Skip to content

MCP Market Russia

by devids77 · remote · no sign-in to list tools · v3.2.0 · published by GitHub user devids77

Russian construction market: 3,395 contractors, 20,322 projects, 24 search/analytics tools.

Final · 1Changes · 7
CompareRegistry entry

24 tools: 1 do something that can't be undone, 7 change things and 16 only read.

Scanned Oct 21, 2026

No check matched anything in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http market-ru https://mcp-market.ru/mcp/

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

24 tools

Can't be undone 1Claude Code: ask
  • request_quoteSend a quote request to a construction company on behalf of the user.Can send data outNo findings

    Why it is in this group

    • The name "request_quote" says "request": a word for a change.
    • The description's first verb is "send": a word for sending, and what is sent cannot be taken back.

    What it can reach

    • outboundThe input takes a destination (input.phone): what the tool writes goes there.
    Description, as the server wrote it
    Send a quote request to a construction company on behalf of the user. Returns confirmation with lead ID and company contact details. Args: company_id: Target company UUID (required) project_id: Specific project UUID if the user is interested in a particular house project name: Client's name for the quote request phone: Client's phone number for callback email: Client's email address comment: Additional comments or requirements for the quote
Changes things 7Claude Code: ask
  • calculate_costCalculate estimated construction cost based on real market data from the catalog.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Calculate estimated construction cost based on real market data from the catalog. Uses average price per m² by material and region from actual company prices and projects. Args: area: House area in square meters (required, e.g. 120) material: Building material (каркас/frame, брус/timber, газобетон/aerated_concrete, кирпич/brick, СИП/SIP). Empty = average across all. region: Region or city name for regional pricing. Empty = nationwide average. floors: Number of floors (1 or 2). 0 = no adjustment.
  • contractor_recommendationAI-powered contractor recommendation.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    AI-powered contractor recommendation. Finds the best matching companies based on budget, region, quality requirements. Returns ranked list with match scores.
  • market_reportGenerate a comprehensive market report for a specific region.No findings

    Why it is in this group

    • The description's first verb is "generate": a word for a change.
    Description, as the server wrote it
    Generate a comprehensive market report for a specific region. Includes: market size, price tiers, top players, contact availability, competitive landscape. Perfect for investors, business development, and market entry analysis. Args: region: Region name (e.g. 'Москва', 'Ленинградская область').
  • project_estimatorEstimate construction project cost based on area, region, category and quality level (economy/standard/premium).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Estimate construction project cost based on area, region, category and quality level (economy/standard/premium). Uses real market data from our database.
  • review_analysisReputation summary from the aggregate star rating and review count, benchmarked against the region average.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Reputation summary from the aggregate star rating and review count, benchmarked against the region average. Provide company_slug for one company, or region/category for a market overview. Review texts are not stored, so no per-review sentiment or themes are returned.
  • smart_matchNatural-language contractor search.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Natural-language contractor search. Pass a free-form Russian brief (e.g. "хочу каркасный дом 180 кв.м в Подмосковье до 15 млн") and get top-N matching contractors plus an explanation of how the brief was parsed. Returns JSON with: parsed filters, matches list, explanation.
  • trend_analyzerCurrent market snapshot by region, category, rating tier and price segment.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Current market snapshot by region, category, rating tier and price segment. This is a distribution of the catalogue as it stands now, not a time series: we do not store historical snapshots, so no growth or change-over-time can be computed. `period` is accepted for backwards compatibility and ignored.
Only reads 16Claude Code: allow
  • company_deep_profileGet comprehensive company profile with all available data - contacts, projects, pricing, reviews analysis, market position, and comparison with competitors in same region.Reads private dataNo findings

    Why it is in this group

    • The description's first verb is "get": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "get" and "contact": it reads contacts.
    Description, as the server wrote it
    Get comprehensive company profile with all available data - contacts, projects, pricing, reviews analysis, market position, and comparison with competitors in same region.
  • company_portfolioGet FULL company portfolio: details, all projects, prices, reviews, contacts.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The description's first verb is "get": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "get" and "contact": it reads contacts.
    • untrusted-inputThe description's first sentence says "get" and "review": it reads comments, which other people can write.
    Description, as the server wrote it
    Get FULL company portfolio: details, all projects, prices, reviews, contacts. Comprehensive dossier for due diligence or hiring decisions. Args: company_slug: Company slug identifier (from search results).
  • compare_companiesCompare 2-3 construction companies side by side on prices, ratings, number of projects, and specialization.No findings

    Why it is in this group

    • The name "compare_companies" says "compare": a word for reading.
    Description, as the server wrote it
    Compare 2-3 construction companies side by side on prices, ratings, number of projects, and specialization. Args: company_ids: Comma-separated company UUIDs to compare (2-3 IDs). Example: 'uuid1,uuid2,uuid3'
  • export_search_csvExport search results as CSV text (UTF-8 with BOM, Excel-friendly).No findings

    Why it is in this group

    • The name "export_search_csv" says "search": a word for reading.
    Description, as the server wrote it
    Export search results as CSV text (UTF-8 with BOM, Excel-friendly). entity: 'companies' or 'projects' query: free-text search in name/description category, region: filter fields budget_max: for companies, cap on min_project_price limit: 1..2000 rows (default 500) Returns CSV text ready to save as .csv and open in Excel.
  • find_best_companiesSmart lead generation: find the best construction companies matching your criteria.No findings

    Why it is in this group

    • The name "find_best_companies" says "find": a word for reading.
    Description, as the server wrote it
    Smart lead generation: find the best construction companies matching your criteria. Perfect for finding contractors, generating leads, or market research. Args: region: Filter by region name (e.g. 'Москва'). Empty = all. category: Filter by category/subcategory. Empty = all. min_rating: Minimum rating (0-5). 0 = no filter. max_price: Maximum price per m2 in thousands RUB. 0 = no filter. min_price: Minimum price per m2 in thousands RUB. 0 = no filter. has_phone: Only companies with phone number. has_projects: Only companies with project portfolio. sort_by: Sort by: 'rating', 'price_asc', 'price_desc', 'reviews', 'projects'. limit: Max results (1-50).
  • get_categoriesGet all company categories with the number of companies in each category.No findings

    Why it is in this group

    • The name "get_categories" says "get": a word for reading.
    Description, as the server wrote it
    Get all company categories with the number of companies in each category.
  • get_companyGet full company profile including contacts, prices, rating, reviews, and list of house projects.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "get_company" says "get": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "get" and "contact": it reads contacts.
    • untrusted-inputThe description's first sentence says "get" and "review": it reads comments, which other people can write.
    Description, as the server wrote it
    Get full company profile including contacts, prices, rating, reviews, and list of house projects. Args: company_id: Company UUID from search_companies results
  • get_lead_statusCheck the status of a lead created via request_quote.No findings

    Why it is in this group

    • The name "get_lead_status" says "get": a word for reading.
    Description, as the server wrote it
    Check the status of a lead created via request_quote. lead_id: UUID returned by request_quote api_key: the api_key used when the lead was created Returns JSON with status (new/contacted/won/lost), company info, contact fields, budget, timestamps.
  • get_projectGet detailed house project information including specifications, price, features, and company contacts.Reads private dataNo findings

    Why it is in this group

    • The name "get_project" says "get": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "get" and "contact": it reads contacts.
    Description, as the server wrote it
    Get detailed house project information including specifications, price, features, and company contacts. Args: project_id: Project UUID from search_projects results
  • get_regionsGet all available regions with the number of companies in each region.No findings

    Why it is in this group

    • The name "get_regions" says "get": a word for reading.
    Description, as the server wrote it
    Get all available regions with the number of companies in each region.
  • get_statsGet catalog statistics: total companies, projects, regions, categories, agent queries today, and leads generated.No findings

    Why it is in this group

    • The name "get_stats" says "get": a word for reading.
    Description, as the server wrote it
    Get catalog statistics: total companies, projects, regions, categories, agent queries today, and leads generated.
  • market_analyticsGet comprehensive market analytics for the Russian construction market.No findings

    Why it is in this group

    • The description's first verb is "get": a word for reading.
    Description, as the server wrote it
    Get comprehensive market analytics for the Russian construction market. Returns: average prices, top companies by rating, market size, price distribution. Perfect for investors, analysts, and companies entering the market. Args: region: Filter by region (e.g. 'Москва', 'Санкт-Петербург'). Empty = all regions. category: Filter by category (e.g. 'Строительство домов'). Empty = all categories.
  • price_comparisonCompare construction prices across regions and categories.No findings

    Why it is in this group

    • The description's first verb is "compare": a word for reading.
    Description, as the server wrote it
    Compare construction prices across regions and categories. Returns detailed price statistics, percentiles, and regional rankings. Args: regions: Comma-separated regions to compare (e.g. 'Москва,Санкт-Петербург'). Empty = all. category: Filter by category. Empty = all.
  • region_comparisonCompare construction markets across regions.No findings

    Why it is in this group

    • The description's first verb is "compare": a word for reading.
    Description, as the server wrote it
    Compare construction markets across regions. Provide comma-separated region names. Shows companies count, ratings, prices, contact availability for each region side by side.
  • search_companiesSearch Russian construction companies by category, region, and budget.No findings

    Why it is in this group

    • The name "search_companies" says "search": a word for reading.
    Description, as the server wrote it
    Search Russian construction companies by category, region, and budget. Returns company name, rating, prices, website, and phone number. Args: query: Free text search query (e.g. 'каркасные дома недорого', 'frame houses') category: Company category filter (каркасные_дома, дома_из_бруса, газобетон, кирпич, недвижимость, модульные_дома, СИП) region: Region or city name (e.g. 'Московская область', 'Санкт-Петербург', 'Краснодар') budget_max: Maximum budget in rubles. Set to 0 for no limit. limit: Number of results to return, maximum 20
  • search_projectsSearch house building projects by area, floors, material, and price.No findings

    Why it is in this group

    • The name "search_projects" says "search": a word for reading.
    Description, as the server wrote it
    Search house building projects by area, floors, material, and price. Returns project specifications, price, direct link, and company contacts. Args: area_min: Minimum house area in square meters. Set to 0 for no limit. area_max: Maximum house area in square meters. Set to 0 for no limit. floors: Number of floors/stories. Set to 0 for any. material: Building material filter (каркас/frame, брус/timber, газобетон/aerated_concrete, кирпич/brick, СИП/SIP) budget_max: Maximum price in rubles. Set to 0 for no limit. region: Filter by company region or city name query: Free text search in project name and description limit: Number of results to return, maximum 20

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

8 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 1 outbound tool breaks every one.

Reads private data4
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write2
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out1
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
deny to break every path
{
  "permissions": {
    "deny": [
      "mcp__market-ru__request_quote"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Looked at Oct 22, 2026, 14:58 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable
yes
HTTP status of an anonymous initialize
200
tools/list served without credentials
yes
Tools that change things, listed without credentials
8
Protocol version
2025-06-18
WWW-Authenticate on 401
not observed
resource_metadata in WWW-Authenticate
none
RFC 9728 protected resource metadata
none
Authorization servers
none
Legacy HTTP+SSE transport
no
Dynamic client registration
not observed
Client ID metadata documents
not observed
  • HighThe whole server

    The endpoint served tools/list without credentials, and the list has 8 tools that change things (1 irreversible, 7 write). Whether a call also works without credentials was not tested: tools are never called.

    Matched text

    https://mcp-market.ru/mcp/: tools/list returned 24 tools to an anonymous client, including request_quote (irreversible), calculate_cost (write), market_report (write), review_analysis (write), contractor_recommendation (write) and 3 more

    What this check looks for

Install

Pinned to version 3.2.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http market-ru https://mcp-market.ru/mcp/

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__market-ru__search_companies",
      "mcp__market-ru__search_projects",
      "mcp__market-ru__compare_companies",
      "mcp__market-ru__get_company",
      "mcp__market-ru__get_project",
      "mcp__market-ru__get_categories",
      "mcp__market-ru__get_regions",
      "mcp__market-ru__get_stats",
      "mcp__market-ru__market_analytics",
      "mcp__market-ru__find_best_companies",
      "mcp__market-ru__price_comparison",
      "mcp__market-ru__company_portfolio",
      "mcp__market-ru__company_deep_profile",
      "mcp__market-ru__region_comparison",
      "mcp__market-ru__export_search_csv",
      "mcp__market-ru__get_lead_status"
    ],
    "ask": [
      "mcp__market-ru__calculate_cost",
      "mcp__market-ru__request_quote",
      "mcp__market-ru__market_report",
      "mcp__market-ru__review_analysis",
      "mcp__market-ru__contractor_recommendation",
      "mcp__market-ru__project_estimator",
      "mcp__market-ru__trend_analyzer",
      "mcp__market-ru__smart_match"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as market-ru. Review it before you use it.

Capability tags behind 5 rules
  • mcp__market-ru__get_company private-data, untrusted-input
  • mcp__market-ru__get_project private-data
  • mcp__market-ru__request_quote outbound
  • mcp__market-ru__company_portfolio private-data, untrusted-input
  • mcp__market-ru__company_deep_profile private-data