apteka.online

online.apteka/mcpapteka.onlinestreamable-httpv1.0.0Scanned 1 hour ago

Polish online pharmacy apteka.online: products, prices, shop policies and the medicines register.

10 tools: 1 change things and 9 only read.

Reads private data · 2
Reads text others write · 2
Can send data out · 0
1 finding

Anlyon alternative

1 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

10 tools

Changes things 1Creates or changes something that can be changed back.Claude Code: ask

build_cart_linkBuild a link that puts products in the visitor's apteka.online cart (variant_id from search_catalog or get_product).1 finding
Why it is in this group
- The name "build_cart_link" says "link": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
  The server marks "build_cart_link" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
  Matched text
  annotations: {"readOnlyHint":true,"openWorldHint":false}; The name "build_cart_link" says "link": a word for a change.
  What this check looks for
Description, as the server wrote it
Build a link that puts products in the visitor's apteka.online cart (variant_id from search_catalog or get_product). The visitor opens it, checks the list and adds it; nothing changes before that, and the visitor pays at checkout. apteka.online is a Polish online pharmacy: it sells only non-prescription products, ships only within Poland (medicines only by courier, not to parcel lockers or pickup points) and lists prices in PLN gross. Do not give medical advice.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false

Only reads 9Looks things up and changes nothing.Show 9 read-only tools

compare_medicinesCompare two non-prescription medicines with the same active substance, like the "X czy Y" pages on apteka.online: indications from each SmPC (section 4.1), forms and strengths they…No findings
Why it is in this group
- The name "compare_medicines" says "compare": a word for reading.
Description, as the server wrote it
Compare two non-prescription medicines with the same active substance, like the "X czy Y" pages on apteka.online: indications from each SmPC (section 4.1), forms and strengths they share or not, and their offers in the shop. Only curated pairs: polocard czy acard, altaziaja czy altacet, zoxin-med czy nizoral, apselan czy sudafed, traumon czy difortan, voltaren-sport czy voltaren-max, etodal czy traumon, recigar czy tabex, otrivin czy xylogel, no-spa czy no-spa-max, hederasal czy prospan, cyclodynon czy castagnus, acatar-zatoki czy ibuprom-zatoki, maxiseptic czy octenisept, upsarin-c czy aspirin-c, essentiale-max czy essentiale-forte, biotebal czy biotynox. Quote the indications, do not recommend one over the other. apteka.online is a Polish online pharmacy: it sells only non-prescription products, ships only within Poland (medicines only by courier, not to parcel lockers or pickup points) and lists prices in PLN gross. Do not give medical advice. Medicine data comes from the Polish register of medicinal products (RPL) and the Ministry of Health refund announcement: prescription medicines are shown for information only and are not sold online, and refund prices are official maximum prices, not apteka.online prices.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
find_equivalentsFind medicines with the same active substance, like /odpowiedniki on apteka.online: sold_online lists shop products with price and unit price, catalog lists the register's other br…No findings
Why it is in this group
- The name "find_equivalents" says "find": a word for reading.
Description, as the server wrote it
Find medicines with the same active substance, like /odpowiedniki on apteka.online: sold_online lists shop products with price and unit price, catalog lists the register's other brands with official refund prices, availability in pharmacies and parallel imports. Filter by dose, route, salt, excipients to avoid (e.g. laktoza; unknown composition never counts as free from it), storage and prescription status; sort by name, availability, dose, package, price or unitprice. options lists the values that exist. apteka.online is a Polish online pharmacy: it sells only non-prescription products, ships only within Poland (medicines only by courier, not to parcel lockers or pickup points) and lists prices in PLN gross. Do not give medical advice. Medicine data comes from the Polish register of medicinal products (RPL) and the Ministry of Health refund announcement: prescription medicines are shown for information only and are not sold online, and refund prices are official maximum prices, not apteka.online prices.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
get_medicineGet one medicine from the register by slug (from search_medicines or a /lek/{slug} URL): substance, strength, form, dispensing category, marketing authorisation holder, ATC code, p…Reads private dataReads text others writeNo findings
Why it is in this group
- The name "get_medicine" says "get": a word for reading.
What it can reach
- private-dataThe description's first sentence says "get" and "document": it reads documents.
- untrusted-inputThe description's first sentence says "get" and "url": it reads web pages, which anyone can write.
Description, as the server wrote it
Get one medicine from the register by slug (from search_medicines or a /lek/{slug} URL): substance, strength, form, dispensing category, marketing authorisation holder, ATC code, packs with EAN, whether it is refunded, and the sections of its patient leaflet (ulotka) and SmPC (chpl) for get_medicine_document. product_handle is set only for a non-prescription medicine sold on apteka.online (use get_product with it). apteka.online is a Polish online pharmacy: it sells only non-prescription products, ships only within Poland (medicines only by courier, not to parcel lockers or pickup points) and lists prices in PLN gross. Do not give medical advice. Medicine data comes from the Polish register of medicinal products (RPL) and the Ministry of Health refund announcement: prescription medicines are shown for information only and are not sold online, and refund prices are official maximum prices, not apteka.online prices.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
get_medicine_documentRead the patient leaflet (ulotka) or the Summary of Product Characteristics (chpl) of a medicine from the register, one section at a time, e.g.Reads private dataNo findings
Why it is in this group
- The name "get_medicine_document" says "get": a word for reading.
What it can reach
- private-dataThe name "get_medicine_document" says "get" and "document": it reads documents.
Description, as the server wrote it
Read the patient leaflet (ulotka) or the Summary of Product Characteristics (chpl) of a medicine from the register, one section at a time, e.g. chpl 4.2 for dosing, ulotka 3 for how to take it. Without section it lists the sections. A long section comes in parts: ask for part 2 and on while part < parts. Quote the text, do not add advice beyond it. apteka.online is a Polish online pharmacy: it sells only non-prescription products, ships only within Poland (medicines only by courier, not to parcel lockers or pickup points) and lists prices in PLN gross. Do not give medical advice. Medicine data comes from the Polish register of medicinal products (RPL) and the Ministry of Health refund announcement: prescription medicines are shown for information only and are not sold online, and refund prices are official maximum prices, not apteka.online prices.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
get_productGet one apteka.online product by handle (from search_catalog results or a /products/{handle} URL): current price, availability, max quantity, variants with ids for the cart and a s…Reads text others writeNo findings
Why it is in this group
- The name "get_product" says "get": a word for reading.
What it can reach
- untrusted-inputThe description's first sentence says "get" and "url": it reads web pages, which anyone can write.
Description, as the server wrote it
Get one apteka.online product by handle (from search_catalog results or a /products/{handle} URL): current price, availability, max quantity, variants with ids for the cart and a short description. details_url has the full data: composition, dosage, warnings. apteka.online is a Polish online pharmacy: it sells only non-prescription products, ships only within Poland (medicines only by courier, not to parcel lockers or pickup points) and lists prices in PLN gross. Do not give medical advice.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
get_refund_pricesOfficial refund prices of a medicine from the current Ministry of Health announcement, per pack (EAN): price at 100%, and per refunded indication the payment level and the patient'…No findings
Why it is in this group
- The name "get_refund_prices" says "get": a word for reading.
Description, as the server wrote it
Official refund prices of a medicine from the current Ministry of Health announcement, per pack (EAN): price at 100%, and per refunded indication the payment level and the patient's copay, plus free_65_plus and free_under_18. The same figures as the /lek card, with the validity of the announcement. These are not apteka.online prices. apteka.online is a Polish online pharmacy: it sells only non-prescription products, ships only within Poland (medicines only by courier, not to parcel lockers or pickup points) and lists prices in PLN gross. Do not give medical advice. Medicine data comes from the Polish register of medicinal products (RPL) and the Ministry of Health refund announcement: prescription medicines are shown for information only and are not sold online, and refund prices are official maximum prices, not apteka.online prices.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
search_catalogSearch the apteka.online catalog by product name, brand, active ingredient or need.No findings
Why it is in this group
- The name "search_catalog" says "search": a word for reading.
Description, as the server wrote it
Search the apteka.online catalog by product name, brand, active ingredient or need. Returns products in store ranking order, available ones first on each page of 60, with price and availability; a product page is /products/{handle}. apteka.online is a Polish online pharmacy: it sells only non-prescription products, ships only within Poland (medicines only by courier, not to parcel lockers or pickup points) and lists prices in PLN gross. Do not give medical advice.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
search_medicinesSearch the register of medicines authorised in Poland by brand name or active substance, prescription and non-prescription, like the /lek catalog on apteka.online.No findings
Why it is in this group
- The name "search_medicines" says "search": a word for reading.
Description, as the server wrote it
Search the register of medicines authorised in Poland by brand name or active substance, prescription and non-prescription, like the /lek catalog on apteka.online. Returns slug, substance, strength, form, prescription (rx or otc), refunded and sold_online; use get_medicine, get_medicine_document or get_refund_prices with the slug. apteka.online is a Polish online pharmacy: it sells only non-prescription products, ships only within Poland (medicines only by courier, not to parcel lockers or pickup points) and lists prices in PLN gross. Do not give medical advice. Medicine data comes from the Polish register of medicinal products (RPL) and the Ministry of Health refund announcement: prescription medicines are shown for information only and are not sold online, and refund prices are official maximum prices, not apteka.online prices.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
search_shop_policies_and_faqsLook up apteka.online shop policies: delivery methods and costs, payment methods, returns and complaints, discounts.No findings
Why it is in this group
- The name "search_shop_policies_and_faqs" says "search": a word for reading.
Description, as the server wrote it
Look up apteka.online shop policies: delivery methods and costs, payment methods, returns and complaints, discounts. Ask in Polish, e.g. dostawa, płatności, zwroty, reklamacje. Returns the best section, the other titles and links to the terms and privacy policy. apteka.online is a Polish online pharmacy: it sells only non-prescription products, ships only within Poland (medicines only by courier, not to parcel lockers or pickup points) and lists prices in PLN gross. Do not give medical advice.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged outbound.

Reads private data2: Reads files, mail, messages, databases, secrets, calendars or repositories.; get_medicine
get_medicine_document
Reads text others write2: Brings in text someone else can write: web pages, inbound email, messages, issues and comments.; get_medicine
get_product
Can send data out0: Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

1 warn

Warnbuild_cart_link
The server marks "build_cart_link" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
Matched text
annotations: {"readOnlyHint":true,"openWorldHint":false}; The name "build_cart_link" says "link": a word for a change.
What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http apteka https://apteka.online/mcp

claude mcp add --transport http apteka https://apteka.online/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__apteka__search_catalog",
      "mcp__apteka__get_product",
      "mcp__apteka__search_shop_policies_and_faqs",
      "mcp__apteka__search_medicines",
      "mcp__apteka__get_medicine",
      "mcp__apteka__get_medicine_document",
      "mcp__apteka__get_refund_prices",
      "mcp__apteka__find_equivalents",
      "mcp__apteka__compare_medicines"
    ],
    "ask": [
      "mcp__apteka__build_cart_link"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as apteka. Review it before you use it.

Capability tags behind 3 rules

mcp__apteka__get_product untrusted-input
mcp__apteka__get_medicine private-data, untrusted-input
mcp__apteka__get_medicine_document private-data

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/online.apteka/mcp/verify?hash=46e80757687cbc40aac496e4c809bf0da684d0459577614bcbe4c06054423fad" | jq -e '.changed == false'

Pinned hash 46e80757687c, from Nov 5, 2026, 13:18 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/online.apteka/mcp/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

[![anlyon.dev](https://anlyon.dev/badge/online.apteka/mcp.svg)](https://anlyon.dev/servers/online.apteka/mcp)

Source: MCP Registry. Synced Nov 5, 2026, 13:18 UTC.