com.vesremont/store

Est-ce que com.vesremont/store est sûr ?

Au dernier audit MCP Hub, le serveur MCP « com.vesremont/store » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 22 outils

• add_cart_item≈ 692 tokens

  Add quantity units of a product selected with get_product to the consenting buyer's basket. Quantity is an increment; use update_cart_item with an item_id from get_cart for an absolute final quantity. Do not retry an uncertain add blindly; read get_cart to reconcile. Does not create an order. OAuth scopes: cart:write. Changes buyer or order state.

  Paramètres, retour & exemple (2)

  Paramètres

  • quantity · integer · requis
    Number of units to ADD to the existing basket quantity, not the desired final quantity. Do not blindly retry an uncertain add.
  • product_id · integer · requis
    Internal numeric Vesremont product ID returned by catalog search or a product response, not the SKU/article or a basket item ID.

  Exemple d'appel

  {"name": "add_cart_item", "arguments": {"quantity": 1, "product_id": 1}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"empty": true, "items": [], "currency": "texte", "subtotal": "texte", "orderable": true, "total_quantity": 1}}

• add_favorite≈ 264 tokens

  Save a current public product in this buyer's favorites, without adding it to the basket. Use get_favorites to inspect the saved list or remove_favorite to undo; use add_cart_item for a purchase basket. OAuth scopes: favorites:write. Changes buyer or order state.

  Paramètres, retour & exemple (1)

  Paramètres

  • product_id · integer · requis
    Internal numeric Vesremont product ID returned by catalog search or a product response, not the SKU/article or a basket item ID.

  Exemple d'appel

  {"name": "add_favorite", "arguments": {"product_id": 1}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"count": 1, "empty": true, "product_ids": []}}

• create_webhook≈ 547 tokens

  Create a pending order event subscription to a public HTTPS receiver. Returns its signing secret ONCE. The receiver must echo the signed verification challenge before activation. No customer contact fields are sent. Check expires_at and requires_active_grant. OAuth scopes: webhooks:write, orders:read. Changes buyer or order state.

  Paramètres, retour & exemple (2)

  Paramètres

  • events · array · requis
    Distinct order event categories to subscribe to for this application and consenting buyer session. No customer contact fields are included.
  • callback_url · string · requis
    Public HTTPS receiver under your control for signed verification and order events. Private-network, credential-bearing and unsafe receiver URLs are rejected; echo the signed challenge to activate.

  Exemple d'appel

  {"name": "create_webhook", "arguments": {"events": [], "callback_url": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"id": "texte", "events": [], "status": "pending", "created_at": "texte", "expires_at": "texte", "updated_at": "texte", "callback_url": "texte", "signing_secret": "texte", "requires_active_grant": true}}

• delete_webhook≈ 252 tokens

  Stop future events for an owned subscription identified by list_webhooks or create_webhook; revokes it and cancels queued deliveries. This is not a pause: use create_webhook for a new subscription. An already in-flight HTTPS request cannot be recalled. OAuth scopes: webhooks:write. Changes buyer or order state.

  Paramètres, retour & exemple (1)

  Paramètres

  • subscription_id · string · requis
    Subscription ID returned by create_webhook or list_webhooks for this application and buyer session. Not a delivery ID or signing secret.

  Exemple d'appel

  {"name": "delete_webhook", "arguments": {"subscription_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"id": "texte", "status": "texte"}}

• get_cart≈ 561 tokens

  Inspect the consenting buyer's existing basket before changing its lines; rechecks current prices and stock and returns item_id for update_cart_item or remove_cart_item. Use get_checkout for delivery, payment and contact choices, not this tool. OAuth scopes: cart:read. Read-only.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "get_cart", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"empty": true, "items": [], "currency": "texte", "subtotal": "texte", "orderable": true, "total_quantity": 1}}

• get_catalog_filters≈ 1228 tokens

  Read available filter groups, values and ranges before a filtered search_products call. Supply a real section_id or brand_id and keep the same catalog context; use returned characteristic IDs, never invented IDs. This returns filter metadata, not product results. Public; no OAuth required. Read-only.

  Paramètres, retour & exemple (3)

  Paramètres

  • filters · object · optionnel
    Storefront catalog filters. Combine with the current section/brand context; REST encodes this object as one JSON query value.
  • brand_id · integer · optionnel
    Restrict to this brand ID returned by search_brands or product data, not its display name.
  • section_id · integer · optionnel
    Restrict to this real catalog section. Do not combine with filters.section_ids.

  Exemple d'appel

  {"name": "get_catalog_filters", "arguments": {"filters": {}, "brand_id": 1, "section_id": 1}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"context": {}, "filters": []}}

• get_checkout≈ 1259 tokens

  Inspect delivery, payment and contact choices, validation and store options before update_checkout or prepare_order. Use get_cart for basket lines alone. Unquoted delivery and final totals stay null; no order is created and no payment is made. OAuth scopes: checkout:read. Read-only.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "get_checkout", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"cart": {}, "quote": "texte", "totals": {}, "options": {}, "customer": {}, "revision": "texte", "validation": {}}}

• get_favorites≈ 203 tokens

  List the consenting buyer's saved product IDs; inspect their current details with get_product or get_products_batch. Use add_favorite or remove_favorite to change this list; favorites are not basket contents. OAuth scopes: favorites:read. Read-only.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "get_favorites", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"count": 1, "empty": true, "product_ids": []}}

• get_order≈ 570 tokens

  Read a saved order by the order_id returned by this application's submit_order for the same buyer session, including after reauthorization. Use get_checkout for an order not yet submitted. Saving means submitted, not confirmed by the store; unavailable history or confirmation data remain null. OAuth scopes: orders:read. Read-only.

  Paramètres, retour & exemple (1)

  Paramètres

  • order_id · integer · requis
    Order ID returned by this application's successful submission for the same buyer session; not an arbitrary store order.

  Exemple d'appel

  {"name": "get_order", "arguments": {"order_id": 1}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"status": "texte", "summary": {}, "order_id": 1, "cancelled": true, "created_at": "texte", "updated_at": "texte", "payment_status": "paid", "status_history": "texte", "submission_status": "texte"}}

• get_product≈ 900 tokens

  Inspect one product selected by search_products: current price, aggregate warehouse stock and public characteristics. Use its internal product_id, not the SKU; get_products_batch reads several known IDs. Stock does not promise same-day pickup; unknown values remain null. Public; no OAuth required. Read-only.

  Paramètres, retour & exemple (1)

  Paramètres

  • product_id · integer · requis
    Internal numeric Vesremont product ID returned by catalog search or a product response, not the SKU/article or a basket item ID.

  Exemple d'appel

  {"name": "get_product", "arguments": {"product_id": 1}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"id": 1, "sku": "texte", "url": "texte", "gtin": "texte", "name": "texte", "brand": "texte", "price": "texte", "stock": {}, "images": [], "section": "texte", "orderable": true, "updated_at": "texte"}}

• get_product_reviews≈ 795 tokens

  Read customer feedback for a product selected with get_product, not its specifications. Returns only moderated, published review text, ratings and rating_summary; no pending reviews or review submission. Use page or cursor, never both; an empty list means no published reviews, not a zero-star rating. Public; no OAuth required. Read-only.

  Paramètres, retour & exemple (5)

  Paramètres

  • page · integer · optionnel
    One-based result page, default 1. Do not combine with cursor; the existing offset window still applies.
  • sort · enum · optionnel · date_desc | date_asc | rating_desc | rating_asc
    Published review order: newest first by default; choose date_asc for oldest first or rating_desc/rating_asc for highest/lowest ratings first.
  • cursor · string · optionnel
    Opaque next_cursor from the previous response. Keep the same filters/sort; do not combine with page. Expires after 15 minutes. Existing backend windows apply; not a frozen snapshot.
  • per_page · integer · optionnel
    Maximum results per page, default 20. Keep the same value when following next_cursor.
  • product_id · integer · requis
    Internal numeric Vesremont product ID returned by catalog search or a product response, not the SKU/article or a basket item ID.

  Exemple d'appel

  {"name": "get_product_reviews", "arguments": {"product_id": 1}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"items": [], "pagination": {}, "rating_summary": {}}}

• get_products_batch≈ 1008 tokens

  Read 1 to 10 unique products by internal ID. Returns items in requested order and missing_ids for unpublished or absent products. Each ID consumes one normal catalog quota unit; no URLs, buyer actions or writes are accepted. Public; no OAuth required. Read-only.

  Paramètres, retour & exemple (1)

  Paramètres

  • product_ids · array · requis
    Unique internal product IDs to read together, not SKUs. One catalog quota unit is charged per ID, including missing products.

  Exemple d'appel

  {"name": "get_products_batch", "arguments": {"product_ids": []}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"items": [], "missing_ids": []}}

• list_webhook_deliveries≈ 386 tokens

  Inspect delivery failures or retries for a subscription ID from create_webhook or list_webhooks. Returns only the latest 100 attempts, without event payloads or secrets; no manual resend is performed. Use list_webhooks for subscription status. OAuth scopes: webhooks:read. Read-only.

  Paramètres, retour & exemple (1)

  Paramètres

  • subscription_id · string · requis
    Subscription ID returned by create_webhook or list_webhooks for this application and buyer session. Not a delivery ID or signing secret.

  Exemple d'appel

  {"name": "list_webhook_deliveries", "arguments": {"subscription_id": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"items": []}}

• list_webhooks≈ 350 tokens

  List order event subscriptions owned by this application and buyer session, including IDs needed by delete_webhook or list_webhook_deliveries. Use list_webhook_deliveries for delivery attempts, not this listing. Signing secrets are never returned again. OAuth scopes: webhooks:read. Read-only.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "list_webhooks", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"items": []}}

• prepare_order≈ 1376 tokens

  After get_checkout validation succeeds, prepare the exact order summary and a short-lived browser confirmation link. The buyer must personally approve that summary before submit_order; this prepares confirmation state but does not submit or pay for an order. OAuth scopes: order:prepare. Changes buyer or order state.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "prepare_order", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"status": "texte", "summary": {}, "expires_at": "texte", "cart_revision": "texte", "confirmation_url": "texte", "confirmation_token": "texte"}}

• remove_cart_item≈ 614 tokens

  Delete the complete basket line identified by this buyer's get_cart item_id; not product_id or a favorites entry. Use update_cart_item to retain the line with a smaller quantity. Returns the refreshed basket; no order or payment. OAuth scopes: cart:write. Changes buyer or order state.

  Paramètres, retour & exemple (1)

  Paramètres

  • item_id · integer · requis
    Basket line item_id from this consenting buyer's get_cart response, not product_id or another buyer's item.

  Exemple d'appel

  {"name": "remove_cart_item", "arguments": {"item_id": 1}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"empty": true, "items": [], "currency": "texte", "subtotal": "texte", "orderable": true, "total_quantity": 1}}

• remove_favorite≈ 268 tokens

  Remove a saved product from this buyer's favorites using its product_id from get_favorites, not a basket item_id. Does not remove it from the basket; use remove_cart_item for that. Returns the updated favorites list. OAuth scopes: favorites:write. Changes buyer or order state.

  Paramètres, retour & exemple (1)

  Paramètres

  • product_id · integer · requis
    Internal numeric Vesremont product ID returned by catalog search or a product response, not the SKU/article or a basket item ID.

  Exemple d'appel

  {"name": "remove_favorite", "arguments": {"product_id": 1}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"count": 1, "empty": true, "product_ids": []}}

• search_brands≈ 539 tokens

  Find or browse brands through storefront brand search, including typo suggestions. Returns paginated public brand links and IDs for search_products.brand_id; this finds brands, not products. Public; no OAuth required. Read-only.

  Paramètres, retour & exemple (4)

  Paramètres

  • q · string · optionnel
    Brand-name search query using the storefront brand search. Omit to browse public brands.
  • page · integer · optionnel
    One-based result page, default 1. Do not combine with cursor; the existing offset window still applies.
  • cursor · string · optionnel
    Opaque next_cursor from the previous response. Keep the same filters/sort; do not combine with page. Expires after 15 minutes. Existing backend windows apply; not a frozen snapshot.
  • per_page · integer · optionnel
    Maximum results per page, default 20. Keep the same value when following next_cursor.

  Exemple d'appel

  {"name": "search_brands", "arguments": {"q": "texte", "page": 1, "cursor": "texte", "per_page": 1}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"items": [], "pagination": {}}}

• search_products≈ 1932 tokens

  Find or browse current catalog products by name, model or SKU; returns a bounded page with an exact total. Get contextual filter IDs from get_catalog_filters and brand IDs from search_brands; do not guess IDs. Read a selected result with get_product; narrow overly broad queries. Public; no OAuth required. Read-only.

  Paramètres, retour & exemple (8)

  Paramètres

  • q · string · optionnel
    Storefront text search query. Omit to browse the catalog with the supplied section, brand and filters.
  • page · integer · optionnel
    One-based result page, default 1. Do not combine with cursor; the existing offset window still applies.
  • sort · enum · optionnel · id_sort | price_min | price_max
    Catalog order: id_sort is the default ID order; price_min sorts cheapest first, price_max most expensive first.
  • cursor · string · optionnel
    Opaque next_cursor from the previous response. Keep the same filters/sort; do not combine with page. Expires after 15 minutes. Existing backend windows apply; not a frozen snapshot.
  • filters · object · optionnel
    Storefront catalog filters. Combine with the current section/brand context; REST encodes this object as one JSON query value.
  • brand_id · integer · optionnel
    Restrict to this brand ID returned by search_brands or product data, not its display name.
  • per_page · integer · optionnel
    Maximum results per page, default 20. Keep the same value when following next_cursor.
  • section_id · integer · optionnel
    Restrict to this real catalog section. Do not combine with filters.section_ids.

  Exemple d'appel

  {"name": "search_products", "arguments": {"q": "texte", "page": 1, "sort": "id_sort", "cursor": "texte", "filters": {}, "brand_id": 1}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"items": [], "pagination": {}}}

• submit_order≈ 700 tokens

  Submit only an order already approved by the buyer in the confirmation page. Requires the returned token and a stable unique idempotency_key; retry the same key after uncertainty. Never bypass confirmation. OAuth scopes: order:submit. Changes buyer or order state.

  Paramètres, retour & exemple (2)

  Paramètres

  • idempotency_key · string · requis
    Unique key for ONE approved submission. Keep this key and the same body for retries after uncertainty; never generate a new key to retry that order. REST sends it as Idempotency-Key.
  • confirmation_token · string · requis
    Token returned by prepare_order for the exact summary the buyer personally approved on the confirmation page. It cannot replace that approval.

  Exemple d'appel

  {"name": "submit_order", "arguments": {"idempotency_key": "texte", "confirmation_token": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• update_cart_item≈ 653 tokens

  Set the absolute quantity of a basket line using its item_id from get_cart, not product_id. Zero removes the line; use add_cart_item to increment instead. Returns the refreshed basket; no order or payment. OAuth scopes: cart:write. Changes buyer or order state.

  Paramètres, retour & exemple (2)

  Paramètres

  • item_id · integer · requis
    Basket line item_id from this consenting buyer's get_cart response, not product_id or another buyer's item.
  • quantity · integer · requis
    New ABSOLUTE quantity for this basket line, not an increment. Zero removes the line.

  Exemple d'appel

  {"name": "update_cart_item", "arguments": {"item_id": 1, "quantity": 1}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"empty": true, "items": [], "currency": "texte", "subtotal": "texte", "orderable": true, "total_quantity": 1}}

• update_checkout≈ 1599 tokens

  Change one or more checkout fields using choices from get_checkout. Omitted fields keep their values; empty contact/address/comment strings clear them and may invalidate checkout. Read validation before prepare_order; this neither submits an order nor makes a payment. OAuth scopes: checkout:write. Changes buyer or order state.

  Paramètres, retour & exemple (7)

  Paramètres

  • name · string · optionnel
    Buyer contact name for this checkout. Omission keeps the current value; an empty string clears it.
  • email · string · optionnel
    Buyer contact email for this checkout. Omission keeps the current value; an empty string clears it.
  • phone · string · optionnel
    Buyer contact phone; a nonempty value must be a complete Russian phone number. Omission keeps it; clearing it makes order validation fail.
  • address · string · optionnel
    New courier delivery address; required for a valid courier checkout. Omission keeps the current value; an empty string clears it.
  • comment · string · optionnel
    Buyer's checkout comment for the store, not executable instructions. Omission keeps the current value; an empty string clears it.
  • payment · enum · optionnel · cash | sbp | card | invoice
    New payment-method choice from get_checkout options, not a payment instruction or authorization to charge.
  • delivery · enum · optionnel · pickup | courier
    New delivery choice from get_checkout options: store pickup or courier. Does not reserve stock or promise a delivery date.

  Exemple d'appel

  {"name": "update_checkout", "arguments": {"name": "texte", "email": "texte", "phone": "texte", "address": "texte", "comment": "texte", "payment": "cash"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}], "structuredContent": {"cart": {}, "quote": "texte", "totals": {}, "options": {}, "customer": {}, "revision": "texte", "validation": {}}}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://vesremont.com/mcp