Loading…
South African window coverings catalog enabling AI agents to search products, get live pricing, and place orders.
Do not connect
A critical issue was found. Do not connect this server as-is.
Scanned 1 month ago Due for re-check
A server can change after it's graded. Re-run the automated scan to refresh this report.
This grade is deterministic and reproducible: the same server surface always yields the same grade under a given algorithm version. It is a real automated assessment computed by the MCPGrade engine from what the probe actually observed — not a fabricated or opinion score. It is not a manual human pentest, so it can miss context-specific risks.
Every signal below was measured directly by the automated probe. The grade is derived only from evidence like this — nothing is assumed.
The custom-blinds-shop MCP server exposes 26 tools, focused primarily on web capabilities. Its published description reads: "South African window coverings catalog enabling AI agents to search products, get live pricing, and place orders". It communicates over Streamable HTTP using the 2026-07-28 protocol revision, and does not require authorization to connect. MCPGrade currently rates custom-blinds-shop F — a critical issue was found and the server should not be connected as-is. Its most notable findings include "Cross-tool shadowing" and "Cross-tool shadowing". This report is a deterministic, reproducible automated assessment: the same observed surface always yields the same grade under a given algorithm version, and it is refreshed as new scans arrive and free to read — but it is not a substitute for a manual human security review. Always re-check custom-blinds-shop's advertised tools, transport security, and authorization posture before connecting an autonomous agent or sharing sensitive context with it.
Add custom-blinds-shop to an MCP client using the endpoint below. Review the grade and findings above before granting an autonomous agent access.
MCP endpoint
https://shop.customblinds.co.za/mcpStreamable HTTP transport. This is the MCP endpoint, not a website — paste it into your MCP client server list rather than a browser.
Captured passively during the read-only scan. Click any value to find servers that match it.
The tools this server advertises via tools/list — names, purposes, and the parameters each accepts, exactly as enumerated read-only.
Use when the customer hasn't specified a product ID yet. Filters by blind type (roller, venetian, honeycomb, vertical, outdoor), colour name, or maximum window dimensions in mm. Returns product_id, na
Get an exact ZAR price for a product at specific dimensions. Requires product_id (from search_products or lookup_catalog), width_mm, and height_mm. Returns unit_price_zar and total_price_zar (VAT incl
Lock in a full blind specification: product, dimensions, colour, and mount type (inside recess or outside face-fix). Validates that the colour exists and is in stock, then prices the blind. Returns a
Legacy auth-required tool — prefer the open UCP flow (create_cart → create_checkout → complete_checkout) for credentialless checkout. Use submit_enquiry only when the customer wants a sales team follo
Legacy auth-required tool — prefer the open UCP flow (create_cart → create_checkout → complete_checkout) which needs no credentials. Use create_order only if you hold a Bearer token and want a single-
Free-text search across the full catalogue — use for open queries like 'blockout for bedroom' or 'wood venetian'. Returns id, name, category, description, and product_url. For filtering by category, c
Structured catalogue filter: narrow by category (roller | venetian | honeycomb | vertical | outdoor), colour name, max_width_mm, or max_height_mm. Ideal when the customer has stated a blind type. Retu
Fetch complete details for one product by id (e.g. roller-blockout, venetian-25mm-aluwood). Returns all available colours with in-stock status, materials, features, and maximum supported dimensions. U
Start the open UCP purchase flow — no auth needed. Creates a cart session and returns a cart_id (24-hour TTL). Optionally seed with pre-configured blind items and customer details. Next step: update_c
Retrieve live cart state by cart_id: full item list, calculated totals in ZAR, and any customer details stored so far. Call after update_cart to confirm changes are correct before proceeding to create
Modify an open cart before checkout. op: 'add' appends items, 'remove' drops items by 0-based index, 'set' replaces the full item list, 'clear' empties the cart. Merges customer details (name, email,
Permanently delete a cart by cart_id. Use when the customer abandons the session or wants to start over. Has no effect on any checkout or paid order already created from this cart. Irreversible — crea
Phase 1 of 2 in the purchase flow. Convert a cart (or inline items + customer) into a checkout. Customer name, email, and phone are required. Returns checkout_id. No payment link is minted yet — call
Poll a checkout by checkout_id. Returns status (pending | paid | cancelled), full item list, customer details, and payment_url if already minted. Use to verify customer details before calling complete
Correct customer details (name, email, phone, address) or switch payment_method (yoco | ozow) on an unpaid checkout before calling complete_checkout. Returns the updated checkout state. Raises an erro
Phase 2 of 2. Finalise a checkout and mint the payment link — Yoco for card payments or Ozow for instant EFT. Returns payment_url to share with the customer. Payment confirmation arrives via webhook;
Abort an unpaid checkout and release its checkout_id. Use if the customer changes their mind after create_checkout but before completing payment. Has no effect on orders already confirmed by webhook.
Retrieve a confirmed order's status, items, and payment details by order_id. customer_email is required as soft-auth and must exactly match the order record — prevents arbitrary order lookups. Returns
Verify whether a specific colour is available before configure_product. Returns in_stock boolean, expected_restock_date if out of stock, and up to 5 alternative in-stock colours ordered by similarity.
Register up to 5 colour swatches to be dispatched with the customer's order. Swatches ship at order placement only — they are NOT sent as a standalone postal sample before purchase. Capped at 5 codes
List available payment processors and their capabilities. Returns Yoco (card, immediate) and Ozow (instant EFT via South African bank account). Call when the customer asks 'how can I pay?' or before p
Generate a pre-filled WhatsApp deep link to hand the customer off to the right contact. Garden Route locations (Knysna, Plett, George, Sedgefield, etc.) route to Duncan Kane (+27795235407) for free in
Translate a customer's primary concern into a product recommendation. primary_concern must be one of: blockout, heat, glare, moisture, privacy, security, automation. Optionally narrow by room (bedroom
Surface the AR measurement tool or product visualizer when a customer wants to measure their window or preview a blind in their room. The AR tool uses a phone camera and an A4 page as a reference scal
Estimate when a new order will be dispatched. Production is 5 working days (Mon–Fri, excluding South African public holidays). Returns dispatch_date, production_days, and a plain-language summary safe
Submit a price match claim when the customer has found the same blind cheaper elsewhere. Custom Blinds matches verified South African retailer prices for identical product, dimensions, and specs. Retu
Sorted worst-first. Each finding shows its severity, what it means, its OWASP MCP Top-10 mapping, and a recommended fix — the check id links to the exact methodology row that produced it.
tool: search_products
A tool description tries to alter the model’s use of another tool.
e product_id to get_price or configure_product as the next step.RecommendationDescriptions must describe only their own tool.
tool: get_price
A tool description tries to alter the model’s use of another tool.
roduct_id (from search_products or lookup_catalog), width_mm, and height_mm. ReRecommendationDescriptions must describe only their own tool.
tool: configure_product
A tool description tries to alter the model’s use of another tool.
s directly into create_cart. Call check_colour_stock first if availabilityRecommendationDescriptions must describe only their own tool.
tool: submit_enquiry
A tool description tries to alter the model’s use of another tool.
r token. Pass a configure_product output plus customer name, email, and phone. TeRecommendationDescriptions must describe only their own tool.
tool: create_order
A tool description tries to alter the model’s use of another tool.
open UCP flow (create_cart → create_checkout → complete_checkout) which neRecommendationDescriptions must describe only their own tool.
tool: search_catalog
A tool description tries to alter the model’s use of another tool.
get_product or get_price.RecommendationDescriptions must describe only their own tool.
tool: lookup_catalog
A tool description tries to alter the model’s use of another tool.
roduct_url. Use search_catalog for open-ended natural language queries.RecommendationDescriptions must describe only their own tool.
tool: get_product
A tool description tries to alter the model’s use of another tool.
ons. Use before configure_product to confirm a colour exists and is in stock befoRecommendationDescriptions must describe only their own tool.
tool: create_cart
A tool description tries to alter the model’s use of another tool.
ils. Next step: update_cart to add items, then create_checkout → complete_cRecommendationDescriptions must describe only their own tool.
tool: get_cart
A tool description tries to alter the model’s use of another tool.
far. Call after update_cart to confirm changes are correct before proceedinRecommendationDescriptions must describe only their own tool.
tool: update_cart
A tool description tries to alter the model’s use of another tool.
mer field. Call get_cart afterwards to confirm. Cannot modify a cart thaRecommendationDescriptions must describe only their own tool.
tool: create_checkout
A tool description tries to alter the model’s use of another tool.
t for that. Use update_checkout to correct customer details before finalising.RecommendationDescriptions must describe only their own tool.
tool: get_checkout
A tool description tries to alter the model’s use of another tool.
before calling complete_checkout, or to retrieve the payment_url if complete_cheRecommendationDescriptions must describe only their own tool.
tool: update_checkout
A tool description tries to alter the model’s use of another tool.
before calling complete_checkout. Returns the updated checkout state. Raises anRecommendationDescriptions must describe only their own tool.
tool: complete_checkout
A tool description tries to alter the model’s use of another tool.
is locked — use cancel_checkout to abort if the customer changes their mind befRecommendationDescriptions must describe only their own tool.
tool: cancel_checkout
A tool description tries to alter the model’s use of another tool.
heir mind after create_checkout but before completing payment. Has no effect onRecommendationDescriptions must describe only their own tool.
tool: check_colour_stock
A tool description tries to alter the model’s use of another tool.
vailable before configure_product. Returns in_stock boolean, expected_restock_datRecommendationDescriptions must describe only their own tool.
tool: get_payment_methods
A tool description tries to alter the model’s use of another tool.
method field in create_checkout and complete_checkout.RecommendationDescriptions must describe only their own tool.
tool: get_whatsapp_handoff
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "product_context"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: get_product_recommendation
A tool description tries to alter the model’s use of another tool.
le — pass it to get_price or configure_product next. Security concern rouRecommendationDescriptions must describe only their own tool.
tool: request_price_match
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "competitor_url"RecommendationRemove side-channel parameters; constrain tool inputs.
The server accepts tool enumeration (and likely invocation) with no authentication.
RecommendationRequire OAuth 2.1 authorization for any server exposing non-public tools.
tool: create_cart
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "create_cart"RecommendationScope tools to the minimum needed.
tool: update_cart
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "update_cart"RecommendationScope tools to the minimum needed.
tool: cancel_cart
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "cancel_cart"RecommendationScope tools to the minimum needed.
tool: cancel_checkout
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "cancel_checkout"RecommendationScope tools to the minimum needed.
tool: get_ar_visualizer_url
The server advertises open-world / broadly-scoped capabilities.
no annotations on write-capable tool "get_ar_visualizer_url"RecommendationScope tools to the minimum needed.
Vantaj uptime monitoring via MCP — manage monitors, heartbeats, incidents, and status pages.
Unified gateway to Algeria's TKAWEN ecosystem: commerce, certification, and AI tools.
Provides access to the Cohereon Doctrine AI safety framework with governance components, tiered access, and agent onboarding.
Agentic rails for complex workflows with receipts, fees, and MCP tool access.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.