Skip to content
anlyon.devby Anlyon

vintrace MCP by usefulapi

io.usefulapi/vintraceusefulapi.iostreamable-httpv1.0.0Scanned

Read vintrace vessels, batches, work orders, lab results, stock; assign work orders, add notes.

34 tools: 2 can delete or cancel things, 3 change things and 29 only read.

Tools: 2 delete, 0 irreversible, 3 write, 29 read.
  • Reads private data · 3
  • Reads text others write · 34
  • Can send data out · 0
  • 2 findings

Anlyon alternative

5 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →
Compare with similar serversMarkdownJSONReport this listing

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

34 tools

Deletes or cancels 2Claude Code: deny
  • vintrace_assign_work_orderWRITE: assigns a work order to the token's own vintrace user (or to assign_operator_id), so it shows up in that operator's list.Reads text others writeNo findings

    Why it is in this group

    • The name "vintrace_assign_work_order" says "assign": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    WRITE: assigns a work order to the token's own vintrace user (or to assign_operator_id), so it shows up in that operator's list. With reassign=true it takes over a work order already assigned to someone else. Check the work order first with vintrace_get_work_order. POST /v6/workorders/assign.

    Annotations the server declares

    • title: Assign a work order
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
  • vintrace_deactivate_bookingWRITE: deactivates a fruit booking so it no longer counts as an active booking (the record is kept; it is not deleted).Reads text others writeNo findings

    Why it is in this group

    • The description's first verb is "write": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    WRITE: deactivates a fruit booking so it no longer counts as an active booking (the record is kept; it is not deleted). Use vintrace_list_bookings to find the booking id first. POST /v7/operation/bookings/{id}/deactivation.

    Annotations the server declares

    • title: Deactivate a fruit booking
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: true
Changes things 3Claude Code: ask
  • vintrace_add_stock_item_noteWRITE: adds a new note to a vintrace stock item (visible to everyone in the winery, recorded under the token's user).Reads text others writeNo findings

    Why it is in this group

    • The name "vintrace_add_stock_item_note" says "add": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    WRITE: adds a new note to a vintrace stock item (visible to everyone in the winery, recorded under the token's user). Adding the same note twice creates two notes. POST /v6/mrp/stock/{id}/notes.

    Annotations the server declares

    • title: Add a note to a stock item
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • vintrace_get_sales_orderOne sales order by id, or by order code (for example VSO20): customer, items, prices, taxes and status.Reads text others write1 finding

    Why it is in this group

    • The name "vintrace_get_sales_order" says "get": a word for reading.
    • The input takes a statement or command to run (input.code), which can change anything it can reach.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "vintrace_get_sales_order" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":true}; The name "vintrace_get_sales_order" says "get": a word for reading.

      What this check looks for
    Description, as the server wrote it
    One sales order by id, or by order code (for example VSO20): customer, items, prices, taxes and status. Give exactly one. GET /v6/sales-order/{id} or /v6/sales-order?code=.

    Annotations the server declares

    • title: Get sales order
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • vintrace_lookup_stock_itemFind one stock item by code (matched against the start of the code) or by id: type, unit, owner, accounts, tax class and sub-components.Reads text others write1 finding

    Why it is in this group

    • The name "vintrace_lookup_stock_item" says "lookup": a word for reading.
    • The input takes a statement or command to run (input.code), which can change anything it can reach.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "vintrace_lookup_stock_item" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":true}; The name "vintrace_lookup_stock_item" says "lookup": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Find one stock item by code (matched against the start of the code) or by id: type, unit, owner, accounts, tax class and sub-components. Give code or id. GET /v6/stock/lookup.

    Annotations the server declares

    • title: Look up stock item
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
Only reads 29Show 29 read-only tools
  • vintrace_get_partyOne party (customer, grower, supplier, owner) by id, or by exact name.Reads text others writeNo findings

    Why it is in this group

    • The name "vintrace_get_party" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    One party (customer, grower, supplier, owner) by id, or by exact name. Give exactly one. GET /v6/party/{id} or /v6/party?name=.

    Annotations the server declares

    • title: Get party
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • vintrace_get_productOne wine product by id (or by vessel barcode) with its vessel, volume and metrics.Reads text others writeNo findings

    Why it is in this group

    • The name "vintrace_get_product" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    One wine product by id (or by vessel barcode) with its vessel, volume and metrics. GET /v6/products/{id}.

    Annotations the server declares

    • title: Get product
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • vintrace_get_purchase_orderOne purchase order with its lines, state and fulfilment.Reads text others writeNo findings

    Why it is in this group

    • The name "vintrace_get_purchase_order" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    One purchase order with its lines, state and fulfilment. GET /v7/account/purchase-orders/{id}.

    Annotations the server declares

    • title: Get purchase order
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • vintrace_get_stock_itemOne stock item by id with optional detail parts: expand=fields,distributions,notes,historyItems,rawComponents,bulkInfo.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "vintrace_get_stock_item" says "get": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "note": it reads notes.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    One stock item by id with optional detail parts: expand=fields,distributions,notes,historyItems,rawComponents,bulkInfo. GET /v6/mrp/stock/{id}.

    Annotations the server declares

    • title: Get stock item details
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • vintrace_get_vesselOne vessel by id: a tank, barrel, barrel group, tanker or bin, with its details, dimensions and contents.Reads text others writeNo findings

    Why it is in this group

    • The name "vintrace_get_vessel" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    One vessel by id: a tank, barrel, barrel group, tanker or bin, with its details, dimensions and contents. GET /v7/vessel/<tanks|barrels|barrel-groups|tankers|bins>/{id}.

    Annotations the server declares

    • title: Get vessel
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • vintrace_get_vessel_details_reportThe bulk wine report: every vessel (tank, barrel, bin, press, tanker) with its contents, volume, batch, owner and winery as at a date.Reads text others writeNo findings

    Why it is in this group

    • The name "vintrace_get_vessel_details_report" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    The bulk wine report: every vessel (tank, barrel, bin, press, tanker) with its contents, volume, batch, owner and winery as at a date. Use extra_fields=composition,allocations,liveMetrics to add them. Covers every winery the token's user may access unless wineryId/wineryName narrows it. GET /v7/report/vessel-details-report.

    Annotations the server declares

    • title: Vessel contents report
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • vintrace_get_work_orderOne work order by id: every job with its steps, summary text, status and assignee.Reads text others writeNo findings

    Why it is in this group

    • The name "vintrace_get_work_order" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    One work order by id: every job with its steps, summary text, status and assignee. Find the id with vintrace_list_work_orders or vintrace_list_work_orders_v6. GET /v6/workorders/{id}.

    Annotations the server declares

    • title: Get work order
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • vintrace_list_barrel_treatmentsBarrel move shipments / barrel treatments recorded in vintrace, with barrel states and treatment types.Reads text others writeNo findings

    Why it is in this group

    • The name "vintrace_list_barrel_treatments" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Barrel move shipments / barrel treatments recorded in vintrace, with barrel states and treatment types. Reply: results plus next_offset. GET /v7/operation/barrel-treatments.

    Annotations the server declares

    • title: List barrel treatments
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • vintrace_list_block_assessmentsList vineyard block assessments (vine and fruit assessments by the viticulture team).Reads text others writeNo findings

    Why it is in this group

    • The name "vintrace_list_block_assessments" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    List vineyard block assessments (vine and fruit assessments by the viticulture team). Reply: results plus next_offset. GET /v7/harvest/assessments.

    Annotations the server declares

    • title: List block assessments
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • vintrace_list_blocksList vineyard blocks (grower, vineyard, region, variety).Reads text others writeNo findings

    Why it is in this group

    • The name "vintrace_list_blocks" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    List vineyard blocks (grower, vineyard, region, variety). To see fruit placements for a vintage pass include=fruitPlacements together with vintage. Reply: results plus next_offset. GET /v7/harvest/blocks.

    Annotations the server declares

    • title: List vineyard blocks
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • vintrace_list_bookingsList active fruit bookings (grape deliveries planned for a vintage) for one or more wineries: grower, block, variety, expected pick time and quantity.Reads text others writeNo findings

    Why it is in this group

    • The name "vintrace_list_bookings" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    List active fruit bookings (grape deliveries planned for a vintage) for one or more wineries: grower, block, variety, expected pick time and quantity. vintage and winery_ids are required. Reply: results plus next_offset. GET /v7/operation/bookings.

    Annotations the server declares

    • title: List fruit bookings
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • vintrace_list_brand_allocationsList brand allocations of bulk wine (how much of a wine is promised to which brand), by status and vintage.Reads text others writeNo findings

    Why it is in this group

    • The name "vintrace_list_brand_allocations" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    List brand allocations of bulk wine (how much of a wine is promised to which brand), by status and vintage. Reply: results plus next_offset. GET /v7/allocations/brand-allocations.

    Annotations the server declares

    • title: List brand allocations
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • vintrace_list_bulk_intakesList bulk wine/juice intakes (wine bought or received in bulk) with batch, volume, owner and cost.Reads text others writeNo findings

    Why it is in this group

    • The name "vintrace_list_bulk_intakes" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    List bulk wine/juice intakes (wine bought or received in bulk) with batch, volume, owner and cost. Reply: results plus next_offset. GET /v7/operation/bulk-intakes.

    Annotations the server declares

    • title: List bulk intakes
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • vintrace_list_cost_transactionsBulk wine cost movements between two times (cost of wine moved between batches and wineries), optionally for one winery or business unit.Reads text others writeNo findings

    Why it is in this group

    • The name "vintrace_list_cost_transactions" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Bulk wine cost movements between two times (cost of wine moved between batches and wineries), optionally for one winery or business unit. Needs the vintrace permission to view costs. Reply: results plus next_offset. GET /v7/costs/business-unit-transactions.

    Annotations the server declares

    • title: List bulk wine cost movements
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • vintrace_list_inventoryStock on hand (bottled wine, dry goods, additives) up to a date: quantity, committed, on order and available per item, location, owner, tax class.Reads text others writeNo findings

    Why it is in this group

    • The name "vintrace_list_inventory" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Stock on hand (bottled wine, dry goods, additives) up to a date: quantity, committed, on order and available per item, location, owner, tax class. breakout_costing needs the view-costs permission. GET /v6/inventory.

    Annotations the server declares

    • title: List stock inventory
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • vintrace_list_lab_requestsThe lab console: analysis tasks (samples to measure) with lab, template, vessel, batch, status and arrival.Reads text others writeNo findings

    Why it is in this group

    • The name "vintrace_list_lab_requests" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    The lab console: analysis tasks (samples to measure) with lab, template, vessel, batch, status and arrival. Completed tasks are left out unless status includes Completed. Reply: results plus next_offset. GET /v7/lab/lab-requests.

    Annotations the server declares

    • title: List lab requests
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • vintrace_list_partiesList parties: customers, growers, suppliers and owners, individuals or organisations, with address, phone and email.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "vintrace_list_parties" says "list": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "list" and "email": it reads mail.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe description's first sentence says "list" and "email": it reads inbound email, which other people can write.
    Description, as the server wrote it
    List parties: customers, growers, suppliers and owners, individuals or organisations, with address, phone and email. Filter by the start of the name and category. GET /v6/party/list.

    Annotations the server declares

    • title: List parties
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • vintrace_list_productsList wine products as they sit in vessels: batch code, vessel, volume, colour, state and the latest lab metrics (TSO2, pH, Brix...).Reads text others writeNo findings

    Why it is in this group

    • The name "vintrace_list_products" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    List wine products as they sit in vessels: batch code, vessel, volume, colour, state and the latest lab metrics (TSO2, pH, Brix...). skip_metrics=true makes it faster. barcode matches a vessel code or asset id. GET /v6/products/list.

    Annotations the server declares

    • title: List products
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • vintrace_list_sales_ordersList sales orders with customer, status, price list, line items, totals and invoice date.Reads text others writeNo findings

    Why it is in this group

    • The name "vintrace_list_sales_orders" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    List sales orders with customer, status, price list, line items, totals and invoice date. Filter by status, customer, order date range or invoice date range. GET /v6/sales-order/list.

    Annotations the server declares

    • title: List sales orders
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • vintrace_list_shipmentsList shipments created by Bulk Dispatch and inter-winery dispatch operations, with destination and wine details.Reads text others writeNo findings

    Why it is in this group

    • The name "vintrace_list_shipments" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    List shipments created by Bulk Dispatch and inter-winery dispatch operations, with destination and wine details. Reply: results plus next_offset. GET /v7/operation/shipments.

    Annotations the server declares

    • title: List bulk shipments
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • vintrace_list_stock_dispatchesList stock dispatch actions (bottled goods and dry goods sent out) with routes, items and shipping information.Reads text others writeNo findings

    Why it is in this group

    • The name "vintrace_list_stock_dispatches" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    List stock dispatch actions (bottled goods and dry goods sent out) with routes, items and shipping information. Reply: results plus next_offset. GET /v7/stock/dispatches.

    Annotations the server declares

    • title: List stock dispatches
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • vintrace_list_stock_item_notesThe notes recorded on a stock item.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "vintrace_list_stock_item_notes" says "list": a word for reading.

    What it can reach

    • private-dataThe name "vintrace_list_stock_item_notes" says "list" and "note": it reads notes.
    • private-dataThe description's first sentence says "note": it reads notes.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    The notes recorded on a stock item. GET /v6/mrp/stock/{id}/notes.

    Annotations the server declares

    • title: List stock item notes
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • vintrace_list_trial_blendsList trial blends (planned blend trials) with status and composition.Reads text others writeNo findings

    Why it is in this group

    • The name "vintrace_list_trial_blends" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    List trial blends (planned blend trials) with status and composition. Use composition_summary_by=variety,vintage to summarise. Reply: results plus next_offset. GET /v7/operation/trial-blends.

    Annotations the server declares

    • title: List trial blends
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • vintrace_list_wine_batchesList wine batches (the named lots of wine) with volume, variety, vintage and owner.Reads text others writeNo findings

    Why it is in this group

    • The name "vintrace_list_wine_batches" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    List wine batches (the named lots of wine) with volume, variety, vintage and owner. Use include=vessels,allocations to add where each batch sits. Reply: results plus next_offset. GET /v7/operation/wine-batches.

    Annotations the server declares

    • title: List wine batches
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • vintrace_list_work_ordersList winery work orders (cellar jobs such as transfers, additions, bottling) with their jobs, assignee, status and scheduled time.Reads text others writeNo findings

    Why it is in this group

    • The name "vintrace_list_work_orders" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    List winery work orders (cellar jobs such as transfers, additions, bottling) with their jobs, assignee, status and scheduled time. Filter by scheduled time range, status and operation type. Reply: results plus next_offset. GET /v7/operation/work-orders.

    Annotations the server declares

    • title: List work orders
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • vintrace_list_work_orders_v6Work orders from the operator's point of view (what is waiting for me / unassigned), with job counts, status and scheduled dates.Reads text others writeNo findings

    Why it is in this group

    • The name "vintrace_list_work_orders_v6" says "list": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Work orders from the operator's point of view (what is waiting for me / unassigned), with job counts, status and scheduled dates. Defaults to the last 7 days to 3 days ahead. GET /v6/workorders/list.

    Annotations the server declares

    • title: List work orders (operator view)
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • vintrace_search_fruit_intakesFruit intake operations (grape deliveries weighed in at the winery): weights, grower, block, vineyard, vintage, docket numbers and metrics.Reads text others writeNo findings

    Why it is in this group

    • The name "vintrace_search_fruit_intakes" says "search": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Fruit intake operations (grape deliveries weighed in at the winery): weights, grower, block, vineyard, vintage, docket numbers and metrics. Filter by vintage, grower, vineyard, block or recorded time. Page with first_result and max_results. GET /v6/intake-operations/search.

    Annotations the server declares

    • title: Search fruit intakes
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • vintrace_search_itemsLook up names and ids of one kind of item: growers, owners, blocks, varietals, vintages, regions, programs, batches, products, tanks, barrels, bins and more.Reads text others writeNo findings

    Why it is in this group

    • The name "vintrace_search_items" says "search": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Look up names and ids of one kind of item: growers, owners, blocks, varietals, vintages, regions, programs, batches, products, tanks, barrels, bins and more. Use it to find the id or exact name another tool needs. GET /v6/search/list.

    Annotations the server declares

    • title: Search vintrace items by type
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true
  • vintrace_search_transactionsWinemaking operations completed in a date range (transfers, additions, blends, racking...) with the from/to vessels and before/after volumes.Reads text others writeNo findings

    Why it is in this group

    • The name "vintrace_search_transactions" says "search": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Winemaking operations completed in a date range (transfers, additions, blends, racking...) with the from/to vessels and before/after volumes. Defaults to today when no dates are given. GET /v6/transaction/search.

    Annotations the server declares

    • title: Search winemaking transactions
    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged outbound.

Reads private data3
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write34
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out0
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

2 warn
  • Warnvintrace_lookup_stock_item

    The server marks "vintrace_lookup_stock_item" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":true}; The name "vintrace_lookup_stock_item" says "lookup": a word for reading.

    What this check looks for
  • Warnvintrace_get_sales_order

    The server marks "vintrace_get_sales_order" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":true}; The name "vintrace_get_sales_order" says "get": a word for reading.

    What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http vintrace https://vintrace.usefulapi.io/mcp
claude mcp add --transport http vintrace https://vintrace.usefulapi.io/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__vintrace__vintrace_list_work_orders",
      "mcp__vintrace__vintrace_list_wine_batches",
      "mcp__vintrace__vintrace_get_vessel_details_report",
      "mcp__vintrace__vintrace_get_vessel",
      "mcp__vintrace__vintrace_list_lab_requests",
      "mcp__vintrace__vintrace_list_trial_blends",
      "mcp__vintrace__vintrace_search_transactions",
      "mcp__vintrace__vintrace_list_barrel_treatments",
      "mcp__vintrace__vintrace_list_blocks",
      "mcp__vintrace__vintrace_list_block_assessments",
      "mcp__vintrace__vintrace_list_bookings",
      "mcp__vintrace__vintrace_list_bulk_intakes",
      "mcp__vintrace__vintrace_search_fruit_intakes",
      "mcp__vintrace__vintrace_list_stock_dispatches",
      "mcp__vintrace__vintrace_list_shipments",
      "mcp__vintrace__vintrace_list_cost_transactions",
      "mcp__vintrace__vintrace_list_brand_allocations",
      "mcp__vintrace__vintrace_get_purchase_order",
      "mcp__vintrace__vintrace_list_inventory",
      "mcp__vintrace__vintrace_get_stock_item",
      "mcp__vintrace__vintrace_list_stock_item_notes",
      "mcp__vintrace__vintrace_list_products",
      "mcp__vintrace__vintrace_get_product",
      "mcp__vintrace__vintrace_list_sales_orders",
      "mcp__vintrace__vintrace_list_parties",
      "mcp__vintrace__vintrace_get_party",
      "mcp__vintrace__vintrace_get_work_order",
      "mcp__vintrace__vintrace_list_work_orders_v6",
      "mcp__vintrace__vintrace_search_items"
    ],
    "ask": [
      "mcp__vintrace__vintrace_lookup_stock_item",
      "mcp__vintrace__vintrace_get_sales_order",
      "mcp__vintrace__vintrace_add_stock_item_note"
    ],
    "deny": [
      "mcp__vintrace__vintrace_assign_work_order",
      "mcp__vintrace__vintrace_deactivate_booking"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as vintrace. Review it before you use it.

Capability tags behind 34 rules
  • mcp__vintrace__vintrace_list_work_orders untrusted-input
  • mcp__vintrace__vintrace_list_wine_batches untrusted-input
  • mcp__vintrace__vintrace_get_vessel_details_report untrusted-input
  • mcp__vintrace__vintrace_get_vessel untrusted-input
  • mcp__vintrace__vintrace_list_lab_requests untrusted-input
  • mcp__vintrace__vintrace_list_trial_blends untrusted-input
  • mcp__vintrace__vintrace_search_transactions untrusted-input
  • mcp__vintrace__vintrace_list_barrel_treatments untrusted-input
  • mcp__vintrace__vintrace_list_blocks untrusted-input
  • mcp__vintrace__vintrace_list_block_assessments untrusted-input
  • mcp__vintrace__vintrace_list_bookings untrusted-input
  • mcp__vintrace__vintrace_list_bulk_intakes untrusted-input
  • mcp__vintrace__vintrace_search_fruit_intakes untrusted-input
  • mcp__vintrace__vintrace_list_stock_dispatches untrusted-input
  • mcp__vintrace__vintrace_list_shipments untrusted-input
  • mcp__vintrace__vintrace_list_cost_transactions untrusted-input
  • mcp__vintrace__vintrace_list_brand_allocations untrusted-input
  • mcp__vintrace__vintrace_get_purchase_order untrusted-input
  • mcp__vintrace__vintrace_list_inventory untrusted-input
  • mcp__vintrace__vintrace_lookup_stock_item untrusted-input
  • mcp__vintrace__vintrace_get_stock_item private-data, untrusted-input
  • mcp__vintrace__vintrace_list_stock_item_notes private-data, untrusted-input
  • mcp__vintrace__vintrace_list_products untrusted-input
  • mcp__vintrace__vintrace_get_product untrusted-input
  • mcp__vintrace__vintrace_list_sales_orders untrusted-input
  • mcp__vintrace__vintrace_get_sales_order untrusted-input
  • mcp__vintrace__vintrace_list_parties private-data, untrusted-input
  • mcp__vintrace__vintrace_get_party untrusted-input
  • mcp__vintrace__vintrace_get_work_order untrusted-input
  • mcp__vintrace__vintrace_list_work_orders_v6 untrusted-input
  • mcp__vintrace__vintrace_search_items untrusted-input
  • mcp__vintrace__vintrace_add_stock_item_note untrusted-input
  • mcp__vintrace__vintrace_assign_work_order untrusted-input
  • mcp__vintrace__vintrace_deactivate_booking untrusted-input

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/io.usefulapi/vintrace/verify?hash=aeee69b20ef7636d4cb933b22ec16981fd2d085d0e89112551220dab42c49d49" | jq -e '.changed == false'

Pinned hash aeee69b20ef7, from Oct 24, 2026, 16:21 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/io.usefulapi/vintrace/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for io.usefulapi/vintrace
[![anlyon.dev](https://anlyon.dev/badge/io.usefulapi/vintrace.svg)](https://anlyon.dev/servers/io.usefulapi/vintrace)

Source: MCP Registry · repository. Synced Oct 24, 2026, 17:18 UTC.