Kuaidi100 launched China's first MCP-protocol-compatible logistics information service platform. The core API services of Kuaidi100's Baidiy
Nothing to run from here
Alza is installed from its publisher's own source and answers where it runs, so this marketplace is not in the path of a single call. There is no address here to send one to, and a panel that pretended otherwise would be showing you an answer we made up. Install it and call it from your own client — the Installation tab has the entry for each one.
93/100
trust score
13
downloads a day
local
runs on your machine
1k
downloads in 30d
What it does
Unofficial MCP server for Alza.cz: catalog search plus token-guarded account and checkout.
Quickstart
# 1 — add it to Claude Code
claude mcp add --scope user alza-mcp '--' npx -y alza-mcp
# 2 — ask your agent for something these tools do
# list_toolsets, set_toolset, auth_discovery and 62 more
Alza costs nothing on mcprush: there is no plan to choose here, no cap to set and nothing mcprush can bill you for.
Publishernot claimed
LUAll 1 server
lukabudik1 server
1 category
Collected from a public index. Nobody has claimed this account, so nothing here was written by its author — claim it if it is yours.
Installation
Where are you running it?
Every route below installs the same thing and ends at the same approval screen. This one runs on your machine: your client starts Alza as a process under your own user, with your files and your network, so the tool surface below is what it can do to your computer rather than to a server somewhere else. Its scan result is on the Security tab — read the surface before you approve it.
Claude Codedeclared by this listing
This is a public server: you run it yourself and this marketplace is not in the path. You need Node.js — the current LTS (24) is the safe choice; npx comes with it. Claude Code registers it in one command; --scope user makes it available in every project. The '--' is in quotes so that PowerShell passes it on.
claude mcp add --scope user alza-mcp '--' npx -y alza-mcpReconnect, or start a new session, and the tools appear in the model’s tool list.
Free on mcprush, and it runs from its publisher’s own package: this marketplace is not in the path, so there is no key of ours to hold and no card to add.
What it writes
One config entry your client uses to start the process locally. A local server runs with your file system and your network, which is why it is priced without metering.
What you approve
65 tools, with what each one reads, writes and reaches shown before you agree — the same list on every route above. Read the tool surface.
Tool surface
What the model actually sees. Descriptions are diffed on every release — see version history.
List every toolset this server groups its tools into: id, title, description, member tool names, and whether it's currently enabled.
No parameter schema on file.
Enable or disable every tool in one toolset (or all for every toolset) at once, so only the tools relevant to the current task are visible.
No parameter schema on file.
Read the live OpenID Connect discovery document that the Alza mobile app uses (issuer, authorization endpoint, token endpoint).
No parameter schema on file.
Start an OAuth 2.0 PKCE sign-in for the Alza mobile API: returns an authorization URL plus a state value.
No parameter schema on file.
Complete the OAuth 2.0 PKCE sign-in: exchange the authorization code for mobile API tokens and load them into this server.
No parameter schema on file.
Read-only escape hatch for Alza mobile API operations that have no dedicated tool.
No parameter schema on file.
Start a two-step mutation by returning a one-time confirmation token bound to exactly one action. This call itself sends nothing to Alza.
No parameter schema on file.
Execute one low-risk, APK-confirmed mutation using a one-time token from prepare_mutation.
No parameter schema on file.
Report whether a mobile API access token is loaded in this server process.
No parameter schema on file.
Read the authenticated user's Alza shopping cart: item lines with quantities and prices, applied discounts, vouchers, and the basket/order identifiers later checkout steps need.
No parameter schema on file.
Add one product to the mobile-API cart (restservice.svc/v2/basket/add) by its Alza product code (the code from search_products/get_product, e.g. RI054b1 — not the numeric id).
No parameter schema on file.
List the delivery and payment option groups for the current Alza account cart (AlzaShop pickup, AlzaBox lockers, courier, payment methods) from the mobile API.
No parameter schema on file.
Despite the name, this tool does not select an AlzaBox or pickup point. It POSTs a delivery selection to the mobile getDeliveryAssociations route and returns the payment methods that work with that delivery, each with the resulting delivery price (data[]: payment id such as 103/143/144/203,…
No parameter schema on file.
Run the read-side of the mobile checkout (sendOrder1 + delivery/payment-group reads) and return a one-time checkout token plus totals.
No parameter schema on file.
Submit an order through the mobile API's multi-step sequence using a checkout token from checkout_preview plus the three explicit payloads (delivery_payment, user_info, complete_order) copied from the preview/delivery responses.
No parameter schema on file.
List Alza pickup places from the live m.alza.cz personalPickup/v1 API: the type-availability form (AlzaBox/branches/24-7/showroom counts), a paginated place list, and — with place_id — a single place's detail (deliveryId, parcelShopId, isFree, typeText, opening hours).
No parameter schema on file.
Add a product to the anonymous (visitor-keyed) Alza HATEOAS web cart via the live m.alza.cz basket/v1 API, using the numeric commodity_id (e.g. 7229946) from search_products/get_product.
No parameter schema on file.
Read the live chatbotapi.alza.cz navigation for the current visitor (row W18): chatbotInitializeChatAction / chatbotReinitializeChatAction / metadata / rating actions with their server-provided hrefs and parameters.
No parameter schema on file.
Open or continue an Alza chatbot session via chatbotapi.alza.cz /v1/chat (row W18): returns the chat configuration (configId, teamName, welcomeText, messages, allowTextInput) and showChat.
No parameter schema on file.
Read the anonymous (visitor) Alza web checkout cart by basket_id (obtained from web_add_to_cart): the HATEOAS cart state (maxStep, itemsAction, emptyCartAction) plus item lines (productId, count, basketItemId, updateQuantityAction).
No parameter schema on file.
Read the authenticated user's Alza profile: personal data, the delivery-address book with per-address HATEOAS actions (create/edit/delete/search), and account sections.
No parameter schema on file.
Read the authenticated user's Alza contact list (mobile API v4/contacts endpoint).
No parameter schema on file.
Register a new Alza account (mobile API CreateUser): submit email, phone, and password plus an optional verification code.
No parameter schema on file.
Create or edit a delivery address on the Alza account by executing the server-provided address form action from profile (createAddressAction for create, the address's editAction for edit) with typed fields.
No parameter schema on file.
Delete a delivery address from the Alza account by executing the per-address delete action from the profile response.
No parameter schema on file.
Search the address database (zip/city) by following the server-provided addressSearchAction from the profile response.
No parameter schema on file.
List the payment-method groups available for the current Alza account cart (mobile API getDeliveryPaymentGroups payment projection).
No parameter schema on file.
List the after-order payment options for an unpaid order part (mobile API getafterorderpayments).
No parameter schema on file.
Execute an after-order payment on an unpaid mobile-API order (AfterOrderRequestBody: order id, invoice number, payment id from after_order_payments, optional stored-card id and device fingerprint).
No parameter schema on file.
Read an authenticated user's Alza order: lines, parts, milestones/tracking, and invoice document references; with part_id, the part detail as well.
No parameter schema on file.
Cancel an order part via Alza's HATEOAS cancel flow (OR11): reads the cancelForm (validating the order/part/hash are cancellable), then commits the cancellation with the given reason.
No parameter schema on file.
Submit a product review (1–5 rating plus optional text) by executing the server-provided review form action from the product detail (writeReviewAction/onSubmitReview or the rating form).
No parameter schema on file.
List the account's active warranty claims by following the server-provided warranty-claims action (activeWarrantyClaimsAction / showActiveWarrantyClaimsAction) from authenticated navigation or order detail.
No parameter schema on file.
Read the AlzaSubscription overview (phases, savings, trial settings) by following the server-provided subscriptionAction from the account menu or authenticated navigation.
No parameter schema on file.
Activate AlzaSubscription by executing the server-provided activateAction form.
No parameter schema on file.
Change the AlzaSubscription installment plan by executing the server-provided updateInstallmentAction form.
No parameter schema on file.
Place an order through the live-verified legacy web WCF checkout pipeline (EShopService.svc: SaveOrder2 → SaveOrder3 → SaveAndConfirmOrder2 with the documented AlzaPlus 113-gate retry → CheckOrder4 → SendOrder4).
No parameter schema on file.
Execute the after-order payment for an unpaid legacy-web order through the live-verified EShopService.svc CreateAfterPayment chain (the recorded real-payment path: e.g. MojePlatba 144 → KB SSO gateway).
No parameter schema on file.
Upload 1–5 image attachments (base64 data URLs, whitelisted image MIME types, max 10 MiB each) by executing the server-provided multipart action (uploadImageAction / complaint attachment actions) — typically for a warranty claim from complaint_claims.
No parameter schema on file.
Search the authenticated user's Alza orders by term (row OR6 — the userOrdersSearch form from the orders navigation): order number/fragment or product term; returns matching orders[] (status, phase, price, created, and documents[] invoice refs) plus commodities[].
No parameter schema on file.
Read the authenticated user's archived orders (row OR7 — the archiveOrders section of the orders navigation): returns {self, paging, value[]} — the same order shape as order_search results (status, phase, price, created, invoice documents[] for order_document).
No parameter schema on file.
Look up Alza catalog products by EAN/barcode (row AT3 — the app's camera barcode-scan API, APK cz.alza.base.{api,lib,android}.vision): POST /services/restservice.svc/v1/getProductByEANlist with {eanList}.
No parameter schema on file.
Read the account's GDPR section (row A17, APK PersonalGdprDetails): the gdprInfoAction (export request), the deleteAccountAction, and the export dialog (AccountGdprDialog: title, description, emailInfo with the login email the export is sent to, and the sendGdprInfoForm).
No parameter schema on file.
Read the detail of a single warranty claim/complaint (row K2) by executing that claim's detailAction, copied verbatim from a complaint_claims list response.
No parameter schema on file.
Download an order invoice or document (row OR10) by following the server-provided self.href of a Document/Attachment object copied verbatim from a prior MCP response (e.g. the documents[] entries of order_search results or an order detail).
No parameter schema on file.
Change the Alza account password (row A14, POST /v2/account/password): submit the current password and the new password twice (new + confirm).
No parameter schema on file.
Turn SMS two-factor on or off (row A15, PATCH /v1/account → /2faEnabled): enabled=true to activate, false to deactivate.
No parameter schema on file.
Change the account's contact phone number (row A16, PATCH /v1/account → /phone): the number that receives pickup codes and 2FA SMS.
No parameter schema on file.
Change the account's contact email (row A16 bonus, PATCH /v1/account → /email): the address that receives invoices and order/claim notifications.
No parameter schema on file.
Delete the Alza account and its personal data (row A18, DELETE /v1/account with acknowledgeAndDelete).
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
No parameter schema on file.
Free
$0 forever
- Every tool, no call limit
- No card, and mcprush charges nothing for it
- Source published under MIT
- Runs on your machine — nothing of it reaches our gateway
- Nothing to cap, because mcprush bills nothing
What counts against your monthly calls
| Tool | Unit | Calls used | Out of the allowance |
|---|
Nothing here is billable: mcprush charges nothing to install Alza or to call it, at any volume.
Call allowance · this installenforced at the gateway
Monthly allowance, in calls
—
—
Alert at 80% · then the tool returns a normal MCP error
Used this month: —
ATrust score 93 / 100
Release 0.5.0 · scanned 14 Oct 2026
Two independent axes, because powerful and malicious are different questions. The grade is threat only. The capability level is blast radius, and it is never a penalty on the grade — it is priced as one subtract-only term in the score, where you can see it.
Threat score99
Client score93
Findings5 threat · 2 capability
Capabilityhigh
Coveragesource
Verificationsource
Surface digest5039bf0da8dea3e76a924f20cdaf7e421941d4e8ccaea8a808a7c7e3237cb191
Score vectorthreat 99 → client 93
| Term | Level | What it prices | Points |
|---|---|---|---|
| capability-exposure | high | capability blast radius (high) — client exposure if the model is manipulated | −6 |
| verification-discount | source | publisher verification (provenance) — cryptographic build provenance ties the artifact to its source | −0 |
| coverage-honesty | source | inspection depth (source) — how much of the target the scan could see | −0 |
score = clamp(round(threatScore − E_cap − E_ver − E_cov), 0, 100). No model, no opinion, no network call at scoring time: the same methodology version against the same bytes always produces this number, and every line above is a field of the report rather than a summary of it.
What the scan could actually read
A grade is only as meaningful as its coverage, so the scanner publishes its own depth before it publishes its result.
Tool surfaceread
Implementation sourceread
Package metadataread
Live transportnot available
Tools were statically extracted from the published source (65 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
Capability — what it could do if the model were manipulated
Tags derived from each tool’s schema and the implementation, not from what the tool calls itself. high is the level these add up to.
| Tool | Capability tags | Why the tag was assigned |
|---|---|---|
| auth_discovery | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| auth_start | external-sink | external-sink: declares readOnlyHint: false, openWorldHint: true |
| auth_exchange | external-sink | external-sink: declares readOnlyHint: false, openWorldHint: true |
| mobile_read | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| prepare_mutation | no tags | |
| mutate_list | external-sink | external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true |
| account_status | no tags | |
| cart | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| add_to_cart | external-sink | external-sink: declares readOnlyHint: false, openWorldHint: true |
| delivery_options | untrusted-input | untrusted-input: keyword "fetch", declares openWorldHint: true (interacts with entities outside the server) |
| select_pickup_point | external-sink | external-sink: declares readOnlyHint: false, openWorldHint: true |
| checkout_preview | external-sink | external-sink: declares readOnlyHint: false, openWorldHint: true |
| place_order | external-sink | external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true |
| web_pickup_places | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| web_add_to_cart | external-sink | external-sink: declares readOnlyHint: false, openWorldHint: true |
| chat_navigation | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| chat_send | external-sink | external-sink: declares readOnlyHint: false, openWorldHint: true |
| web_cart | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| profile | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| contacts | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| register | external-sink | external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true |
| address_upsert | external-sink | external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true |
| address_delete | external-sink | external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true |
| address_search | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| payment_methods | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| after_order_payments | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| pay_after_order | external-sink | external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true |
| order | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| cancel_order | external-sink | external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true |
| review_submit | external-sink | external-sink: declares readOnlyHint: false, openWorldHint: true |
| complaint_claims | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| subscription_overview | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| subscription_activate | external-sink | external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true |
| subscription_update_installment | external-sink | external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true |
| web_place_order | external-sink | external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true |
| web_pay_after_order | external-sink | external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true |
| upload_attachment | external-sink | external-sink: declares readOnlyHint: false, openWorldHint: true |
| order_search | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| order_archive | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| product_by_ean | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| gdpr_info | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| claim_detail | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| order_document | untrusted-input | untrusted-input: keyword "download", declares openWorldHint: true (interacts with entities outside the server) |
| change_password | external-sink | external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true |
| two_factor_set | external-sink | external-sink: keyword "sms", declares readOnlyHint: false, destructiveHint: true, openWorldHint: true |
| phone_change | external-sink | external-sink: keyword "sms", declares readOnlyHint: false, destructiveHint: true, openWorldHint: true |
| email_change | external-sink | external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true |
| delete_account | external-sink | external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true |
| autocomplete | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| compare_products | untrusted-input | untrusted-input: keyword "fetch", declares openWorldHint: true (interacts with entities outside the server) |
| find_pickup_points | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| get_deals | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| get_product_reviews | untrusted-input | untrusted-input: keyword "fetch", declares openWorldHint: true (interacts with entities outside the server) |
| get_product | untrusted-input | untrusted-input: keyword "fetch", declares openWorldHint: true (interacts with entities outside the server) |
| list_categories | untrusted-input | untrusted-input: keyword "browse", declares openWorldHint: true (interacts with entities outside the server) |
| list_category_filters | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| pc_build_check | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| pc_build_suggest | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| report_issue | no tags | |
| search_products | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| list_toolsets | no tags | |
| set_toolset | state-write | state-write: declares readOnlyHint: false |
| watchdog_list | untrusted-input | untrusted-input: declares openWorldHint: true (interacts with entities outside the server) |
| watchdog_set | external-sink | external-sink: declares readOnlyHint: false, openWorldHint: true |
| watchdog_delete | external-sink | external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true |
Toxic-flow graph
The lethal trifecta, checked as a graph rather than as a checklist: untrusted input, a sensitive source and an external sink have to meet before there is a path worth worrying about.
flow-1
Untrusted input can drive an external action even though no sensitive source is exposed.
Supply chain and provenance
Integrityfirst-seen
Surface digest5039bf0da8dea3e7
Scanned2026-10-14
This is the first scan of this surface here, so there is nothing yet to compare it against.
Every result on this tab comes from one deterministic pass over the published package — offline, rule by rule, and auditable line by line above. Same methodology version, same bytes, same score.
Release history
Always latest — the install command names no version, so it installs the newest release when it runs; the current release on file is 0.5.0. Pin a release below and the command asks for exactly that one.
0.5.0
7 Oct 2026
latestNo release note was published with this version.
0.4.0
undated
- The version this listing was on when mcprush began following its releases. The registry was not asked when it shipped, so this row carries no date.
—
no reviews yet
Who can review
One review per account, from a signed-in account that does not publish this listing. Nothing else is asked — you can say what you think before you install it. Publishers can reply once per review, and a review can be edited or deleted by whoever wrote it.
Sign in to write one
Any signed-in account that does not publish Alza can review it, once — before installing it or after. A review from an account that has installed it is marked as one.
No reviews yet
Nobody has reviewed this listing. The rating on the card is the mean of the reviews written here and nothing else, so there is no rating until somebody writes the first — which takes a signed-in account that does not publish it, and nothing else.