Vesremont

by vesremont.com · remote · no sign-in to list tools · v1.0.0 · published by com.vesremont

Vesremont catalog, product search and buyer-authorized shopping operations.

Deletes · 6Changes · 4

Compare Registry entry

22 tools: 6 can delete or cancel things, 4 change things and 12 only read.

Scanned Oct 21, 2026

Deletes or cancels6Claude Code: deny: see these tools
Can't be undone0Claude Code: ask
Changes things4Claude Code: ask: see these tools
Only reads12Claude Code: allow: see these tools

1 check matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http store https://vesremont.com/mcp

Findings

Matches of fixed checks, with the text they matched.

1 info

Infocreate_webhook
The input schema at properties.callback_url.description mentions "credential".
Matched text
inputSchema.properties.callback_url.description: "...tion and order events. Private-network, credential-bearing and unsafe receiver URLs are re..."
What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

22 tools

Deletes or cancels 6Removes, cancels or revokes something.Claude Code: deny

delete_webhookStop future events for an owned subscription identified by list_webhooks or create_webhook; revokes it and cancels queued deliveries.No findings
Why it is in this group
- The name "delete_webhook" says "delete": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Stop future events for an owned subscription identified by list_webhooks or create_webhook; revokes it and cancels queued deliveries. This is not a pause: use create_webhook for a new subscription. An already in-flight HTTPS request cannot be recalled. OAuth scopes: webhooks:write. Changes buyer or order state.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
remove_cart_itemDelete the complete basket line identified by this buyer's get_cart item_id; not product_id or a favorites entry.No findings
Why it is in this group
- The name "remove_cart_item" says "remove": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Delete the complete basket line identified by this buyer's get_cart item_id; not product_id or a favorites entry. Use update_cart_item to retain the line with a smaller quantity. Returns the refreshed basket; no order or payment. OAuth scopes: cart:write. Changes buyer or order state.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
remove_favoriteRemove a saved product from this buyer's favorites using its product_id from get_favorites, not a basket item_id.No findings
Why it is in this group
- The name "remove_favorite" says "remove": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Remove a saved product from this buyer's favorites using its product_id from get_favorites, not a basket item_id. Does not remove it from the basket; use remove_cart_item for that. Returns the updated favorites list. OAuth scopes: favorites:write. Changes buyer or order state.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
submit_orderSubmit only an order already approved by the buyer in the confirmation page.No findings
Why it is in this group
- The name "submit_order" says "submit": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Submit only an order already approved by the buyer in the confirmation page. Requires the returned token and a stable unique idempotency_key; retry the same key after uncertainty. Never bypass confirmation. OAuth scopes: order:submit. Changes buyer or order state.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
update_cart_itemSet the absolute quantity of a basket line using its item_id from get_cart, not product_id.No findings
Why it is in this group
- The name "update_cart_item" says "update": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Set the absolute quantity of a basket line using its item_id from get_cart, not product_id. Zero removes the line; use add_cart_item to increment instead. Returns the refreshed basket; no order or payment. OAuth scopes: cart:write. Changes buyer or order state.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false
update_checkoutChange one or more checkout fields using choices from get_checkout.No findings
Why it is in this group
- The name "update_checkout" says "update": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Change one or more checkout fields using choices from get_checkout. Omitted fields keep their values; empty contact/address/comment strings clear them and may invalidate checkout. Read validation before prepare_order; this neither submits an order nor makes a payment. OAuth scopes: checkout:write. Changes buyer or order state.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: false

Changes things 4Creates or changes something that can be changed back.Claude Code: ask

add_cart_itemAdd quantity units of a product selected with get_product to the consenting buyer's basket.No findings
Why it is in this group
- The name "add_cart_item" says "add": a word for a change.
Description, as the server wrote it
Add quantity units of a product selected with get_product to the consenting buyer's basket. Quantity is an increment; use update_cart_item with an item_id from get_cart for an absolute final quantity. Do not retry an uncertain add blindly; read get_cart to reconcile. Does not create an order. OAuth scopes: cart:write. Changes buyer or order state.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
add_favoriteSave a current public product in this buyer's favorites, without adding it to the basket.No findings
Why it is in this group
- The name "add_favorite" says "add": a word for a change.
Description, as the server wrote it
Save a current public product in this buyer's favorites, without adding it to the basket. Use get_favorites to inspect the saved list or remove_favorite to undo; use add_cart_item for a purchase basket. OAuth scopes: favorites:write. Changes buyer or order state.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
create_webhookCreate a pending order event subscription to a public HTTPS receiver.Reads text others writeCan send data out1 finding
Why it is in this group
- The name "create_webhook" says "create": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a URL (input.callback_url): a request to a URL can carry data to whoever runs it.
Findings
- Info
  The input schema at properties.callback_url.description mentions "credential".
  Matched text
  inputSchema.properties.callback_url.description: "...tion and order events. Private-network, credential-bearing and unsafe receiver URLs are re..."
  What this check looks for
Description, as the server wrote it
Create a pending order event subscription to a public HTTPS receiver. Returns its signing secret ONCE. The receiver must echo the signed verification challenge before activation. No customer contact fields are sent. Check expires_at and requires_active_grant. OAuth scopes: webhooks:write, orders:read. Changes buyer or order state.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
prepare_orderAfter get_checkout validation succeeds, prepare the exact order summary and a short-lived browser confirmation link.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
After get_checkout validation succeeds, prepare the exact order summary and a short-lived browser confirmation link. The buyer must personally approve that summary before submit_order; this prepares confirmation state but does not submit or pay for an order. OAuth scopes: order:prepare. Changes buyer or order state.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false

Only reads 12Looks things up and changes nothing.Claude Code: allow

get_cartInspect the consenting buyer's existing basket before changing its lines; rechecks current prices and stock and returns item_id for update_cart_item or remove_cart_item.No findings
Why it is in this group
- The name "get_cart" says "get": a word for reading.
Description, as the server wrote it
Inspect the consenting buyer's existing basket before changing its lines; rechecks current prices and stock and returns item_id for update_cart_item or remove_cart_item. Use get_checkout for delivery, payment and contact choices, not this tool. OAuth scopes: cart:read. Read-only.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_catalog_filtersRead available filter groups, values and ranges before a filtered search_products call.No findings
Why it is in this group
- The name "get_catalog_filters" says "get": a word for reading.
Description, as the server wrote it
Read available filter groups, values and ranges before a filtered search_products call. Supply a real section_id or brand_id and keep the same catalog context; use returned characteristic IDs, never invented IDs. This returns filter metadata, not product results. Public; no OAuth required. Read-only.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_checkoutInspect delivery, payment and contact choices, validation and store options before update_checkout or prepare_order.Reads private dataNo findings
Why it is in this group
- The name "get_checkout" says "get": a word for reading.
What it can reach
- private-dataThe description's first sentence says "inspect" and "contact": it reads contacts.
Description, as the server wrote it
Inspect delivery, payment and contact choices, validation and store options before update_checkout or prepare_order. Use get_cart for basket lines alone. Unquoted delivery and final totals stay null; no order is created and no payment is made. OAuth scopes: checkout:read. Read-only.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_favoritesList the consenting buyer's saved product IDs; inspect their current details with get_product or get_products_batch.No findings
Why it is in this group
- The name "get_favorites" says "get": a word for reading.
Description, as the server wrote it
List the consenting buyer's saved product IDs; inspect their current details with get_product or get_products_batch. Use add_favorite or remove_favorite to change this list; favorites are not basket contents. OAuth scopes: favorites:read. Read-only.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_orderRead a saved order by the order_id returned by this application's submit_order for the same buyer session, including after reauthorization.No findings
Why it is in this group
- The name "get_order" says "get": a word for reading.
Description, as the server wrote it
Read a saved order by the order_id returned by this application's submit_order for the same buyer session, including after reauthorization. Use get_checkout for an order not yet submitted. Saving means submitted, not confirmed by the store; unavailable history or confirmation data remain null. OAuth scopes: orders:read. Read-only.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_productInspect one product selected by search_products: current price, aggregate warehouse stock and public characteristics.No findings
Why it is in this group
- The name "get_product" says "get": a word for reading.
Description, as the server wrote it
Inspect one product selected by search_products: current price, aggregate warehouse stock and public characteristics. Use its internal product_id, not the SKU; get_products_batch reads several known IDs. Stock does not promise same-day pickup; unknown values remain null. Public; no OAuth required. Read-only.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_product_reviewsRead customer feedback for a product selected with get_product, not its specifications.Reads text others writeNo findings
Why it is in this group
- The name "get_product_reviews" says "get": a word for reading.
What it can reach
- untrusted-inputThe name "get_product_reviews" says "get" and "review": it reads comments, which other people can write.
Description, as the server wrote it
Read customer feedback for a product selected with get_product, not its specifications. Returns only moderated, published review text, ratings and rating_summary; no pending reviews or review submission. Use page or cursor, never both; an empty list means no published reviews, not a zero-star rating. Public; no OAuth required. Read-only.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_products_batchRead 1 to 10 unique products by internal ID.No findings
Why it is in this group
- The name "get_products_batch" says "get": a word for reading.
Description, as the server wrote it
Read 1 to 10 unique products by internal ID. Returns items in requested order and missing_ids for unpublished or absent products. Each ID consumes one normal catalog quota unit; no URLs, buyer actions or writes are accepted. Public; no OAuth required. Read-only.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
list_webhook_deliveriesInspect delivery failures or retries for a subscription ID from create_webhook or list_webhooks.No findings
Why it is in this group
- The name "list_webhook_deliveries" says "list": a word for reading.
Description, as the server wrote it
Inspect delivery failures or retries for a subscription ID from create_webhook or list_webhooks. Returns only the latest 100 attempts, without event payloads or secrets; no manual resend is performed. Use list_webhooks for subscription status. OAuth scopes: webhooks:read. Read-only.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
list_webhooksList order event subscriptions owned by this application and buyer session, including IDs needed by delete_webhook or list_webhook_deliveries.No findings
Why it is in this group
- The name "list_webhooks" says "list": a word for reading.
Description, as the server wrote it
List order event subscriptions owned by this application and buyer session, including IDs needed by delete_webhook or list_webhook_deliveries. Use list_webhook_deliveries for delivery attempts, not this listing. Signing secrets are never returned again. OAuth scopes: webhooks:read. Read-only.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
search_brandsFind or browse brands through storefront brand search, including typo suggestions.Reads text others writeNo findings
Why it is in this group
- The name "search_brands" says "search": a word for reading.
What it can reach
- untrusted-inputThe description's first sentence says "browse": it reads web pages, which anyone can write.
Description, as the server wrote it
Find or browse brands through storefront brand search, including typo suggestions. Returns paginated public brand links and IDs for search_products.brand_id; this finds brands, not products. Public; no OAuth required. Read-only.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
search_productsFind or browse current catalog products by name, model or SKU; returns a bounded page with an exact total.Reads text others writeNo findings
Why it is in this group
- The name "search_products" says "search": a word for reading.
What it can reach
- untrusted-inputThe description's first sentence says "browse": it reads web pages, which anyone can write.
Description, as the server wrote it
Find or browse current catalog products by name, model or SKU; returns a bounded page with an exact total. Get contextual filter IDs from get_catalog_filters and brand IDs from search_brands; do not guess IDs. Read a selected result with get_product; narrow overly broad queries. Public; no OAuth required. Read-only.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

4 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 1 outbound tool breaks every one.

Reads private data1: Reads files, mail, messages, databases, secrets, calendars or repositories.; get_checkout
Reads text others write4: Brings in text someone else can write: web pages, inbound email, messages, issues and comments.; create_webhook
get_product_reviews
search_brands
search_products
Can send data out1: Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.; create_webhook

deny to break every path

{
  "permissions": {
    "deny": [
      "mcp__store__create_webhook"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Looked at Oct 22, 2026, 14:43 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable: yes
HTTP status of an anonymous initialize: 200
tools/list served without credentials: yes
Tools that change things, listed without credentials: 10
Protocol version: 2025-06-18
WWW-Authenticate on 401: not observed
resource_metadata in WWW-Authenticate: none
RFC 9728 protected resource metadata: https://vesremont.com/.well-known/oauth-protected-resource/mcp
Authorization servers: https://vesremont.com
Legacy HTTP+SSE transport: no
Dynamic client registration: no
Client ID metadata documents: yes

HighThe whole server
The endpoint served tools/list without credentials, and the list has 10 tools that change things (6 destructive, 4 write). Whether a call also works without credentials was not tested: tools are never called.
Matched text
https://vesremont.com/mcp: tools/list returned 22 tools to an anonymous client, including update_cart_item (destructive), remove_cart_item (destructive), remove_favorite (destructive), update_checkout (destructive), submit_order (destructive) and 5 more
What this check looks for

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http store https://vesremont.com/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__store__search_products",
      "mcp__store__get_product",
      "mcp__store__get_products_batch",
      "mcp__store__search_brands",
      "mcp__store__get_catalog_filters",
      "mcp__store__get_product_reviews",
      "mcp__store__get_cart",
      "mcp__store__get_favorites",
      "mcp__store__get_checkout",
      "mcp__store__get_order",
      "mcp__store__list_webhooks",
      "mcp__store__list_webhook_deliveries"
    ],
    "ask": [
      "mcp__store__add_cart_item",
      "mcp__store__add_favorite",
      "mcp__store__prepare_order",
      "mcp__store__create_webhook"
    ],
    "deny": [
      "mcp__store__update_cart_item",
      "mcp__store__remove_cart_item",
      "mcp__store__remove_favorite",
      "mcp__store__update_checkout",
      "mcp__store__submit_order",
      "mcp__store__delete_webhook"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as store. Review it before you use it.

Capability tags behind 5 rules

mcp__store__search_products untrusted-input
mcp__store__search_brands untrusted-input
mcp__store__get_product_reviews untrusted-input
mcp__store__get_checkout private-data
mcp__store__create_webhook untrusted-input, outbound

Keep track

Get told when this server's tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/com.vesremont/store/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Anlyon alternative

10 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Compare with other servers for the same product.

Source: MCP Registry. Synced Oct 21, 2026, 18:10 UTC.

For agents: Markdown · JSON · report this listing