Quartermaster eSIM

io.github.dvirmimon123-tech/quartermasterdvirmimon123-techstreamable-httpv0.3.2Scanned 3 hours ago

Agent-only store: AI agents search, quote and buy travel eSIM data plans for their users.

14 tools: 2 can delete or cancel things, 2 do something that can't be undone, 6 change things and 4 only read.

Reads private data · 0
Reads text others write · 3
Can send data out · 0
1 finding

The remote endpoint did not answer the last look. Remote posture

Anlyon alternative

10 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

14 tools

Deletes or cancels 2Removes, cancels or revokes something.Claude Code: deny

request_refundReasons "unused" and "changed_plans" are voluntary refunds under the refund policy.No findings
Why it is in this group
- The name "request_refund" says "request": a word for a change.
- The name "request_refund" also says "refund": a word that usually means money moves, which cannot be taken back.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Reasons "unused" and "changed_plans" are voluntary refunds under the refund policy. Reasons "not_delivered", "not_working" and "duplicate_purchase" open a dispute under the dispute policy, which can refund fully, partially, reject, or escalate to a human. Denials return error.code = the policy reason_code.
Annotations the server declares
- destructiveHint: true
- idempotentHint: false
rotate_principal_keyReplace your principal's principal_key.1 finding
Why it is in this group
- The description's first verb is "replace": a word for a change.
- The server marks it destructive (destructiveHint: true).
Findings
- Info
  The description mentions "credentials".
  Matched text
  description: "...cipal's principal_key. Needs your agent credentials and the current principal_key (argument..."
  What this check looks for
Description, as the server wrote it
Replace your principal's principal_key. Needs your agent credentials and the current principal_key (argument or X-Principal-Key header). Returns the new key once; the old one stops working. Existing agents are unaffected. A principal registered before keys existed has none: any of its agents can call this without principal_key to mint the first one.
Annotations the server declares
- destructiveHint: true
- idempotentHint: false

Can't be undone 2Sends, pays, publishes or merges: once done, it cannot be taken back.Claude Code: ask

purchaseBuy the product in a quote.Reads text others writeNo findings
Why it is in this group
- The name "purchase" says "purchase": a word that usually means money moves, which cannot be taken back.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Buy the product in a quote. Enforces the mandate and the wallet policy, holds the amount in the principal's wallet, orders from the supplier, debits the wallet, and returns the order with the eSIM delivery payload and a signed receipt. If the wallet is short, fails with WALLET_INSUFFICIENT_FUNDS and a ready top-up link for the principal. idempotency_key is required: reusing it returns the original order and never charges twice.
Annotations the server declares
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
sandbox_simulate_topup_paymentSandbox only.No findings
Why it is in this group
- The name "sandbox_simulate_topup_payment" says "topup": a word that usually means money moves, which cannot be taken back.
Description, as the server wrote it
Sandbox only. Acts as the principal paying a get_topup_link URL: the mock provider sends a PayPlus-format IPN through the same webhook path production uses, and the wallet is credited. outcome "declined" simulates a failed card.

Changes things 6Creates or changes something that can be changed back.Claude Code: ask

get_quoteLock the final price for one product for a short time (quote_ttl_seconds in store terms).No findings
Why it is in this group
- The name "get_quote" says "get": a word for reading.
- The description's first verb is "lock": a word for a change.
Description, as the server wrote it
Lock the final price for one product for a short time (quote_ttl_seconds in store terms). Also returns a mandate pre-check and the refund terms, so you know before buying whether the purchase will be allowed.
Annotations the server declares
- readOnlyHint: false
- idempotentHint: false
get_topup_linkCreate a hosted payment URL to hand to your human principal.Reads text others writeNo findings
Why it is in this group
- The name "get_topup_link" says "get": a word for reading.
- The description's first verb is "create": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe description's first sentence says "create" and "url": it reads web pages, which anyone can write.
Description, as the server wrote it
Create a hosted payment URL to hand to your human principal. They pay in ILS on the acquirer's page (PayPlus); you never see card data. amount_minor is in `currency`: USD (the wallet credit you want; the ILS charge is computed at today's rate) or ILS (the exact charge). The wallet is credited in USD at the rate in force when payment is confirmed. Limits are in the topup policy.
Annotations the server declares
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
regenerate_activationFor one of your own delivered orders whose activation code (QR / LPA) does not install: asks the supplier for a fresh code and returns the new delivery payload.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
For one of your own delivered orders whose activation code (QR / LPA) does not install: asks the supplier for a fresh code and returns the new delivery payload. The previous code may stop working. Not every supplier supports it (NOT_SUPPORTED_BY_SUPPLIER); then open a dispute with reason not_working.
Annotations the server declares
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
register_agentCreate an agent identity bound to a principal, with a spending mandate (limits in minor units).No findings
Why it is in this group
- The description's first verb is "create": a word for a change.
Description, as the server wrote it
Create an agent identity bound to a principal, with a spending mandate (limits in minor units). Returns agent_key once; send it on every later call. The first agent of a new principal_id also receives principal_key (once): the principal owns the wallet, and every later register_agent for that principal_id must present principal_key (argument or X-Principal-Key header), else PRINCIPAL_KEY_REQUIRED. New agents are capped by the registration policy (see get_policies).
Annotations the server declares
- destructiveHint: false
- idempotentHint: false
sandbox_simulate_activationSandbox only.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Sandbox only. Marks the order's eSIM as installed and used, as if the traveler activated it. Use it to exercise refund and dispute rules.
verify_receiptCheck a receipt's signature and that it matches its hash-chained ledger entry.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Check a receipt's signature and that it matches its hash-chained ledger entry.
Annotations the server declares
- readOnlyHint: true

Only reads 4Looks things up and changes nothing.Show 4 read-only tools

get_policiesReturns every policy as machine-readable JSON (mandate, refund, dispute, supplier trust, registration), the store terms and the product/agent JSON Schemas, so you can reason about …No findings
Why it is in this group
- The name "get_policies" says "get": a word for reading.
Description, as the server wrote it
Returns every policy as machine-readable JSON (mandate, refund, dispute, supplier trust, registration), the store terms and the product/agent JSON Schemas, so you can reason about terms before buying.
Annotations the server declares
- readOnlyHint: true
get_walletBalance, available funds (balance minus pending holds), open top-up links, recent top-ups and recent ledger entries of the wallet of the principal you act for.No findings
Why it is in this group
- The name "get_wallet" says "get": a word for reading.
Description, as the server wrote it
Balance, available funds (balance minus pending holds), open top-up links, recent top-ups and recent ledger entries of the wallet of the principal you act for. Shared by all of the principal's agents. Amounts in minor units.
Annotations the server declares
- readOnlyHint: true
order_statusCurrent order state, eSIM delivery payload, activation and data usage from the supplier, receipts and disputes.No findings
Why it is in this group
- The name "order_status" says "status": a word for reading.
Description, as the server wrote it
Current order state, eSIM delivery payload, activation and data usage from the supplier, receipts and disputes.
Annotations the server declares
- readOnlyHint: true
search_plansSearch eSIM data plans from trusted suppliers.No findings
Why it is in this group
- The name "search_plans" says "search": a word for reading.
Description, as the server wrote it
Search eSIM data plans from trusted suppliers. Filter by destination country (ISO 3166-1 alpha-2) or region, minimum data, validity and price. Results are sorted by final price unless sort says otherwise. Suppliers below the trust threshold are excluded and listed in excluded_suppliers.
Annotations the server declares
- readOnlyHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data or outbound.

Reads private data0: Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write3: Brings in text someone else can write: web pages, inbound email, messages, issues and comments.; get_topup_link
purchase
regenerate_activation
Can send data out0: Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

The remote endpoint did not answer the last look

Looked at Nov 3, 2026, 01:19 UTC, unchanged since Nov 3, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable: no
HTTP status of an anonymous initialize: not observed
tools/list served without credentials: no
Tools that change things, listed without credentials: 0
Protocol version: not observed
WWW-Authenticate on 401: not observed
resource_metadata in WWW-Authenticate: not observed
RFC 9728 protected resource metadata: not observed
Authorization servers: not observed
Legacy HTTP+SSE transport: no
Dynamic client registration: not observed
Client ID metadata documents: not observed

The probe stopped: The operation was aborted due to timeout

Findings

Matches of fixed checks, with the text they matched.

1 info

Inforotate_principal_key
The description mentions "credentials".
Matched text
description: "...cipal's principal_key. Needs your agent credentials and the current principal_key (argument..."
What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 0.3.2. Values in angle brackets are yours to fill in.

claude mcp add --transport http quartermaster https://api.quartermasterhq.ai/mcp

claude mcp add --transport http quartermaster https://api.quartermasterhq.ai/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__quartermaster__get_policies",
      "mcp__quartermaster__search_plans",
      "mcp__quartermaster__get_wallet",
      "mcp__quartermaster__order_status"
    ],
    "ask": [
      "mcp__quartermaster__register_agent",
      "mcp__quartermaster__get_quote",
      "mcp__quartermaster__purchase",
      "mcp__quartermaster__get_topup_link",
      "mcp__quartermaster__regenerate_activation",
      "mcp__quartermaster__verify_receipt",
      "mcp__quartermaster__sandbox_simulate_topup_payment",
      "mcp__quartermaster__sandbox_simulate_activation"
    ],
    "deny": [
      "mcp__quartermaster__rotate_principal_key",
      "mcp__quartermaster__request_refund"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as quartermaster. Review it before you use it.

Capability tags behind 3 rules

mcp__quartermaster__purchase untrusted-input
mcp__quartermaster__get_topup_link untrusted-input
mcp__quartermaster__regenerate_activation untrusted-input

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/io.github.dvirmimon123-tech/quartermaster/verify?hash=08fa288313c7d2c2bbca06966c54a9022308a37461c0f5ba1149349e354769b5" | jq -e '.changed == false'

Pinned hash 08fa288313c7, from Nov 3, 2026, 10:18 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/io.github.dvirmimon123-tech/quartermaster/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

[![anlyon.dev](https://anlyon.dev/badge/io.github.dvirmimon123-tech/quartermaster.svg)](https://anlyon.dev/servers/io.github.dvirmimon123-tech/quartermaster)

Source: MCP Registry · repository. Synced Nov 3, 2026, 10:17 UTC.