com.cordering/whitelabel-ordering

Est-ce que com.cordering/whitelabel-ordering est sûr ?

Au dernier audit MCP Hub, le serveur MCP « com.cordering/whitelabel-ordering » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 10 outils

• check_order≈ 234 tokens

  Check the current status of an order the user has already placed, using the order number returned by place_order. Reports whether the restaurant has accepted it, whether it is on its way, and whether it has finished (delivered or declined). There is no background tracking and no notification: call this again when the user asks, and only until the order is reported as finished.

  Paramètres, retour & exemple (2)

  Paramètres

  • orderId · integer · requis
    The order number returned by place_order.
  • clientId · integer · optionnel
    clientId of the restaurant the order was placed with, from the list_vendors result. Omit only when the server is configured for a single restaurant.

  Exemple d'appel

  {"name": "check_order", "arguments": {"orderId": 1}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• list_accounts≈ 104 tokens

  Show which accounts are signed in, per restaurant, and which one is active. Useful when the user keeps separate work and personal accounts.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "list_accounts", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• list_menu≈ 231 tokens

  Show the restaurant's menu to the user as a visual HTML document — a horizontally-scrollable category strip with item photos, names and prices. Present the returned HTML by opening it as an HTML artifact; do NOT paste the markup into the chat as text. (Ordering does not require this — prepare_order resolves item names on its own.)

  Paramètres, retour & exemple (2)

  Paramètres

  • clientId · integer · optionnel
    clientId of the restaurant, from a list_vendors result. Omit only when the server is configured for a single restaurant.
  • vendorId · integer · optionnel
    vendorId of the restaurant, from a list_vendors result. Omit only when the server is configured for a single restaurant.

  Exemple d'appel

  {"name": "list_menu", "arguments": {"clientId": 1, "vendorId": 1}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• list_vendors≈ 261 tokens

  Find restaurants (vendors) available for ordering. This is the discovery entry point: each card shows the clientId and vendorId that list_menu and prepare_order need. Call it with no arguments to list every restaurant — that is the normal case. Returns a complete, self-contained HTML document of vendor cards (logo, address, phone, delivery fee) — restaurants open today first in colour, those closed today greyed out at the bottom. Present the returned HTML to the user by opening it as an HTML artifact; do not paste the markup into the chat.

  Paramètres, retour & exemple (1)

  Paramètres

  • city · string · optionnel
    City to filter by. Pass this ONLY when the user named a city themselves; never guess one from context, because a filter that matches nothing hides restaurants the user could have ordered from.

  Exemple d'appel

  {"name": "list_vendors", "arguments": {"city": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• login≈ 220 tokens

  Start signing the user in to a restaurant so they can place orders. Browsing the menu never needs this — only ordering and saving an address do. Returns a URL the user must open in a browser to sign in with Google or Apple; afterwards they copy the 'code' value from the address bar and you call submit_login_code. Each restaurant has its own login, so this must be done per restaurant.

  Paramètres, retour & exemple (1)

  Paramètres

  • clientId · integer · optionnel
    clientId of the restaurant to sign in to, from a list_vendors result. Omit only when the server is configured for a single restaurant.

  Exemple d'appel

  {"name": "login", "arguments": {"clientId": 1}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• logout≈ 175 tokens

  Sign the user out. By default signs out of every restaurant; pass a clientId to sign out of one, and an account label to sign out just that account.

  Paramètres, retour & exemple (2)

  Paramètres

  • label · string · optionnel
    Account label to sign out, e.g. 'work'. Omit to sign out every account at that restaurant.
  • clientId · integer · optionnel
    clientId of the restaurant to sign out of. Omit to sign out everywhere.

  Exemple d'appel

  {"name": "logout", "arguments": {"label": "texte", "clientId": 1}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• place_order≈ 149 tokens

  Place an order previously staged by prepare_order. Requires the confirmationToken returned by prepare_order. This causes a real order to be sent to the vendor.

  Paramètres, retour & exemple (1)

  Paramètres

  • confirmationToken · string · requis
    The confirmationToken returned by prepare_order.

  Exemple d'appel

  {"name": "place_order", "arguments": {"confirmationToken": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• prepare_order≈ 786 tokens

  Resolve a natural-language food order (one or more items) to concrete menu items and return a summary plus a confirmation token. Does NOT place the order. Call place_order with the returned token to actually place it. Delivery is as soon as possible by default; pass 'date' to ask for a later time instead. Each call covers one delivery, so an order for more than one day means one call per day. The restaurant may still refuse a time it is not open for.

  Paramètres, retour & exemple (8)

  Paramètres

  • date · string · optionnel
    Delivery date-time as an ISO-8601 UTC instant, e.g. '2026-07-25T12:00:00Z'. Must be in the future. Defaults to 5 minutes from now (as soon as possible) — only pass this when the user asks for a specific time.
  • items · array · requis
    The item(s) to order — one or more lines, each with an item name, an optional quantity (default 1), an optional size, and optional extra ingredients by name.
  • notes · string · optionnel
    Optional notes for the vendor.
  • cutlery · boolean · optionnel
    Whether to ask the restaurant to include disposable cutlery. Only pass this when the user says either way; omit to leave it to the restaurant's default. Ignored (with a note) by vendors that do not offer it.
  • clientId · integer · optionnel
    clientId of the restaurant, from a list_vendors result. Omit only when the server is configured for a single restaurant.
  • vendorId · integer · optionnel
    vendorId of the restaurant, from a list_vendors result. Omit only when the server is configured for a single restaurant.
  • bringTerminal · boolean · optionnel
    Whether the courier should bring a card terminal so the order can be paid by card on delivery. Pass true when the user wants to pay by card, false for cash; omit when they do not say. Ignored (with a note) by vendors that cannot take card on delivery.
  • deliveryAddress · string · requis
    Delivery address text, e.g. 'Orlovica Pavla 26'.

  Exemple d'appel

  {"name": "prepare_order", "arguments": {"items": [], "deliveryAddress": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• submit_login_code≈ 222 tokens

  Complete a sign-in started by login, using the 'code' value the user copied from the browser address bar. On success the user can place orders from that restaurant.

  Paramètres, retour & exemple (3)

  Paramètres

  • code · string · requis
    The code value copied from the redirect URL after signing in.
  • label · string · optionnel
    Optional label for this account, e.g. 'work' or 'personal'. Defaults to the email address on the account.
  • clientId · integer · optionnel
    clientId of the restaurant being signed in to. Omit if only one sign-in is in progress.

  Exemple d'appel

  {"name": "submit_login_code", "arguments": {"code": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• switch_account≈ 176 tokens

  Choose which signed-in account to order with at a restaurant, e.g. to switch between work and personal. The account must already be signed in via login.

  Paramètres, retour & exemple (2)

  Paramètres

  • label · string · requis
    Account label to make active, e.g. 'work'.
  • clientId · integer · optionnel
    clientId of the restaurant. Omit only when the server is configured for a single restaurant.

  Exemple d'appel

  {"name": "switch_account", "arguments": {"label": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://wl-mcp.cordering.com/mcp