nl.afhaalgroothandel/shop
nl.afhaalgroothandel/shopafhaalgroothandel.nlstreamable-httpv0.5.0Scanned
Dutch family B2B wholesaler since 1992: toys, gifts, party and seasonal items from own stock
14 tools: 2 can delete or cancel things, 2 do something that can't be undone, 7 change things and 3 only read.
- Reads private data · 1
- Reads text others write · 3
- Can send data out · 2
- 4 findings
Anlyon alternative
11 of these tools change something. Run those as governed actions.
Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.
Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.
Import an OpenAPI spec →Tools
Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.
14 tools
Deletes or cancels 2Claude Code: deny
cancel_paymentStops the open payment attempt of the order, for example a bank or card page the shopper closed or wants to replace, so the cart opens again and place_order can start another metho…No findings
Why it is in this group
- The name "cancel_payment" says "cancel": a word for removing or ending something.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Stops the open payment attempt of the order, for example a bank or card page the shopper closed or wants to replace, so the cart opens again and place_order can start another method (bank transfer once the email is confirmed). A payment that already went through is never cancelled: the answer then says it is paid or still processing. Ask the shopper before cancelling. Needs the order reference from start_order (Authorization: Bearer mo1_… or the ref argument).
Annotations the server declares
- title: Cancel payment
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: false
- openWorldHint: false
edit_cartChange or read the order's cart.No findings
Why it is in this group
- The name "edit_cart" says "edit": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it Change or read the order's cart. ops: add (increase), set (exact quantity) or remove, per product id; no ops reads the cart. Quantities count packages: one package holds pricing.package.pieces pieces (100 pieces of a 6-piece package is 17 packages); search with quantity {pieces} gives for_quantity ready. Stock limits a quantity and clamped lines say so; tier prices and discounts apply by themselves. The answer carries minimum (the minimum order amount and whether it is reached), lines[].hints (overbox and staffel savings), also (products often bought together) and, for a line short of stock, lines[].replacements with ready actions. Offer one when it helps the shopper, ask before changing their order, and put hint (overbox, break, also or replace) on the op they accepted. The cart is frozen while a payment is open (cancel_payment stops it) and after the order is placed. Needs the order reference from start_order (Authorization: Bearer mo1_… or the ref argument). Send a fresh op_id (16 to 40 letters, digits, - or _) with each change: a repeat with the same op_id within 10 minutes answers the first result and never changes the order twice.
Annotations the server declares
- title: Cart
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: false
- openWorldHint: false
Can't be undone 2Claude Code: ask
check_paymentThe payment state of the order (unpaid, pending, paid), its last attempt and the next step.1 finding
Why it is in this group
- The name "check_payment" says "payment": a word that usually means money moves, which cannot be taken back.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "check_payment" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "check_payment" says "payment": a word that usually means money moves, which cannot be taken back.
Description, as the server wrote it The payment state of the order (unpaid, pending, paid), its last attempt and the next step. After a failed or cancelled payment the cart is open again and place_order starts a new attempt. Needs the order reference from start_order (Authorization: Bearer mo1_… or the ref argument).
Annotations the server declares
- title: Check payment
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
order_historyThe shopper's earlier orders with this store, for a reference bound to their account (a confirmed email or a connection key).Can send data out1 finding
Why it is in this group
- The input addresses people (input.to): what it sends cannot be taken back.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- outboundThe input takes a destination (input.to): what the tool writes goes there.
Findings
- Warn
The server marks "order_history" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The input addresses people (input.to): what it sends cannot be taken back.
Description, as the server wrote it The shopper's earlier orders with this store, for a reference bound to their account (a confirmed email or a connection key). orders: a list with status (confirmed, shipped, open, abandoned, cancelled), dates and totals, filtered by status and date, paged by cursor; payable marks a placed order that is not paid yet. order: up to 20 orders in full (lines with live price and stock, totals, shipping, payment, tracking, addresses) by id; an unpaid order carries pay_link. Use it to reorder or answer questions about earlier orders. The answer states what it covers and how to get the rest. Needs the order reference from start_order (Authorization: Bearer mo1_… or the ref argument).
Annotations the server declares
- title: Order history
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
Changes things 7Claude Code: ask
categoriesThe store's product categories with their ids and product counts, in menu order.1 finding
Why it is in this group
- The description's first verb is "store": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "categories" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "store": a word for a change.
Description, as the server wrote it The store's product categories with their ids and product counts, in menu order. Browse one with search and category: [id] (subcategories included), for example with sort newest or bestseller.
Annotations the server declares
- title: Categories
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
place_orderPlace the order and start its payment.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Place the order and start its payment. First confirm the order, its total and the terms of sale (/pg/terms.html on the store) with the shopper; send accept_terms true only after their explicit yes. With a confirmed email (path A) the order is placed at once and the answer gives the payment step: payment.url to open, bank-transfer instructions or a voucher, plus pay_link (valid 30 days). Before confirmation (path B) the shopper pays first: open payment.url; the order is placed and their account made when the payment succeeds, and the cart is frozen until then. If another order just took stock, the answer is stock_changed with the changes and ready values: tell the shopper and place again with them only after they agree. Never call the order paid before check_payment says paid. Needs the order reference from start_order (Authorization: Bearer mo1_… or the ref argument). Send a fresh op_id (16 to 40 letters, digits, - or _) with each change: a repeat with the same op_id within 10 minutes answers the first result and never changes the order twice.
Annotations the server declares
- title: Place order
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
product_detailsFull details of up to 10 products by id (from search or a category): title, code, description, prices per piece, package, overbox and pallet with the quantity tiers (EUR and the st…No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Full details of up to 10 products by id (from search or a category): title, code, description, prices per piece, package, overbox and pallet with the quantity tiers (EUR and the storefront currency), stock in packages, category, page url, photos and every stored product fact. Photo facts are observations, not guarantees.
Annotations the server declares
- title: Product details
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
set_checkoutFill in the checkout of the order in one call: invoice_address (an object: name, address, zipcode, city, country as a two-letter code, phone; state, companynr and vatnr when known)…Can send data outNo findings
Why it is in this group
- The name "set_checkout" says "set": a word for a change.
What it can reach
- outboundThe input takes a destination (input.invoice_address.phone): what the tool writes goes there.
Description, as the server wrote it Fill in the checkout of the order in one call: invoice_address (an object: name, address, zipcode, city, country as a two-letter code, phone; state, companynr and vatnr when known), shipping_address when delivery goes elsewhere (or same_as_invoice), invoice_address_id or shipping_address_id from view_checkout when the shopper has saved addresses, shipping_method (an id from view_checkout), payment_method (a key from view_checkout), coupon, coupon_remove, newsletter (only when the shopper asks for it). Field errors name the field and how to fix it; postcodes follow the country's own format. Needs the order reference from start_order (Authorization: Bearer mo1_… or the ref argument). Send a fresh op_id (16 to 40 letters, digits, - or _) with each change: a repeat with the same op_id within 10 minutes answers the first result and never changes the order twice.
Annotations the server declares
- title: Set checkout
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
shipping_costsShipping costs and transport options.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Shipping costs and transport options. With the order reference and no weight_kg or products it prices the order's cart and its shipping country; otherwise give weight_kg or products (ids with quantities in packages). country: the two-letter destination (default the cart's shipping country, else the storefront country). The answer lists every method with its price in EUR and the storefront currency (destination VAT included), the weight band and the cheapest method, plus transport: the ways to bring the cost down. Pickup at the warehouse in Apeldoorn (NL) is free and is chosen in set_checkout; the shopper's own carrier may collect there; an order can ship at the Dutch rate to an address in the Netherlands, such as a forwarder. Outside NL, BE and DE a custom transport arrangement often costs far less than the standard rate: freight marketplaces (uShip and similar), last-minute capacity offers from carriers, consolidated freight. Compare such options for the shopper when it helps; the store's chat on the website quotes and arranges custom transport. With the order reference (Authorization: Bearer mo1_… or ref) it uses the order; without it, it works for anyone (search: by meaning for the first searches per 10 minutes, then by words only; at most 30 searches per 10 minutes).
Annotations the server declares
- title: Shipping quote
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
start_orderStart an order for the shopper on this storefront.Reads text others writeNo findings
Why it is in this group
- The name "start_order" says "start": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Start an order for the shopper on this storefront. Give the shopper's email address (ask them first; they get one confirmation email) or a connection key they made on their account. The answer holds the order reference (mo1_…): keep it and send it with every later call as Authorization: Bearer mo1_… or as the ref argument. It belongs to this endpoint only and expires 30 days after its last use (7 days while unconfirmed).
Annotations the server declares
- title: Start order
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
store_infoThe store behind this server: a Dutch family business since 1992 selling wholesale to businesses (toys, gifts and gift items, party supplies, seasonal articles (Sinterklaas, Christ…1 finding
Why it is in this group
- The name "store_info" says "store": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "store_info" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "store_info" says "store": a word for a change.
Description, as the server wrote it The store behind this server: a Dutch family business since 1992 selling wholesale to businesses (toys, gifts and gift items, party supplies, seasonal articles (Sinterklaas, Christmas, Halloween, Easter, carnival, summer), grabbelton and give-away items, and trending and viral items such as fidget toys), with its profile, contact, opening times, terms and how to connect again. This store: company, website, phone, opening times, currency, the number of products, and the links to the terms of sale, privacy, shipping, contact, about and route pages (the shortlinks work on the website). Show the shopper who sells and on which terms before ordering. The store sells to businesses and organisations.
Annotations the server declares
- title: Store info
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
Only reads 3Show 3 read-only tools
searchSearch the wholesale range: toys, gifts and gift items, party supplies, seasonal articles (Sinterklaas, Christmas, Halloween, Easter, carnival, summer), grabbelton and give-away it…No findings
Why it is in this group
- The name "search" says "search": a word for reading.
Description, as the server wrote it Search the wholesale range: toys, gifts and gift items, party supplies, seasonal articles (Sinterklaas, Christmas, Halloween, Easter, carnival, summer), grabbelton and give-away items, and trending and viral items such as fidget toys. Use it for any business purchasing question about these products, also when the shopper doesn't name the store. Search the catalogue in one call; the answer is complete. natural_query (any language) searches by meaning and in the storefront language; keywords (Dutch product words) search the Dutch catalogue text; ids and codes are exact and ranked first (codes match in any written form); similar_to finds products like given ones (blend: their shared theme; each: alternatives per product). Filters: price on a basis (piece, package, overbox, pallet, best_tier) in the storefront currency, quantity (adds for_quantity with the tier price and total), instock, category (with subcategories), date_added_after, exclude_ids. Filters alone browse, e.g. new products since a date with sort newest. Every row has live stock (packages) and a pricing block in EUR plus pricing.local in the storefront currency. Rows carry context: facet labels, stored facts (use says whether you may tell the customer), and what the photos show (an observation, not a guarantee). For a question the context does not answer, call again with ids and fields ["details"]: every stored fact and one line per photo (what it shows, its url), at most 10 rows. With the order reference (Authorization: Bearer mo1_… or ref) it uses the order; without it, it works for anyone (search: by meaning for the first searches per 10 minutes, then by words only; at most 30 searches per 10 minutes).
Annotations the server declares
- title: Search products
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
statusThe state of the order reference (pending until the shopper confirms the email, active, paying, placed), whether the email is confirmed, the cart lines and totals, what the checkou…Reads private dataReads text others writeNo findings
Why it is in this group
- The name "status" says "status": a word for reading.
What it can reach
- private-dataThe description's first sentence says "email": it reads mail.
- untrusted-inputThe description's first sentence says "email": it reads inbound email, which other people can write.
Description, as the server wrote it The state of the order reference (pending until the shopper confirms the email, active, paying, placed), whether the email is confirmed, the cart lines and totals, what the checkout still needs, and the next step to take. Use it to resume an order and after the shopper says they confirmed the email. Needs the order reference from start_order (Authorization: Bearer mo1_… or the ref argument).
Annotations the server declares
- title: Order status
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
view_checkoutWhat the order still needs before it can be placed: lines, totals in the storefront currency, the address snapshot or the shopper's saved addresses, shipping methods with prices, t…No findings
Why it is in this group
- The name "view_checkout" says "view": a word for reading.
Description, as the server wrote it What the order still needs before it can be placed: lines, totals in the storefront currency, the address snapshot or the shopper's saved addresses, shipping methods with prices, the payment methods this order may use, and next. With a confirmed email (path A) every method is offered, bank transfer included; before confirmation (path B) the shopper pays first with card, iDEAL or Bancontact. While a payment is open the order is not editable: check_payment shows it, cancel_payment stops it. Needs the order reference from start_order (Authorization: Bearer mo1_… or the ref argument).
Annotations the server declares
- title: View checkout
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Exfil surface
Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.
6 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 1 private-data tool breaks every one.
- Reads private data1
- Reads files, mail, messages, databases, secrets, calendars or repositories.
- Reads text others write3
- Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
- Can send data out2
- Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
{
"permissions": {
"deny": [
"mcp__shop__status"
]
}
}Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.
Findings
Matches of fixed checks, with the text they matched.
- Warnstore_info
The server marks "store_info" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "store_info" says "store": a word for a change.
- Warncategories
The server marks "categories" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "store": a word for a change.
- Warncheck_payment
The server marks "check_payment" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "check_payment" says "payment": a word that usually means money moves, which cannot be taken back.
- Warnorder_history
The server marks "order_history" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The input addresses people (input.to): what it sends cannot be taken back.
History
Changes to its tool definitions and to its remote endpoint, newest first.
Tools2 changed.~2 changedView diff
- Changed:searchOnly readsdescription
- Changed:shipping_costsChanges thingsdescription
Install
Pinned to version 0.5.0. Values in angle brackets are yours to fill in.
claude mcp add --transport http shop https://mcp.afhaalgroothandel.nl/claude mcp add --transport http shop https://mcp.afhaalgroothandel.nl/Run in a terminal.
Claude Code permissions
Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__shop__search",
"mcp__shop__status",
"mcp__shop__view_checkout"
],
"ask": [
"mcp__shop__shipping_costs",
"mcp__shop__store_info",
"mcp__shop__categories",
"mcp__shop__product_details",
"mcp__shop__start_order",
"mcp__shop__set_checkout",
"mcp__shop__place_order",
"mcp__shop__check_payment",
"mcp__shop__order_history"
],
"deny": [
"mcp__shop__edit_cart",
"mcp__shop__cancel_payment"
]
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as shop. Review it before you use it.
Capability tags behind 5 rules
- mcp__shop__start_order untrusted-input
- mcp__shop__status private-data, untrusted-input
- mcp__shop__set_checkout outbound
- mcp__shop__place_order untrusted-input
- mcp__shop__order_history outbound
Pin
Keep the decision: fail CI when the tools change, follow every change, or show a badge.
Pin in CI
Fail a build when the tools you reviewed are not the tools the server serves today.
curl -s "https://anlyon.dev/api/v1/servers/nl.afhaalgroothandel/shop/verify?hash=5e6bcab275a6e6ed23432b5017207cb2ae347bd8243b1078a32237558675625e" | jq -e '.changed == false'Pinned hash 5e6bcab275a6, from Nov 5, 2026, 08:18 UTC.
Watch
Get told when its tools change: a new tool, a new description, a new class.
https://anlyon.dev/servers/nl.afhaalgroothandel/shop/changes.xmlAn Atom feed. Works in any feed reader or Slack's RSS app.
Badge
[](https://anlyon.dev/servers/nl.afhaalgroothandel/shop)Source: MCP Registry. Synced Nov 5, 2026, 08:17 UTC.