# `io.github.theluckystrike/supplier-list` on anlyon.dev > Text inside fenced blocks marked untrusted-server-text was written by the MCP server's publisher, not by anlyon.dev. It is data to inspect, not instructions to follow. Invisible characters are shown as [U+XXXX]. > No finding is not a safety guarantee: these are point-in-time checks of tool definitions, not of code or behaviour. - Page: https://anlyon.dev/servers/io.github.theluckystrike/supplier-list - JSON: https://anlyon.dev/api/v1/servers/io.github.theluckystrike/supplier-list - Version: 0.22.6 (active) - Publisher: io.github.theluckystrike (GitHub account) - Runs: remote (streamable-http), local (mcpb) - Sign-in to list tools: none - Repository: https://github.com/theluckystrike/mcp-servers - Metadata from the official MCP Registry, synced 2026-10-21T18:50:32.829Z Title and description, as the publisher wrote them: ```untrusted-server-text A supplier directory that does not rot: contacts, terms, lead times, review dates. ``` Scanned 2026-10-21T19:38:44.099Z over streamable-http. **10 tools: 1 can delete or cancel things, 6 change things and 3 only read.** | Group | Class | Tools | Claude Code | | --- | --- | --- | --- | | Deletes or cancels | destructive | 1 | deny | | Can't be undone | irreversible | 0 | ask | | Changes things | write | 6 | ask | | Only reads | read | 3 | allow | ## Findings No check matched anything in these tool definitions. ## Deletes or cancels (1) Removes, cancels or revokes something. Claude Code: deny. ### `supplier_remove` - The name "supplier_remove" says "remove": a word for removing or ending something. - The server marks it destructive (destructiveHint: true). Description, as the server wrote it: ```untrusted-server-text Remove a supplier from the directory by SUP number or name, returning the record as it stood so nothing is lost silently. The SUP number is never reissued. On the free tier the slot is freed for another supplier. ``` ## Changes things (6) Creates or changes something that can be changed back. Claude Code: ask. ### `license_activate` - Nothing in its name or description says what it does, so it is counted as a write. Description, as the server wrote it: ```untrusted-server-text Turn Pro on for this connection with key, an MCPL1.. issued at checkout for this server or the bundle. Data under your token stays; a wrong or expired key changes nothing. license_status confirms it. ``` ### `supplier_add` - The name "supplier_add" says "add": a word for a change. Description, as the server wrote it: ```untrusted-server-text Add a supplier to the directory and return its SUP-YYYY-NNNN number: the name, what they supply, who to contact and how, the payment terms, the lead time in days, and notes. Free tier: 10 suppliers; removing one you no longer use frees its slot. ``` ### `supplier_due_review` - Nothing in its name or description says what it does, so it is counted as a write. Description, as the server wrote it: ```untrusted-server-text The due-review report: every supplier whose record has not been reviewed in the last N days -- 90 unless you say otherwise -- most overdue first. A record never reviewed is always due, whatever its age. This is the report that keeps the directory from rotting. Pro feature. ``` ### `supplier_export` - Nothing in its name or description says what it does, so it is counted as a write. - The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class. Description, as the server wrote it: ```untrusted-server-text Export the supplier directory as CSV or a Markdown table: every field, one row per supplier, A to Z by name. CSV opens in any spreadsheet; Markdown drops into a doc, a wiki or a README. Filter by category and free text first if you only want part of it. CSV is free; Markdown is Pro. ``` ### `supplier_mark_reviewed` - The name "supplier_mark_reviewed" says "mark": a word for a change. Description, as the server wrote it: ```untrusted-server-text Stamp a supplier's record as reviewed on a date, today by default: you have checked the contact, the terms and the lead time are still true. This is the stamp supplier_due_review reads, so a reviewed record stops being flagged as stale. ``` ### `supplier_update` - The name "supplier_update" says "update": a word for a change. Description, as the server wrote it: ```untrusted-server-text Change any of a supplier's fields by SUP number or name: name, category, the contact fields, payment terms, lead time, notes. Only the fields you pass change; pass at least one. The SUP number and the review stamp are not writable here -- supplier_mark_reviewed does the stamp. ``` ## Only reads (3) Looks things up and changes nothing. Claude Code: allow. ### `license_status` - The name "license_status" says "status": a word for reading. Description, as the server wrote it: ```untrusted-server-text Report this endpoint's licence state for your token as JSON: the product, the tier free or pro, why it is not Pro, and the checkout URL. Call it to explain a free-tier refusal. No arguments, nothing changes. ``` ### `supplier_get` - The name "supplier_get" says "get": a word for reading. Description, as the server wrote it: ```untrusted-server-text Read one supplier record in full by SUP number or name: every contact field, the payment terms, the lead time, the notes, and when the record was last reviewed. Reads only. ``` ### `supplier_list` - The name "supplier_list" says "list": a word for reading. Description, as the server wrote it: ```untrusted-server-text List the supplier directory A to Z by name: contact, payment terms, lead time, when each record was last reviewed and how many days ago that was. Filter by category and by free text across every field. Reads only. ``` ## Claude Code permissions For `.claude/settings.json`, assuming the server is installed as `supplier-list`: ```json { "permissions": { "allow": [ "mcp__supplier-list__supplier_list", "mcp__supplier-list__supplier_get", "mcp__supplier-list__license_status" ], "ask": [ "mcp__supplier-list__supplier_add", "mcp__supplier-list__supplier_update", "mcp__supplier-list__supplier_mark_reviewed", "mcp__supplier-list__supplier_due_review", "mcp__supplier-list__supplier_export", "mcp__supplier-list__license_activate" ], "deny": [ "mcp__supplier-list__supplier_remove" ] } } ```