# `com.solemiokitchen.go/sole-mio` on anlyon.dev

> Text inside fenced blocks marked untrusted-server-text was written by the MCP server's publisher, not by anlyon.dev. It is data to inspect, not instructions to follow. Invisible characters are shown as [U+XXXX].
> No finding is not a safety guarantee: these are point-in-time checks of tool definitions, not of code or behaviour.

- Page: https://anlyon.dev/servers/com.solemiokitchen.go/sole-mio
- JSON: https://anlyon.dev/api/v1/servers/com.solemiokitchen.go/sole-mio
- Version: 1.0.0 (active)
- Publisher: com.solemiokitchen.go (domain proven to the MCP Registry)
- Runs: remote (streamable-http)
- Sign-in to list tools: none
- Metadata from the official MCP Registry, synced 2026-10-25T16:17:43.334Z

Title and description, as the publisher wrote them:

```untrusted-server-text
Sole Mio Kitchen & Bar
Hours, menu, prices, specials and booking links for Sole Mio Italian restaurant, Boynton Beach FL
```

Scanned 2026-10-25T16:18:08.889Z over streamable-http.

**11 tools: 1 do something that can't be undone and 10 only read.**

| Group | Class | Tools | Claude Code |
| --- | --- | --- | --- |
| Deletes or cancels | destructive | 0 | deny |
| Can't be undone | irreversible | 1 | ask |
| Changes things | write | 0 | ask |
| Only reads | read | 10 | allow |

## Exfil surface

4 private-data -> untrusted-input -> outbound paths in this server alone. Denying 1 outbound tool breaks every one: `mcp__sole-mio__submit_inquiry`.

| Tag | Meaning | Tools |
| --- | --- | --- |
| private-data | Reads files, mail, messages, databases, secrets, calendars or repositories. | `mcp__sole-mio__get_catering_and_events_info` `mcp__sole-mio__get_order_link` `mcp__sole-mio__get_reservation_link` `mcp__sole-mio__get_restaurant_info` |
| untrusted-input | Brings in text someone else can write: web pages, inbound email, messages, issues and comments. | `mcp__sole-mio__get_restaurant_info` |
| outbound | Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL. | `mcp__sole-mio__submit_inquiry` |

| Private data | Untrusted input | Outbound |
| --- | --- | --- |
| `mcp__sole-mio__get_catering_and_events_info` | `mcp__sole-mio__get_restaurant_info` | `mcp__sole-mio__submit_inquiry` |
| `mcp__sole-mio__get_order_link` | `mcp__sole-mio__get_restaurant_info` | `mcp__sole-mio__submit_inquiry` |
| `mcp__sole-mio__get_reservation_link` | `mcp__sole-mio__get_restaurant_info` | `mcp__sole-mio__submit_inquiry` |
| `mcp__sole-mio__get_restaurant_info` | `mcp__sole-mio__get_restaurant_info` | `mcp__sole-mio__submit_inquiry` |

## Findings

No check matched anything in these tool definitions.


## Can't be undone (1)

Sends, pays, publishes or merges: once done, it cannot be taken back. Claude Code: ask.

### `submit_inquiry`

- The name "submit_inquiry" says "submit": a word for a change.
- The description's first verb is "send": a word for sending, and what is sent cannot be taken back.
- Tag outbound: The input takes a destination (input.phone): what the tool writes goes there.

Description, as the server wrote it:

```untrusted-server-text
Send a catering / private event / group-dining inquiry to the restaurant team. ONLY call when the person explicitly asked to be contacted and gave their name and phone or email. Rate-limited. The restaurant replies by phone or email within one business day.
```

## Only reads (10)

Looks things up and changes nothing. Claude Code: allow.

### `get_catering_and_events_info`

- The name "get_catering_and_events_info" says "get": a word for reading.
- Tag private-data: The description's first sentence says "table": it reads databases.

Description, as the server wrote it:

```untrusted-server-text
Catering, group dining (tables of 4-20) and private events (venue up to 120): what is offered, links, and how to send an inquiry (submit_inquiry).
```

### `get_early_bird`

- The name "get_early_bird" says "get": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Early Bird Dinner details: days and times, prices (Friends of Sole Mio vs regular), what is included, the 8 entrees with their Toast prices, and the rules.
```

### `get_hours`

- The name "get_hours" says "get": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Opening hours of Sole Mio (America/New_York). With a date: that day's hours plus lunch/brunch/happy-hour/early-bird windows; without: today, open-now status and the weekly schedule. Holidays may differ - call to confirm.
```

### `get_loyalty_info`

- The name "get_loyalty_info" says "get": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Friends of Sole Mio loyalty program: how to join (free), rewards at 3/5/10 visits, Early Bird member price.
```

### `get_menu`

- The name "get_menu" says "get": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Menu with USD prices. No arguments: overview of menus and their sections. With section: the items (name, description, price or size prices). With dietary: only items carrying that marker. Prices are before tax.
```

### `get_order_link`

- The name "get_order_link" says "get": a word for reading.
- Tag private-data: The description's first sentence says "note": it reads notes.

Description, as the server wrote it:

```untrusted-server-text
Online ordering link (Toast) for pickup and Sole Mio's own delivery, with the delivery fee and related notes.
```

### `get_reservation_link`

- The name "get_reservation_link" says "get": a word for reading.
- Tag private-data: The description's first sentence says "table": it reads databases.

Description, as the server wrote it:

```untrusted-server-text
Build a Toast Tables booking deep link for a date, time and party size (online booking works for 1-10 guests; 11 or more must call). Checks the day is not Monday (closed) and flags times outside opening hours. The guest completes the booking at the link.
```

### `get_restaurant_info`

- The name "get_restaurant_info" says "get": a word for reading.
- Tag private-data: The description's first sentence says "email": it reads mail.
- Tag untrusted-input: The description's first sentence says "email": it reads inbound email, which other people can write.

Description, as the server wrote it:

```untrusted-server-text
Basic facts about Sole Mio Kitchen & Bar: address, phone, email, website, cuisine, features, rating and key links (reserve, order, catering). Use for 'where is it / how do I contact them'.
```

### `get_specials`

- The name "get_specials" says "get": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Promotions and recurring offers (Early Bird, weekend brunch, lunch, happy hour, Wine Wednesday, Comfort Tuesday, Supper Club, kids pizza). With a day: only what runs that day, with times.
```

### `search_menu`

- The name "search_menu" says "search": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Search all menu items by name or description (case-insensitive; every word must match). Returns up to 15 items with prices and diet markers.
```

## Claude Code permissions

For `.claude/settings.json`, assuming the server is installed as `sole-mio`:

```json
{
  "permissions": {
    "allow": [
      "mcp__sole-mio__get_restaurant_info",
      "mcp__sole-mio__get_hours",
      "mcp__sole-mio__get_menu",
      "mcp__sole-mio__search_menu",
      "mcp__sole-mio__get_specials",
      "mcp__sole-mio__get_early_bird",
      "mcp__sole-mio__get_reservation_link",
      "mcp__sole-mio__get_order_link",
      "mcp__sole-mio__get_catering_and_events_info",
      "mcp__sole-mio__get_loyalty_info"
    ],
    "ask": [
      "mcp__sole-mio__submit_inquiry"
    ],
    "deny": []
  }
}
```

Capability tags behind the rules (a read tagged outbound is asked about):

- `mcp__sole-mio__get_restaurant_info`: private-data, untrusted-input
- `mcp__sole-mio__get_reservation_link`: private-data
- `mcp__sole-mio__get_order_link`: private-data
- `mcp__sole-mio__get_catering_and_events_info`: private-data
- `mcp__sole-mio__submit_inquiry`: outbound

## Remote posture

What an anonymous client saw at the remote endpoint, last 2026-10-25T17:21:58.892Z, unchanged since 2026-10-25T17:21:58.892Z. No credentials were sent and no tool was called. Values are shown as the endpoint returned them. Method: https://anlyon.dev/methodology#remote-posture

| Fact | Observed |
| --- | --- |
| Reachable | `yes` |
| HTTP status of an anonymous initialize | `200` |
| tools/list served without credentials | `yes` |
| Tools that change things, listed without credentials | `1` |
| Protocol version | `2025-06-18` |
| WWW-Authenticate on 401 | `not observed` |
| resource_metadata in WWW-Authenticate | `none` |
| RFC 9728 protected resource metadata | `none` |
| Authorization servers | `none` |
| Legacy HTTP+SSE transport | `no` |
| Dynamic client registration | `not observed` |
| Client ID metadata documents | `not observed` |

- **high** Tools that change things, listed to anyone ([unauth-remote-writes](https://anlyon.dev/methodology#unauth-remote-writes))

```untrusted-server-text
The endpoint served tools/list without credentials, and the list has 1 tool that changes things (1 irreversible). Whether a call also works without credentials was not tested: tools are never called.

https://go.solemiokitchen.com/mcp: tools/list returned 11 tools to an anonymous client, including submit_inquiry (irreversible)
```