthly or annual plan prices and compare listing capacities. Input: No body or query input. Authentication is optional: sign in for eligible legacy prices. Anonymous requests receive public prices. Admin-only: false. The selected channel is not required. Output: Returns the complete enabled listing-plan catalogue. ProductOrder is listing capacity. Each price includes PlatformId, BillingPeriodId, CurrencyId, Price and PlatformProductId. LegacyPricing indicates continuing legacy subscription eligibility. Search terms: products subscriptions get.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_get_salesReads sales aggregates for the selected visible store using WAPI GetSales.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_get_sales" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Reads sales aggregates for the selected visible store using WAPI GetSales. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_get_sales_getorderimage_orderid_cacheDedicated HGRApi tool for GET api/Sales/GetOrderImage/{orderId}/{cache}.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_get_sales_getorderimage_orderid_cache" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Dedicated HGRApi tool for GET api/Sales/GetOrderImage/{orderId}/{cache}. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Provides the GET get order image operation in sales/order operations. Use when: Use it when a client needs to run the get order image operation for sales/order operations. Input: [FromRoute] orderId: int. [FromRoute] cache: string. Header channel: current ChannelOAuthId. Output: Returns the result or applies the effect of the get order image operation. Search terms: sales getorderimage orderid cache. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_get_searchproduct_getmissinglistingsDedicated HGRApi tool for GET api/SearchProduct/getMissingListings.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_get_searchproduct_getmissinglistings" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Dedicated HGRApi tool for GET api/SearchProduct/getMissingListings. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Returns marketplace/channel listings that HGR detected during the latest periodic synchronization as missing from HGR for the current store. ownerAgent: listings. Domain: listings. Entity: missing_listing. Operation: list_missing. Scope: current_store. Use when: Use it when the user asks what products or listings from the current store can be imported into HGR, what listings are missing in HGR, or what items were detected as not present after synchronization. Input: Header channel: current ChannelOAuthId. No body. Output: Returns missing listing candidates with ChannelItem, ChannelTitle, Sku and variation attributes. HGRApi removes entries that already exist in HGR as successfully created listings before returning them. Search terms: searchproduct getmissinglistings. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_get_searchproduct_getpendingnoapipreviousvaluesDedicated HGRApi tool for GET api/SearchProduct/GetPendingNoApiPreviousValues.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_get_searchproduct_getpendingnoapipreviousvalues" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Dedicated HGRApi tool for GET api/SearchProduct/GetPendingNoApiPreviousValues. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Provides the GET get pending no api previous values operation in existing published product/listing management. Use when: Use it when a client needs to run the get pending no api previous values operation for existing published product/listing management. Input: Header channel: current ChannelOAuthId. Output: Returns the result or applies the effect of the get pending no api previous values operation. Search terms: searchproduct getpendingnoapipreviousvalues. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_get_searchproduct_pricechangesDedicated HGRApi tool for GET api/SearchProduct/PriceChanges.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_get_searchproduct_pricechanges" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Dedicated HGRApi tool for GET api/SearchProduct/PriceChanges. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Reads the recorded selling price change history shown in HGRWeb for one listing variation. ownerAgent: listings. Domain: listings. Entity: listing_price_history. Operation: read_history. Scope: exact_variation. Use when: Use it when the user asks for price history, price changes, previous selling prices or a price timeline of an identified or attached store product. Current price in the product details is not its history. Input: Required query id: positive internal ListingVariationId, not the parent ListingId, supplier ProductSourceId or marketplace Product ID. Resolve the attached product's visible Product ID through Listing/GetListings in the selected channel; use the matching variation Id. If several variations match, resolve the requested variation rather than choosing one arbitrarily. Output: Returns History entries with Date, Value (channel selling price), Author and Why when recorded. A successful History: [] means no recorded price changes for that variation. success=false or a missing History is a failed lookup, not evidence of no history. Search terms: searchproduct pricechanges. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_get_searchproduct_stockchangesDedicated HGRApi tool for GET api/SearchProduct/StockChanges.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_get_searchproduct_stockchanges" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Dedicated HGRApi tool for GET api/SearchProduct/StockChanges. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Reads the recorded stock quantity change history shown in HGRWeb for one listing variation. ownerAgent: listings. Domain: listings. Entity: listing_stock_history. Operation: read_history. Scope: exact_variation. Use when: Use it when the user asks for stock history, stock changes, quantity changes, inventory history or an availability timeline of an identified or attached store product. Current stock in the product details is not its history. Input: Required query id: positive internal ListingVariationId, not the parent ListingId, supplier ProductSourceId or marketplace Product ID. Resolve the attached product's visible Product ID through Listing/GetListings in the selected channel; use the matching variation Id. If several variations match, resolve the requested variation rather than choosing one arbitrarily. Output: Returns History entries with Date, Value (channel stock quantity), Author and Why when recorded. A successful History: [] means no recorded stock changes for that variation. success=false or a missing History is a failed lookup, not evidence of no history. Search terms: searchproduct stockchanges. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_get_source_configurationReads explicitly saved supplier settings for one visible store.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_get_source_configuration" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Reads explicitly saved supplier settings for one visible store. This is settings data, not supplier availability or listing usage data. It must never be interpreted as an enabled, disabled or suspended supplier state. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_get_sourcesLists current sources/suppliers from WAPI for one visible store/channel, optionally filtered by visible countryCode.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_get_sources" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Lists current sources/suppliers from WAPI for one visible store/channel, optionally filtered by visible countryCode. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_get_sources_getDedicated HGRApi tool for GET api/Sources/Get.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_get_sources_get" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Dedicated HGRApi tool for GET api/Sources/Get. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Lists supplier/source marketplaces available to the user and the current channel. ownerAgent: catalog-sources. supportingAgents: listings. Domain: sources. Entity: supplier_source. Operation: list. Scope: current_store. Use when: Use it to build supplier selectors, map sourceId values to visible names, resolve suppliers for a catalog search, or verify whether a supplier supports publication and Auto Ordering for the selected store and country. Use actual returned supplier IDs when a catalog search specifies a supplier; do not invent IDs. Input: [FromQuery] isoCountry: int?. Header channel: current ChannelOAuthId. If isoCountry is not sent, use the selected channel country. Output: Returns sources/suppliers with Id, Name, BaseUrl, Site, publication permissions, HasAutoOrder, AutoOrderingFee and other visible metadata. Search terms: sources get. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_get_sources_getpublicDedicated HGRApi tool for GET api/Sources/GetPublic.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_get_sources_getpublic" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Dedicated HGRApi tool for GET api/Sources/GetPublic. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Lists visible supplier/source marketplaces and their capabilities for a requested country without requiring a selected channel. ownerAgent: catalog-sources. supportingAgents: account-metrics, orders-autoordering, support. Domain: sources. Entity: supplier_source. Operation: list. Scope: country_catalog. AllowedIntents: supplier_capabilities. Use when: Use it for general commercial or pre-sales questions about suppliers available in a country, publication methods, Auto Ordering support, or the configured Auto Ordering fee when no authenticated store context is required. SearchTerms: suppliers available by country, supplier capabilities by country, Amazon Italy Auto Ordering, Amazon.it Auto Ordering, supplier Auto Ordering fee, supported suppliers in Italy. NegativeUseCases: Do not use it to claim that a supplier account is configured for the current user; Do not use it to list private suppliers belonging to the authenticated user. Input: Required [FromQuery] isoCountry: string. Use the two-letter HGR country code inferred from the marketplace or country named by the user, such as IT for Italy. Output: Returns visible sources/suppliers for the country with Id, Name, BaseUrl, Site, publication permissions, HasAutoOrder and AutoOrderingFee. Search terms: sources getpublic.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_get_sources_gooutDedicated HGRApi tool for GET api/Sources/GoOut.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_get_sources_goout" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Dedicated HGRApi tool for GET api/Sources/GoOut. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Provides the GET go out operation in source/supplier reading. Use when: Use it when a client needs to run the go out operation for source/supplier reading. Input: [FromQuery] sourceUrl: string. [FromQuery] isoCountry: int?. [FromQuery] channelListingId: int?. Output: Returns the result or applies the effect of the go out operation. Search terms: sources goout. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_get_subscription_summaryReads the visible current subscription/quota summary.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_get_subscription_summary" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Reads the visible current subscription/quota summary. It never creates, changes or cancels subscriptions.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_get_support_ticketReads one support ticket by its visible ticket id/reference.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_get_support_ticket" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe name "hgr_get_support_ticket" says "get" and "ticket": it reads issues, which other people can write.
    • untrusted-inputThe description's first sentence says "read" and "ticket": it reads issues, which other people can write.
    Description, as the server wrote it
    Reads one support ticket by its visible ticket id/reference.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_get_terminated_listingsLists terminated listings for one visible store.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_get_terminated_listings" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Lists terminated listings for one visible store. First resolve the store with hgr_list_channels, then call this tool using channelOAuthId from the selected store. Supports fields, sortBy, sortDirection, limit and pagination declared by HGRApi. Terminated listings do not expose price or stock fields. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_get_user_gettokenbalanceDedicated HGRApi tool for GET Api/User/GetTokenBalance.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_get_user_gettokenbalance" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Dedicated HGRApi tool for GET Api/User/GetTokenBalance. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Provides the GET get token balance operation in visible user data. Use when: Use it when a client needs to run the get token balance operation for visible user data. Input: No explicit input parameters required. Output: Returns the result or applies the effect of the get token balance operation. Search terms: user gettokenbalance.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_get_user_gettokenhistoryDedicated HGRApi tool for GET Api/User/GetTokenHistory.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_get_user_gettokenhistory" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Dedicated HGRApi tool for GET Api/User/GetTokenHistory. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Returns the authenticated user's token usage history. ownerAgent: account-metrics. Domain: account_tokens. Entity: token_history. Operation: list. Scope: authenticated_user. Use when: Use it when the authenticated user needs to review token charges, credits, awards, paid token entries or AI action usage history. Input: No body. Uses the authenticated user id from Authorization. No Header channel / ChannelOAuthId required. Not admin-only. Output: Returns history items with ReferenceType, Title, TokenAmount, UpdatedOn and ActionTypes. Search terms: user gettokenhistory.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_get_virtual_assistantsLists Virtual Assistant / VA profiles.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_get_virtual_assistants" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Lists Virtual Assistant / VA profiles. Prefer names in user-facing responses.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_get_winning_get_idDedicated HGRApi tool for GET api/Winning/Get/{id}.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_get_winning_get_id" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Dedicated HGRApi tool for GET api/Winning/Get/{id}. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Provides the GET get operation in winning product generation reading. Use when: Use it when a client needs to run the get operation for winning product generation reading. Input: [FromRoute] id: int. Output: Returns the result or applies the effect of the get operation. Search terms: winning get id.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_get_winning_listDedicated HGRApi tool for GET api/Winning/List.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_get_winning_list" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Dedicated HGRApi tool for GET api/Winning/List. This is an explicit tool with a fixed endpoint; it is not a generic endpoint caller. HGRApi functional documentation: Purpose: Provides the GET list operation in winning product generation reading. Use when: Use it when a client needs to run the list operation for winning product generation reading. Input: No explicit input parameters required. Output: Returns the result or applies the effect of the list operation. Search terms: winning list.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_list_channelsLists the user's connected stores/channels with channelOAuthId, store name, marketplace, country and connection status.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_list_channels" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Lists the user's connected stores/channels with channelOAuthId, store name, marketplace, country and connection status. Use channelOAuthId from this response for store-scoped endpoint tools.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_list_support_ticketsLists support tickets for the authenticated user.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_list_support_tickets" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe name "hgr_list_support_tickets" says "list" and "ticket": it reads issues, which other people can write.
    • untrusted-inputThe description's first sentence says "list" and "ticket": it reads issues, which other people can write.
    Description, as the server wrote it
    Lists support tickets for the authenticated user.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_list_templatesLists listing templates for one visible store/channel.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_list_templates" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Lists listing templates for one visible store/channel. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_load_order_progressReads progress for an order resolved from visible order Reference.Reads text others writeNo findings

    Why it is in this group

    • The description's first verb is "read": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Reads progress for an order resolved from visible order Reference. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • hgr_search_ordersSearches orders/order lines by visible order Reference and optional visible store.Reads text others writeNo findings

    Why it is in this group

    • The name "hgr_search_orders" says "search": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Searches orders/order lines by visible order Reference and optional visible store. Requires HGRApi Header channel / ChannelOAuthId resolved internally.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data.

Reads private data0
Reads files, mail, messages, databases, secrets, calendars or repositories.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

26 warn10 info
  • The server marks "hgr_generate_limited_products_csv" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "hgr_generate_limited_products_csv" says "generate": a word for a change.

    What this check looks for
  • The server marks "hgr_list_pending_now" destructive (destructiveHint: true), and its name says "list", a word for reading.

    Matched text

    annotations: {"readOnlyHint":false,"destructiveHint":true,"idempotentHint":false,"openWorldHint":true}; The name "hgr_list_pending_now" says "list": a word for reading.

    What this check looks for
  • The server marks "hgr_change_ai_publisher_status" destructive (destructiveHint: true), and its name says "status", a word for reading.

    Matched text

    annotations: {"readOnlyHint":false,"destructiveHint":true,"idempotentHint":false,"openWorldHint":true}; The name "hgr_change_ai_publisher_status" says "status": a word for reading.

    What this check looks for
  • The server marks "hgr_post_ai_getimageinfo" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "hgr_post_ai_getimageinfo" says "post": a word for a change.

    What this check looks for
  • The server marks "hgr_post_ai_gettaskresult" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "hgr_post_ai_gettaskresult" says "post": a word for a change.

    What this check looks for
  • The server marks "hgr_post_catalog_getproducts" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "hgr_post_catalog_getproducts" says "post": a word for a change.

    What this check looks for
Show 30 more findings
  • The server marks "hgr_post_channellisting_getcategoriesbytext" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "hgr_post_channellisting_getcategoriesbytext" says "post": a word for a change.

    What this check looks for
  • The server marks "hgr_post_channellisting_getcategoryspecifics" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "hgr_post_channellisting_getcategoryspecifics" says "post": a word for a change.

    What this check looks for
  • The server marks "hgr_post_channellisting_getsuggestedcategories" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "hgr_post_channellisting_getsuggestedcategories" says "post": a word for a change.

    What this check looks for
  • The server marks "hgr_post_channellisting_getsuggestedtitles" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "hgr_post_channellisting_getsuggestedtitles" says "post": a word for a change.

    What this check looks for
  • The server marks "hgr_post_channellisting_list" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "hgr_post_channellisting_list" says "post": a word for a change.

    What this check looks for
  • The description contains a 42-character base64 string.

    Matched text

    description: "...GRApi tool for POST api/ChannelListing/MonitorExistingListing2. This is an explici..."

    What this check looks for
  • The input schema at properties.body.description contains a 43-character base64 string.

    Matched text

    inputSchema.properties.body.description: "HGRApi POST /api/ChannelListing/MonitorExistingListing2 request body."

    What this check looks for
  • The server marks "hgr_post_dispatch_getshipmentdetails" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "hgr_post_dispatch_getshipmentdetails" says "post": a word for a change.

    What this check looks for
  • The server marks "hgr_post_listing_getbulkhistory" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "hgr_post_listing_getbulkhistory" says "post": a word for a change.

    What this check looks for
  • The server marks "hgr_post_listing_getscrapingconfig" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "hgr_post_listing_getscrapingconfig" says "post": a word for a change.

    What this check looks for
  • The server marks "hgr_post_listingcreate_getdata" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "hgr_post_listingcreate_getdata" says "post": a word for a change.

    What this check looks for
  • The server marks "hgr_post_listingcreate_getdatabypsids" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "hgr_post_listingcreate_getdatabypsids" says "post": a word for a change.

    What this check looks for
  • The server marks "hgr_post_notificationcenter_getall" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "hgr_post_notificationcenter_getall" says "post": a word for a change.

    What this check looks for
  • The server marks "hgr_post_sales_loadaddressesfromorderline" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "hgr_post_sales_loadaddressesfromorderline" says "post": a word for a change.

    What this check looks for
  • The server marks "hgr_post_sales_loadprogress" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "hgr_post_sales_loadprogress" says "post": a word for a change.

    What this check looks for
  • The server marks "hgr_post_searchproduct_getlistingsimages" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "hgr_post_searchproduct_getlistingsimages" says "post": a word for a change.

    What this check looks for
  • The description contains a 43-character base64 string.

    Matched text

    description: "...GRApi tool for POST api/SearchProduct/getPendingListingsImages2. This is an explici..."

    What this check looks for
  • The input schema at properties.body.description contains a 44-character base64 string.

    Matched text

    inputSchema.properties.body.description: "HGRApi POST /api/SearchProduct/getPendingListingsImages2 request body."

    What this check looks for
  • The server marks "hgr_post_searchproduct_getpendinglistingsimages2" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "hgr_post_searchproduct_getpendinglistingsimages2" says "post": a word for a change.

    What this check looks for
  • The server marks "hgr_post_smartlister_filters_checknew" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "hgr_post_smartlister_filters_checknew" says "post": a word for a change.

    What this check looks for
  • The description mentions "credential".

    Matched text

    description: "...e and impactConfirmed=true for supplier credential/configuration changes. Secret fields ar..."

    What this check looks for
  • The description mentions "credentials".

    Matched text

    description: "Updates No-API Server credentials/configuration with the exact WAPI crede..."

    What this check looks for
  • The input schema at properties.confirmed.description mentions "credential".

    Matched text

    inputSchema.properties.confirmed.description: "...icitly requested or confirmed the exact credential/configuration change."

    What this check looks for
  • The input schema at properties.impactConfirmed.description mentions "credential".

    Matched text

    inputSchema.properties.impactConfirmed.description: "...user explicitly confirmed the concrete credential/configuration consequences."

    What this check looks for
  • The input schema at required[0] mentions "credentials".

    Matched text

    inputSchema.required[0]: "credentials"

    What this check looks for
  • The description is 2,842 characters long, over the 2,000 this check looks for.

    Matched text

    description ends: "...oad in body. Requires HGRApi Header channel / ChannelOAuthId resolved internally."

    What this check looks for
  • The description is 2,046 characters long, over the 2,000 this check looks for.

    Matched text

    description ends: "...-only request fields are removed automatically before the HGRApi request is sent."

    What this check looks for
  • The description is 2,276 characters long, over the 2,000 this check looks for.

    Matched text

    description ends: "...oad in body. Requires HGRApi Header channel / ChannelOAuthId resolved internally."

    What this check looks for
  • The description is 2,135 characters long, over the 2,000 this check looks for.

    Matched text

    description ends: "...oad in body. Requires HGRApi Header channel / ChannelOAuthId resolved internally."

    What this check looks for
  • The description is 2,091 characters long, over the 2,000 this check looks for.

    Matched text

    description ends: "...e execution. Requires HGRApi Header channel / ChannelOAuthId resolved internally."

    What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

Install

Pinned to version 2026.10.29. Values in angle brackets are yours to fill in.

claude mcp add --transport http hustlegotreal https://mcp.hustlegotreal.com/
claude mcp add --transport http hustlegotreal https://mcp.hustlegotreal.com/

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__hustlegotreal__hgr_get_authenticated_user",
      "mcp__hustlegotreal__hgr_list_channels",
      "mcp__hustlegotreal__hgr_get_subscription_summary",
      "mcp__hustlegotreal__hgr_get_active_listings",
      "mcp__hustlegotreal__hgr_get_pending_listings",
      "mcp__hustlegotreal__hgr_get_terminated_listings",
      "mcp__hustlegotreal__hgr_get_listings",
      "mcp__hustlegotreal__hgr_get_listing_price_history",
      "mcp__hustlegotreal__hgr_get_listing_stock_history",
      "mcp__hustlegotreal__hgr_search_orders",
      "mcp__hustlegotreal__hgr_load_order_progress",
      "mcp__hustlegotreal__hgr_get_sales",
      "mcp__hustlegotreal__hgr_get_sources",
      "mcp__hustlegotreal__hgr_get_autoorder_fees",
      "mcp__hustlegotreal__hgr_get_autoordering_configuration",
      "mcp__hustlegotreal__hgr_get_noapi_servers",
      "mcp__hustlegotreal__hgr_get_noapi_solution_state",
      "mcp__hustlegotreal__hgr_get_channel_configuration",
      "mcp__hustlegotreal__hgr_get_source_configuration",
      "mcp__hustlegotreal__hgr_get_computed_source_configuration",
      "mcp__hustlegotreal__hgr_get_pricing_rules",
      "mcp__hustlegotreal__hgr_get_price_warrior",
      "mcp__hustlegotreal__hgr_get_ai_agent_configuration",
      "mcp__hustlegotreal__hgr_get_ai_agent_dashboard",
      "mcp__hustlegotreal__hgr_get_ai_publisher_filters",
      "mcp__hustlegotreal__hgr_get_ai_publisher_history",
      "mcp__hustlegotreal__hgr_list_templates",
      "mcp__hustlegotreal__hgr_get_virtual_assistants",
      "mcp__hustlegotreal__hgr_get_affiliate_dashboard",
      "mcp__hustlegotreal__hgr_get_affiliate_dashboard_monthly",
      "mcp__hustlegotreal__hgr_get_affiliate_withdrawals",
      "mcp__hustlegotreal__hgr_list_support_tickets",
      "mcp__hustlegotreal__hgr_get_support_ticket",
      "mcp__hustlegotreal__hgr_get_ai_gettasks",
      "mcp__hustlegotreal__hgr_get_analytics_beingwatched",
      "mcp__hustlegotreal__hgr_get_analytics_getwatchers",
      "mcp__hustlegotreal__hgr_get_analytics_productsnotbeingwatched",
      "mcp__hustlegotreal__hgr_get_catalog_getproductsource",
      "mcp__hustlegotreal__hgr_get_catalog_newgetlistingstatus",
      "mcp__hustlegotreal__hgr_get_channellisting_getcategoryinfo",
      "mcp__hustlegotreal__hgr_get_channellisting_getcustomcategories",
      "mcp__hustlegotreal__hgr_get_channellisting_getsettings",
      "mcp__hustlegotreal__hgr_get_channellisting_isbrandinverolist",
      "mcp__hustlegotreal__hgr_get_dashboard_getaffiliatestatistics_period_from_to",
      "mcp__hustlegotreal__hgr_get_dashboard_getlistingservices",
      "mcp__hustlegotreal__hgr_get_dashboard_getlistingsummary",
      "mcp__hustlegotreal__hgr_get_dashboard_getnoapiservers",
      "mcp__hustlegotreal__hgr_get_dashboard_getoptimizedcount",
      "mcp__hustlegotreal__hgr_get_dashboard_getpendingstatistics",
      "mcp__hustlegotreal__hgr_get_dashboard_getupcomingwebinar",
      "mcp__hustlegotreal__hgr_get_dashboard_requestcode",
      "mcp__hustlegotreal__hgr_get_dashboard_taskpendingautoorder2",
      "mcp__hustlegotreal__hgr_get_dispatch_get",
      "mcp__hustlegotreal__hgr_get_helpcentre_getticket_id",
      "mcp__hustlegotreal__hgr_get_listing_didlist",
      "mcp__hustlegotreal__hgr_get_listing_listingscountperchannel",
      "mcp__hustlegotreal__hgr_get_products_subscriptions_get",
      "mcp__hustlegotreal__hgr_get_sales_getorderimage_orderid_cache",
      "mcp__hustlegotreal__hgr_get_searchproduct_getmissinglistings",
      "mcp__hustlegotreal__hgr_get_searchproduct_getpendingnoapipreviousvalues",
      "mcp__hustlegotreal__hgr_get_searchproduct_pricechanges",
      "mcp__hustlegotreal__hgr_get_searchproduct_stockchanges",
      "mcp__hustlegotreal__hgr_get_sources_get",
      "mcp__hustlegotreal__hgr_get_sources_getpublic",
      "mcp__hustlegotreal__hgr_get_sources_goout",
      "mcp__hustlegotreal__hgr_get_user_gettokenbalance",
      "mcp__hustlegotreal__hgr_get_user_gettokenhistory",
      "mcp__hustlegotreal__hgr_get_winning_get_id",
      "mcp__hustlegotreal__hgr_get_winning_list"
    ],
    "ask": [
      "mcp__hustlegotreal__hgr_generate_limited_products_csv",
      "mcp__hustlegotreal__hgr_load_order_addresses",
      "mcp__hustlegotreal__hgr_load_business_policies",
      "mcp__hustlegotreal__hgr_load_shipping_options",
      "mcp__hustlegotreal__hgr_post_ai_getimageinfo",
      "mcp__hustlegotreal__hgr_post_ai_gettaskresult",
      "mcp__hustlegotreal__hgr_post_catalog_getproducts",
      "mcp__hustlegotreal__hgr_post_channellisting_getcategoriesbytext",
      "mcp__hustlegotreal__hgr_post_channellisting_getcategoryspecifics",
      "mcp__hustlegotreal__hgr_post_channellisting_getsuggestedcategories",
      "mcp__hustlegotreal__hgr_post_channellisting_getsuggestedtitles",
      "mcp__hustlegotreal__hgr_post_channellisting_list",
      "mcp__hustlegotreal__hgr_post_dispatch_getshipmentdetails",
      "mcp__hustlegotreal__hgr_post_listing_getbulkhistory",
      "mcp__hustlegotreal__hgr_post_listing_getscrapingconfig",
      "mcp__hustlegotreal__hgr_post_listingcreate_getdata",
      "mcp__hustlegotreal__hgr_post_listingcreate_getdatabypsids",
      "mcp__hustlegotreal__hgr_post_notificationcenter_getall",
      "mcp__hustlegotreal__hgr_post_sales_loadaddressesfromorderline",
      "mcp__hustlegotreal__hgr_post_sales_loadprogress",
      "mcp__hustlegotreal__hgr_post_searchproduct_getlistingsimages",
      "mcp__hustlegotreal__hgr_post_searchproduct_getpendinglistingsimages2",
      "mcp__hustlegotreal__hgr_post_smartlister_filters_checknew"
    ],
    "deny": [
      "mcp__hustlegotreal__hgr_update_listing",
      "mcp__hustlegotreal__hgr_force_refresh_listings",
      "mcp__hustlegotreal__hgr_list_pending_now",
      "mcp__hustlegotreal__hgr_pause_pending_to_review",
      "mcp__hustlegotreal__hgr_remove_listing",
      "mcp__hustlegotreal__hgr_terminate_listing",
      "mcp__hustlegotreal__hgr_relist_listing",
      "mcp__hustlegotreal__hgr_set_shipping_address",
      "mcp__hustlegotreal__hgr_process_order_lines",
      "mcp__hustlegotreal__hgr_force_process_order_lines",
      "mcp__hustlegotreal__hgr_stop_order_lines",
      "mcp__hustlegotreal__hgr_mark_order_lines_fixed",
      "mcp__hustlegotreal__hgr_manually_dispatch_order_lines",
      "mcp__hustlegotreal__hgr_mark_order_lines_as_purchased",
      "mcp__hustlegotreal__hgr_generate_tracking_id",
      "mcp__hustlegotreal__hgr_set_manual_tracking_id",
      "mcp__hustlegotreal__hgr_save_autoordering_configuration",
      "mcp__hustlegotreal__hgr_remove_autoordering_configuration",
      "mcp__hustlegotreal__hgr_update_noapi_servers",
      "mcp__hustlegotreal__hgr_request_noapi_code",
      "mcp__hustlegotreal__hgr_send_noapi_code",
      "mcp__hustlegotreal__hgr_send_noapi_answer",
      "mcp__hustlegotreal__hgr_refresh_business_policies",
      "mcp__hustlegotreal__hgr_save_channel_setting",
      "mcp__hustlegotreal__hgr_save_source_setting",
      "mcp__hustlegotreal__hgr_add_pricing_rule",
      "mcp__hustlegotreal__hgr_update_pricing_rule",
      "mcp__hustlegotreal__hgr_delete_pricing_rule",
      "mcp__hustlegotreal__hgr_update_price_warrior_settings",
      "mcp__hustlegotreal__hgr_save_ai_agent_configuration",
      "mcp__hustlegotreal__hgr_create_ai_publisher_agent",
      "mcp__hustlegotreal__hgr_change_ai_publisher_status",
      "mcp__hustlegotreal__hgr_update_ai_publisher_optimization",
      "mcp__hustlegotreal__hgr_make_default_template",
      "mcp__hustlegotreal__hgr_update_template",
      "mcp__hustlegotreal__hgr_add_virtual_assistant",
      "mcp__hustlegotreal__hgr_update_virtual_assistant",
      "mcp__hustlegotreal__hgr_create_support_ticket",
      "mcp__hustlegotreal__hgr_reply_support_ticket",
      "mcp__hustlegotreal__hgr_post_ai_createtask",
      "mcp__hustlegotreal__hgr_post_ai_publishnow",
      "mcp__hustlegotreal__hgr_post_analytics_addwork",
      "mcp__hustlegotreal__hgr_post_catalog_submitcatalog",
      "mcp__hustlegotreal__hgr_post_channellisting_clearonevariation",
      "mcp__hustlegotreal__hgr_post_channellisting_clearvariations",
      "mcp__hustlegotreal__hgr_post_channellisting_monitorexistinglisting",
      "mcp__hustlegotreal__hgr_post_channellisting_monitorexistinglisting2",
      "mcp__hustlegotreal__hgr_post_channellisting_optimizeimage",
      "mcp__hustlegotreal__hgr_post_channellisting_optimizespecificfields",
      "mcp__hustlegotreal__hgr_post_dispatch_updateshipmentdetails",
      "mcp__hustlegotreal__hgr_post_helpcentre_contact",
      "mcp__hustlegotreal__hgr_post_listing_autolist",
      "mcp__hustlegotreal__hgr_post_listing_migratebulk",
      "mcp__hustlegotreal__hgr_post_listing_partner",
      "mcp__hustlegotreal__hgr_post_listing_relistedbulk2",
      "mcp__hustlegotreal__hgr_post_listing_saveautolist",
      "mcp__hustlegotreal__hgr_post_listing_savebulkpublish",
      "mcp__hustlegotreal__hgr_post_listingcreate_editpending",
      "mcp__hustlegotreal__hgr_post_listingcreate_submit",
      "mcp__hustlegotreal__hgr_post_notificationcenter_markallasread",
      "mcp__hustlegotreal__hgr_post_notificationcenter_markallchannelasread",
      "mcp__hustlegotreal__hgr_post_notificationcenter_markasread",
      "mcp__hustlegotreal__hgr_post_sales_fixedorderline",
      "mcp__hustlegotreal__hgr_post_sales_forceprocessorderline",
      "mcp__hustlegotreal__hgr_post_sales_generatetrackingid",
      "mcp__hustlegotreal__hgr_post_sales_manuallydispatchorderline",
      "mcp__hustlegotreal__hgr_post_sales_markasdispatched",
      "mcp__hustlegotreal__hgr_post_sales_processorderline",
      "mcp__hustlegotreal__hgr_post_sales_stoporderline",
      "mcp__hustlegotreal__hgr_post_searchproduct_defaultsettingsmultiple",
      "mcp__hustlegotreal__hgr_post_searchproduct_listnow",
      "mcp__hustlegotreal__hgr_post_searchproduct_optimize",
      "mcp__hustlegotreal__hgr_post_searchproduct_pausetoreview",
      "mcp__hustlegotreal__hgr_post_searchproduct_relist",
      "mcp__hustlegotreal__hgr_post_searchproduct_removelisting",
      "mcp__hustlegotreal__hgr_post_searchproduct_savemultipleproductchanges",
      "mcp__hustlegotreal__hgr_post_searchproduct_terminatelisting2",
      "mcp__hustlegotreal__hgr_post_smartlister_filters_new"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as hustlegotreal. Review it before you use it.

Capability tags behind 170 rules
  • mcp__hustlegotreal__hgr_get_authenticated_user untrusted-input
  • mcp__hustlegotreal__hgr_list_channels untrusted-input
  • mcp__hustlegotreal__hgr_get_subscription_summary untrusted-input
  • mcp__hustlegotreal__hgr_get_active_listings untrusted-input
  • mcp__hustlegotreal__hgr_get_pending_listings untrusted-input
  • mcp__hustlegotreal__hgr_get_terminated_listings untrusted-input
  • mcp__hustlegotreal__hgr_get_listings untrusted-input
  • mcp__hustlegotreal__hgr_generate_limited_products_csv untrusted-input
  • mcp__hustlegotreal__hgr_update_listing untrusted-input
  • mcp__hustlegotreal__hgr_force_refresh_listings untrusted-input
  • mcp__hustlegotreal__hgr_list_pending_now untrusted-input
  • mcp__hustlegotreal__hgr_pause_pending_to_review untrusted-input
  • mcp__hustlegotreal__hgr_remove_listing untrusted-input
  • mcp__hustlegotreal__hgr_terminate_listing untrusted-input
  • mcp__hustlegotreal__hgr_relist_listing untrusted-input
  • mcp__hustlegotreal__hgr_get_listing_price_history untrusted-input
  • mcp__hustlegotreal__hgr_get_listing_stock_history untrusted-input
  • mcp__hustlegotreal__hgr_search_orders untrusted-input
  • mcp__hustlegotreal__hgr_load_order_progress untrusted-input
  • mcp__hustlegotreal__hgr_load_order_addresses untrusted-input
  • mcp__hustlegotreal__hgr_set_shipping_address untrusted-input
  • mcp__hustlegotreal__hgr_process_order_lines untrusted-input
  • mcp__hustlegotreal__hgr_force_process_order_lines untrusted-input
  • mcp__hustlegotreal__hgr_stop_order_lines untrusted-input
  • mcp__hustlegotreal__hgr_mark_order_lines_fixed untrusted-input
  • mcp__hustlegotreal__hgr_manually_dispatch_order_lines untrusted-input
  • mcp__hustlegotreal__hgr_mark_order_lines_as_purchased untrusted-input
  • mcp__hustlegotreal__hgr_generate_tracking_id untrusted-input
  • mcp__hustlegotreal__hgr_set_manual_tracking_id untrusted-input
  • mcp__hustlegotreal__hgr_get_sales untrusted-input
  • mcp__hustlegotreal__hgr_get_sources untrusted-input
  • mcp__hustlegotreal__hgr_get_autoorder_fees untrusted-input
  • mcp__hustlegotreal__hgr_get_autoordering_configuration untrusted-input
  • mcp__hustlegotreal__hgr_save_autoordering_configuration untrusted-input
  • mcp__hustlegotreal__hgr_remove_autoordering_configuration untrusted-input
  • mcp__hustlegotreal__hgr_get_noapi_servers untrusted-input
  • mcp__hustlegotreal__hgr_update_noapi_servers untrusted-input
  • mcp__hustlegotreal__hgr_get_noapi_solution_state untrusted-input
  • mcp__hustlegotreal__hgr_request_noapi_code untrusted-input
  • mcp__hustlegotreal__hgr_send_noapi_code untrusted-input, outbound
  • mcp__hustlegotreal__hgr_send_noapi_answer untrusted-input, outbound
  • mcp__hustlegotreal__hgr_get_channel_configuration untrusted-input
  • mcp__hustlegotreal__hgr_load_business_policies untrusted-input
  • mcp__hustlegotreal__hgr_load_shipping_options untrusted-input
  • mcp__hustlegotreal__hgr_refresh_business_policies untrusted-input
  • mcp__hustlegotreal__hgr_save_channel_setting untrusted-input
  • mcp__hustlegotreal__hgr_get_source_configuration untrusted-input
  • mcp__hustlegotreal__hgr_get_computed_source_configuration untrusted-input
  • mcp__hustlegotreal__hgr_save_source_setting untrusted-input
  • mcp__hustlegotreal__hgr_get_pricing_rules untrusted-input
  • mcp__hustlegotreal__hgr_add_pricing_rule untrusted-input
  • mcp__hustlegotreal__hgr_update_pricing_rule untrusted-input
  • mcp__hustlegotreal__hgr_delete_pricing_rule untrusted-input
  • mcp__hustlegotreal__hgr_get_price_warrior untrusted-input
  • mcp__hustlegotreal__hgr_update_price_warrior_settings untrusted-input
  • mcp__hustlegotreal__hgr_get_ai_agent_configuration untrusted-input
  • mcp__hustlegotreal__hgr_get_ai_agent_dashboard untrusted-input
  • mcp__hustlegotreal__hgr_save_ai_agent_configuration untrusted-input
  • mcp__hustlegotreal__hgr_get_ai_publisher_filters untrusted-input
  • mcp__hustlegotreal__hgr_create_ai_publisher_agent untrusted-input
  • mcp__hustlegotreal__hgr_change_ai_publisher_status untrusted-input
  • mcp__hustlegotreal__hgr_update_ai_publisher_optimization untrusted-input
  • mcp__hustlegotreal__hgr_get_ai_publisher_history untrusted-input
  • mcp__hustlegotreal__hgr_list_templates untrusted-input
  • mcp__hustlegotreal__hgr_make_default_template untrusted-input
  • mcp__hustlegotreal__hgr_update_template untrusted-input
  • mcp__hustlegotreal__hgr_get_virtual_assistants untrusted-input
  • mcp__hustlegotreal__hgr_add_virtual_assistant untrusted-input
  • mcp__hustlegotreal__hgr_update_virtual_assistant untrusted-input
  • mcp__hustlegotreal__hgr_get_affiliate_dashboard untrusted-input
  • mcp__hustlegotreal__hgr_get_affiliate_dashboard_monthly untrusted-input
  • mcp__hustlegotreal__hgr_get_affiliate_withdrawals untrusted-input
  • mcp__hustlegotreal__hgr_list_support_tickets untrusted-input
  • mcp__hustlegotreal__hgr_get_support_ticket untrusted-input
  • mcp__hustlegotreal__hgr_create_support_ticket untrusted-input
  • mcp__hustlegotreal__hgr_reply_support_ticket untrusted-input, outbound
  • mcp__hustlegotreal__hgr_get_ai_gettasks untrusted-input
  • mcp__hustlegotreal__hgr_get_analytics_beingwatched untrusted-input
  • mcp__hustlegotreal__hgr_get_analytics_getwatchers untrusted-input
  • mcp__hustlegotreal__hgr_get_analytics_productsnotbeingwatched untrusted-input
  • mcp__hustlegotreal__hgr_get_catalog_getproductsource untrusted-input
  • mcp__hustlegotreal__hgr_get_catalog_newgetlistingstatus untrusted-input
  • mcp__hustlegotreal__hgr_get_channellisting_getcategoryinfo untrusted-input
  • mcp__hustlegotreal__hgr_get_channellisting_getcustomcategories untrusted-input
  • mcp__hustlegotreal__hgr_get_channellisting_getsettings untrusted-input
  • mcp__hustlegotreal__hgr_get_channellisting_isbrandinverolist untrusted-input
  • mcp__hustlegotreal__hgr_get_dashboard_getaffiliatestatistics_period_from_to untrusted-input
  • mcp__hustlegotreal__hgr_get_dashboard_getlistingservices untrusted-input
  • mcp__hustlegotreal__hgr_get_dashboard_getlistingsummary untrusted-input
  • mcp__hustlegotreal__hgr_get_dashboard_getnoapiservers untrusted-input
  • mcp__hustlegotreal__hgr_get_dashboard_getoptimizedcount untrusted-input
  • mcp__hustlegotreal__hgr_get_dashboard_getpendingstatistics untrusted-input
  • mcp__hustlegotreal__hgr_get_dashboard_getupcomingwebinar untrusted-input
  • mcp__hustlegotreal__hgr_get_dashboard_requestcode untrusted-input
  • mcp__hustlegotreal__hgr_get_dashboard_taskpendingautoorder2 untrusted-input
  • mcp__hustlegotreal__hgr_get_dispatch_get untrusted-input
  • mcp__hustlegotreal__hgr_get_helpcentre_getticket_id untrusted-input
  • mcp__hustlegotreal__hgr_get_listing_didlist untrusted-input
  • mcp__hustlegotreal__hgr_get_listing_listingscountperchannel untrusted-input
  • mcp__hustlegotreal__hgr_get_products_subscriptions_get untrusted-input
  • mcp__hustlegotreal__hgr_get_sales_getorderimage_orderid_cache untrusted-input
  • mcp__hustlegotreal__hgr_get_searchproduct_getmissinglistings untrusted-input
  • mcp__hustlegotreal__hgr_get_searchproduct_getpendingnoapipreviousvalues untrusted-input
  • mcp__hustlegotreal__hgr_get_searchproduct_pricechanges untrusted-input
  • mcp__hustlegotreal__hgr_get_searchproduct_stockchanges untrusted-input
  • mcp__hustlegotreal__hgr_get_sources_get untrusted-input
  • mcp__hustlegotreal__hgr_get_sources_getpublic untrusted-input
  • mcp__hustlegotreal__hgr_get_sources_goout untrusted-input
  • mcp__hustlegotreal__hgr_get_user_gettokenbalance untrusted-input
  • mcp__hustlegotreal__hgr_get_user_gettokenhistory untrusted-input
  • mcp__hustlegotreal__hgr_get_winning_get_id untrusted-input
  • mcp__hustlegotreal__hgr_get_winning_list untrusted-input
  • mcp__hustlegotreal__hgr_post_ai_createtask untrusted-input, outbound
  • mcp__hustlegotreal__hgr_post_ai_getimageinfo untrusted-input, outbound
  • mcp__hustlegotreal__hgr_post_ai_gettaskresult untrusted-input, outbound
  • mcp__hustlegotreal__hgr_post_ai_publishnow untrusted-input, outbound
  • mcp__hustlegotreal__hgr_post_analytics_addwork untrusted-input, outbound
  • mcp__hustlegotreal__hgr_post_catalog_getproducts untrusted-input, outbound
  • mcp__hustlegotreal__hgr_post_catalog_submitcatalog untrusted-input, outbound
  • mcp__hustlegotreal__hgr_post_channellisting_clearonevariation untrusted-input, outbound
  • mcp__hustlegotreal__hgr_post_channellisting_clearvariations untrusted-input, outbound
  • mcp__hustlegotreal__hgr_post_channellisting_getcategoriesbytext untrusted-input, outbound
  • mcp__hustlegotreal__hgr_post_channellisting_getcategoryspecifics untrusted-input, outbound
  • mcp__hustlegotreal__hgr_post_channellisting_getsuggestedcategories untrusted-input, outbound
  • mcp__hustlegotreal__hgr_post_channellisting_getsuggestedtitles untrusted-input, outbound
  • mcp__hustlegotreal__hgr_post_channellisting_list untrusted-input, outbound
  • mcp__hustlegotreal__hgr_post_channellisting_monitorexistinglisting untrusted-input, outbound
  • mcp__hustlegotreal__hgr_post_channellisting_monitorexistinglisting2 untrusted-input, outbound
  • mcp__hustlegotreal__hgr_post_channellisting_optimizeimage untrusted-input, outbound
  • mcp__hustlegotreal__hgr_post_channellisting_optimizespecificfields untrusted-input, outbound
  • mcp__hustlegotreal__hgr_post_dispatch_getshipmentdetails untrusted-input, outbound
  • mcp__hustlegotreal__hgr_post_dispatch_updateshipmentdetails untrusted-input, outbound
  • mcp__hustlegotreal__hgr_post_helpcentre_contact untrusted-input, outbound
  • mcp__hustlegotreal__hgr_post_listing_autolist untrusted-input, outbound
  • mcp__hustlegotreal__hgr_post_listing_getbulkhistory untrusted-input, outbound
  • mcp__hustlegotreal__hgr_post_listing_getscrapingconfig untrusted-input, outbound
  • mcp__hustlegotreal__hgr_post_listing_migratebulk untrusted-input, outbound
  • mcp__hustlegotreal__hgr_post_listing_partner untrusted-input, outbound
  • mcp__hustlegotreal__hgr_post_listing_relistedbulk2 untrusted-input, outbound
  • mcp__hustlegotreal__hgr_post_listing_saveautolist untrusted-input, outbound
  • mcp__hustlegotreal__hgr_post_listing_savebulkpublish untrusted-input, outbound
  • mcp__hustlegotreal__hgr_post_listingcreate_editpending untrusted-input, outbound
  • mcp__hustlegotreal__hgr_post_listingcreate_getdata untrusted-input, outbound
  • mcp__hustlegotreal__hgr_post_listingcreate_getdatabypsids untrusted-input, outbound
  • mcp__hustlegotreal__hgr_post_listingcreate_submit untrusted-input, outbound
  • mcp__hustlegotreal__hgr_post_notificationcenter_getall untrusted-input, outbound
  • mcp__hustlegotreal__hgr_post_notificationcenter_markallasread untrusted-input, outbound
  • mcp__hustlegotreal__hgr_post_notificationcenter_markallchannelasread untrusted-input, outbound
  • mcp__hustlegotreal__hgr_post_notificationcenter_markasread untrusted-input, outbound
  • mcp__hustlegotreal__hgr_post_sales_fixedorderline untrusted-input, outbound
  • mcp__hustlegotreal__hgr_post_sales_forceprocessorderline untrusted-input, outbound
  • mcp__hustlegotreal__hgr_post_sales_generatetrackingid untrusted-input, outbound
  • mcp__hustlegotreal__hgr_post_sales_loadaddressesfromorderline untrusted-input, outbound
  • mcp__hustlegotreal__hgr_post_sales_loadprogress untrusted-input, outbound
  • mcp__hustlegotreal__hgr_post_sales_manuallydispatchorderline untrusted-input, outbound
  • mcp__hustlegotreal__hgr_post_sales_markasdispatched untrusted-input, outbound
  • mcp__hustlegotreal__hgr_post_sales_processorderline untrusted-input, outbound
  • mcp__hustlegotreal__hgr_post_sales_stoporderline untrusted-input, outbound
  • mcp__hustlegotreal__hgr_post_searchproduct_defaultsettingsmultiple untrusted-input, outbound
  • mcp__hustlegotreal__hgr_post_searchproduct_getlistingsimages untrusted-input, outbound
  • mcp__hustlegotreal__hgr_post_searchproduct_getpendinglistingsimages2 untrusted-input, outbound
  • mcp__hustlegotreal__hgr_post_searchproduct_listnow untrusted-input, outbound
  • mcp__hustlegotreal__hgr_post_searchproduct_optimize untrusted-input, outbound
  • mcp__hustlegotreal__hgr_post_searchproduct_pausetoreview untrusted-input, outbound
  • mcp__hustlegotreal__hgr_post_searchproduct_relist untrusted-input, outbound
  • mcp__hustlegotreal__hgr_post_searchproduct_removelisting untrusted-input, outbound
  • mcp__hustlegotreal__hgr_post_searchproduct_savemultipleproductchanges untrusted-input, outbound
  • mcp__hustlegotreal__hgr_post_searchproduct_terminatelisting2 untrusted-input, outbound
  • mcp__hustlegotreal__hgr_post_smartlister_filters_checknew untrusted-input, outbound
  • mcp__hustlegotreal__hgr_post_smartlister_filters_new untrusted-input, outbound

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/com.hustlegotreal/mcp/verify?hash=d0827a241d584f4e39937d9d627888300878021a92bcd0c81c3092fe18ee8e8a" | jq -e '.changed == false'

Pinned hash d0827a241d58, from Oct 29, 2026, 10:18 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/com.hustlegotreal/mcp/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for com.hustlegotreal/mcp
[![anlyon.dev](https://anlyon.dev/badge/com.hustlegotreal/mcp.svg)](https://anlyon.dev/servers/com.hustlegotreal/mcp)

Source: MCP Registry · repository. Synced Oct 29, 2026, 10:17 UTC.