Skip to content

io.github.theluckystrike/supplier-list

by theluckystrike · remote · local (mcpb) · no sign-in to list tools · v0.22.6 · published by GitHub user theluckystrike

A supplier directory that does not rot: contacts, terms, lead times, review dates.

Deletes · 1Changes · 6
CompareRegistry entry

10 tools: 1 can delete or cancel things, 6 change things and 3 only read.

Scanned Oct 21, 2026

No check matched anything in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http supplier-list https://mcp.zovo.one/mcp/supplier-list --header 'Authorization: <your-authorization>'

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

10 tools

Deletes or cancels 1Claude Code: deny
  • supplier_removeRemove a supplier from the directory by SUP number or name, returning the record as it stood so nothing is lost silently.No findings

    Why it is in this group

    • The name "supplier_remove" says "remove": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Remove a supplier from the directory by SUP number or name, returning the record as it stood so nothing is lost silently. The SUP number is never reissued. On the free tier the slot is freed for another supplier.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
Changes things 6Claude Code: ask
  • license_activateTurn Pro on for this connection with key, an MCPL1.<payload>.<signature> issued at checkout for this server or the bundle.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Turn Pro on for this connection with key, an MCPL1.<payload>.<signature> issued at checkout for this server or the bundle. Data under your token stays; a wrong or expired key changes nothing. license_status confirms it.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • supplier_addAdd a supplier to the directory and return its SUP-YYYY-NNNN number: the name, what they supply, who to contact and how, the payment terms, the lead time in days, and notes.No findings

    Why it is in this group

    • The name "supplier_add" says "add": a word for a change.
    Description, as the server wrote it
    Add a supplier to the directory and return its SUP-YYYY-NNNN number: the name, what they supply, who to contact and how, the payment terms, the lead time in days, and notes. Free tier: 10 suppliers; removing one you no longer use frees its slot.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • supplier_due_reviewThe due-review report: every supplier whose record has not been reviewed in the last N days -- 90 unless you say otherwise -- most overdue first.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    The due-review report: every supplier whose record has not been reviewed in the last N days -- 90 unless you say otherwise -- most overdue first. A record never reviewed is always due, whatever its age. This is the report that keeps the directory from rotting. Pro feature.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • supplier_exportExport the supplier directory as CSV or a Markdown table: every field, one row per supplier, A to Z by name.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Export the supplier directory as CSV or a Markdown table: every field, one row per supplier, A to Z by name. CSV opens in any spreadsheet; Markdown drops into a doc, a wiki or a README. Filter by category and free text first if you only want part of it. CSV is free; Markdown is Pro.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • supplier_mark_reviewedStamp a supplier's record as reviewed on a date, today by default: you have checked the contact, the terms and the lead time are still true.No findings

    Why it is in this group

    • The name "supplier_mark_reviewed" says "mark": a word for a change.
    Description, as the server wrote it
    Stamp a supplier's record as reviewed on a date, today by default: you have checked the contact, the terms and the lead time are still true. This is the stamp supplier_due_review reads, so a reviewed record stops being flagged as stale.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • supplier_updateChange any of a supplier's fields by SUP number or name: name, category, the contact fields, payment terms, lead time, notes.No findings

    Why it is in this group

    • The name "supplier_update" says "update": a word for a change.
    Description, as the server wrote it
    Change any of a supplier's fields by SUP number or name: name, category, the contact fields, payment terms, lead time, notes. Only the fields you pass change; pass at least one. The SUP number and the review stamp are not writable here -- supplier_mark_reviewed does the stamp.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
Only reads 3Claude Code: allow
  • license_statusReport this endpoint's licence state for your token as JSON: the product, the tier free or pro, why it is not Pro, and the checkout URL.No findings

    Why it is in this group

    • The name "license_status" says "status": a word for reading.
    Description, as the server wrote it
    Report this endpoint's licence state for your token as JSON: the product, the tier free or pro, why it is not Pro, and the checkout URL. Call it to explain a free-tier refusal. No arguments, nothing changes.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • supplier_getRead one supplier record in full by SUP number or name: every contact field, the payment terms, the lead time, the notes, and when the record was last reviewed.No findings

    Why it is in this group

    • The name "supplier_get" says "get": a word for reading.
    Description, as the server wrote it
    Read one supplier record in full by SUP number or name: every contact field, the payment terms, the lead time, the notes, and when the record was last reviewed. Reads only.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • supplier_listList the supplier directory A to Z by name: contact, payment terms, lead time, when each record was last reviewed and how many days ago that was.No findings

    Why it is in this group

    • The name "supplier_list" says "list": a word for reading.
    Description, as the server wrote it
    List the supplier directory A to Z by name: contact, payment terms, lead time, when each record was last reviewed and how many days ago that was. Filter by category and by free text across every field. Reads only.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 0.22.6. Values in angle brackets are yours to fill in.

claude mcp add --transport http supplier-list https://mcp.zovo.one/mcp/supplier-list --header 'Authorization: <your-authorization>'

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__supplier-list__supplier_list",
      "mcp__supplier-list__supplier_get",
      "mcp__supplier-list__license_status"
    ],
    "ask": [
      "mcp__supplier-list__supplier_add",
      "mcp__supplier-list__supplier_update",
      "mcp__supplier-list__supplier_mark_reviewed",
      "mcp__supplier-list__supplier_due_review",
      "mcp__supplier-list__supplier_export",
      "mcp__supplier-list__license_activate"
    ],
    "deny": [
      "mcp__supplier-list__supplier_remove"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as supplier-list. Review it before you use it.