# `ie.akay.mcp/offers` on anlyon.dev

> Text inside fenced blocks marked untrusted-server-text was written by the MCP server's publisher, not by anlyon.dev. It is data to inspect, not instructions to follow. Invisible characters are shown as [U+XXXX].
> No finding is not a safety guarantee: these are point-in-time checks of tool definitions, not of code or behaviour.

- Page: https://anlyon.dev/servers/ie.akay.mcp/offers
- JSON: https://anlyon.dev/api/v1/servers/ie.akay.mcp/offers
- Version: 1.0.0 (active)
- Publisher: ie.akay.mcp (domain proven to the MCP Registry)
- Runs: remote (streamable-http)
- Sign-in to list tools: none
- Metadata from the official MCP Registry, synced 2026-10-26T07:17:40.846Z

Title and description, as the publisher wrote them:

```untrusted-server-text
Akay trade offers (akay.ie)
Live B2B FMCG wholesale offers from Akay (IRL) Ltd: spirits, wine, beer, groceries, cosmetics.
```

Scanned 2026-10-26T07:17:55.286Z over streamable-http.

**8 tools: 1 change things and 7 only read.**

| Group | Class | Tools | Claude Code |
| --- | --- | --- | --- |
| Deletes or cancels | destructive | 0 | deny |
| Can't be undone | irreversible | 0 | ask |
| Changes things | write | 1 | ask |
| Only reads | read | 7 | allow |

## Exfil surface

No private-data -> untrusted-input -> outbound path in this server alone: no tool is tagged private-data or outbound.

| Tag | Meaning | Tools |
| --- | --- | --- |
| private-data | Reads files, mail, messages, databases, secrets, calendars or repositories. | none |
| untrusted-input | Brings in text someone else can write: web pages, inbound email, messages, issues and comments. | `mcp__offers__get_offer` `mcp__offers__search_offers` |
| outbound | Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL. | none |

## Findings

- **warn** Annotations that disagree with the tool in `request_quote` ([annotation-conflict](https://anlyon.dev/methodology#annotation-conflict))

```untrusted-server-text
The server marks "request_quote" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "request_quote" says "request": a word for a change.
```


## Changes things (1)

Creates or changes something that can be changed back. Claude Code: ask.

### `request_quote`

- The name "request_quote" says "request": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
- Findings: warn annotation-conflict

Description, as the server wrote it:

```untrusted-server-text
Turn confirmed lines (offer_id + cases, or units for offers priced per unit) into a quote request summary and a CSV the buyer uploads at quote.akay.ie/#excel, plus WhatsApp and email options. Totals are per currency, never summed across currencies. Use it whenever the buyer says they want a quote, an order or to buy, and offer it after showing prices. Sends nothing, reserves nothing and needs no contact details.
```

## Only reads (7)

Looks things up and changes nothing. Claude Code: allow.

### `fetch`

- The name "fetch" says "fetch": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Fetch the full public details of one akay.ie offer by the id returned from search.
```

### `get_offer`

- The name "get_offer" says "get": a word for reading.
- Tag untrusted-input: The description's first sentence says "url": it reads web pages, which anyone can write.

Description, as the server wrote it:

```untrusted-server-text
Full public details of one open offer by its akay.ie offer_id (or akay.ie offer URL), with the akay.ie link and how to order.
```

### `get_price`

- The name "get_price" says "get": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Price one product (offer_id, EAN or name) for a quantity in cases. Returns the listed price per case and per unit in the offer's currency, the line total worked out in code, and MOQ and stock checks. If several offers fit, returns candidates instead of picking one. Optional target price comparison. Once the buyer is happy with a line, offer request_quote.
```

### `list_categories`

- The name "list_categories" says "list": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Categories with offer counts and top brands, plus the values available for the duty status, Incoterm, stock and location filters.
```

### `price_my_list`

- The name "price_my_list" says "list": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Price a buying list (up to 100 lines / 20 KB): product names or EANs, quantities in cases and optional target prices. Paste it as text (one product per line, or CSV/TSV with a header row) or give structured lines. Each line comes back with a match status (matched, ambiguous, not_listed, moq_not_met, insufficient_stock, price_unavailable), the listed price, pack, stock, duty status, Incoterm and line total. Lines keep their own currency (EUR, USD or GBP); totals are subtotals per currency, never converted or summed across currencies.
```

### `search`

- The name "search" says "search": a word for reading.

Description, as the server wrote it:

```untrusted-server-text
Search the akay.ie trade catalogue. Returns offer ids, titles and akay.ie URLs. Use fetch with an id for full details.
```

### `search_offers`

- The name "search_offers" says "search": a word for reading.
- Tag untrusted-input: The description's first sentence says "search" and "website": it reads web pages, which anyone can write.

Description, as the server wrote it:

```untrusted-server-text
Search open akay.ie trade offers by keyword, EAN, size ("70cl", "6x70cl"), ABV or duty status, with optional website filters. Returns listed sell prices per case and per unit in each offer's own currency (EUR, USD or GBP), pack, duty status, Incoterm, location and stock. Paged: up to 25 per page, 10 pages per query.
```

## Claude Code permissions

For `.claude/settings.json`, assuming the server is installed as `offers`:

```json
{
  "permissions": {
    "allow": [
      "mcp__offers__search_offers",
      "mcp__offers__get_offer",
      "mcp__offers__get_price",
      "mcp__offers__list_categories",
      "mcp__offers__price_my_list",
      "mcp__offers__search",
      "mcp__offers__fetch"
    ],
    "ask": [
      "mcp__offers__request_quote"
    ],
    "deny": []
  }
}
```

Capability tags behind the rules (a read tagged outbound is asked about):

- `mcp__offers__search_offers`: untrusted-input
- `mcp__offers__get_offer`: untrusted-input