TCC Group website

group.tcc/websitetcc.groupstreamable-httpv1.3.0Scanned 2 hours ago

Read-only tools for tcc.group: contact card, documents, page search and page content.

18 tools: 18 only read.

Reads private data · 6
Reads text others write · 7
Can send data out · 1
1 finding

Anlyon alternative

Run the operations that matter as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

18 tools

Only reads 18Looks things up and changes nothing.Show 18 read-only tools

get_citation_linksReturn clean source links and markdown citation bullets for a query context.No findings
Why it is in this group
- The name "get_citation_links" says "get": a word for reading.
Description, as the server wrote it
Return clean source links and markdown citation bullets for a query context.
Annotations the server declares
- title: Get citation links
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_contact_cardUse this when a person asks how to get in touch with this organisation and would like to see it as a card: it shows the same facts as get_contact_options, which are the address of …Reads private dataReads text others writeNo findings
Why it is in this group
- The name "get_contact_card" says "get": a word for reading.
What it can reach
- private-dataThe name "get_contact_card" says "get" and "contact": it reads contacts.
- private-dataThe description's first sentence says "contact": it reads contacts.
- untrusted-inputThe description's first sentence says "email": it reads inbound email, which other people can write.
Description, as the server wrote it
Use this when a person asks how to get in touch with this organisation and would like to see it as a card: it shows the same facts as get_contact_options, which are the address of its contact page, the enquiry routes that page offers, and the email address, telephone number and office hours the site publishes, with a button that opens the contact page. A fact the site does not publish is left out, and hours and routes are stated as the site publishes them, not as a promise of availability or of a response time. Takes no arguments, accepts no personal data and sends nothing: the person completes any enquiry on the contact page themselves. A client that does not show cards receives the same answer as text.
Annotations the server declares
- title: Show contact options as a card
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_contact_optionsGet how a person can contact this organisation: the address of its contact page, the enquiry routes that page offers, and the email address, telephone number and office hours the s…Reads private dataReads text others writeNo findings
Why it is in this group
- The name "get_contact_options" says "get": a word for reading.
What it can reach
- private-dataThe name "get_contact_options" says "get" and "contact": it reads contacts.
- private-dataThe description's first sentence says "get" and "contact": it reads contacts.
- untrusted-inputThe description's first sentence says "get" and "email": it reads inbound email, which other people can write.
Description, as the server wrote it
Get how a person can contact this organisation: the address of its contact page, the enquiry routes that page offers, and the email address, telephone number and office hours the site publishes. Use it when a person asks how to get in touch. A fact the site does not publish is left out, and hours and routes are stated as the site publishes them, not as a promise of availability or of a response time. Takes no arguments, accepts no personal data and sends nothing: the person completes any enquiry on the contact page themselves.
Annotations the server declares
- title: Get contact options
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_documentGet one public document card, with its schema.org node, by the id that search_documents returns.Reads private dataNo findings
Why it is in this group
- The name "get_document" says "get": a word for reading.
What it can reach
- private-dataThe name "get_document" says "get" and "document": it reads documents.
- private-dataThe description's first sentence says "get" and "document": it reads documents.
Description, as the server wrote it
Get one public document card, with its schema.org node, by the id that search_documents returns. A document that does not exist or is not published for this website returns the same not-found answer.
Annotations the server declares
- title: Get document
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_document_carouselUse this when a person wants to see documents that search_documents or get_document returned: it shows up to three of them as a carousel of cards, each with the document's title, s…Reads private dataNo findings
Why it is in this group
- The name "get_document_carousel" says "get": a word for reading.
What it can reach
- private-dataThe name "get_document_carousel" says "get" and "document": it reads documents.
- private-dataThe description's first sentence says "document": it reads documents.
Description, as the server wrote it
Use this when a person wants to see documents that search_documents or get_document returned: it shows up to three of them as a carousel of cards, each with the document's title, summary, size, number of pages and preview image, a button that opens the PDF and a link to contact the organisation. Pass the id of each document to show, taken from the id of its card, at most three. A document that is not published for this website is left out, and when none can be shown the answer is the one get_document gives for a document that is not found. Do not use it to find documents: call search_documents for that. A client that does not show cards receives the same answer as text.
Annotations the server declares
- title: Show documents as cards
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_navigationReturn the primary navigation structure.No findings
Why it is in this group
- The name "get_navigation" says "get": a word for reading.
Description, as the server wrote it
Return the primary navigation structure.
Annotations the server declares
- title: Get site navigation
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_page_content_with_schemaGet full page textual content and published JSON-LD schema for grounded evaluation.Reads text others writeCan send data outNo findings
Why it is in this group
- The name "get_page_content_with_schema" says "get": a word for reading.
What it can reach
- untrusted-inputThe input takes a URL (input.url), and the tool reads it: it reads web pages, which anyone can write.
- outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
Claude Code: ask, because it is tagged outbound.
Description, as the server wrote it
Get full page textual content and published JSON-LD schema for grounded evaluation.
Annotations the server declares
- title: Get page content and schema
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_person_profileGet one published team member profile and its schema.org Person JSON-LD by slug.No findings
Why it is in this group
- The name "get_person_profile" says "get": a word for reading.
Description, as the server wrote it
Get one published team member profile and its schema.org Person JSON-LD by slug.
Annotations the server declares
- title: Get team member profile
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_schema_contextReturn the sitewide Organization schema context.No findings
Why it is in this group
- The name "get_schema_context" says "get": a word for reading.
Description, as the server wrote it
Return the sitewide Organization schema context.
Annotations the server declares
- title: Get organisation schema context
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_site_infoGet site metadata and MCP server capabilities.No findings
Why it is in this group
- The name "get_site_info" says "get": a word for reading.
Description, as the server wrote it
Get site metadata and MCP server capabilities.
Annotations the server declares
- title: Get site information
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_team_directoryGet the published, featured team member directory (Core-managed People profiles).Reads private data1 finding
Why it is in this group
- The name "get_team_directory" says "get": a word for reading.
What it can reach
- private-dataThe name "get_team_directory" says "get" and "directory": it reads files.
- private-dataThe description's first sentence says "get" and "directory": it reads files.
Findings
- Warn
  The description contains "every other tool", wording about other tools or servers.
  Matched text
  description: "...es). Read-only and published-only, like every other tool."
  What this check looks for
Description, as the server wrote it
Get the published, featured team member directory (Core-managed People profiles). Read-only and published-only, like every other tool.
Annotations the server declares
- title: Get team directory
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
list_pagesList published WordPress pages with pagination.No findings
Why it is in this group
- The name "list_pages" says "list": a word for reading.
Description, as the server wrote it
List published WordPress pages with pagination.
Annotations the server declares
- title: List pages
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
list_postsList published posts, insights, or case studies, optionally filtered by taxonomy.Reads text others writeNo findings
Why it is in this group
- The name "list_posts" says "list": a word for reading.
What it can reach
- untrusted-inputThe name "list_posts" says "list" and "post": it reads posts, which other people can write.
- untrusted-inputThe description's first sentence says "list" and "post": it reads posts, which other people can write.
Description, as the server wrote it
List published posts, insights, or case studies, optionally filtered by taxonomy.
Annotations the server declares
- title: List posts, insights and case studies
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
list_taxonomy_termsList published taxonomy terms with counts.No findings
Why it is in this group
- The name "list_taxonomy_terms" says "list": a word for reading.
Description, as the server wrote it
List published taxonomy terms with counts.
Annotations the server declares
- title: List taxonomy terms
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
search_contentSearch public pages, posts, insights, and case studies.Reads text others writeNo findings
Why it is in this group
- The name "search_content" says "search": a word for reading.
What it can reach
- untrusted-inputThe description's first sentence says "search" and "post": it reads posts, which other people can write.
Description, as the server wrote it
Search public pages, posts, insights, and case studies.
Annotations the server declares
- title: Search site content
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
search_documentsSearch the public documents (PDF files) that this website publishes and return each as a document card with its schema.org node.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "search_documents" says "search": a word for reading.
What it can reach
- private-dataThe name "search_documents" says "search" and "document": it reads documents.
- private-dataThe description's first sentence says "search" and "document": it reads documents.
- untrusted-inputThe description's first sentence says "search" and "website": it reads web pages, which anyone can write.
Description, as the server wrote it
Search the public documents (PDF files) that this website publishes and return each as a document card with its schema.org node. Filter by topic or sector (slugs), by the address of a page on this website to find the documents related to it, or search by phrase. Call get_document to open one document by its id. Only published, open documents appear, and none may be available.
Annotations the server declares
- title: Search documents
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
search_enriched_page_contextsSearch site content and return top matching page contexts enriched with full text and JSON-LD schema.No findings
Why it is in this group
- The name "search_enriched_page_contexts" says "search": a word for reading.
Description, as the server wrote it
Search site content and return top matching page contexts enriched with full text and JSON-LD schema.
Annotations the server declares
- title: Search enriched page contexts
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
search_media_assetsSearch public, active Core-managed Media Assets eligible for this website and return safe delivery variants plus schema.org MediaObject JSON-LD.Reads text others writeNo findings
Why it is in this group
- The name "search_media_assets" says "search": a word for reading.
What it can reach
- untrusted-inputThe description's first sentence says "search" and "website": it reads web pages, which anyone can write.
Description, as the server wrote it
Search public, active Core-managed Media Assets eligible for this website and return safe delivery variants plus schema.org MediaObject JSON-LD. Private and management records are never returned.
Annotations the server declares
- title: Search media assets
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

42 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 1 outbound tool breaks every one.

Reads private data6: Reads files, mail, messages, databases, secrets, calendars or repositories.; get_contact_card
get_contact_options
get_document
get_document_carousel
get_team_directory
search_documents
Reads text others write7: Brings in text someone else can write: web pages, inbound email, messages, issues and comments.; get_contact_card
get_contact_options
get_page_content_with_schema
list_posts
search_content
search_documents
search_media_assets
Can send data out1: Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.; get_page_content_with_schema

deny to break every path

{
  "permissions": {
    "deny": [
      "mcp__website__get_page_content_with_schema"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

1 warn

Warnget_team_directory
The description contains "every other tool", wording about other tools or servers.
Matched text
description: "...es). Read-only and published-only, like every other tool."
What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 1.3.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http website https://tcc.group/wp-json/tcc-mcp/v1/mcp

claude mcp add --transport http website https://tcc.group/wp-json/tcc-mcp/v1/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__website__get_site_info",
      "mcp__website__list_pages",
      "mcp__website__list_posts",
      "mcp__website__list_taxonomy_terms",
      "mcp__website__search_content",
      "mcp__website__search_enriched_page_contexts",
      "mcp__website__get_citation_links",
      "mcp__website__get_schema_context",
      "mcp__website__get_navigation",
      "mcp__website__get_team_directory",
      "mcp__website__get_person_profile",
      "mcp__website__search_media_assets",
      "mcp__website__search_documents",
      "mcp__website__get_document",
      "mcp__website__get_contact_options",
      "mcp__website__get_document_carousel",
      "mcp__website__get_contact_card"
    ],
    "ask": [
      "mcp__website__get_page_content_with_schema"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as website. Review it before you use it.

Capability tags behind 10 rules

mcp__website__list_posts untrusted-input
mcp__website__search_content untrusted-input
mcp__website__get_page_content_with_schema untrusted-input, outbound
mcp__website__get_team_directory private-data
mcp__website__search_media_assets untrusted-input
mcp__website__search_documents private-data, untrusted-input
mcp__website__get_document private-data
mcp__website__get_contact_options private-data, untrusted-input
mcp__website__get_document_carousel private-data
mcp__website__get_contact_card private-data, untrusted-input

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/group.tcc/website/verify?hash=a8eeb606d06b31406e022707351f976b258415f089aa1f8c1eb2ebd08c70828d" | jq -e '.changed == false'

Pinned hash a8eeb606d06b, from Nov 2, 2026, 08:18 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/group.tcc/website/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

[![anlyon.dev](https://anlyon.dev/badge/group.tcc/website.svg)](https://anlyon.dev/servers/group.tcc/website)

Source: MCP Registry. Synced Nov 2, 2026, 08:17 UTC.