CustomCat MCP by usefulapi
io.usefulapi/customcatusefulapi.iostreamable-httpv1.0.0Scanned
Browse the CustomCat catalog, your products and designs; check shipping; create and cancel orders.
12 tools: 2 can delete or cancel things and 10 only read.
- Reads private data · 0
- Reads text others write · 12
- Can send data out · 0
- No findings
Anlyon alternative
2 of these tools change something. Run those as governed actions.
Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.
Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.
Import an OpenAPI spec →Tools
Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.
12 tools
Deletes or cancels 2Claude Code: deny
customcat_cancel_orderWRITE: cancel (delete) an order by YOUR order id.Reads text others writeNo findings
Why it is in this group
- The name "customcat_cancel_order" says "cancel": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it WRITE: cancel (delete) an order by YOUR order id. CustomCat can only cancel an order that has not gone into production; one already printed or shipped is refused. Needs the Write API key. Confirm with the user first. DELETE /order/{order_id}.
Annotations the server declares
- title: Cancel an order
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: true
customcat_create_orderWRITE: place an order for CustomCat to print and ship.Reads text others writeNo findings
Why it is in this group
- The name "customcat_create_order" says "create": a word for a change.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it WRITE: place an order for CustomCat to print and ship. This CHARGES the payment method on file in your CustomCat account (product cost + shipping; a front+back print adds $5 per line item) unless sandbox=true, which only validates the order. A real order (sandbox=false) also needs confirm=true, set only after the user confirmed it. The order id is yours and must be new (a duplicate is rejected). Needs the Write API key. Check stock with customcat_get_catalog_sku and the method name with customcat_list_shipping_methods first, and confirm the details with the user before calling. POST /order/{order_id}.
Annotations the server declares
- title: Place an order
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: false
- openWorldHint: true
Only reads 10Show 10 read-only tools
customcat_get_catalog_productOne catalog product by numeric id with its colors, sizes and SKUs.Reads text others writeNo findings
Why it is in this group
- The name "customcat_get_catalog_product" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it One catalog product by numeric id with its colors, sizes and SKUs. GET /catalog/{catalog_product_id}.
Annotations the server declares
- title: Get a catalog product
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
customcat_get_catalog_skuOne catalog SKU with its price and stock status.Reads text others writeNo findings
Why it is in this group
- The name "customcat_get_catalog_sku" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it One catalog SKU with its price and stock status. Use it before ordering: a SKU that is out of stock, discontinued or invalid makes the order fail. GET /catalog/sku/{catalog_sku_id}.
Annotations the server declares
- title: Get a catalog SKU
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
customcat_get_order_statusStatus of an order by YOUR order id: order status (Pending, Verified, Shipped), per-item production status, shipments with tracking ids, totals and the ship-to address.Reads text others writeNo findings
Why it is in this group
- The name "customcat_get_order_status" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Status of an order by YOUR order id: order status (Pending, Verified, Shipped), per-item production status, shipments with tracking ids, totals and the ship-to address. Set sandbox=true to look up a sandbox test order. GET /order/status/{order_id}.
Annotations the server declares
- title: Get order status
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
customcat_get_productOne of your CustomCat products by id (e.g.Reads text others writeNo findings
Why it is in this group
- The name "customcat_get_product" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it One of your CustomCat products by id (e.g. 22-2580581): variants, SKUs, cost, price, options, designs. GET /product/{product_id}.
Annotations the server declares
- title: Get one of your products
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
customcat_get_shipping_costCalculate the shipping cost of one shipping method for a destination and a list of catalog SKUs with quantities.Reads text others writeNo findings
Why it is in this group
- The name "customcat_get_shipping_cost" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Calculate the shipping cost of one shipping method for a destination and a list of catalog SKUs with quantities. Read-only quote: it places nothing. POST /shipping/{shipping_id} (shipping_id from customcat_list_shipping_methods).
Annotations the server declares
- title: Get the shipping cost
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
customcat_list_catalogBrowse the full CustomCat catalog of printable blank products (the items you can order with your own artwork).Reads text others writeNo findings
Why it is in this group
- The name "customcat_list_catalog" says "list": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe description's first sentence says "browse": it reads web pages, which anyone can write.
Description, as the server wrote it Browse the full CustomCat catalog of printable blank products (the items you can order with your own artwork). Filter by category and subcategory from customcat_list_catalog_categories. The reply carries the total in `total`. GET /catalog.
Annotations the server declares
- title: List the catalog
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
customcat_list_catalog_categoriesThe CustomCat catalog categories (Digisoft, Sublimation) and their subcategories (e.g.Reads text others writeNo findings
Why it is in this group
- The name "customcat_list_catalog_categories" says "list": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it The CustomCat catalog categories (Digisoft, Sublimation) and their subcategories (e.g. T-Shirts, Sweatshirts, Bags), to narrow customcat_list_catalog. GET /catalogcategory.
Annotations the server declares
- title: List catalog categories
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
customcat_list_designsList the designs uploaded to your CustomCat account: id, name, tags, image URLs, default product and last-updated time.Reads text others writeNo findings
Why it is in this group
- The name "customcat_list_designs" says "list": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it List the designs uploaded to your CustomCat account: id, name, tags, image URLs, default product and last-updated time. GET /design.
Annotations the server declares
- title: List your designs
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
customcat_list_productsList the products you set up in CustomCat (a design on one or more catalog items) with variants, SKUs, cost, price, stock flag and design images.Reads text others writeNo findings
Why it is in this group
- The name "customcat_list_products" says "list": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it List the products you set up in CustomCat (a design on one or more catalog items) with variants, SKUs, cost, price, stock flag and design images. Use the variant SKUs when placing an order for these products. GET /product.
Annotations the server declares
- title: List your products
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
customcat_list_shipping_methodsThe shipping methods CustomCat offers for a destination country (ids and names).Reads text others writeNo findings
Why it is in this group
- The name "customcat_list_shipping_methods" says "list": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it The shipping methods CustomCat offers for a destination country (ids and names). The method name is required when placing an order. GET /shipping.
Annotations the server declares
- title: List shipping methods
- readOnlyHint: true
- destructiveHint: false
- openWorldHint: true
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Exfil surface
Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.
No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data or outbound.
- Reads private data0
- Reads files, mail, messages, databases, secrets, calendars or repositories.
- Reads text others write12
- Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
- customcat_cancel_order
- customcat_create_order
- customcat_get_catalog_product
- customcat_get_catalog_sku
- customcat_get_order_status
- customcat_get_product
- customcat_get_shipping_cost
- customcat_list_catalog
- customcat_list_catalog_categories
- customcat_list_designs
- customcat_list_products
- customcat_list_shipping_methods
- Can send data out0
- Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.
Findings
Matches of fixed checks, with the text they matched.
No check matched anything in these tool definitions. That is not a safety guarantee.
History
Changes to its tool definitions and to its remote endpoint, newest first.
No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.
Install
Pinned to version 1.0.0. Values in angle brackets are yours to fill in.
claude mcp add --transport http customcat https://customcat.usefulapi.io/mcpclaude mcp add --transport http customcat https://customcat.usefulapi.io/mcpRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__customcat__customcat_list_products",
"mcp__customcat__customcat_get_product",
"mcp__customcat__customcat_list_designs",
"mcp__customcat__customcat_list_catalog_categories",
"mcp__customcat__customcat_list_catalog",
"mcp__customcat__customcat_get_catalog_product",
"mcp__customcat__customcat_get_catalog_sku",
"mcp__customcat__customcat_list_shipping_methods",
"mcp__customcat__customcat_get_shipping_cost",
"mcp__customcat__customcat_get_order_status"
],
"ask": [],
"deny": [
"mcp__customcat__customcat_create_order",
"mcp__customcat__customcat_cancel_order"
]
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as customcat. Review it before you use it.
Capability tags behind 12 rules
- mcp__customcat__customcat_list_products untrusted-input
- mcp__customcat__customcat_get_product untrusted-input
- mcp__customcat__customcat_list_designs untrusted-input
- mcp__customcat__customcat_list_catalog_categories untrusted-input
- mcp__customcat__customcat_list_catalog untrusted-input
- mcp__customcat__customcat_get_catalog_product untrusted-input
- mcp__customcat__customcat_get_catalog_sku untrusted-input
- mcp__customcat__customcat_list_shipping_methods untrusted-input
- mcp__customcat__customcat_get_shipping_cost untrusted-input
- mcp__customcat__customcat_get_order_status untrusted-input
- mcp__customcat__customcat_create_order untrusted-input
- mcp__customcat__customcat_cancel_order untrusted-input
Pin
Keep the decision: fail CI when the tools change, follow every change, or show a badge.
Pin in CI
Fail a build when the tools you reviewed are not the tools the server serves today.
curl -s "https://anlyon.dev/api/v1/servers/io.usefulapi/customcat/verify?hash=c52eadc41b484cf3deb5cc843cdc97e02f7190bced7afc91b0a3bda5053f9f17" | jq -e '.changed == false'Pinned hash c52eadc41b48, from Oct 24, 2026, 13:19 UTC.
Watch
Get told when its tools change: a new tool, a new description, a new class.
https://anlyon.dev/servers/io.usefulapi/customcat/changes.xmlAn Atom feed. Works in any feed reader or Slack's RSS app.
Badge
[](https://anlyon.dev/servers/io.usefulapi/customcat)Source: MCP Registry · repository. Synced Oct 24, 2026, 13:17 UTC.