PGA Golf

by pga.com · remote · no sign-in to list tools · v1.0.0 · published by com.pga

PGA's official MCP Server for all things golf-related. Find a coach, play golf, improve your game.

Changes · 11 high finding

Compare Registry entry

4 tools: 1 change things and 3 only read.

Scanned Oct 21, 2026

Deletes or cancels0Claude Code: deny
Can't be undone0Claude Code: ask
Changes things1Claude Code: ask: see these tools
Only reads3Claude Code: allow: see these tools

1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http pga-golf https://mcp.pga.com/mcp

Findings

Matches of fixed checks, with the text they matched.

1 high

Highbook_golf_lesson
The description contains "never show or mention it to the user", an instruction to keep something from the user.
Matched text
description: "...`offeringId` is an internal identifier; never show or mention it to the user. - A continuation URL will be returned..."
What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

4 tools

Changes things 1Creates or changes something that can be changed back.Claude Code: ask

book_golf_lessonRequest to book a golf lesson for a specific coach's offering.1 finding
Why it is in this group
- The description's first verb is "request": a word for a change.
Findings
- High
  The description contains "never show or mention it to the user", an instruction to keep something from the user.
  Matched text
  description: "...`offeringId` is an internal identifier; never show or mention it to the user. - A continuation URL will be returned..."
  What this check looks for
Description, as the server wrote it
Request to book a golf lesson for a specific coach's offering. - `offeringId` is an internal identifier; never show or mention it to the user. - A continuation URL will be returned that you can direct the user to after calling this tool. - If the offering was booked automatically (e.g., free lesson or no prepayment required), the confirmation code will also be included.
Annotations the server declares
- title: Book Golf Lesson
- readOnlyHint: false
- openWorldHint: false
- destructiveHint: false

Only reads 3Looks things up and changes nothing.Claude Code: allow

get_golf_coach_availabilityRetrieve offering details and available lesson times for one specific coach.No findings
Why it is in this group
- The name "get_golf_coach_availability" says "get": a word for reading.
Description, as the server wrote it
Retrieve offering details and available lesson times for one specific coach. Use this when the user asks for schedule, openings, or available times for a known coach. If the user has not selected a coach yet, call `search_golf_coaches` first (or reuse a coach already identified from `search_golf_programs`). Coach `slug` and offering `id` values are internal identifiers and must never be shown or mentioned to the user.
Annotations the server declares
- title: Get Golf Coach Availability
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
search_golf_coachesSearch for qualified PGA golf coaches listed on pga.com/coach in the specified location (required).No findings
Why it is in this group
- The name "search_golf_coaches" says "search": a word for reading.
Description, as the server wrote it
Search for qualified PGA golf coaches listed on pga.com/coach in the specified location (required). Use this tool when the user asks to find, browse, or compare coaches for private lessons in a location. For location-first discovery of clinics, camps, classes, or other group programs, use `search_golf_programs` instead. If the user asks for availability for a specific coach, use `get_golf_coach_availability` instead. Internal record identifiers (for example coach `slug` and offering `id`) are for tool calls only and must never be shown or mentioned to the user. - Search results include the coach's profile information, private-lesson offerings, pricing, and a short teaser of upcoming public programs they host (capped at 2). For location-first program discovery, use `search_golf_programs`. - Use that program context to recommend which group offering best fits the golfer when relevant; present upcoming programs when available. - Results are ordered by proximity to the search location, so list them to the user in this order. - Results are paginated, so use the pagination cursor provided at the end of the response to retrieve the next page of results.
Annotations the server declares
- title: Search Golf Coaches
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false
search_golf_programsSearch for upcoming public PGA Coach programs (clinics, camps, classes, and other group events) near a location (required).No findings
Why it is in this group
- The name "search_golf_programs" says "search": a word for reading.
Description, as the server wrote it
Search for upcoming public PGA Coach programs (clinics, camps, classes, and other group events) near a location (required). Use this tool when the user asks to find programs, clinics, camps, classes, or group events — not private one-on-one lessons. For private lesson coaches, use `search_golf_coaches` instead. Internal record identifiers (for example program `id` and coach `slug`) are for tool calls only and must never be shown or mentioned to the user. - Search results include program details plus the hosting coach and facility for each program. - The response also includes top-level `coaches` and `facilities` arrays summarizing the unique coaches and venues in the result set — always present those to the user. - Results are ordered by program start instant and filtered to the requested radius. - Discovery uses nearby PGA Coach profiles (nearest 20 in the radius), then loads up to 30 upcoming public programs per coach in a 180-day window in one batched GraphQL request. Facility coordinates still have to fall inside the radius. - Results are paginated. The pagination cursor carries the remaining nearby programs so additional pages do not repeat GraphQL discovery. Reuse that cursor with the original location and radius. - Direct golfers to the program URL to view details and register. Coach profile and booking URLs are also included when the golfer wants to learn more about the coach.
Annotations the server declares
- title: Search Golf Programs
- readOnlyHint: true
- openWorldHint: false
- destructiveHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data or untrusted-input or outbound.

Reads private data0: Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write0: Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out0: Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http pga-golf https://mcp.pga.com/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__pga-golf__search_golf_coaches",
      "mcp__pga-golf__search_golf_programs",
      "mcp__pga-golf__get_golf_coach_availability"
    ],
    "ask": [
      "mcp__pga-golf__book_golf_lesson"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as pga-golf. Review it before you use it.

Keep track

Get told when this server's tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/com.pga/pga-golf/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Anlyon alternative

1 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Compare with other servers for the same product.

Source: MCP Registry. Synced Oct 21, 2026, 18:00 UTC.

For agents: Markdown · JSON · report this listing