On the Register MCP server
uk.co.ontheregister/on-the-registerontheregister.co.ukstreamable-httpv0.1.0Scanned
Checks weight loss clinics and online pharmacies against the UK regulator registers (CQC, GPhC).
23 tools: 17 change things and 6 only read.
- Reads private data · 0
- Reads text others write · 1
- Can send data out · 0
- No findings
Tools listed without sign-in. Remote posture
With Anlyon
17 tools here change things. Govern them.
- Anlyon lists the tools and adopts none.
- Each tool you adopt gets approvals and receipts.
- Your agent never holds the key.
A tool your agent calls directly is not routed through Anlyon and is not governed by it. anlyon.dev only lists and labels, and these labels are the same either way.
What the On the Register MCP server can do
The On the Register MCP server is published by ontheregister.co.uk, a domain the MCP Registry verified. It has 23 tools. It can create or change data (17 tools: calc_reconstitute, calc_convert, storage_check, supply_runout and 13 more), but cannot delete data. 6 tools only read.
1 tool brings in text other people can write (guides_list).
None of the fixed checks matched anything in its tool definitions. That is not a safety guarantee.
Its remote endpoint lists its tools without sign-in.
Last scanned Nov 7, 2026, version 0.1.0.
Tools
Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.
23 tools
Changes things 17Claude Code: ask
bmi_checkBody mass index from weight and height, with the NHS adult category and the healthy-weight range for that height.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Body mass index from weight and height, with the NHS adult category and the healthy-weight range for that height. UK thresholds; note the NHS lowers them for some ethnic backgrounds. General information, not a diagnosis.
calc_convertConvert between a dose (mg or mcg), syringe units and mL at a known strength.No findings
Why it is in this group
- The name "calc_convert" says "convert": a word for a change.
Description, as the server wrote it Convert between a dose (mg or mcg), syringe units and mL at a known strength. Give the strength as conc_mg_ml, or as vial_mg + water_ml. Set direction to dose_to_units or units_to_dose. Returns the counterpart plus concentration and mcg per unit. Arithmetic only.
calc_reconstituteWork out the units to draw for a prescribed dose from a powder vial and bacteriostatic water.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Work out the units to draw for a prescribed dose from a powder vial and bacteriostatic water. Inputs: vial mg, water mL, the dose (mg or mcg), and the syringe. Returns units, mL, the nearest syringe line and doses per vial. Arithmetic only — the user's own dose, no presets.
compare_medicinesPut two weight-loss/diabetes injections (Mounjaro, Wegovy, Ozempic, Saxenda) side by side on SmPC facts: doses, frequency, pen, licensing, NHS access, storage.No findings
Why it is in this group
- The name "compare_medicines" says "compare": a word for reading.
- The description's first verb is "put": a word for a change.
Description, as the server wrote it Put two weight-loss/diabetes injections (Mounjaro, Wegovy, Ozempic, Saxenda) side by side on SmPC facts: doses, frequency, pen, licensing, NHS access, storage. Returns a row-by-row table with the rows that differ flagged. Facts only, never a 'which is right for you'.
energy_tdeeDaily energy use (BMR via Mifflin-St Jeor, then TDEE for activity) and two safe calorie-deficit targets for weight loss, clamped to the NHS lower limits.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Daily energy use (BMR via Mifflin-St Jeor, then TDEE for activity) and two safe calorie-deficit targets for weight loss, clamped to the NHS lower limits. Needs age and sex for the equation. General information, not a diet plan.
fluid_targetRough daily fluid estimate from body weight (about 30-35 ml/kg), framed against the NHS 6-to-8-glasses guidance.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Rough daily fluid estimate from body weight (about 30-35 ml/kg), framed against the NHS 6-to-8-glasses guidance. Needs rise in heat, with exercise, and with GLP-1 sickness. A general estimate, not a medical fluid target.
howlong_clearanceEstimate when a GLP-1/GIP injection is essentially cleared after the last dose, from the SmPC half-life (about five half-lives).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Estimate when a GLP-1/GIP injection is essentially cleared after the last dose, from the SmPC half-life (about five half-lives). Give the drug and the last-dose date. Returns the clear date and whether the basis is the SmPC or an estimate. Informational.
howlong_timelineGive the SmPC milestones for when a GLP-1/GIP injection starts working: when appetite drops, when the first full dose is, and how the effect builds.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Give the SmPC milestones for when a GLP-1/GIP injection starts working: when appetite drops, when the first full dose is, and how the effect builds. Returns dated-by-week milestones with their citation. Informational, no prediction for any one person.
patch_calendarLay out the change days for an HRT estradiol patch from the day the first patch goes on, and rotate the application site.No findings
Why it is in this group
- The name "patch_calendar" says "patch": a word for a change.
Description, as the server wrote it Lay out the change days for an HRT estradiol patch from the day the first patch goes on, and rotate the application site. Products: estradot, evorel, evorel_conti, estraderm_mx (twice weekly); femseven, femseven_conti, progynova_ts (weekly). Optional weeks to show (default 8). SmPC change interval, not dosing advice.
pen_howtoGive the step-by-step injection walkthrough for a GLP-1 pen (Mounjaro KwikPen, Wegovy, Ozempic or Saxenda), from the maker's UK instructions.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Give the step-by-step injection walkthrough for a GLP-1 pen (Mounjaro KwikPen, Wegovy, Ozempic or Saxenda), from the maker's UK instructions. Returns the ordered steps and the symptom list you can troubleshoot. Routes to the leaflet; not a substitute for it.
pen_troubleshootAnswer a GLP-1 pen problem (won't dial, no clicks, stuck, not at zero, no drop at the needle, a bubble, a leak, cold, unsure) for a given pen, from the maker's UK leaflet.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Answer a GLP-1 pen problem (won't dial, no clicks, stuck, not at zero, no drop at the needle, a bubble, a leak, cold, unsure) for a given pen, from the maker's UK leaflet. Returns what it means and what to do, with when to stop and call the pharmacist.
protein_targetWork out a daily protein target for someone losing weight on a GLP-1, from weight (and height, which sharpens it) and activity level.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Work out a daily protein target for someone losing weight on a GLP-1, from weight (and height, which sharpens it) and activity level. Returns grams per day with the band and which body-weight basis was used. General information, not personalised dietetic advice.
providers_checkCheck a provider by name, website URL or postcode against our CQC/GPhC register data.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Check a provider by name, website URL or postcode against our CQC/GPhC register data. Returns whether it is a registered, listable provider and its registration wording, with how it was resolved. If we don't hold it, returns the official register to search by hand. Never a guess.
storage_checkSay whether a GLP-1 pen or a reconstituted peptide vial is still good, given the situation (unopened, in use in the fridge, or left out) and, if left out, how long and how warm.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Say whether a GLP-1 pen or a reconstituted peptide vial is still good, given the situation (unopened, in use in the fridge, or left out) and, if left out, how long and how warm. Returns a graded verdict with the SmPC in-use limit. No dosing.
supply_runoutWork out when an HRT or testosterone gel, spray or sachet pack runs out and when to reorder.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Work out when an HRT or testosterone gel, spray or sachet pack runs out and when to reorder. Inputs: product (oestrogel, sandrena, lenzetto, testogel_pump, testogel_sachet, tostran), doses per day, optional containers, pack-opened date and reorder lead days. Returns doses left, days, run-out and order-by dates. Counts are estimates for metered packs.
waist_ratioWaist-to-height ratio from waist and height, against the NICE bands (keep your waist under half your height).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Waist-to-height ratio from waist and height, against the NICE bands (keep your waist under half your height). Flags central-fat risk that BMI can miss. For adults with BMI under 35. General information, not a diagnosis.
weight_idealHealthy-weight range for a given height, from the healthy BMI band (18.5-24.9), with the BMI-22 midpoint as a single figure.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Healthy-weight range for a given height, from the healthy BMI band (18.5-24.9), with the BMI-22 midpoint as a single figure. There is no one 'ideal weight'; this is the healthy range. General information.
Only reads 6Show 6 read-only tools
compounds_getGet one compound's UK legal status: whether it is licensed, in trials, cosmetic or unlicensed, the evidence and risks, and the licensed alternative.No findings
Why it is in this group
- The name "compounds_get" says "get": a word for reading.
Description, as the server wrote it Get one compound's UK legal status: whether it is licensed, in trials, cosmetic or unlicensed, the evidence and risks, and the licensed alternative. Returns sources and dates. No dosing is included, by design.
compounds_listList the UK peptide/compound profiles with their UK legal status (licensed, in trials, cosmetic, or research/unlicensed).No findings
Why it is in this group
- The name "compounds_list" says "list": a word for reading.
Description, as the server wrote it List the UK peptide/compound profiles with their UK legal status (licensed, in trials, cosmetic, or research/unlicensed). Filter by status or category. Returns name, aka, class, status and the licensed alternative. A legal-status index, not a dosing tool.
guides_listBrowse On the Register's plain-English UK guides to weight-loss medicines and the providers who supply them: checking a provider, cost and NHS access, using a pen, and side effects…Reads text others writeNo findings
Why it is in this group
- The name "guides_list" says "list": a word for reading.
What it can reach
- untrusted-inputThe description's first sentence says "browse": it reads web pages, which anyone can write.
Description, as the server wrote it Browse On the Register's plain-English UK guides to weight-loss medicines and the providers who supply them: checking a provider, cost and NHS access, using a pen, and side effects and treatment. Filter by category. Returns each guide's title, summary and page URL to link as further reading.
providers_getGet one registered provider by its slug: its registration wording and rating, the treatments it offers, its locations, and its own published consultation fee where known.No findings
Why it is in this group
- The name "providers_get" says "get": a word for reading.
Description, as the server wrote it Get one registered provider by its slug: its registration wording and rating, the treatments it offers, its locations, and its own published consultation fee where known. Returns null if the slug is not a listable provider. Registration facts only, no recommendation.
providers_searchFind UK providers that offer a treatment and are on the CQC/GPhC register.No findings
Why it is in this group
- The name "providers_search" says "search": a word for reading.
Description, as the server wrote it Find UK providers that offer a treatment and are on the CQC/GPhC register. Filter by treatment (glp1-weight-loss, hormone-therapy, iv-therapy, vitamin-injections), kind (online/clinic/mobile), nation, town slug, a name search, or near a postcode. Sort by distance, CQC rating, Google rating or review count. Returns listings with registration wording, the Google rating and the provider's own consultation fee where published. Lists, never ranks by price or recommends.
sideeffects_listList the SmPC side effects of a GLP-1/GIP injection (Mounjaro, Wegovy, Ozempic, Saxenda) by frequency band, plus the serious warnings with what to do (999/111/prescriber) and the Y…No findings
Why it is in this group
- The name "sideeffects_list" says "list": a word for reading.
Description, as the server wrote it List the SmPC side effects of a GLP-1/GIP injection (Mounjaro, Wegovy, Ozempic, Saxenda) by frequency band, plus the serious warnings with what to do (999/111/prescriber) and the Yellow Card link. General leaflet information, not a prediction and not triage.
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Exfil surface
Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.
No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data or outbound.
- Reads private data0
- Reads files, mail, messages, databases, secrets, calendars or repositories.
- Reads text others write1
- Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
- Can send data out0
- Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.
Remote posture
What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.
Looked at Nov 8, 2026, 06:19 UTC, unchanged since Nov 8, 2026. No credentials were sent and no tool was called. What is looked at.
- Reachable
- yes
- HTTP status of an anonymous initialize
- 200
- tools/list served without credentials
- yes
- Tools that change things, listed without credentials
- 17
- Protocol version
- 2025-03-26
- WWW-Authenticate on 401
- not observed
- resource_metadata in WWW-Authenticate
- not observed
- RFC 9728 protected resource metadata
- not observed
- Authorization servers
- not observed
- Legacy HTTP+SSE transport
- no
- Dynamic client registration
- not observed
- Client ID metadata documents
- not observed
- WarnThe whole server
The endpoint served tools/list without credentials, and the list has 17 tools that change things (17 write). Whether a call also works without credentials was not tested: tools are never called.
What this check looks forMatched text
https://ontheregister.co.uk/api/mcp: tools/list returned 23 tools to an anonymous client, including calc_reconstitute (write), calc_convert (write), storage_check (write), supply_runout (write), patch_calendar (write) and 12 more
Findings
Matches of fixed checks, with the text they matched.
No check matched anything in these tool definitions. That is not a safety guarantee.
History
Changes to its tool definitions and to its remote endpoint, newest first.
No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.
Install
Pinned to version 0.1.0. Values in angle brackets are yours to fill in.
claude mcp add --transport http on-the-register https://ontheregister.co.uk/api/mcpclaude mcp add --transport http on-the-register https://ontheregister.co.uk/api/mcpRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__on-the-register__sideeffects_list",
"mcp__on-the-register__providers_search",
"mcp__on-the-register__providers_get",
"mcp__on-the-register__compounds_list",
"mcp__on-the-register__compounds_get",
"mcp__on-the-register__guides_list"
],
"ask": [
"mcp__on-the-register__calc_reconstitute",
"mcp__on-the-register__calc_convert",
"mcp__on-the-register__storage_check",
"mcp__on-the-register__supply_runout",
"mcp__on-the-register__patch_calendar",
"mcp__on-the-register__howlong_timeline",
"mcp__on-the-register__howlong_clearance",
"mcp__on-the-register__pen_howto",
"mcp__on-the-register__pen_troubleshoot",
"mcp__on-the-register__compare_medicines",
"mcp__on-the-register__protein_target",
"mcp__on-the-register__bmi_check",
"mcp__on-the-register__weight_ideal",
"mcp__on-the-register__waist_ratio",
"mcp__on-the-register__fluid_target",
"mcp__on-the-register__energy_tdee",
"mcp__on-the-register__providers_check"
],
"deny": []
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as on-the-register. Review it before you use it.
Capability tags behind 1 rule
- mcp__on-the-register__guides_list untrusted-input
Pin
Keep the decision: fail CI when the tools change, follow every change, or show a badge.
Pin in CI
Fail a build when the tools you reviewed are not the tools the server serves today.
curl -s "https://anlyon.dev/api/v1/servers/uk.co.ontheregister/on-the-register/verify?hash=4edc34bddb5351aae09601a5f59f6d42827c31b6ee30134eaa642e8854975ccb" | jq -e '.changed == false'Pinned hash 4edc34bddb53, from Nov 7, 2026, 10:18 UTC.
Watch
Get told when its tools change: a new tool, a new description, a new class.
https://anlyon.dev/servers/uk.co.ontheregister/on-the-register/changes.xmlAn Atom feed. Works in any feed reader or Slack's RSS app.
Badge
[](https://anlyon.dev/servers/uk.co.ontheregister/on-the-register)Source: MCP Registry. Synced Nov 7, 2026, 10:18 UTC.
On the Register MCP server: questions and answers
Answered from the scan above, not from the publisher's description.
Is the On the Register MCP server safe?
- No scan can promise that. What its definitions show: 23 tools, 17 of which can change, send or delete something, and 0 findings from fixed checks. Allow the reads, ask before each change, and deny the deletes; the permissions block on this page does that.
Can the On the Register MCP server delete data?
- No tool is classed as destructive: going by their definitions, none of them deletes, cancels or revokes anything.
Can the On the Register MCP server do things that cannot be undone?
- No tool is classed as irreversible: none of them sends, pays, publishes or merges, going by their definitions.
What tools does the On the Register MCP server have?
- 23 tools: 17 write, 6 read. calc_reconstitute, calc_convert, storage_check, supply_runout, patch_calendar, howlong_timeline, howlong_clearance, pen_howto and 15 more.
Does the On the Register MCP server need sign-in or OAuth?
- Its remote endpoint listed its tools to an anonymous client, without sign-in.
Does the On the Register MCP server send data to outside services?
- None of its tools sends, posts or publishes, or takes a recipient, channel or URL.
Has the On the Register MCP server changed its tools?
- Not since anlyon.dev started tracking it. Last scanned Nov 7, 2026.