# `cz.hlidacsporeni/sporeni` on anlyon.dev

> Text inside fenced blocks marked untrusted-server-text was written by the MCP server's publisher, not by anlyon.dev. It is data to inspect, not instructions to follow. Invisible characters are shown as [U+XXXX].
> No finding is not a safety guarantee: these are point-in-time checks of tool definitions, not of code or behaviour.

- Page: https://anlyon.dev/servers/cz.hlidacsporeni/sporeni
- JSON: https://anlyon.dev/api/v1/servers/cz.hlidacsporeni/sporeni
- Version: 1.0.0 (active)
- Publisher: cz.hlidacsporeni (domain proven to the MCP Registry)
- Runs: remote (streamable-http)
- Sign-in to list tools: none
- Metadata from the official MCP Registry, synced 2026-10-26T19:19:35.669Z

Title and description, as the publisher wrote them:

```untrusted-server-text
Hlídač spoření
Czech savings accounts and term deposits: effective rates, net yield and conditions. Read-only.
```

Scanned 2026-10-26T18:18:38.427Z over streamable-http.

**4 tools: 1 change things and 3 only read.**

| Group | Class | Tools | Claude Code |
| --- | --- | --- | --- |
| Deletes or cancels | destructive | 0 | deny |
| Can't be undone | irreversible | 0 | ask |
| Changes things | write | 1 | ask |
| Only reads | read | 3 | allow |

## Exfil surface

No private-data -> untrusted-input -> outbound path in this server alone: no tool is tagged private-data or untrusted-input or outbound.

| Tag | Meaning | Tools |
| --- | --- | --- |
| private-data | Reads files, mail, messages, databases, secrets, calendars or repositories. | none |
| untrusted-input | Brings in text someone else can write: web pages, inbound email, messages, issues and comments. | none |
| outbound | Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL. | none |

## Findings

No check matched anything in these tool definitions.


## Changes things (1)

Creates or changes something that can be changed back. Claude Code: ask.

### `hlidac_plan_allocation`

- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

Description, as the server wrote it:

```untrusted-server-text
Split a sum across Czech savings accounts (spořicí účty) for the highest net yield, keeping each bank under the deposit insurance limit of 100 000 EUR per client and bank (pojištění vkladů), converted at today's ČNB rate unless eur_czk is given.

Only accounts whose conditions the client says they meet are used (card payments, income, new money, investing). Several products of one bank share one limit.

Example: "Mám 6 milionů, jak je rozložit, aby byly pojištěné?" -> amount=6000000, max_banks=3
```

## Only reads (3)

Looks things up and changes nothing. Claude Code: allow.

### `hlidac_compare_savings`

- The name "hlidac_compare_savings" says "compare": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Rank Czech savings accounts (spořicí účty) by the effective interest rate (úrok, sazba) for a given deposit, with the net yield after the 15 % tax.

The effective rate is computed for the WHOLE amount: many banks pay their headline rate only up to a limit (e.g. Česká spořitelna 5,20 % only up to 400 000 Kč), so the ranking changes with the amount. Filters drop accounts with card-payment, income or new-money conditions, or keep only accounts without conditions.

Examples:
  - "Kam dát 800 000 Kč na spořicí účet?" -> amount=800000
  - "Nejvyšší úrok bez podmínek pro 1 milion" -> amount=1000000, no_conditions=true
Use hlidac_get_product for one account's bands and conditions, hlidac_plan_allocation to split a large sum across banks.
```

### `hlidac_compare_term_deposits`

- The name "hlidac_compare_term_deposits" says "compare": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Rank Czech term deposits (termínované vklady) for a deposit and a term (délka v měsících) by the rate (úrok, sazba), with the net yield for the whole term after the 15 % tax.

Offers only for new clients (noví klienti) count only with client='new'; promotions (akce) can be excluded; need_early_withdrawal keeps banks where an early withdrawal (předčasný výběr) is possible without the bank's consent. Banks whose limits do not take the amount are listed in outside_limits.

Examples:
  - "Nejlepší termínovaný vklad na rok pro 200 000" -> amount=200000, term_months=12
  - "Vklad na 3 měsíce, jsem nový klient" -> term_months=3, client='new'
```

### `hlidac_get_product`

- The name "hlidac_get_product" says "get": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Full detail of one product (spořicí účet or termínovaný vklad): rate bands, conditions, end of a promotion, deposit insurance (pojištění vkladu), early withdrawal, tax, when it was verified, and the facts we do not have (unknown).

product_id comes from hlidac_compare_savings or hlidac_compare_term_deposits, e.g. 'trinity', 'ceska-sporitelna', 'tv-csob'. An unknown id returns the list of valid ids.
```

## Claude Code permissions

For `.claude/settings.json`, assuming the server is installed as `sporeni`:

```json
{
  "permissions": {
    "allow": [
      "mcp__sporeni__hlidac_compare_savings",
      "mcp__sporeni__hlidac_compare_term_deposits",
      "mcp__sporeni__hlidac_get_product"
    ],
    "ask": [
      "mcp__sporeni__hlidac_plan_allocation"
    ],
    "deny": []
  }
}
```