Skip to content

MyDesigns

io.mydesigns/mcpmydesigns.iostreamable-httpv1.0.0Scanned

Turn designs into print-on-demand products and sell them in your MyDesigns store.

34 tools: 7 can delete or cancel things, 1 do something that can't be undone, 13 change things and 13 only read.

Tools: 7 delete, 1 irreversible, 13 write, 13 read.
  • Reads private data · 5
  • Reads text others write · 8
  • Can send data out · 1
  • 1 finding

Anlyon alternative

21 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

34 tools

Deletes or cancels 7Claude Code: deny
  • create_store_imagesMake images for one of the seller's stores with Dream AI and put them on it: the logo, the banner across the top of the home page, a separate banner for phones, and the favicon (th…No findings

    Why it is in this group

    • The name "create_store_images" says "create": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Make images for one of the seller's stores with Dream AI and put them on it: the logo, the banner across the top of the home page, a separate banner for phones, and the favicon (the small icon in the browser tab). MyDesigns picks the model, shape and size each image needs and puts it on the store straight away, in place of the one there; the images are not saved in the seller's designs. A favicon given no prompt is made from the logo in the same call, at no extra cost. It costs AI credits: 1.5 for a logo or a favicon, 3 for a banner or a phone banner. Before calling, tell the seller the cost and which of their current images it replaces, and wait for their yes. When they do not like one image, call again with only that one. Images you make with your own image tool stay in this chat and cannot be put on the store: use this instead. Make one call at a time for a store, never several at once. For the seller's own image, use upload_store_image; to take an image off, use update_store. An image with an error in the result was not set: tell the seller.

    Annotations the server declares

    • title: Create store images
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
    • readOnlyHint: false
  • delete_design_from_cardMove one design to the seller's trash.No findings

    Why it is in this group

    • The name "delete_design_from_card" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Move one design to the seller's trash. The designs card calls this when the seller deletes a design from it.

    Annotations the server declares

    • title: Delete design from card
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: false
  • delete_designsMove designs the seller does not want to their MyDesigns trash, by the designIds create_designs, deep search or an upload gave.No findings

    Why it is in this group

    • The name "delete_designs" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Move designs the seller does not want to their MyDesigns trash, by the designIds create_designs, deep search or an upload gave. Use it only when the seller asked to delete them; when it is not clear which ones they mean, ask. They can restore them from the trash in the MyDesigns app for a while. The AI credits the designs cost are not given back. Never use a deleted designId again, for create_products or anything else.

    Annotations the server declares

    • title: Delete designs
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: false
  • remove_store_domainDisconnect a domain from its store; the seller keeps owning it.Reads text others writeNo findings

    Why it is in this group

    • The name "remove_store_domain" says "remove": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Disconnect a domain from its store; the seller keeps owning it. If it was the main link, the store's MyDesigns link takes over. Ask the seller before removing one.

    Annotations the server declares

    • title: Remove store domain
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: false
  • save_store_imagePuts one file from the store image upload card on the store.No findings

    Why it is in this group

    • The name "save_store_image" says "save": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Puts one file from the store image upload card on the store. The card calls this.

    Annotations the server declares

    • title: Save store image
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
    • readOnlyHint: false
  • update_seller_infoChange the seller info of one of the seller's stores: who sells there (a person or a business), their legal address and how to reach them.No findings

    Why it is in this group

    • The name "update_seller_info" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Change the seller info of one of the seller's stores: who sells there (a person or a business), their legal address and how to reach them. The store's legal pages show it, so fill it only with what the seller tells you: never guess or make up a name, address or tax number. Only the values given change, but the store keeps seller info only when it is complete, as the app does: when list_stores shows some missing, ask the seller for all of it first, then make one call.

    Annotations the server declares

    • title: Update seller info
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: false
  • update_storeChange a store's name, description, accent color, banner text, the logo's size and whether the store name shows next to it in the header, or its About page: the about text, the con…No findings

    Why it is in this group

    • The name "update_store" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Change a store's name, description, accent color, banner text, the logo's size and whether the store name shows next to it in the header, or its About page: the about text, the contact email, phone and address, and links to its social media. Only the values given change; everything else stays as it is; images are made with create_store_images or uploaded with upload_store_image, and the seller info is changed with update_seller_info. To remove a value or an image and go back to the store's default, name it in clear. payoutAccountId puts the store on one of the seller's payout accounts from list_stores: ask the seller first, naming the account by the stores already on it.

    Annotations the server declares

    • title: Update store
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: false
Can't be undone 1Claude Code: ask
  • publish_productsPut products into one of the seller's MyDesigns stores, where buyers can see and order them.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "publish_products" says "publish": a word for a change that another call does not undo.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "publish_products" says "publish": it sends or publishes something to other people.
    Description, as the server wrote it
    Put products into one of the seller's MyDesigns stores, where buyers can see and order them. Give either the jobId a create_products call returned, once get_product_status says READY (or FAILED, which publishes the ones that were made), or the productIds of products from list_products that are not in a store yet, e.g. ones made in an earlier chat. Products already in a store cannot be published again. Ask the seller which store when they have more than one; never pick one for them. The products then go into the store in the background over a few minutes: check with get_product_status and the jobIds returned here, and tell the seller when they are live.

    Annotations the server declares

    • title: Publish products
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
    • readOnlyHint: false
Changes things 13Claude Code: ask
  • add_store_domainConnect a domain the seller already owns to a store; it does not buy one.Reads text others writeNo findings

    Why it is in this group

    • The name "add_store_domain" says "add": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Connect a domain the seller already owns to a store; it does not buy one. A root domain (example.com) also adds its www version. Needs a paid plan. The result lists the store's domains with the DNS record to add for each: give the seller those exact values to add where they bought the domain. A domain usually goes live a few minutes to a few hours after the record is added; check it then with check_store_domain.

    Annotations the server declares

    • title: Add store domain
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
    • readOnlyHint: false
  • check_store_domainCheck again whether a domain is live, after the seller added its DNS record.Reads text others writeNo findings

    Why it is in this group

    • The name "check_store_domain" says "store": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Check again whether a domain is live, after the seller added its DNS record. While it is not live, the result repeats the record to add and any problem found with it.

    Annotations the server declares

    • title: Check store domain
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
    • readOnlyHint: false
  • create_designsCreate designs, the app's Dream AI: make 1 to 10 designs for the seller with AI, one per prompt, and save them in their MyDesigns designs.Reads text others writeNo findings

    Why it is in this group

    • The name "create_designs" says "create": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Create designs, the app's Dream AI: make 1 to 10 designs for the seller with AI, one per prompt, and save them in their MyDesigns designs. No product is made. When the seller asks for Dream AI or the dreamer, or to dream designs, use this tool. Use it too when the seller wants designs only, or wants to see the designs before choosing products; when they want products, create_products makes the designs and the products in one call. Plan exactly as many designs as the seller asked for, each with its own idea; for more than 10, call again with the rest. The designs are generated together, about 1.5 AI credits each on the default model (other models cost more or less), and take up to a minute or two. Before designs the seller did not clearly ask for (redos, more versions, a vague "make them pop"), tell them they cost credits and wait for a yes. A design that could not be made is listed with the reason and the others are still made. A card shows the seller the designs, so do not put the images in your reply. To make products from them later, give create_products their designIds, never their prompts again: a prompt makes a new design and costs credits again.

    Annotations the server declares

    • title: Create designs (Dream AI)
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
    • readOnlyHint: false
  • create_folderMake a design folder, at the top level or inside another folder.No findings

    Why it is in this group

    • The name "create_folder" says "create": a word for a change.
    Description, as the server wrote it
    Make a design folder, at the top level or inside another folder. Names must differ from the other folders in the same place; check list_folders first to reuse one that already exists. Then pass its id as folderId to create_products, create_designs or deep_search_designs.

    Annotations the server declares

    • title: Create folder
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
    • readOnlyHint: false
  • create_productsCreate 1 to 10 print-on-demand products for the seller, one per design: generate each design from a prompt with AI (or use an existing design), then make them into products with on…Reads text others writeNo findings

    Why it is in this group

    • The name "create_products" says "create": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Create 1 to 10 print-on-demand products for the seller, one per design: generate each design from a prompt with AI (or use an existing design), then make them into products with one of the seller's product profiles, which sets the products, colors, sizes, prices and mockups. Find the profile with list_profiles first: when the seller named a product (a tee, a Gildan 5000, a mug), search for it and use a profile only if it clearly fits. When the seller named no product, or nothing fits, show them a few profiles and ask which to use; never pick one for them. Plan exactly as many products as the seller asked for, each with its own design idea, and count them before calling; for more than 10, call again with the rest. The designs are generated together, about 1.5 AI credits each (a reused designId costs none), and take up to a minute or two. Before new designs the seller did not clearly ask for (redos, more versions, a vague "make them pop"), tell them they cost credits and wait for a yes. A design that could not be made is listed with the reason and the others still go ahead. The products are saved together in the seller's MyDesigns products, not put in any store; they are not drafts. They are then made in the background over a few minutes: check them with get_product_status and the one jobId returned here, and tell the seller when they are ready. Show the seller the design images.

    Annotations the server declares

    • title: Create products
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
    • readOnlyHint: false
  • create_storeOpen a new MyDesigns store for the seller.No findings

    Why it is in this group

    • The name "create_store" says "create": a word for a change.
    Description, as the server wrote it
    Open a new MyDesigns store for the seller. It is live at its link right away but empty: put products in it with publish_products. It can take orders only once it is on a payout account. Check list_stores first: the plan limits how many stores a seller can have, and when the seller has a payout account that is ready, ask whether to use it for this store, naming it by the stores already on it, and on their yes pass it as payoutAccountId; with none ready, the seller sets up payouts in the MyDesigns app. Before calling, tell the seller the name and the web link you will use and wait for their yes: the link cannot be changed later.

    Annotations the server declares

    • title: Create store
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
    • readOnlyHint: false
  • deep_search_designsDeep search, the app's Scout AI: MyDesigns researches what really sells for one or more niches on Amazon right now and makes designs from each, each with a title, description and t…Reads private dataReads text others write1 finding

    Why it is in this group

    • The name "deep_search_designs" says "search": a word for reading.
    • The server marks it as not read-only (readOnlyHint: false).

    What it can reach

    • private-dataThe input names a folder (input.folderId), and the tool reads: it reads files.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "deep_search_designs" as not read-only (readOnlyHint: false), and its words say it reads.

      Matched text

      annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":true}; The name "deep_search_designs" says "search": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Deep search, the app's Scout AI: MyDesigns researches what really sells for one or more niches on Amazon right now and makes designs from each, each with a title, description and tags. It is heavy research that takes a few minutes, so do your own research and use create_products by default; offer deep search only when the seller wants to know what sells or wants ideas from real sales data, tell them it uses up to 1.5 AI credits per design, and start it only after they agree. Needs a Pro plan or higher; one deep search runs at a time, so put every search term in one call, one per line: they run as one job, like the Scout AI page. Then check it with get_deep_search_results and the jobId returned here, show the seller the designs, and make products from the ones they pick with create_products and their designIds.

    Annotations the server declares

    • title: Deep search designs
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
    • readOnlyHint: false
  • move_designsMove designs into another of the seller's folders, by the ids list_designs gives, up to 100 at a time.No findings

    Why it is in this group

    • The name "move_designs" says "move": a word for a change.
    Description, as the server wrote it
    Move designs into another of the seller's folders, by the ids list_designs gives, up to 100 at a time. Before moving more than a few, show the seller which go where and wait for their yes. Each folder is set up with its own image slots and fields, and designs move only between folders set up the same way; the result says which could not move and why. Those the seller moves in the MyDesigns app, where they choose where each image and field goes.

    Annotations the server declares

    • title: Move designs
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: false
  • product_creation_progressHow far a product job has got.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    How far a product job has got. The product card calls this while it is open.

    Annotations the server declares

    • title: Product creation progress
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
  • save_uploaded_designSaves one file from the upload card as a design.No findings

    Why it is in this group

    • The name "save_uploaded_design" says "save": a word for a change.
    Description, as the server wrote it
    Saves one file from the upload card as a design. The card calls this.

    Annotations the server declares

    • title: Save uploaded design
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
    • readOnlyHint: false
  • set_store_main_domainChoose the store's main link: one of its domains, or with no domainId its own MyDesigns link.No findings

    Why it is in this group

    • The name "set_store_main_domain" says "set": a word for a change.
    Description, as the server wrote it
    Choose the store's main link: one of its domains, or with no domainId its own MyDesigns link. Its other links send buyers to the main one. Choose a domain only once it is live.

    Annotations the server declares

    • title: Set store main domain
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: false
  • upload_designsOpen a card where the seller uploads their own images (PNG or JPEG, up to 20 MB each) as designs.No findings

    Why it is in this group

    • The name "upload_designs" says "upload": a word for a change.
    Description, as the server wrote it
    Open a card where the seller uploads their own images (PNG or JPEG, up to 20 MB each) as designs. Use it when the seller wants products from art they already have: you cannot take an image from the chat, and never write a prompt to recreate one. The card saves the files and then gives you their designIds, which create_products takes instead of a prompt, at no credit cost. Uploading costs nothing.

    Annotations the server declares

    • title: Upload designs
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
    • readOnlyHint: false
  • upload_store_imageOpen a card where the seller uploads their own images for one of their stores: the logo, the banner across the top of the home page, a separate banner for phones, or the favicon (t…No findings

    Why it is in this group

    • The name "upload_store_image" says "upload": a word for a change.
    Description, as the server wrote it
    Open a card where the seller uploads their own images for one of their stores: the logo, the banner across the top of the home page, a separate banner for phones, or the favicon (the small icon in the browser tab). Use it when the seller already has the image: you cannot take an image from the chat. The card resizes each file and puts it on the store straight away, in place of the one there; it is not saved in the seller's designs. Free. Nothing comes back to you: when the seller says they are done, the images are on the store.

    Annotations the server declares

    • title: Upload store images
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
    • readOnlyHint: false
Only reads 13Show 13 read-only tools
  • get_accountGet the signed-in MyDesigns account: its id, name, email, subscription plan code (TIER_0 is the free plan) and the subscription that plan comes from: where it is billed (STRIPE, SH…Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "get_account" says "get": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "get" and "email": it reads mail.
    • untrusted-inputThe description's first sentence says "get" and "email": it reads inbound email, which other people can write.
    Description, as the server wrote it
    Get the signed-in MyDesigns account: its id, name, email, subscription plan code (TIER_0 is the free plan) and the subscription that plan comes from: where it is billed (STRIPE, SHOPIFY, PKS, or NONE for the free plan), the plan type (STARTER, PRO, PRO_PLUS), the plan name, status, frequency (MONTHLY, YEARLY, LIFETIME), list price, when it renews or ends, any coupon, and for Stripe the amount the last invoice actually charged after discounts. Fields a billing source does not have are null. aiCredits is how many AI credits the seller has left; new designs spend them.

    Annotations the server declares

    • title: Get account
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
  • get_deep_search_resultsThe designs a deep_search_designs run has made, by its jobId.No findings

    Why it is in this group

    • The name "get_deep_search_results" says "get": a word for reading.
    Description, as the server wrote it
    The designs a deep_search_designs run has made, by its jobId. RUNNING: still researching or designing, which usually takes a few minutes; the designs so far are listed; check again later, not over and over. DONE: all made. A card shows the seller each design's image and title, so do not put the images in your reply. The titles are long, search-friendly ones: shorten them for create_products if the seller wants. A design on trademarkHold has text a trademark check flagged; tell the seller before they sell it. Problems say why a niche found nothing or a design was skipped. NOT_FOUND: no deep search by that id for this seller.

    Annotations the server declares

    • title: Get deep search results
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
  • get_orderGet one MyDesigns order by its id: the seller and their shop, the payment method, the billing address, every print partner with its own fulfillment status, created date and trackin…No findings

    Why it is in this group

    • The name "get_order" says "get": a word for reading.
    Description, as the server wrote it
    Get one MyDesigns order by its id: the seller and their shop, the payment method, the billing address, every print partner with its own fulfillment status, created date and tracking, and every line with its partner, SKUs, print areas and manufacturing cost. One order can hold several fulfillments at the same partner, so a partner name is not unique. An admin token reaches any order; any other token reaches only that seller's own orders. userId, userEmail, providerCode and isPrintify are for support staff: when talking to the seller, name the marketplace in words (MyDesigns Store, Etsy) and leave those out.

    Annotations the server declares

    • title: Get order
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
  • get_product_statusCheck whether products started with create_products are made yet, or products sent with publish_products are in the store yet, by the jobId each call returned.No findings

    Why it is in this group

    • The name "get_product_status" says "get": a word for reading.
    Description, as the server wrote it
    Check whether products started with create_products are made yet, or products sent with publish_products are in the store yet, by the jobId each call returned. CREATING: still being made or published, which usually takes a few minutes; check again later, not over and over. READY: all made (or all in the store). FAILED: done, but some or all were not made; the failed list gives each one's designId and the reason, and the design is kept, so it can be tried again with that designId. NOT_FOUND: no such product job for this seller, or one started only seconds ago.

    Annotations the server declares

    • title: Get product status
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
  • get_store_statsGet a store's real performance over the last N days: orders, items sold, revenue, profit and fees in USD, visits, and its top products, each compared with the N days before.No findings

    Why it is in this group

    • The name "get_store_stats" says "get": a word for reading.
    Description, as the server wrote it
    Get a store's real performance over the last N days: orders, items sold, revenue, profit and fees in USD, visits, and its top products, each compared with the N days before. Fees are everything the sales cost the seller: making and shipping the products plus marketplace fees, so call them costs, not fees alone. Top products are ranked by net sales, then by page views; only products with tracked page views are listed, so one that sold without a tracked view is missing from the list. The numbers come from daily rollups, so today's activity can be missing.

    Annotations the server declares

    • title: Get store stats
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
  • list_designsList the seller's designs with their folder, title, tags and picture, folder by folder in the order list_folders gives, about 50 at a time.Reads private dataNo findings

    Why it is in this group

    • The name "list_designs" says "list": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "list" and "folder": it reads files.
    • private-dataThe input names a folder (input.folderId), and the tool reads: it reads files.
    Description, as the server wrote it
    List the seller's designs with their folder, title, tags and picture, folder by folder in the order list_folders gives, about 50 at a time. Give folderId for one folder, and search to find designs by title, tags or file name. When nextCursor is set there are more: call again with it and the same folderId and search. A cursor counts designs by place, so after moving or deleting designs it would skip some: start again without it.

    Annotations the server declares

    • title: List designs
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
  • list_foldersList the seller's design folders with how many designs each holds.Reads private dataNo findings

    Why it is in this group

    • The name "list_folders" says "list": a word for reading.

    What it can reach

    • private-dataThe name "list_folders" says "list" and "folder": it reads files.
    • private-dataThe description's first sentence says "list" and "folder": it reads files.
    Description, as the server wrote it
    List the seller's design folders with how many designs each holds. parentId is the folder it sits in, null for a top-level one. New designs go in the first top-level folder unless create_products, create_designs or deep_search_designs is given a folderId.

    Annotations the server declares

    • title: List folders
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
  • list_ordersList the seller's orders, newest first, 16 per page: order id, date, status, which shop or store it came from, the buyer's name, the total in USD and the items.No findings

    Why it is in this group

    • The name "list_orders" says "list": a word for reading.
    Description, as the server wrote it
    List the seller's orders, newest first, 16 per page: order id, date, status, which shop or store it came from, the buyer's name, the total in USD and the items. Use it for the seller's latest orders or to find an order's id; get_order gives one order in full.

    Annotations the server declares

    • title: List orders
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
  • list_product_typesSearch the MyDesigns print-on-demand catalog: the blank products a design can be printed on (t-shirts, mugs, ...), with brand, product code, price range, number of variants and the…No findings

    Why it is in this group

    • The name "list_product_types" says "list": a word for reading.
    Description, as the server wrote it
    Search the MyDesigns print-on-demand catalog: the blank products a design can be printed on (t-shirts, mugs, ...), with brand, product code, price range, number of variants and the print partners that make it. 24 per page. This is the catalog, not what the seller can make today: a product is made only from a profile, so use list_profiles for that.

    Annotations the server declares

    • title: List product types
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
  • list_productsList the seller's products, newest first, 24 per page: title, the blanks it is made on, when it was made, where it is (the store or shop it is in, or none when it is not in a store…No findings

    Why it is in this group

    • The name "list_products" says "list": a word for reading.
    Description, as the server wrote it
    List the seller's products, newest first, 24 per page: title, the blanks it is made on, when it was made, where it is (the store or shop it is in, or none when it is not in a store yet), price range, public link, status, how many items have been ordered, and the designId it is made from, which create_products can reuse at no credit cost. Leave storeId out to see every product, for questions like "did my last products go live" or "what is not in a store yet".

    Annotations the server declares

    • title: List products
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
  • list_profilesList the product profiles a product can be made from.No findings

    Why it is in this group

    • The name "list_profiles" says "list": a word for reading.
    Description, as the server wrote it
    List the product profiles a product can be made from. A profile is a saved set of products (t-shirt, mug, ...) with their print partner, colors, sizes, prices and mockups, so a design becomes a product without choosing each of those. Shows the seller's own profiles, or MyDesigns' public ones. Each has its products with colors, sizes and price range. These are the only products the seller can make: when neither their own nor the public profiles have one, it cannot be made. 24 per page.

    Annotations the server declares

    • title: List product profiles
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
  • list_store_domainsList a store's own domains (like shop.example.com): whether each is live, which one is the main link buyers land on, and for each one not live yet the DNS record the seller must ad…No findings

    Why it is in this group

    • The name "list_store_domains" says "list": a word for reading.
    Description, as the server wrote it
    List a store's own domains (like shop.example.com): whether each is live, which one is the main link buyers land on, and for each one not live yet the DNS record the seller must add where they bought the domain. A store has up to 3 domains.

    Annotations the server declares

    • title: List store domains
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true
  • list_storesList the signed-in seller's MyDesigns stores with their public link, whether they can take orders yet (payouts connected), how many more stores the plan allows, and each store's ab…Reads private dataNo findings

    Why it is in this group

    • The name "list_stores" says "list": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "list" and "contact": it reads contacts.
    Description, as the server wrote it
    List the signed-in seller's MyDesigns stores with their public link, whether they can take orders yet (payouts connected), how many more stores the plan allows, and each store's about and contact details and seller info, with the seller info still missing. payoutAccounts are the seller's payout accounts, with the stores already on each, that a store can be put on with create_store or update_store.

    Annotations the server declares

    • title: List stores
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
    • readOnlyHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

40 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 1 outbound tool breaks every one.

Reads private data5
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write8
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out1
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
deny to break every path
{
  "permissions": {
    "deny": [
      "mcp__mydesigns__publish_products"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

1 warn
  • The server marks "deep_search_designs" as not read-only (readOnlyHint: false), and its words say it reads.

    Matched text

    annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":false,"openWorldHint":true}; The name "deep_search_designs" says "search": a word for reading.

    What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http mydesigns https://mcp.mydesigns.io/mcp
claude mcp add --transport http mydesigns https://mcp.mydesigns.io/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__mydesigns__get_store_stats",
      "mcp__mydesigns__list_store_domains",
      "mcp__mydesigns__list_stores",
      "mcp__mydesigns__get_deep_search_results",
      "mcp__mydesigns__get_product_status",
      "mcp__mydesigns__list_products",
      "mcp__mydesigns__list_product_types",
      "mcp__mydesigns__list_orders",
      "mcp__mydesigns__get_order",
      "mcp__mydesigns__list_profiles",
      "mcp__mydesigns__get_account",
      "mcp__mydesigns__list_designs",
      "mcp__mydesigns__list_folders"
    ],
    "ask": [
      "mcp__mydesigns__add_store_domain",
      "mcp__mydesigns__check_store_domain",
      "mcp__mydesigns__set_store_main_domain",
      "mcp__mydesigns__upload_store_image",
      "mcp__mydesigns__create_store",
      "mcp__mydesigns__deep_search_designs",
      "mcp__mydesigns__create_products",
      "mcp__mydesigns__publish_products",
      "mcp__mydesigns__product_creation_progress",
      "mcp__mydesigns__move_designs",
      "mcp__mydesigns__create_designs",
      "mcp__mydesigns__upload_designs",
      "mcp__mydesigns__save_uploaded_design",
      "mcp__mydesigns__create_folder"
    ],
    "deny": [
      "mcp__mydesigns__remove_store_domain",
      "mcp__mydesigns__save_store_image",
      "mcp__mydesigns__update_store",
      "mcp__mydesigns__update_seller_info",
      "mcp__mydesigns__create_store_images",
      "mcp__mydesigns__delete_design_from_card",
      "mcp__mydesigns__delete_designs"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as mydesigns. Review it before you use it.

Capability tags behind 11 rules
  • mcp__mydesigns__add_store_domain untrusted-input
  • mcp__mydesigns__check_store_domain untrusted-input
  • mcp__mydesigns__remove_store_domain untrusted-input
  • mcp__mydesigns__list_stores private-data
  • mcp__mydesigns__deep_search_designs private-data, untrusted-input
  • mcp__mydesigns__create_products untrusted-input
  • mcp__mydesigns__publish_products untrusted-input, outbound
  • mcp__mydesigns__get_account private-data, untrusted-input
  • mcp__mydesigns__list_designs private-data
  • mcp__mydesigns__create_designs untrusted-input
  • mcp__mydesigns__list_folders private-data

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/io.mydesigns/mcp/verify?hash=9f34ac4d552a446d194a347f90d276bda96012c710164775be1aa118d1eb3722" | jq -e '.changed == false'

Pinned hash 9f34ac4d552a, from Nov 4, 2026, 12:18 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/io.mydesigns/mcp/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for io.mydesigns/mcp
[![anlyon.dev](https://anlyon.dev/badge/io.mydesigns/mcp.svg)](https://anlyon.dev/servers/io.mydesigns/mcp)

Source: MCP Registry. Synced Nov 4, 2026, 12:18 UTC.