Lezzoo

com.lezzoo/lezzoolezzoo.comstreamable-httpv0.15.0Scanned 2 hours ago

Order food, groceries & pharmacy delivery in Kurdistan & Iraq: search, menus, cart, checkout.

21 tools: 3 can delete or cancel things, 6 change things and 12 only read.

Reads private data · 1
Reads text others write · 15
Can send data out · 0
3 findings

Anlyon alternative

9 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

21 tools

Deletes or cancels 3Removes, cancels or revokes something.Claude Code: deny

clear_cartRemove all items from the cart.1 finding
Why it is in this group
- The description's first verb is "remove": a word for removing or ending something.
- The server marks it not destructive (destructiveHint: false), but an annotation never lowers a class.
Findings
- Warn
  The server marks "clear_cart" not destructive (destructiveHint: false), and its own name, description or input give the class "destructive".
  Matched text
  annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "remove": a word for removing or ending something.
  What this check looks for
Description, as the server wrote it
Remove all items from the cart.
Annotations the server declares
- title: Clear cart
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
place_orderPlace the order from the current cart.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Place the order from the current cart. Call review_order first so the customer can confirm the total. Set confirm:true to actually place the order — without it, this returns a preview only. Requires sign-in and a non-empty cart.
Annotations the server declares
- title: Place order
- readOnlyHint: false
- destructiveHint: true
- openWorldHint: true
remove_cart_itemRemove a cart line by line_id (from view_cart).1 finding
Why it is in this group
- The name "remove_cart_item" says "remove": a word for removing or ending something.
- The server marks it not destructive (destructiveHint: false), but an annotation never lowers a class.
Findings
- Warn
  The server marks "remove_cart_item" not destructive (destructiveHint: false), and its own name, description or input give the class "destructive".
  Matched text
  annotations: {"readOnlyHint":false,"destructiveHint":false,"openWorldHint":false}; The name "remove_cart_item" says "remove": a word for removing or ending something.
  What this check looks for
Description, as the server wrote it
Remove a cart line by line_id (from view_cart).
Annotations the server declares
- title: Remove cart item
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: false

Changes things 6Creates or changes something that can be changed back.Claude Code: ask

add_to_cartAdd one or more products to the cart in a single call (put a whole request's items in one call).Reads text others writeNo findings
Why it is in this group
- The name "add_to_cart" says "add": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Add one or more products to the cart in a single call (put a whole request's items in one call). For several of the SAME item use `quantity` (e.g. "2 Chili Boxes" → quantity: 2). For DIFFERENT products use `items` (an array of { productId, quantity?, optionValueIds? }), each with its own `quantity`. For a single product, pass `productId`/`quantity`/`optionValueIds` directly. product_id comes from search_merchant_products/get_product_details; optionValueIds are addon/size value ids from the product's options. One merchant per cart.
Annotations the server declares
- title: Add to cart
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true
get_payment_linkGenerate a payment link for a placed order.Reads text others write1 finding
Why it is in this group
- The name "get_payment_link" says "get": a word for reading.
- The description's first verb is "generate": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Findings
- Warn
  The server marks "get_payment_link" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
  Matched text
  annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":true}; The name "get_payment_link" says "get": a word for reading.
  What this check looks for
Description, as the server wrote it
Generate a payment link for a placed order. Use this if the payment link expired or was not returned at order placement. Requires sign-in.
Annotations the server declares
- title: Get payment link
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
logoutSign the customer out of this session (clears the stored token).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Sign the customer out of this session (clears the stored token).
Annotations the server declares
- title: Sign out
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
review_orderPrices the current cart for checkout (delivery, discount, fees, total) and renders an interactive widget in which the user selects their delivery address and payment method as tapp…Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Prices the current cart for checkout (delivery, discount, fees, total) and renders an interactive widget in which the user selects their delivery address and payment method as tappable options — those details are chosen in the widget rather than in chat. Use when the user is ready to check out. Requires sign-in and a non-empty cart. Places no order.
Annotations the server declares
- title: Review order
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
track_orderTrack a Lezzoo order live — status, ETA, driver name/status/location, merchant, destination, and the ordered items (name, description, quantity, price, chosen options, image) — ren…Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Track a Lezzoo order live — status, ETA, driver name/status/location, merchant, destination, and the ordered items (name, description, quantity, price, chosen options, image) — rendered as a status card with a progress stepper (and a map when the driver's live position is available). Pass an order_id, or omit it to track the customer's most recent active order. Requires sign-in. Read-only. Call again to refresh.
Annotations the server declares
- title: Track order
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
update_cart_itemSet the quantity of a cart line by line_id (from view_cart).No findings
Why it is in this group
- The name "update_cart_item" says "update": a word for a change.
Description, as the server wrote it
Set the quantity of a cart line by line_id (from view_cart). Quantity 0 removes it.
Annotations the server declares
- title: Update cart item
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: false

Only reads 12Looks things up and changes nothing.Show 12 read-only tools

auth_statusReturn whether the customer is signed in for this session, and who.No findings
Why it is in this group
- The name "auth_status" says "status": a word for reading.
Description, as the server wrote it
Return whether the customer is signed in for this session, and who.
Annotations the server declares
- title: Sign-in status
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_addressesReturn the signed-in customer's saved delivery addresses (title, details, type, coordinates).Reads text others writeNo findings
Why it is in this group
- The name "get_addresses" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Return the signed-in customer's saved delivery addresses (title, details, type, coordinates). Requires the customer to be signed in for this session. Read-only.
Annotations the server declares
- title: My addresses
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
get_full_menuFetch the entire menu of a merchant in one call — all categories and all items.Reads text others writeNo findings
Why it is in this group
- The name "get_full_menu" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Fetch the entire menu of a merchant in one call — all categories and all items. Use this when the user wants to browse the full menu, or when you need to find an item across all sections without paging. Returns every category with its products. Capped at 250 items total; if truncated, use search_merchant_products with query= to find specific items.
Annotations the server declares
- title: Show the full menu
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
get_order_historyReturn the signed-in customer's orders — `current` (in-progress) and `history` (past), each with merchant, status, total, item count and date.Reads text others writeNo findings
Why it is in this group
- The name "get_order_history" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Return the signed-in customer's orders — `current` (in-progress) and `history` (past), each with merchant, status, total, item count and date. Requires the customer to be signed in for this session. Read-only.
Annotations the server declares
- title: My orders
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
get_payment_methodsList the available DIGITAL payment methods for checkout (e.g.Reads text others writeNo findings
Why it is in this group
- The name "get_payment_methods" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
List the available DIGITAL payment methods for checkout (e.g. Lezzoo Pay wallet, FIB, Card, Asia Pay, FastPay, Qi Card, NassWallet). Cash on delivery is NOT supported. Requires sign-in. Use this to map a payment method the user names to its payment_type_id.
Annotations the server declares
- title: Get payment methods
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
get_product_detailsShow full details for a single product/menu item by product_id (obtain it from a `search_merchant_products` result).Reads text others writeNo findings
Why it is in this group
- The name "get_product_details" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Show full details for a single product/menu item by product_id (obtain it from a `search_merchant_products` result). Returns the image, description, price/discount, stock, and addon options (sizes, extras, toppings) with their prices — rendered as a card when the host supports MCP Apps. Call this when the user taps a product or asks about a specific item.
Annotations the server declares
- title: Show product details
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
get_profileReturn the signed-in customer's profile (name, phone, email, language, loyalty tier, total orders, member-since).Reads private dataReads text others writeNo findings
Why it is in this group
- The name "get_profile" says "get": a word for reading.
What it can reach
- private-dataThe description's first sentence says "return" and "email": it reads mail.
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe description's first sentence says "return" and "email": it reads inbound email, which other people can write.
Description, as the server wrote it
Return the signed-in customer's profile (name, phone, email, language, loyalty tier, total orders, member-since). Requires the customer to be signed in for this session. Read-only.
Annotations the server declares
- title: My profile
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
get_top_searchesReturn the platform's currently trending / most-searched terms.Reads text others writeNo findings
Why it is in this group
- The name "get_top_searches" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Return the platform's currently trending / most-searched terms. Useful for suggesting what users can look for. Takes no arguments.
Annotations the server declares
- title: Trending searches
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
get_wallet_balanceGet the current Lezzoo Pay (wallet) balance for the signed-in customer.Reads text others writeNo findings
Why it is in this group
- The name "get_wallet_balance" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Get the current Lezzoo Pay (wallet) balance for the signed-in customer. Requires sign-in.
Annotations the server declares
- title: Get wallet balance
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
searchSearch Lezzoo for restaurants/stores near a location.Reads text others writeNo findings
Why it is in this group
- The name "search" says "search": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Search Lezzoo for restaurants/stores near a location. Results are ranked by relevance and proximity, so location matters: pass the user's latitude/longitude when known. If location is unknown, the user's area/address can be used to derive it; otherwise a configured default location applies. Returns restaurants as cards (when the host supports MCP Apps). Use a returned merchant's `merchant_id` with `search_merchant_products` to open its menu. Anonymous — no sign-in or account is required. Read-only.
Annotations the server declares
- title: Search restaurants & stores
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
search_merchant_productsShow the menu for a merchant/restaurant by merchant_id (from a `search` result).Reads text others writeNo findings
Why it is in this group
- The name "search_merchant_products" says "search": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Show the menu for a merchant/restaurant by merchant_id (from a `search` result). The result includes the menu's `categories` (sections); pass a `categoryId` to browse that section's items (paged via `page`, with `has_more`). Omit both to show the top items; provide `query` to search within the menu. Renders as cards with category tabs and Prev/Next when the host supports MCP Apps. Results are paginated — a single response is only part of the menu. To locate a specific item, call this with `query="<item name>"`, which searches the entire menu across pages and sections (more reliable than paging for finding a named item).
Annotations the server declares
- title: Show a merchant's menu
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
view_cartShow the current shopping cart (items, options, quantities, line prices, subtotal).No findings
Why it is in this group
- The name "view_cart" says "view": a word for reading.
Description, as the server wrote it
Show the current shopping cart (items, options, quantities, line prices, subtotal). Anonymous — no sign-in required. Read-only.
Annotations the server declares
- title: View cart
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged outbound.

Reads private data1: Reads files, mail, messages, databases, secrets, calendars or repositories.; get_profile
Reads text others write15: Brings in text someone else can write: web pages, inbound email, messages, issues and comments.; add_to_cart
get_addresses
get_full_menu
get_order_history
get_payment_link
get_payment_methods
get_product_details
get_profile
get_top_searches
get_wallet_balance
place_order
review_order
and 3 more
Can send data out0: Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

3 warn

Warnremove_cart_item
The server marks "remove_cart_item" not destructive (destructiveHint: false), and its own name, description or input give the class "destructive".
Matched text
annotations: {"readOnlyHint":false,"destructiveHint":false,"openWorldHint":false}; The name "remove_cart_item" says "remove": a word for removing or ending something.
What this check looks for
Warnclear_cart
The server marks "clear_cart" not destructive (destructiveHint: false), and its own name, description or input give the class "destructive".
Matched text
annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "remove": a word for removing or ending something.
What this check looks for
Warnget_payment_link
The server marks "get_payment_link" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
Matched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":true}; The name "get_payment_link" says "get": a word for reading.
What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 0.15.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http lezzoo https://mcp.lezzoo.com/mcp

claude mcp add --transport http lezzoo https://mcp.lezzoo.com/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__lezzoo__search",
      "mcp__lezzoo__search_merchant_products",
      "mcp__lezzoo__get_full_menu",
      "mcp__lezzoo__get_product_details",
      "mcp__lezzoo__get_top_searches",
      "mcp__lezzoo__auth_status",
      "mcp__lezzoo__get_profile",
      "mcp__lezzoo__get_addresses",
      "mcp__lezzoo__get_order_history",
      "mcp__lezzoo__view_cart",
      "mcp__lezzoo__get_payment_methods",
      "mcp__lezzoo__get_wallet_balance"
    ],
    "ask": [
      "mcp__lezzoo__logout",
      "mcp__lezzoo__track_order",
      "mcp__lezzoo__add_to_cart",
      "mcp__lezzoo__update_cart_item",
      "mcp__lezzoo__review_order",
      "mcp__lezzoo__get_payment_link"
    ],
    "deny": [
      "mcp__lezzoo__remove_cart_item",
      "mcp__lezzoo__clear_cart",
      "mcp__lezzoo__place_order"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as lezzoo. Review it before you use it.

Capability tags behind 15 rules

mcp__lezzoo__search untrusted-input
mcp__lezzoo__search_merchant_products untrusted-input
mcp__lezzoo__get_full_menu untrusted-input
mcp__lezzoo__get_product_details untrusted-input
mcp__lezzoo__get_top_searches untrusted-input
mcp__lezzoo__get_profile private-data, untrusted-input
mcp__lezzoo__get_addresses untrusted-input
mcp__lezzoo__get_order_history untrusted-input
mcp__lezzoo__track_order untrusted-input
mcp__lezzoo__add_to_cart untrusted-input
mcp__lezzoo__get_payment_methods untrusted-input
mcp__lezzoo__get_wallet_balance untrusted-input
mcp__lezzoo__review_order untrusted-input
mcp__lezzoo__place_order untrusted-input
mcp__lezzoo__get_payment_link untrusted-input

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/com.lezzoo/lezzoo/verify?hash=f5ef4da179c1f396f3e5aa4616788db5816b7aa74c39f642e92405dc06ab30b1" | jq -e '.changed == false'

Pinned hash f5ef4da179c1, from Oct 29, 2026, 14:18 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/com.lezzoo/lezzoo/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

[![anlyon.dev](https://anlyon.dev/badge/com.lezzoo/lezzoo.svg)](https://anlyon.dev/servers/com.lezzoo/lezzoo)

Source: MCP Registry. Synced Oct 29, 2026, 14:17 UTC.