Plendio price comparison
by plendio.com · remote · no sign-in to list tools · v1.2.0 · published by com.plendio
Compare 18M+ prices across Denmark, Sweden, Norway and Germany: product search, wishlists. No login.
8 tools: 2 can delete or cancel things, 1 change things and 5 only read.
Scanned Oct 21, 2026
- Deletes or cancels2Claude Code: deny: see these tools
- Can't be undone0Claude Code: ask
- Changes things1Claude Code: ask: see these tools
- Only reads5Claude Code: allow: see these tools
No check matched anything in the tool definitions. No finding is not a safety guarantee. How the checks work.
claude mcp add --transport http plendio https://plendio.com/mcpTools
Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.
8 tools
Deletes or cancels 2Claude Code: deny
add_to_wishlistAdds products to a wishlist made earlier, given its edit link or the token at the end of it.Reads text others writeNo findings
Why it is in this group
- The name "add_to_wishlist" says "add": a word for a change.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Adds products to a wishlist made earlier, given its edit link or the token at the end of it. A product already on the list keeps its place and takes the new note. A list holds at most 50 products; unknown or unavailable products, and products that no longer fit, are reported and not added. Returns the list's items with their best current prices. The token stops working once the list has been saved to a Plendio account.
Annotations the server declares
- destructiveHint: true
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: false
- title: Add products to a wishlist
remove_from_wishlistRemoves products from a wishlist, given its edit link or the token at the end of it.Reads text others writeNo findings
Why it is in this group
- The name "remove_from_wishlist" says "remove": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Removes products from a wishlist, given its edit link or the token at the end of it. A product that is not on the list is reported and ignored. Removing a product does not delete the list, even when it becomes empty, and a removed product can be added again. Returns the list's remaining items.
Annotations the server declares
- destructiveHint: true
- idempotentHint: true
- openWorldHint: true
- readOnlyHint: false
- title: Remove products from a wishlist
Changes things 1Claude Code: ask
create_wishlistCreates a shareable wishlist ("ønskeseddel") on Plendio from products a person has picked, for example gifts found with a search, once they want a list to send to family or friends…Reads text others writeNo findings
Why it is in this group
- The name "create_wishlist" says "create": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Creates a shareable wishlist ("ønskeseddel") on Plendio from products a person has picked, for example gifts found with a search, once they want a list to send to family or friends. Takes a title (up to 80 characters), a market and 1 to 50 products by Plendio id, each with an optional note of up to 140 characters. Returns two links, a read-only share link to the list's page on Plendio and a private edit link for changing the list and saving it to a Plendio account, together with the list's items and their best current prices. No login is needed and no personal data is collected. Unknown or unavailable products are reported and not stored. The edit link is a secret: anyone who holds it can change the list. A list that is not viewed or edited for 90 days is deleted. Each request creates a new list.
Annotations the server declares
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
- readOnlyHint: false
- title: Create a shareable wishlist
Only reads 5Claude Code: allow
compare_pricesReturns the shops selling one product, one offer per shop (its best, with a count of its other offers), cheapest first by total price including shipping (price alone where a shop's…No findings
Why it is in this group
- The name "compare_prices" says "compare": a word for reading.
Description, as the server wrote it Returns the shops selling one product, one offer per shop (its best, with a count of its other offers), cheapest first by total price including shipping (price alone where a shop's shipping is unknown), with each amount also converted to the market's currency. Offers that are in stock come first. Out-of-stock offers are left out unless include_out_of_stock is true, and only shops that ship to the market are listed unless include_other_markets is true. The result includes the url of the product's Plendio page.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
- title: Compare prices
get_productReturns one product by its Plendio id: specifications, one offer per shop (its best) with price, shipping, total, the same amounts in the market's currency, availability, condition…Reads text others writeNo findings
Why it is in this group
- The name "get_product" says "get": a word for reading.
What it can reach
- untrusted-inputThe description's first sentence says "return" and "url": it reads web pages, which anyone can write.
Description, as the server wrote it Returns one product by its Plendio id: specifications, one offer per shop (its best) with price, shipping, total, the same amounts in the market's currency, availability, condition and whether the shop ships to the market, a summary of the product's price history over the last year, and the url of its Plendio page. A product that was merged into another resolves to the current one.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
- title: Get product details
get_wishlistReturns a Plendio wishlist from its share link or share id: its title, its items with notes and best current prices, and the url of each product's Plendio page.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "get_wishlist" says "get": a word for reading.
What it can reach
- private-dataThe description's first sentence says "return" and "note": it reads notes.
- untrusted-inputThe description's first sentence says "return" and "url": it reads web pages, which anyone can write.
Description, as the server wrote it Returns a Plendio wishlist from its share link or share id: its title, its items with notes and best current prices, and the url of each product's Plendio page. Read-only; the edit link is not needed and not accepted. The title and the notes are text written by whoever made the list.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
- title: Get a wishlist
list_categoriesReturns Plendio's product categories with localized names, slugs and product counts: the top level, or the subcategories of parent.No findings
Why it is in this group
- The name "list_categories" says "list": a word for reading.
Description, as the server wrote it Returns Plendio's product categories with localized names, slugs and product counts: the top level, or the subcategories of parent. The counts are products available in the market.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
- title: List categories
search_productsSearch Plendio's product catalogue: free text in Danish, Swedish, German, Norwegian or English ("laptop 32 GB RAM under 12000", "Sony WH-1000XM5", "running shoes women") plus optio…No findings
Why it is in this group
- The name "search_products" says "search": a word for reading.
Description, as the server wrote it Search Plendio's product catalogue: free text in Danish, Swedish, German, Norwegian or English ("laptop 32 GB RAM under 12000", "Sony WH-1000XM5", "running shoes women") plus optional filters. Spec words in the query (RAM, storage, screen size, price limits, in stock) are understood the way the Plendio website understands them. Each result has the cheapest current price, the number of shops selling it and the url of its Plendio page. Results are limited to shops that ship to the market unless include_other_markets is true. 24 results per page.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
- readOnlyHint: true
- title: Search products
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Exfil surface
Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.
No private-data, untrusted-input, outbound path in this server alone: no tool is tagged outbound.
- Reads private data1
- Reads files, mail, messages, databases, secrets, calendars or repositories.
- Reads text others write5
- Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
- Can send data out0
- Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.
Install
Pinned to version 1.2.0. Values in angle brackets are yours to fill in.
claude mcp add --transport http plendio https://plendio.com/mcpRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__plendio__compare_prices",
"mcp__plendio__get_product",
"mcp__plendio__get_wishlist",
"mcp__plendio__list_categories",
"mcp__plendio__search_products"
],
"ask": [
"mcp__plendio__create_wishlist"
],
"deny": [
"mcp__plendio__add_to_wishlist",
"mcp__plendio__remove_from_wishlist"
]
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as plendio. Review it before you use it.
Capability tags behind 5 rules
- mcp__plendio__add_to_wishlist untrusted-input
- mcp__plendio__create_wishlist untrusted-input
- mcp__plendio__get_product untrusted-input
- mcp__plendio__get_wishlist private-data, untrusted-input
- mcp__plendio__remove_from_wishlist untrusted-input