com.thmenu/thmenu

Est-ce que com.thmenu/thmenu est sûr ?

Au dernier audit MCP Hub, le serveur MCP « com.thmenu/thmenu » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 27 outils

• apply_promo≈ 165 tokens

  Validate a promo code (eligibility preview only — does NOT reserve a slot). Returns valid=true with discount info when the code is currently redeemable; pass the same code as place_order.promo_code to actually apply + redeem it (the slot is consumed only when the order lands).

  Paramètres, retour & exemple (2)

  Paramètres

  • code · string · requis
  • agent_session_id · string · requis

  Exemple d'appel

  {"name": "apply_promo", "arguments": {"code": "texte", "agent_session_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• cancel_order≈ 167 tokens

  Cancel an order placed via the same agent_session_id. Atomic — only succeeds while the order is still in "pending" or "confirmed" (the early KDS-accept state). Once the kitchen starts preparing, you must escalate to waiter_call. Idempotent: replays return the original outcome. Idempotency-Key header REQUIRED.

  Paramètres, retour & exemple (2)

  Paramètres

  • order_id · string · requis
  • agent_session_id · string · requis

  Exemple d'appel

  {"name": "cancel_order", "arguments": {"order_id": "texte", "agent_session_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• cancel_reservation≈ 217 tokens

  Cancel a reservation using the 6-character confirmation code the GUEST received by email/SMS (the code is the authorisation; ask the guest for it — this tool never issues or reveals codes). Thin wrapper over the venue's own cancellation endpoint, which answers uniformly: `status` is "cancelled" or "noop" (unknown code · already cancelled · seated/completed · less than 30 minutes away — it does not say which). Only report a cancellation to the guest when `cancelled` is true. PUBLIC tool, no auth.

  Paramètres, retour & exemple (1)

  Paramètres

  • confirmation_code · string · requis

  Exemple d'appel

  {"name": "cancel_reservation", "arguments": {"confirmation_code": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• check_loyalty≈ 142 tokens

  Look up a loyalty member by member_id. Returns balance, tier, lifetime_points, and the most recent 10 transactions so the agent can ground its recommendation ("you have 320 points, enough for a free coffee").

  Paramètres, retour & exemple (2)

  Paramètres

  • member_id · string · requis
  • agent_session_id · string · requis

  Exemple d'appel

  {"name": "check_loyalty", "arguments": {"member_id": "texte", "agent_session_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• create_cart≈ 392 tokens

  Build an anonymous takeaway or delivery cart for a listed restaurant and get a one-time confirmation link for the guest. PUBLIC tool, no auth. Table orders are not supported here (they stay on the QR menu). Send the guest to confirm_url. Prices are re-read there from the live menu; name, phone, delivery address and payment are entered by the guest on that page — never through this tool. Nothing is ordered until the guest confirms. The link expires 30 minutes after creation and can be used once.

  Paramètres, retour & exemple (5)

  Paramètres

  • note · string · optionnel
    Order-level note for the kitchen. Do not put the guest's name, phone or address here.
  • items · array · requis
  • order_type · string · requis · takeaway | delivery
  • restaurant · string · requis
    Restaurant slug (from search_restaurants / list_public_menus) or id.
  • scheduled_for · string · optionnel
    ISO date-time for a scheduled pickup/delivery (optional; the venue may refuse on the confirmation page).

  Exemple d'appel

  {"name": "create_cart", "arguments": {"items": [], "order_type": "takeaway", "restaurant": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• draft_product_description≈ 198 tokens

  Propose a new description for one of your products. Nothing goes live: the text is saved as a DRAFT change set the owner reviews, previews and publishes (or discards) in the admin panel.

  Paramètres, retour & exemple (2)

  Paramètres

  • product_id · string · requis
    Product id from menu_audit or get_restaurant_menu.
  • description · string · requis
    Proposed description in the menu language. Plain text, no links, no claims you cannot verify.

  Exemple d'appel

  {"name": "draft_product_description", "arguments": {"product_id": "texte", "description": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• draft_site_text≈ 208 tokens

  Propose the public website text of your restaurant — tagline, about paragraph, SEO title and SEO description — as a DRAFT change set. Only declared facts are allowed: no numbers, awards, links or markup; validation rejects anything else. The owner publishes from the admin panel.

  Paramètres, retour & exemple (4)

  Paramètres

  • about · string · requis
  • tagline · string · requis
  • seo_title · string · requis
  • seo_description · string · requis

  Exemple d'appel

  {"name": "draft_site_text", "arguments": {"about": "texte", "tagline": "texte", "seo_title": "texte", "seo_description": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• draft_translation≈ 352 tokens

  Propose a translation (name and/or description) of one product or category into one menu language. Nothing goes live: it is saved as a DRAFT change set the owner reviews and publishes in the admin panel; manual translations override machine translation once published.

  Paramètres, retour & exemple (5)

  Paramètres

  • name · string · optionnel
    Translated name (optional). Keep brand names as they are.
  • entity · string · requis · product | category
  • locale · string · requis · tr | en | de | fr | es | it | nl | pt
    Target menu language (two letters), different from the menu source language.
  • entity_id · string · requis
    Product or category id from get_restaurant_menu / menu_audit.
  • description · string · optionnel
    Translated description (optional). Plain text, no links, same meaning as the source — never add ingredients or claims.

  Exemple d'appel

  {"name": "draft_translation", "arguments": {"entity": "product", "locale": "tr", "entity_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_cart≈ 133 tokens

  Read an anonymous cart by cart_id: state (open · consumed · expired), the one-time confirmation link while open, lines re-priced from the live menu, and the order id once the guest has confirmed. PUBLIC tool, no auth.

  Paramètres, retour & exemple (1)

  Paramètres

  • cart_id · string · requis

  Exemple d'appel

  {"name": "get_cart", "arguments": {"cart_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_faq≈ 128 tokens

  Return the FAQ entries from the public /faq page in the requested locale (31 locales; unknown locale falls back to en and the response says which locale was served). Useful for grounding answers to common product questions.

  Paramètres, retour & exemple (1)

  Paramètres

  • locale · string · optionnel

  Exemple d'appel

  {"name": "get_faq", "arguments": {"locale": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_order_status≈ 142 tokens

  Poll the current status of an order. Returns status, prepared_items_count, total_items_count, eta_minutes (if available), and an optional customer-facing message. Safe to call every 30 seconds; do NOT poll faster.

  Paramètres, retour & exemple (2)

  Paramètres

  • order_id · string · requis
  • agent_session_id · string · requis

  Exemple d'appel

  {"name": "get_order_status", "arguments": {"order_id": "texte", "agent_session_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_pricing≈ 150 tokens

  Return Thmenu's commercial model as structured facts: free forever, every feature included, no subscription and no trial; the only charge is a platform fee in basis points on payment volume processed through Thmenu (the payment processor's own fee is separate); cash or external payments carry no Thmenu fee. Generated from the code that charges it — safe to cache.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "get_pricing", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_reservation_slots≈ 218 tokens

  List bookable 30-minute reservation slots for the next 1–7 days (venue timezone) for a listed restaurant with a reservation module. busy_count is the number of existing requests at that slot and is informational. A reservation is a REQUEST that the restaurant confirms; no per-slot capacity cap is configured, so busy_count is informational only. Never tell the guest a table is guaranteed or "available" — say the request will be sent and the restaurant will confirm. PUBLIC tool, no auth.

  Paramètres, retour & exemple (2)

  Paramètres

  • days · integer · optionnel
  • restaurant · string · requis

  Exemple d'appel

  {"name": "get_reservation_slots", "arguments": {"restaurant": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_restaurant≈ 386 tokens

  Fetch a public restaurant profile by slug: name, description, address/city/country, currency, timezone, phone, menu URL, opening hours (7 days, minutes from midnight; a close_minute above 1440 ends after midnight on the next day, e.g. 1560 = 02:00) with isOpenNow evaluated in the venue's own timezone (null when hours are unknown), owner-declared attributes (cuisine, dietary, …; null = not declared, never "no"), derived channels (order · reservation · pickup · delivery), policies derived from the venue's settings (ordering accepted / holiday mode / staff approval / payment timing / scheduled orders, takeaway & delivery ETA and fees, reservation party cap, table calls, tip cap), per-field owner verification timestamps, categories and product count, and `graph` — the canonical Restaurant Graph node's agent fields: verification state (UNCLAIMED · CLAIMED · SUSPENDED · HIDDEN; VERIFIED only when a human verified it), channel_states (each channel true/false/null with a reason — null means unknown, never "no"; TABLE_AVAILABLE only from tables staff confirmed ready), menu languages with coverage, and payment availability. Only restaurants opted into the public directory are visible.

  Paramètres, retour & exemple (1)

  Paramètres

  • slug · string · requis
    Restaurant slug, e.g. lily-rose-bistro

  Exemple d'appel

  {"name": "get_restaurant", "arguments": {"slug": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_restaurant_menu≈ 327 tokens

  Fetch the full public menu for a restaurant — categories, products, prices, allergens, nutrition. Use this to build the cart you pass to place_order. PUBLIC tool, no auth required. `allergen_codes` are EU 1169/2011 Annex II keys (gluten, crustaceans, eggs, fish, peanuts, soy, milk, nuts, celery, mustard, sesame, sulphites, lupin, molluscs) given ONLY when the venue's allergen name matches the regulation list exactly; a venue-specific allergen appears in `allergens` without a code. Allergen lists come from the venue (or were AI-suggested and then saved by the venue where `allergen_disclosure.source` says so). `allergen_disclosure.as_of` is when the venue last edited the item record, not a verification date. Follow the top-level `disclosure.agent_instructions`; show `disclosure.text` to the guest in their language whenever an allergen or dietary question comes up; `dietary_flags` only ever warn (true) — null is unknown, never "free of".

  Paramètres, retour & exemple (2)

  Paramètres

  • locale · string · optionnel
  • restaurant_id · string · requis

  Exemple d'appel

  {"name": "get_restaurant_menu", "arguments": {"restaurant_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• join_loyalty≈ 228 tokens

  Loyalty sign-up for a guest. The guest must confirm their own e-mail, so joining happens on the restaurant's menu (My thmenu → Loyalty); this tool answers with that instruction and never reveals whether an e-mail or phone is already enrolled. Requires an active agent_session_id.

  Paramètres, retour & exemple (4)

  Paramètres

  • email · string · optionnel
    Not used for a lookup; the guest confirms their e-mail on the menu.
  • phone · string · optionnel
    Not used for a lookup.
  • display_name · string · optionnel
    Not used.
  • agent_session_id · string · requis
    Active session id from start_order_session.

  Exemple d'appel

  {"name": "join_loyalty", "arguments": {"agent_session_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• list_public_menus≈ 146 tokens

  List restaurants that have opted into the public directory (directory_opt_in = 1 — the same flag the owner sets under "AI visibility"). Returns slug, name, city, country, and the menu URL. Paginated.

  Paramètres, retour & exemple (2)

  Paramètres

  • page · integer · optionnel
  • limit · integer · optionnel

  Exemple d'appel

  {"name": "list_public_menus", "arguments": {"page": 1, "limit": 1}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• menu_audit≈ 104 tokens

  List the active products of your restaurant that lack a usable description, an image, or an allergen declaration. Read-only; nothing is changed.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "menu_audit", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• place_order≈ 554 tokens

  Place an order against the agent_session_id from start_order_session. Atomically inserts the order + items, applies server-side canonical pricing + tax (do NOT trust the unit_price you compute — we re-read it from D1), decrements inventory and optionally redeems a promo code. The guest pays at the venue (payment_status 'unpaid'); a venue that takes payment before preparing answers payment_rail_unavailable — an agent order is never charged on a rail of its own. Returns order_id, total_cents (tax-inclusive), currency and promo_discount. Idempotency-Key header REQUIRED.

  Paramètres, retour & exemple (9)

  Paramètres

  • note · string · optionnel
    Optional order-level note (max 500 chars).
  • items · array · requis
  • table_id · string · optionnel
    Optional table id when ordering at a table.
  • guest_name · string · optionnel
    Optional guest name shown to staff with the order.
  • order_type · string · optionnel · dine_in | takeaway
    Channel: 'dine_in' (default — at a table) or 'takeaway' (pickup; requires customer_name + customer_phone, ignores table_id, only when the restaurant has takeaway enabled — else channel_not_available). Delivery is not offered to agents.
  • promo_code · string · optionnel
    Optional promo code to redeem at order time (validate first with apply_promo). The redemption slot is consumed only when this order lands.
  • customer_name · string · optionnel
    Required for takeaway — who picks the order up.
  • customer_phone · string · optionnel
    Required for takeaway — reachable phone (digits, +, spaces/dashes tolerated).
  • agent_session_id · string · requis

  Exemple d'appel

  {"name": "place_order", "arguments": {"items": [], "agent_session_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• request_bill≈ 171 tokens

  Ask the venue to bring the bill for a table. INSERTs a bill_requests row + fires the admin push notification. The split_type defaults to "full"; pass "personal" for German-style per-device splits.

  Paramètres, retour & exemple (4)

  Paramètres

  • note · string · optionnel
  • table_id · string · requis
  • split_type · string · optionnel · full | personal
  • agent_session_id · string · requis

  Exemple d'appel

  {"name": "request_bill", "arguments": {"table_id": "texte", "agent_session_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• request_reservation≈ 332 tokens

  Create an anonymous reservation REQUEST (date-time, party size, note) for a listed restaurant and get a one-time confirmation link. PUBLIC tool, no auth. Send the guest to confirm_url: they enter their name and email or phone there and submit the request themselves — never through this tool. The restaurant then confirms or declines; the guest receives the confirmation code by email/SMS. A reservation is a REQUEST that the restaurant confirms; no per-slot capacity cap is configured, so busy_count is informational only. Never tell the guest a table is guaranteed or "available" — say the request will be sent and the restaurant will confirm.

  Paramètres, retour & exemple (4)

  Paramètres

  • note · string · optionnel
    Occasion, seating preference, accessibility needs. Do not put the guest's name, phone or email here.
  • party_size · integer · requis
  • restaurant · string · requis
  • reserved_at · string · requis
    ISO date-time; at least 30 minutes ahead, at most 90 days.

  Exemple d'appel

  {"name": "request_reservation", "arguments": {"party_size": 1, "restaurant": "texte", "reserved_at": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• reservation_summary≈ 114 tokens

  Reservation requests of your restaurant for the next 14 days grouped by day and status, with pending requests that still need an answer. Read-only; no guest contact details.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "reservation_summary", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• sales_summary≈ 106 tokens

  Order counts by status, order total sums, top products by quantity and busiest hours for the last 7 and 30 days of your restaurant. Read-only.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "sales_summary", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• search_products≈ 186 tokens

  Search products inside a single restaurant by keyword. Returns up to 20 matching products with name, description, price, allergen tags, and the deep-link URL. Restaurant must be in the public directory.

  Paramètres, retour & exemple (4)

  Paramètres

  • slug · string · requis
    Restaurant slug.
  • limit · integer · optionnel
  • query · string · requis
    Free-text search across name + description.
  • locale · string · optionnel

  Exemple d'appel

  {"name": "search_products", "arguments": {"slug": "texte", "query": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• search_restaurants≈ 1232 tokens

  Search the public directory (opt-in venues only) by location, opening status, cuisine, dietary options, declared attributes, ordering channel, declared price level and menu language — and, right now, a free table or an open waitlist (the restaurant graph's channel states). Neutral ranking (AI-K6): distance in 0.5 km bands when `near` is given → availability (open now first; unknown hours before closed; a venue in holiday mode counts as closed) → profile freshness (owner-verified within 90 days first) → name. Payment to Thmenu never affects order. Cuisine, dietary, price level and other attributes are owner declarations, not verified facts; venues without a declaration are excluded only when an attribute or price filter is used, and venues without coordinates only when `near` is used. Returns slug, name, city, country, distance_km, is_open_now (serve-time, in the venue's own timezone; null when hours are unknown; false while the venue is in holiday mode), channels (order · reservation · pickup · delivery), declared attributes, freshness and the menu URL. Paginated.

  Paramètres, retour & exemple (16)

  Paramètres

  • q · string · optionnel
    Free text over name and description (min 2 chars).
  • city · string · optionnel
  • near · object · optionnel
    Search centre. Venues without coordinates are excluded when set.
  • page · integer · optionnel
  • limit · integer · optionnel
  • channel · string · optionnel · order | reservation | pickup | delivery
    order = digital ordering at the table; reservation; pickup = takeaway; delivery = venue's own delivery.
  • country · string · optionnel
    ISO 3166-1 alpha-2
  • cuisine · array · optionnel
    All listed cuisines must be declared by the venue.
  • dietary · array · optionnel
    Owner declaration, not a certification.
  • open_now · boolean · optionnel
    Only venues open right now in their own timezone; venues with unknown hours are excluded when true.
  • waitlist · boolean · optionnel
    Only venues whose waitlist is open now (WAITLIST_AVAILABLE): the reservations switch, which also opens the waitlist, and the venue open now — not in holiday mode.
  • price_max · integer · optionnel
    Owner-declared price level 1–4 (schema.org priceRange "$" … "$$$$"): venues at or below it. Venues that declared no level are excluded when set.
  • radius_km · number · optionnel
  • attributes · array · optionnel
    Any declared attribute token (meals, family, outdoor, accessibility, cuisine, dietary).
  • menu_language · string · optionnel · tr | en | de | fr | es | it | nl | pt
    The menu can be read in this language: it is the menu's source language, or at least 90 % of the guest menu's dish names are translated into it (the restaurant graph's rule).
  • table_available · boolean · optionnel
    Only venues open now with a table that staff marked ready on the live table board (TABLE_AVAILABLE). Venues not using the board are excluded: unknown is not "available".

  Exemple d'appel

  {"name": "search_restaurants", "arguments": {"q": "texte", "city": "texte", "near": {}, "page": 1, "limit": 1, "channel": "order"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• start_order_session≈ 187 tokens

  Open a 30-minute transactional window for an AI agent against a specific restaurant. Returns an agent_session_id you MUST pass to every downstream order tool (place_order, cancel_order, request_bill, waiter_call, apply_promo). Also returns the customer-facing confirmation URL — share it with the human so they can review the cart before checkout.

  Paramètres, retour & exemple (1)

  Paramètres

  • restaurant_id · string · requis
    Canonical restaurant id from get_restaurant or search_products.

  Exemple d'appel

  {"name": "start_order_session", "arguments": {"restaurant_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• waiter_call≈ 145 tokens

  Flag a waiter to the table. INSERTs a waiter_calls row + fires the admin push notification. Pass an optional human-readable message (max 500 chars) the staff sees in the dashboard.

  Paramètres, retour & exemple (3)

  Paramètres

  • message · string · optionnel
  • table_id · string · requis
  • agent_session_id · string · requis

  Exemple d'appel

  {"name": "waiter_call", "arguments": {"table_id": "texte", "agent_session_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://mcp.thmenu.com/