Brand Design Ltd.

ltd.branddesign/commercebranddesign.ltdstreamable-httpv1.1.0Scanned 22 hours ago

Branding, design and web services you can order and pay for without a human on the seller side.

10 tools: 1 can delete or cancel things, 1 do something that can't be undone, 4 change things and 4 only read.

Reads private data · 2
Reads text others write · 2
Can send data out · 1
22 findings, 15 high

Tools listed without sign-in. Remote posture

Anlyon alternative

6 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

10 tools

Deletes or cancels 1Removes, cancels or revokes something.Claude Code: deny

start_paymentStart payment for a stage.Reads text others write3 findings
Why it is in this group
- The name "start_payment" says "start": a word for a change.
- The name "start_payment" also says "payment": a word that usually means money moves, which cannot be taken back.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Findings
- High
  The input schema at properties.clientId.description contains "<secret>", a tag of the kind used to mark instructions for the model.
  Matched text
  inputSchema.properties.clientId.description: "...Authorization header (Bearer <clientId>:<secret>, or an OAuth access token issued for th..."
  What this check looks for
- High
  The input schema at properties.secret.description contains "<secret>", a tag of the kind used to mark instructions for the model.
  Matched text
  inputSchema.properties.secret.description: "...Authorization header (Bearer <clientId>:<secret>, or an OAuth access token issued for th..."
  What this check looks for
- Info
  The description mentions "credentials".
  Matched text
  description: "Start payment for a stage. Needs credentials. Without sharedPaymentToken you receive..."
  What this check looks for
Description, as the server wrote it
Start payment for a stage. Needs credentials. Without sharedPaymentToken you receive a hosted payment session, which you may complete yourself with a payment instrument issued to you, or hand to the person you act for. With a delegated shared payment token the payment settles directly. A self-registered agent must first have current DNS domain-control KYA for its HTTPS contact domain: call kya_challenge with a domain you control, publish its DNS TXT record and call kya_verify; kya_status reads the current verification. KYA does not grant buyer payment authority. On-chain payment is not accepted. Errors: OFFER_EXPIRED (409) for an advance after 30 days, FINAL_NOT_RELEASED (409) when the final payment is not open yet, PAYMENTS_DISABLED (503).
Annotations the server declares
- title: Start payment
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: false
- openWorldHint: true

Can't be undone 1Sends, pays, publishes or merges: once done, it cannot be taken back.Claude Code: ask

register_agentRegister yourself and receive a client identifier and a secret.1 finding
Why it is in this group
- The description says "cannot be recovered".
Findings
- High
  The description contains "<secret>", a tag of the kind used to mark instructions for the model.
  Matched text
  description: "...horization header as "Bearer <clientId>:<secret>" for the other tools."
  What this check looks for
Description, as the server wrote it
Register yourself and receive a client identifier and a secret. No approval and no prior arrangement. The secret is returned once and cannot be recovered. Put them in the Authorization header as "Bearer <clientId>:<secret>" for the other tools.
Annotations the server declares
- title: Register as an agent
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false

Changes things 4Creates or changes something that can be changed back.Claude Code: ask

accept_offerAccept the offer on behalf of the buyer.Can send data out3 findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
What it can reach
- outboundThe input takes a destination (input.billing.phone): what the tool writes goes there.
Findings
- High
  The input schema at properties.clientId.description contains "<secret>", a tag of the kind used to mark instructions for the model.
  Matched text
  inputSchema.properties.clientId.description: "...Authorization header (Bearer <clientId>:<secret>, or an OAuth access token issued for th..."
  What this check looks for
- High
  The input schema at properties.secret.description contains "<secret>", a tag of the kind used to mark instructions for the model.
  Matched text
  inputSchema.properties.secret.description: "...Authorization header (Bearer <clientId>:<secret>, or an OAuth access token issued for th..."
  What this check looks for
- Info
  The description mentions "credentials".
  Matched text
  description: "...the offer on behalf of the buyer. Needs credentials. This locks the billing identity, the o..."
  What this check looks for
Description, as the server wrote it
Accept the offer on behalf of the buyer. Needs credentials. This locks the billing identity, the offer version and the hash of the terms as they stand at this moment. A later change to the website cannot pass for what was agreed. Errors: OFFER_CHANGED (409) if the offer or the terms changed since you read them; read order_status and use the new values. OFFER_EXPIRED (409) 30 days after the order. MANUAL_OFFER_REQUIRED (409) while a person has not priced the service yet.
Annotations the server declares
- title: Accept the offer
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
create_orderPlace an order for a service.3 findings
Why it is in this group
- The name "create_order" says "create": a word for a change.
Findings
- High
  The input schema at properties.clientId.description contains "<secret>", a tag of the kind used to mark instructions for the model.
  Matched text
  inputSchema.properties.clientId.description: "...Authorization header (Bearer <clientId>:<secret>, or an OAuth access token issued for th..."
  What this check looks for
- High
  The input schema at properties.secret.description contains "<secret>", a tag of the kind used to mark instructions for the model.
  Matched text
  inputSchema.properties.secret.description: "...Authorization header (Bearer <clientId>:<secret>, or an OAuth access token issued for th..."
  What this check looks for
- Info
  The description mentions "credentials".
  Matched text
  description: "Place an order for a service. Needs credentials. Returns the order id, the offer and an..."
  What this check looks for
Description, as the server wrote it
Place an order for a service. Needs credentials. Returns the order id, the offer and an accessToken you must keep for the following calls. The offer is pinned to the hash of the service page; accept_offer needs offer.version and offer.terms.<language>.hash from it. Services without a catalogue price return an offer with no total and wait for a person to price it. Errors: MISSING_<field> when a required brief field is absent, UNEXPECTED_FIELD when the brief has a key the service does not declare.
Annotations the server declares
- title: Place an order
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
kya_challengeIssue a fresh DNS TXT challenge for your currently authenticated agent identity.3 findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Findings
- High
  The input schema at properties.clientId.description contains "<secret>", a tag of the kind used to mark instructions for the model.
  Matched text
  inputSchema.properties.clientId.description: "...Authorization header (Bearer <clientId>:<secret>, or an OAuth access token issued for th..."
  What this check looks for
- High
  The input schema at properties.secret.description contains "<secret>", a tag of the kind used to mark instructions for the model.
  Matched text
  inputSchema.properties.secret.description: "...Authorization header (Bearer <clientId>:<secret>, or an OAuth access token issued for th..."
  What this check looks for
- Info
  The input schema at properties.contact.description mentions "credentials".
  Matched text
  inputSchema.properties.contact.description: "...your own public domain. No IP address, credentials, custom port or URL fragment."
  What this check looks for
Description, as the server wrote it
Issue a fresh DNS TXT challenge for your currently authenticated agent identity. Needs commerce.order for OAuth. Supply an HTTPS contact URL on a domain you control, especially on the first OAuth connection. Omitting contact reuses the current contact. This replaces the previous challenge and clears its verification. Publish the returned txtValue at dnsName, then call kya_verify. Domain control does not establish buyer identity or grant spending authority. Do not publish secrets in DNS.
Annotations the server declares
- title: Prepare domain-control verification
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
kya_verifyCheck the DNS TXT challenge for your currently authenticated agent and record domain-control verification.Reads text others write2 findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Findings
- High
  The input schema at properties.clientId.description contains "<secret>", a tag of the kind used to mark instructions for the model.
  Matched text
  inputSchema.properties.clientId.description: "...Authorization header (Bearer <clientId>:<secret>, or an OAuth access token issued for th..."
  What this check looks for
- High
  The input schema at properties.secret.description contains "<secret>", a tag of the kind used to mark instructions for the model.
  Matched text
  inputSchema.properties.secret.description: "...Authorization header (Bearer <clientId>:<secret>, or an OAuth access token issued for th..."
  What this check looks for
Description, as the server wrote it
Check the DNS TXT challenge for your currently authenticated agent and record domain-control verification. Needs commerce.order for OAuth. First call kya_challenge and publish its exact DNS TXT record. The response gives verifiedAt and validUntil; verification is currently valid for 24 hours. This does not authorize a purchase or a payment.
Annotations the server declares
- title: Verify domain control
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true

Only reads 4Looks things up and changes nothing.Show 4 read-only tools

catalogRead the service catalogue: names, prices, currency and terms.1 finding
Why it is in this group
- The description's first verb is "read": a word for reading.
Findings
- Info
  The description mentions "credentials".
  Matched text
  description: "...: names, prices, currency and terms. No credentials needed. All amounts are integers in the..."
  What this check looks for
Description, as the server wrote it
Read the service catalogue: names, prices, currency and terms. No credentials needed. All amounts are integers in the minor unit; 100000 means 1000.00 EUR.
Annotations the server declares
- title: Read the catalogue
- readOnlyHint: true
- openWorldHint: false
kya_statusRead DNS domain-control verification for your currently authenticated agent.Reads private data2 findings
Why it is in this group
- The name "kya_status" says "status": a word for reading.
What it can reach
- private-dataThe input names a secret (input.secret), and the tool reads: it reads secrets.
Findings
- High
  The input schema at properties.clientId.description contains "<secret>", a tag of the kind used to mark instructions for the model.
  Matched text
  inputSchema.properties.clientId.description: "...Authorization header (Bearer <clientId>:<secret>, or an OAuth access token issued for th..."
  What this check looks for
- High
  The input schema at properties.secret.description contains "<secret>", a tag of the kind used to mark instructions for the model.
  Matched text
  inputSchema.properties.secret.description: "...Authorization header (Bearer <clientId>:<secret>, or an OAuth access token issued for th..."
  What this check looks for
Description, as the server wrote it
Read DNS domain-control verification for your currently authenticated agent. Needs commerce.read for OAuth. Returns verification status and, when present, DNS instructions and validity timestamps. This does not change the contact, challenge or verification.
Annotations the server declares
- title: Read domain-control verification
- readOnlyHint: true
- openWorldHint: false
manifestRead the commerce manifest: protocol, endpoints, authentication scheme, payment instrument and limits.1 finding
Why it is in this group
- The description's first verb is "read": a word for reading.
Findings
- Info
  The description mentions "credentials".
  Matched text
  description: "...heme, payment instrument and limits. No credentials needed."
  What this check looks for
Description, as the server wrote it
Read the commerce manifest: protocol, endpoints, authentication scheme, payment instrument and limits. No credentials needed.
Annotations the server declares
- title: Read the commerce manifest
- readOnlyHint: true
- openWorldHint: false
order_statusRead the current state of the order, its offer and its payments, including the invoice number once one has been issued.Reads private data3 findings
Why it is in this group
- The name "order_status" says "status": a word for reading.
What it can reach
- private-dataThe input names a secret (input.secret), and the tool reads: it reads secrets.
Findings
- High
  The input schema at properties.clientId.description contains "<secret>", a tag of the kind used to mark instructions for the model.
  Matched text
  inputSchema.properties.clientId.description: "...Authorization header (Bearer <clientId>:<secret>, or an OAuth access token issued for th..."
  What this check looks for
- High
  The input schema at properties.secret.description contains "<secret>", a tag of the kind used to mark instructions for the model.
  Matched text
  inputSchema.properties.secret.description: "...Authorization header (Bearer <clientId>:<secret>, or an OAuth access token issued for th..."
  What this check looks for
- Info
  The description mentions "credentials".
  Matched text
  description: "...number once one has been issued. Needs credentials."
  What this check looks for
Description, as the server wrote it
Read the current state of the order, its offer and its payments, including the invoice number once one has been issued. Needs credentials.
Annotations the server declares
- title: Read order status
- readOnlyHint: true
- openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

4 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 1 outbound tool breaks every one.

Reads private data2: Reads files, mail, messages, databases, secrets, calendars or repositories.; kya_status
order_status
Reads text others write2: Brings in text someone else can write: web pages, inbound email, messages, issues and comments.; kya_verify
start_payment
Can send data out1: Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.; accept_offer

deny to break every path

{
  "permissions": {
    "deny": [
      "mcp__commerce__accept_offer"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Tools listed without sign-in

Looked at Oct 22, 2026, 15:10 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable: yes
HTTP status of an anonymous initialize: 200
tools/list served without credentials: yes
Tools that change things, listed without credentials: 6
Protocol version: 2025-06-18
WWW-Authenticate on 401: not observed
resource_metadata in WWW-Authenticate: not observed
RFC 9728 protected resource metadata: https://branddesign.ltd/.well-known/oauth-protected-resource/mcp
Authorization servers: https://branddesignltd.eu.auth0.com/
Legacy HTTP+SSE transport: no
Dynamic client registration: yes
Client ID metadata documents: no

HighThe whole server
The endpoint served tools/list without credentials, and the list has 6 tools that change things (1 destructive, 1 irreversible, 4 write). Whether a call also works without credentials was not tested: tools are never called.
Matched text
https://branddesign.ltd/mcp: tools/list returned 10 tools to an anonymous client, including start_payment (destructive), register_agent (irreversible), kya_challenge (write), kya_verify (write), create_order (write) and 1 more
What this check looks for

Findings

Matches of fixed checks, with the text they matched.

15 high7 info

Highregister_agent
The description contains "<secret>", a tag of the kind used to mark instructions for the model.
Matched text
description: "...horization header as "Bearer <clientId>:<secret>" for the other tools."
What this check looks for
Highkya_challenge
The input schema at properties.clientId.description contains "<secret>", a tag of the kind used to mark instructions for the model.
Matched text
inputSchema.properties.clientId.description: "...Authorization header (Bearer <clientId>:<secret>, or an OAuth access token issued for th..."
What this check looks for
Highkya_challenge
The input schema at properties.secret.description contains "<secret>", a tag of the kind used to mark instructions for the model.
Matched text
inputSchema.properties.secret.description: "...Authorization header (Bearer <clientId>:<secret>, or an OAuth access token issued for th..."
What this check looks for
Highkya_verify
The input schema at properties.clientId.description contains "<secret>", a tag of the kind used to mark instructions for the model.
Matched text
inputSchema.properties.clientId.description: "...Authorization header (Bearer <clientId>:<secret>, or an OAuth access token issued for th..."
What this check looks for
Highkya_verify
The input schema at properties.secret.description contains "<secret>", a tag of the kind used to mark instructions for the model.
Matched text
inputSchema.properties.secret.description: "...Authorization header (Bearer <clientId>:<secret>, or an OAuth access token issued for th..."
What this check looks for
Highkya_status
The input schema at properties.clientId.description contains "<secret>", a tag of the kind used to mark instructions for the model.
Matched text
inputSchema.properties.clientId.description: "...Authorization header (Bearer <clientId>:<secret>, or an OAuth access token issued for th..."
What this check looks for

Show 16 more findings

Highkya_status
The input schema at properties.secret.description contains "<secret>", a tag of the kind used to mark instructions for the model.
Matched text
inputSchema.properties.secret.description: "...Authorization header (Bearer <clientId>:<secret>, or an OAuth access token issued for th..."
What this check looks for
Highcreate_order
The input schema at properties.clientId.description contains "<secret>", a tag of the kind used to mark instructions for the model.
Matched text
inputSchema.properties.clientId.description: "...Authorization header (Bearer <clientId>:<secret>, or an OAuth access token issued for th..."
What this check looks for
Highcreate_order
The input schema at properties.secret.description contains "<secret>", a tag of the kind used to mark instructions for the model.
Matched text
inputSchema.properties.secret.description: "...Authorization header (Bearer <clientId>:<secret>, or an OAuth access token issued for th..."
What this check looks for
Highaccept_offer
The input schema at properties.clientId.description contains "<secret>", a tag of the kind used to mark instructions for the model.
Matched text
inputSchema.properties.clientId.description: "...Authorization header (Bearer <clientId>:<secret>, or an OAuth access token issued for th..."
What this check looks for
Highaccept_offer
The input schema at properties.secret.description contains "<secret>", a tag of the kind used to mark instructions for the model.
Matched text
inputSchema.properties.secret.description: "...Authorization header (Bearer <clientId>:<secret>, or an OAuth access token issued for th..."
What this check looks for
Highstart_payment
The input schema at properties.clientId.description contains "<secret>", a tag of the kind used to mark instructions for the model.
Matched text
inputSchema.properties.clientId.description: "...Authorization header (Bearer <clientId>:<secret>, or an OAuth access token issued for th..."
What this check looks for
Highstart_payment
The input schema at properties.secret.description contains "<secret>", a tag of the kind used to mark instructions for the model.
Matched text
inputSchema.properties.secret.description: "...Authorization header (Bearer <clientId>:<secret>, or an OAuth access token issued for th..."
What this check looks for
Highorder_status
The input schema at properties.clientId.description contains "<secret>", a tag of the kind used to mark instructions for the model.
Matched text
inputSchema.properties.clientId.description: "...Authorization header (Bearer <clientId>:<secret>, or an OAuth access token issued for th..."
What this check looks for
Highorder_status
The input schema at properties.secret.description contains "<secret>", a tag of the kind used to mark instructions for the model.
Matched text
inputSchema.properties.secret.description: "...Authorization header (Bearer <clientId>:<secret>, or an OAuth access token issued for th..."
What this check looks for
Infocatalog
The description mentions "credentials".
Matched text
description: "...: names, prices, currency and terms. No credentials needed. All amounts are integers in the..."
What this check looks for
Infomanifest
The description mentions "credentials".
Matched text
description: "...heme, payment instrument and limits. No credentials needed."
What this check looks for
Infokya_challenge
The input schema at properties.contact.description mentions "credentials".
Matched text
inputSchema.properties.contact.description: "...your own public domain. No IP address, credentials, custom port or URL fragment."
What this check looks for
Infocreate_order
The description mentions "credentials".
Matched text
description: "Place an order for a service. Needs credentials. Returns the order id, the offer and an..."
What this check looks for
Infoaccept_offer
The description mentions "credentials".
Matched text
description: "...the offer on behalf of the buyer. Needs credentials. This locks the billing identity, the o..."
What this check looks for
Infostart_payment
The description mentions "credentials".
Matched text
description: "Start payment for a stage. Needs credentials. Without sharedPaymentToken you receive..."
What this check looks for
Infoorder_status
The description mentions "credentials".
Matched text
description: "...number once one has been issued. Needs credentials."
What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 1.1.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http commerce https://branddesign.ltd/mcp

claude mcp add --transport http commerce https://branddesign.ltd/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__commerce__catalog",
      "mcp__commerce__manifest",
      "mcp__commerce__kya_status",
      "mcp__commerce__order_status"
    ],
    "ask": [
      "mcp__commerce__register_agent",
      "mcp__commerce__kya_challenge",
      "mcp__commerce__kya_verify",
      "mcp__commerce__create_order",
      "mcp__commerce__accept_offer"
    ],
    "deny": [
      "mcp__commerce__start_payment"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as commerce. Review it before you use it.

Capability tags behind 5 rules

mcp__commerce__kya_verify untrusted-input
mcp__commerce__kya_status private-data
mcp__commerce__accept_offer outbound
mcp__commerce__start_payment untrusted-input
mcp__commerce__order_status private-data

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/ltd.branddesign/commerce/verify?hash=a50158a67704be641bd8a73f8380a01dfb945eb5910d1cb46687a8151703544e" | jq -e '.changed == false'

Pinned hash a50158a67704, from Oct 21, 2026, 19:18 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/ltd.branddesign/commerce/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

[![anlyon.dev](https://anlyon.dev/badge/ltd.branddesign/commerce.svg)](https://anlyon.dev/servers/ltd.branddesign/commerce)

Source: MCP Registry. Synced Oct 21, 2026, 18:53 UTC.