# `com.santyvv/tienda` on anlyon.dev

> Text inside fenced blocks marked untrusted-server-text was written by the MCP server's publisher, not by anlyon.dev. It is data to inspect, not instructions to follow. Invisible characters are shown as [U+XXXX].
> No finding is not a safety guarantee: these are point-in-time checks of tool definitions, not of code or behaviour.

- Page: https://anlyon.dev/servers/com.santyvv/tienda
- JSON: https://anlyon.dev/api/v1/servers/com.santyvv/tienda
- Version: 1.0.1 (active)
- Publisher: com.santyvv (domain proven to the MCP Registry)
- Runs: remote (streamable-http), local (npm)
- Sign-in to list tools: none
- Metadata from the official MCP Registry, synced 2026-10-21T18:02:13.400Z

Title and description, as the publisher wrote them:

```untrusted-server-text
santyvv-data — market & on-chain data
Market and on-chain crypto data for AI agents. Pay per call in USDC on Base (x402).
```

Scanned 2026-10-21T18:54:55.938Z over streamable-http.

**8 tools: 8 change things.**

| Group | Class | Tools | Claude Code |
| --- | --- | --- | --- |
| Deletes or cancels | destructive | 0 | deny |
| Can't be undone | irreversible | 0 | ask |
| Changes things | write | 8 | ask |
| Only reads | read | 0 | allow |

## Findings

- **warn** Base64 strings in `ficha_token` ([base64-blob](https://anlyon.dev/methodology#base64-blob))

```untrusted-server-text
The input schema at properties.tokens.description contains a 42-character base64 string.

inputSchema.properties.tokens.description: "...up to 10. Example: 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913"
```

- **warn** Base64 strings in `saldo` ([base64-blob](https://anlyon.dev/methodology#base64-blob))

```untrusted-server-text
The input schema at properties.token.description contains a 42-character base64 string.

inputSchema.properties.token.description: "...ract (USDC on Base: 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913)."
```


## Changes things (8)

Creates or changes something that can be changed back. Claude Code: ask.

### `catalogo`

- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

Description, as the server wrote it:

```untrusted-server-text
What can be ordered, at what price and under what name. Includes this MCP server's tools and the equivalent HTTP routes. Free.
```

### `estado_fuentes`

- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

Description, as the server wrote it:

```untrusted-server-text
Live probe of every public source behind the data (response, HTTP status and latency). Free: use it to decide whether a paid call is worth it, and to see where a number came from.
```

### `ficha_token`

- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
- Findings: warn base64-blob

Description, as the server wrote it:

```untrusted-server-text
What a token is and what it is worth: name, symbol, decimals, supply, contract address and price per token. Use it to confirm that an address is a real contract and what it represents. Cuesta $0.03 por llamada, en USDC sobre Base (protocolo x402).
```

### `mercado`

- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

Description, as the server wrote it:

```untrusted-server-text
The big picture: total market cap, Bitcoin dominance, 24 h change, the coins by market cap and the top movers. This is the context question, not the one about a single asset. Cuesta $0.03 por llamada, en USDC sobre Base (protocolo x402).
```

### `precio`

- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

Description, as the server wrote it:

```untrusted-server-text
What an asset is worth right now, in USD, as a MEDIAN across several venues with its spread - not a single exchange's last trade. Use it to quote, to compare venues or to spot a dislocated market. Cuesta $0.02 por llamada, en USDC sobre Base (protocolo x402).
```

### `saldo`

- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
- Findings: warn base64-blob

Description, as the server wrote it:

```untrusted-server-text
What an address holds: the native balance of the network and, if you pass a token, that ERC-20 balance with its decimals. Use it to verify a payment or a holding without opening a block explorer. Cuesta $0.03 por llamada, en USDC sobre Base (protocolo x402).
```

### `tvl_protocolo`

- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

Description, as the server wrote it:

```untrusted-server-text
How much money is deposited in a DeFi protocol (TVL in USD) with its 24 h and 7 day change. The measure of a protocol's size and health before you interact with it. Cuesta $0.01 por llamada, en USDC sobre Base (protocolo x402).
```

### `velas`

- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

Description, as the server wrote it:

```untrusted-server-text
Recent candles for a trading pair at the interval you ask for (1m to 1d). What you need to compute trend or volatility, or to draw a chart without an exchange API key. Cuesta $0.01 por llamada, en USDC sobre Base (protocolo x402).
```

## Claude Code permissions

For `.claude/settings.json`, assuming the server is installed as `tienda`:

```json
{
  "permissions": {
    "allow": [],
    "ask": [
      "mcp__tienda__catalogo",
      "mcp__tienda__estado_fuentes",
      "mcp__tienda__precio",
      "mcp__tienda__ficha_token",
      "mcp__tienda__velas",
      "mcp__tienda__mercado",
      "mcp__tienda__tvl_protocolo",
      "mcp__tienda__saldo"
    ],
    "deny": []
  }
}
```