SendaMeal Storefront
by sendameal.com · remote · no sign-in to list tools · v1.0.0 · published by com.sendameal
Search gift meals and send them as gifts. Live catalog, cart, and guest checkout for SendaMeal.
6 tools: 1 can delete or cancel things, 3 change things and 2 only read.
Scanned Oct 21, 2026
- Deletes or cancels1Claude Code: deny: see these tools
- Can't be undone0Claude Code: ask
- Changes things3Claude Code: ask: see these tools
- Only reads2Claude Code: allow: see these tools
4 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.
claude mcp add --transport http storefront https://store-odebi8ye4k-1.mybigcommerce.com/api/mcpFindings
Matches of fixed checks, with the text they matched.
The description contains "do not tell the user", an instruction to keep something from the user.
What this check looks forMatched text
description: "...ants exist than the tool returned. Then do not tell the user that a variant does not exist. You did..."
- Infoadd_item_to_cart
The description is 2,221 characters long, over the 2,000 this check looks for.
What this check looks forMatched text
description ends: "...uch an option is also required, tell the user to buy the product on the website."
The description is 4,309 characters long, over the 2,000 this check looks for.
What this check looks forMatched text
description ends: "...to add. If a product has required modifier options, you must send those options."
- Infosearch_products
The description is 2,390 characters long, over the 2,000 this check looks for.
What this check looks forMatched text
description ends: "...product to the cart. - [IMPORTANT] If product has variants ask user to pick"
Tools
Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.
6 tools
Deletes or cancels 1Claude Code: deny
remove_item_from_cartRemove specific items from your shopping cart.No findings
Why it is in this group
- The name "remove_item_from_cart" says "remove": a word for removing or ending something.
Description, as the server wrote it Remove specific items from your shopping cart. It is removing the item completly from the cart. If you want to reduce quantity of the items use 'update_cart_item' Remove unwanted items from your shopping cart by targeting specific item IDs. This tool provides precise control over cart cleanup and item removal. Use this tool when customers want to: -Remove specific products they no longer want -Delete gift certificates from their cart -Clean up their cart before checkout -Remove items added by mistake Features: - Target removal by specific item ID - Works with both products and gift certificates - Maintains cart structure after removal - Immediate cart updates Flow: - Call 'search_products' tool to find products by search term. - Call 'get_product_details' tool to get product variants and images. - Call 'add_item_to_cart' tool to create new cart with item - Call 'add_item_to_cart' tool to add another item to cart - Call 'remove_item_from_cart' tool to remove added item to cart - Call 'create_checkout_url' tool to generate a checkout URL for the cart. Requires an existing cart with items to remove.
Changes things 3Claude Code: ask
add_item_to_cartAdd one or more items to the shopping cart.1 finding
Why it is in this group
- The name "add_item_to_cart" says "add": a word for a change.
Findings
- Info
The description is 2,221 characters long, over the 2,000 this check looks for.
What this check looks forMatched text
description ends: "...uch an option is also required, tell the user to buy the product on the website."
Description, as the server wrote it Add one or more items to the shopping cart. If no cart exists, this tool makes a new cart. This tool adds products and gift certificates. Steps 1. Call the 'search_products' tool to find a product. 2. Call the 'get_product_details' tool to get the variants and the modifier options. 3. Call this tool to add the item. 4. Call the 'create_checkout_url' tool to get a checkout URL. Rules Send 'quantity' and 'productEntityId' for each item. If the product has variants, send 'variantEntityId'. Modifier options A modifier option is a product choice that is not a variant. Examples are an engraving message and a nicotine strength. The 'get_product_details' tool returns these options in 'modifierOptions'. If the product has no 'modifierOptions', do not send 'selectedOptions'. Do not send a variant option in 'selectedOptions'. Send a variant in 'variantEntityId'. An option is required if 'isRequired' is 'true'. Send each required option. If you do not send a required option, the server does not add the item. To send an option: 1. Read the bucket name from 'selectedOptionsKey'. 2. Add the option to 'item.selectedOptions' in that bucket. 3. Send the 'optionEntityId' of the option. 4. For a choice option, send the 'valueEntityId' of the value that the user selected. Send only the buckets that you need. Example. A required choice option has a 'selectedOptionsKey' of "multipleChoices", an 'optionEntityId' of 108, and a selected value with a 'valueEntityId' of 251: { "item": { "quantity": 1, "productEntityId": 88, "variantEntityId": 67, "selectedOptions": { "multipleChoices": [ { "optionEntityId": 108, "optionValueEntityId": 251 } ] } } } A free-entry bucket takes a typed value in place of an ID. 'textFields' and 'multiLineTextFields' take "text". 'numberFields' takes "number". 'dateFields' takes "date". Obey the 'constraints' of the option. If a required option has more than one value, ask the user to select one value. Do not select a value yourself. Do not use the default value. If 'unsupported' is 'true', you cannot send the option. If such an option is also required, tell the user to buy the product on the website.
create_checkout_urlCreateResult a checkout URL for a cart assigned to a current session Arguments: None, but requires a cart to be present in the current session.No findings
Why it is in this group
- The name "create_checkout_url" says "create": a word for a change.
Description, as the server wrote it CreateResult a checkout URL for a cart assigned to a current session Arguments: None, but requires a cart to be present in the current session. Returns: - checkoutURL - the URL to redirect the user to for checkout - errors - any errors encountered during the process (like, cart not found, etc.) Flow: - Call 'manage_cart' with 'create_cart' operation to create a new cart. - Call this tool to create a checkout URL for the cart assigned to the current session.
update_cart_itemChange an item that is already in the shopping cart.No findings
Why it is in this group
- The name "update_cart_item" says "update": a word for a change.
Description, as the server wrote it Change an item that is already in the shopping cart. Use this tool to change the quantity, the variant, or the modifier options of one cart item. A cart must exist and must have items. Steps 1. Call the 'add_item_to_cart' tool to put an item in the cart. 2. Call this tool to change the item. 3. Call the 'create_checkout_url' tool to get a checkout URL. Rules Send 'line_item_id' to select the cart item to change. Send 'quantity' and 'productEntityId' in 'item'. If the product has variants, send 'variantEntityId'. Modifier options 'item.selectedOptions' works as it works in the 'add_item_to_cart' tool. The 'get_product_details' tool returns these options in 'modifierOptions'. If the product has required modifier options, send them again in this request. If you do not send them, the server does not change the item. Send only the buckets that you need.
Only reads 2Claude Code: allow
get_product_detailsGet the details of one or more products.2 findings
Why it is in this group
- The name "get_product_details" says "get": a word for reading.
Findings
- High
The description contains "do not tell the user", an instruction to keep something from the user.
What this check looks forMatched text
description: "...ants exist than the tool returned. Then do not tell the user that a variant does not exist. You did..."
- Info
The description is 4,309 characters long, over the 2,000 this check looks for.
What this check looks forMatched text
description ends: "...to add. If a product has required modifier options, you must send those options."
Description, as the server wrote it Get the details of one or more products. The details are the variants, the options, and the images. Arguments productIds - The list of product IDs. Get these IDs from the 'search_products' tool. Request only the products that the user needs. The server has a maximum count of IDs. The default maximum is 20. If you send too many IDs, the server returns an error. Then send fewer IDs. option_values - The option IDs and the value IDs of one variant. Use this argument with one product ID only. This argument applies to the B2C catalog. For a B2B buyer, the tool returns all the variants. Then select one variant. channelId - Optional. This argument selects the B2B catalog. The default is the channel of the request. variantCursor - Optional. This argument gets the next page of variants. Use this argument with one product ID only. Take the value from 'nextVariantCursor' in the previous result. If 'nextVariantCursor' is absent, or is null, or is the text "null", do not send this argument. Results The tool returns a list of products in 'products'. The output schema gives all the fields. A product has 'modifierOptions' only if the product has modifier options. A variant has a price, an inventory level, a purchase flag, and bulk prices only for a B2B buyer. If the tool does not find a product, the list does not include that product. Modifier options A modifier option is a product choice that is not a variant. Examples are an engraving message and a gift note. A variant option is never a modifier option. If a product has no 'modifierOptions', add the product to the cart without 'selectedOptions'. An option is required if 'isRequired' is 'true'. Send each required option to the 'add_item_to_cart' tool. If you do not send a required option, the server does not add the item. A variant selection does not replace a required option. Each option has 'optionEntityId', 'displayName', and 'selectedOptionsKey'. 'selectedOptionsKey' is the name of the field to send the option in. A choice option has 'values'. Each value has 'valueEntityId' and 'label'. A free-entry option has 'constraints' in place of 'values'. If 'unsupported' is 'true', you cannot send the option. A file upload is one example. If such an option is also required, tell the user to buy the product on the website. Variant pages The list of variants can be one page of a longer list. The server sets the page size. If 'hasMoreVariants' is 'true', more variants exist than the tool returned. Then do not tell the user that a variant does not exist. You did not receive all the variants. To get the next page, call this tool again. Send the same product ID, and only that product ID. Send 'variantCursor' with the value of 'nextVariantCursor'. A filter is better than a page walk. If the user named the variant, send 'option_values' instead. One filtered call is cheaper than many pages. Do not change 'option_values' between pages. The cursor is a position in the list of the previous call. A different filter gives the wrong variants. Stock Each product has 'inStock'. It tells you if the store has units in stock. It does not tell you if the user can buy the product. If 'inStock' is 'false', do not refuse the request. Many stores accept orders for products that are not in stock. Tell the user that the product is not in stock, and that delivery can take more time. Then add the product if the user agrees. If the store blocks the purchase, the 'add_item_to_cart' tool fails and gives a reason. Give that reason to the user. If 'inStock' is 'true', the store reports no out-of-stock condition. A store that does not count stock reports 'true' for all products. Therefore do not tell the user a quantity. 'inventoryLevel' is present only if the store publishes stock counts. If 'inventoryLevel' is absent, the count is unknown. The count is not zero. Each variant has its own 'inStock'. Use the value of the variant if you add one variant. Steps 1. Call the 'search_products' tool to get the product IDs. 2. Call this tool with the product IDs. 3. Call the 'add_item_to_cart' tool with the results of step 1 and step 2. If a product has variants, you must tell the 'add_item_to_cart' tool which variant to add. If a product has required modifier options, you must send those options.
search_productsSearch products by a term Arguments: term - the search term to look for products.1 finding
Why it is in this group
- The name "search_products" says "search": a word for reading.
Findings
- Info
The description is 2,390 characters long, over the 2,000 this check looks for.
What this check looks forMatched text
description ends: "...product to the cart. - [IMPORTANT] If product has variants ask user to pick"
Description, as the server wrote it Search products by a term Arguments: term - the search term to look for products. It should be at least 3 characters long. cursor - optional, used for pagination. If provided, it will return the next page of results after. Pagination: Supports pagination with 'cursor' arguments. If 'cursor' is not provided, it will return the first page of results. Value for 'cursor' can be obtained from the 'nextCursor' field in the response. If 'nextCursor' is null, it means there are no more results to fetch. If value of cursor is null (or a string representation of 'null') dont send it in the payload. Results: Each product includes 'requiresFileUpload'. When true, the product has a required file-upload option (e.g. "upload your design") and shouldn't be added to cart through this assistant. Do not attempt to purchase it — tell the user it must be ordered on the website. Stock: Each product carries 'inStock'. It reports whether the store has units on hand. It does NOT report whether the item can be bought. - false does NOT mean the purchase will fail. Many stores accept orders for out-of-stock items - backorder, pre-order, or made-to-order goods that are fabricated after ordering. Whether a given store does is not exposed by this API. So: tell the user the item is out of stock and may take longer to arrive, then ADD IT if they still want it. Do not refuse on 'inStock: false' alone. - If the store really does block it, 'add_item_to_cart' fails and returns the reason. Relay that reason to the user. Attempting the add is the only reliable way to find out. - true only means no out-of-stock condition is reported. A store that does not track inventory reports true for every product, so never state or imply a quantity. - 'inventoryLevel' appears only on stores that publish stock figures; absent means undisclosed, not zero. Flow: - Call this tool with a 'term' argument and optionally with 'cursor' to search for products. - if you find a matching product, call 'get_product_details' with the product ID to get its variants and options (if any). - if 'requiresFileUpload' is true, inform the user the product needs a file upload and cannot be purchased here. - Call 'add_item_to_cart' with results of 'search_products' and 'get_product_details' (variant) tools to add the product to the cart. - [IMPORTANT] If product has variants ask user to pick
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Exfil surface
Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.
No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data or untrusted-input or outbound.
- Reads private data0
- Reads files, mail, messages, databases, secrets, calendars or repositories.
- Reads text others write0
- Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
- Can send data out0
- Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.
Install
Pinned to version 1.0.0. Values in angle brackets are yours to fill in.
claude mcp add --transport http storefront https://store-odebi8ye4k-1.mybigcommerce.com/api/mcpRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__storefront__get_product_details",
"mcp__storefront__search_products"
],
"ask": [
"mcp__storefront__add_item_to_cart",
"mcp__storefront__create_checkout_url",
"mcp__storefront__update_cart_item"
],
"deny": [
"mcp__storefront__remove_item_from_cart"
]
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as storefront. Review it before you use it.