Skip to content

Oklahomaautoquotes

by oklahomaautoquotes.com · remote · no sign-in to list tools · v0.5.0 · published by com.oklahomaautoquotes

Indicative US auto insurance prices for agents: rating facts only, no PII, consented path to agents.

Changes · 6

8 tools: 6 change things and 2 only read.

Scanned Oct 21, 2026

2 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http quote-exchange https://oklahomaautoquotes.com/

Findings

Matches of fixed checks, with the text they matched.

2 info
  • The input schema at properties.credential.description mentions "credential".

    Matched text

    inputSchema.properties.credential.description: "MPP credential (the base64url JSON that would follow "..."

    What this check looks for
  • The input schema at properties.credential.description mentions "credential".

    Matched text

    inputSchema.properties.credential.description: "MPP credential"

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

8 tools

Changes things 6Claude Code: ask
  • check_eligibilityCheck whether we can return quotes for a state before any personal details are collected.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Check whether we can return quotes for a state before any personal details are collected. Call this first. Returns the states we are licensed in, what we can do in each, and how many licensed agents can take a request there.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • data_use_termsWhat happens to anything you send us: who receives it, for what purpose, how long it is kept, how your human revokes it, and the exact consent wording to present before request_age…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    What happens to anything you send us: who receives it, for what purpose, how long it is kept, how your human revokes it, and the exact consent wording to present before request_agent_contact. Machine readable so you can evaluate the exchange before making it.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • market_dataThe qualified demand dataset contains only requests backed by a cryptographically or IP-verified agent, or a phone-verified consumer outcome.1 finding

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Info

      The input schema at properties.credential.description mentions "credential".

      Matched text

      inputSchema.properties.credential.description: "MPP credential"

      What this check looks for
    Description, as the server wrote it
    The qualified demand dataset contains only requests backed by a cryptographically or IP-verified agent, or a phone-verified consumer outcome. User-agent claims, legacy rows, probes and impostors are quarantined and unavailable for sale. Qualified rows are de-identified (age band, ZIP3, vehicle, coverage, mileage band, prices shown, door, verified agent identity and outcome). Never a name, phone, email, date of birth or five-digit ZIP. Filter by state, since, until, door, vendor; limit and offset. Priced per record with a minimum per pull; pay with a prepaid buyer key, x402, MPP or AP2. Without payment the result is a 402 with the price and a preview count. A free sample and the schema are at /data.json.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • pull_requestsDrain the queue of pool records routed to you.1 finding

    Why it is in this group

    • The name "pull_requests" says "request": a word for a change.

    Findings

    • Info

      The input schema at properties.credential.description mentions "credential".

      Matched text

      inputSchema.properties.credential.description: "MPP credential (the base64url JSON that would follow "..."

      What this check looks for
    Description, as the server wrote it
    Drain the queue of pool records routed to you. Requires your buyer key. Metered buyers receive an x402 payment requirement (status 402, accepts[]) until a payment is supplied. Records are projected to the scope the consumer granted — never wider.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • register_agencyFor an AI working for a licensed insurance agency: register the agency to receive consented consumer requests in its states.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    For an AI working for a licensed insurance agency: register the agency to receive consented consumer requests in its states. Needs the agency name, the producer NPN (National Producer Number) and its state, the states it is appointed in, the licensed contact's name, email and mobile, and how leads should arrive (email, webhook, or pull by key). The licensed contact confirms by a link sent to their email; nothing is delivered before that. The first agencies in a state receive leads free for a founding period, then prepaid credits by card. Read /join for the terms.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • request_agent_contactConnect the consumer with licensed insurance agents who can quote firm and bind.No findings

    Why it is in this group

    • The name "request_agent_contact" says "request": a word for a change.
    Description, as the server wrote it
    Connect the consumer with licensed insurance agents who can quote firm and bind. Needs the quote_id from get_quotes, the consumer's name and phone, and the consumer's explicit consent to be contacted — granted by the human, presented by you, or confirmed by the human directly at the consent URL the elicitation returns. Under scope contact_consumer up to 4 licensed agents receive the request and contact details; sell_identity additionally permits sharing with marketing partners. Nothing leaves without the consent. Every delivery and refusal is receipted, and POST /forget revokes.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
Only reads 2Claude Code: allow
  • agency_statusFor a registered agency: its states, rail, terms, founding period, queued and delivered counts, credit balance, and whether the licence was verified.No findings

    Why it is in this group

    • The name "agency_status" says "status": a word for reading.
    Description, as the server wrote it
    For a registered agency: its states, rail, terms, founding period, queued and delivered counts, credit balance, and whether the licence was verified. Requires the buyer key issued at confirmation.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_quotesReturn indicative auto insurance prices from multiple carriers, where this entity is licensed to show them.No findings

    Why it is in this group

    • The name "get_quotes" says "get": a word for reading.
    Description, as the server wrote it
    Return indicative auto insurance prices from multiple carriers, where this entity is licensed to show them. Takes rating facts only — no name, phone, email, SSN or licence number is required for an indicative price. Where we are not licensed to show prices, the request is still registered and a quote_id returned so licensed agents can quote it. If facts are missing the server asks for exactly what it needs and nothing more.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 0.5.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http quote-exchange https://oklahomaautoquotes.com/

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__quote-exchange__get_quotes",
      "mcp__quote-exchange__agency_status"
    ],
    "ask": [
      "mcp__quote-exchange__check_eligibility",
      "mcp__quote-exchange__pull_requests",
      "mcp__quote-exchange__data_use_terms",
      "mcp__quote-exchange__request_agent_contact",
      "mcp__quote-exchange__register_agency",
      "mcp__quote-exchange__market_data"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as quote-exchange. Review it before you use it.