Alza MCP server

Read from the package source without running it. The installed server may list more.

• account_status

  Report whether a mobile API access token is loaded in this server process, and when it expires (`expiresAt`, `expired`) if that is known. An expired token is refreshed automatically before the next account call when a refresh token is loaded.

• add_to_cart

  Add one product to the mobile-API cart (`restservice.svc/v2/basket/add`) by its Alza product code (the `code` from `search_products`/`get_product`, e.g. `RI054b1` — not the numeric id).

• address_deletewrite action

  Delete a delivery address from the Alza account by executing the per-address delete action from the `profile` response.

• address_search

  Search Alza's zip/city database. Use to suggest a valid address before `address_upsert`, or to verify a zip/city combination.

• address_upsertwrite action

  Create or edit a delivery address on the Alza account by executing the server-provided address form action from `profile` (createAddressAction for create, the address's editAction for edit) with typed fields.

• after_order_paymentswrite action

  List the after-order payment options for an unpaid order part (mobile API getafterorderpayments). An `err:1` answer (e.g. the order does not exist) is returned as an error carrying Alza's message.

• auth_discovery

  Read the live OpenID Connect discovery document that the Alza mobile app uses (issuer, authorization endpoint, token endpoint).

• auth_exchange

  Complete the OAuth 2.0 PKCE sign-in: exchange the authorization code for mobile API tokens and load them into this server.

• auth_start

  Start an OAuth 2.0 PKCE sign-in for the Alza mobile API: returns an authorization URL plus a state value.

• autocomplete

  Cheap search-box suggestions (plain HTTP, no page render): suggested query phrases plus matching categories, brands and products with ids/codes. Use it to refine a messy Czech query before a full `search_products` — pass a category `id` as `category_id`, or a product code to `get_product`.

• cancel_orderwrite action

  Cancel an order part via Alza's HATEOAS cancel flow (OR11): reads the `cancelForm` (validating the order/part/hash are cancellable), then commits the cancellation with the given `reason`.

• cart

  Read the authenticated user's Alza shopping cart: item lines with quantities and prices, applied discounts, vouchers, and the basket/order identifiers later checkout steps need.

• change_password

  Change the Alza account password (row A14, `POST /v2/account/password`): submit the current password and the new password twice (new + confirm).

• chat_navigation

  Read the live chatbotapi.alza.cz navigation for the current visitor (row W18): chatbotInitializeChatAction / chatbotReinitializeChatAction / metadata / rating actions with their server-provided hrefs and parameters.

• chat_sendwrite action

  Open or continue an Alza chatbot session via chatbotapi.alza.cz /v1/chat (row W18): returns the chat configuration (configId, teamName, welcomeText, messages, allowTextInput) and showChat.

• checkout_previewwrite action

  Run the read-side of the mobile checkout (sendOrder1 + delivery/payment-group reads) and return a one-time checkout token plus totals.

• claim_detail

  Read the detail of a single warranty claim/complaint (row K2) by following that claim's `detailAction`, copied verbatim from a `complaint_claims` list response.

• compare_products

  Fetch 2–6 products by their Alza codes (the `code` from `search_products`) and return one aligned comparison table: a column per product,

• complaint_claims

  List the account's warranty claims (row K1): `GET /api/users/{user_id}/v1/warrantyClaims/{scope}` — `scope` `active` (default) or `archive`.

• contacts

  Read the authenticated user's Alza contact list (mobile API v4/contacts endpoint).

• delete_accountwrite action

  Delete the Alza account and its personal data (row A18, `DELETE /v1/account` with `acknowledgeAndDelete`).

• delivery_options

  List the delivery and payment option groups for the current Alza account cart (AlzaShop pickup, AlzaBox lockers, courier, payment methods) from the mobile API.

• email_changewrite action

  Change the account's contact email (row A16 bonus, `PATCH /v1/account` → `/email`): the address that receives invoices and order/claim notifications.

• find_pickup_points

  Find AlzaBox parcel lockers and AlzaShop showrooms near a Czech/Slovak postal code: name, address, GPS, distance and opening hours, sorted nearest first.

• gdpr_info

  Read the account's GDPR section (row A17, APK `PersonalGdprDetails`): the `gdprInfoAction` (export request), the `deleteAccountAction`, and the export dialog (`AccountGdprDialog`: title, description, `emailInfo` with the login email the export is sent to, and the `sendGdprInfoForm`).

• get_deals

  Find currently discounted products on Alza.cz, with current price, original price, savings and a discount % COMPUTED from the observed prices (never from marketing badges).

• get_product

  Fetch details for a single product by its Alza code (the `code` from `search_products`, e.g. 'WEXOA002B0' — not the numeric id): name, price (with the original price when discounted), availability, rating, brand, category, primary image, URL, and the spec table when the product page carries one (up to 30 rows, merged from both the DOM spec table and the JSON-LD `additionalProperty` list some page

• get_product_reviews

  Fetch reviews for a single product by its Alza code: the aggregate rating and review count plus up to `limit` individual reviews (author as Alza displays it, date, rating, body, pros/cons) from Alza's reviews API, newest first.

• list_categories

  Browse the Alza category tree one level at a time. Useful for narrowing a product search — find the right category id, then pass it to `search_products` as `category_id`. Without arguments, returns top-level categories.

• list_category_filters

  List the brands and attribute filters (facets) Alza defines for a category, with real ids and product counts.

• list_toolsets

  List every toolset this server groups its tools into: id, title, description, member tool names, and whether it's currently enabled.

• mobile_read

  Read-only escape hatch for Alza mobile API operations that have no dedicated tool.

• mutate_listwrite action

  Execute one low-risk, APK-confirmed mutation using a one-time token from `prepare_mutation`.

• orderwrite action

  Read an authenticated user's Alza order: lines, parts, milestones/tracking, and invoice document references; with `part_id`, the part detail as well.

• order_archivewrite action

  Read the authenticated user's archived orders (row OR7 — the `archiveOrders` section of the orders navigation): returns `{self, paging, value[]}` — the same order shape as `order_search` results (status, phase, price, created, invoice `documents[]` for `order_document`).

• order_documentwrite action

  Download an order invoice or document (row OR10) by following the server-provided `self.href` of a `Document`/`Attachment` object copied verbatim from a prior MCP response (e.g. the `documents[]` entries of `order_search` results or an order detail).

• order_searchwrite action

  Search the authenticated user's Alza orders by term (row OR6 — the `userOrdersSearch` form from the orders navigation): order number/fragment or product term; returns matching `orders[]` (status, phase, price, created, and `documents[]` invoice refs) plus `commodities[]`.

• pay_after_orderwrite action

  Execute an after-order payment on an unpaid mobile-API order (AfterOrderRequestBody: order id, invoice number, payment id from `after_order_payments`, optional stored-card id and device fingerprint).

• payment_methods

  List the payment-method groups available for the current Alza account cart (mobile API getDeliveryPaymentGroups payment projection).

• pc_build_suggest

  Check whether a list of Alza PC parts works together. Fetches each part's spec table (one product-page load per part, roughly 5–20 s each when not cached; cached 15 min), detects its role (cpu, motherboard, ram, gpu, storage, case, cooler, psu) unless given, and runs every compatibility rule: CPU socket ↔ motherboard, RAM generation / DIMM type / slot count ↔ motherboard, RAM ↔ CPU memory controll

• phone_change

  Change the account's contact phone number (row A16, `PATCH /v1/account` → `/phone`): the number that receives pickup codes and 2FA SMS.

• place_orderwrite action

  Submit an order through the mobile API's multi-step sequence using a checkout token from `checkout_preview` plus the three explicit payloads (`delivery_payment`, `user_info`, `complete_order`) copied from the preview/delivery responses.

• prepare_mutation

  Start a two-step mutation by returning a one-time confirmation token bound to exactly one action. This call itself sends nothing to Alza.

• product_by_ean

  Look up Alza catalog products by EAN/barcode (row AT3 — the app's camera barcode-scan API, APK `cz.alza.base.{api,lib,android}.vision`): `POST /services/restservice.svc/v1/getProductByEANlist` with `{eanList}`.

• profile

  Read the authenticated user's Alza profile: personal data, the delivery-address book with per-address HATEOAS actions (create/edit/delete/search), and account sections.

• recommend_alternatives

  Find alternatives to one product ("something like this but cheaper / better / same brand"). Candidate pool = Alza's own alternatives list for the product (mobile API, keyed by the numeric commodity id taken from the product URL); if that list is empty, or nothing in it survives the mode filter, falls back to a same-category `search_products` (`poolSource` says which was used).

• register

  Register a new Alza account (mobile API CreateUser): submit email, phone, and password plus an optional verification code.

• report_issue

  Draft a bug report or feature request for the alza-mcp project (github.com/…).

• review_submitwrite action

  Submit a product review (1–5 rating plus optional text) by executing the server-provided review form action from the product detail (writeReviewAction/onSubmitReview or the rating form).

• search_products
• select_pickup_point

  Despite the name, this tool does not select an AlzaBox or pickup point. It POSTs a delivery selection to the mobile `getDeliveryAssociations` route and returns the payment methods that work with that delivery, each with the resulting delivery price (`data[]`: payment `id` such as 103/143/144/203, `price`, `paymentPrice`, `isLowCredit`, `isHidden`).

• set_toolset

  Enable or disable every tool in one toolset (or `all` for every toolset) at once, so only the tools relevant to the current task are visible.

• subscription_activate

  Activate AlzaSubscription by executing the server-provided activateAction form.

• subscription_overview

  Read the account's subscription section — the resource Alza's authenticated navigation links as `userSubscription` (`GET https://webapi.alza.cz/api/users/{user_id}/v1/subscription?country=CZ`).

• subscription_update_installmentwrite action

  Change the AlzaSubscription installment plan by executing the server-provided updateInstallmentAction form.

• two_factor_set

  Turn SMS two-factor on or off (row A15, `PATCH /v1/account` → `/2faEnabled`): `enabled=true` to activate, `false` to deactivate.

• upload_attachmentwrite action

  Upload 1–5 image attachments (base64 data URLs, whitelisted image MIME types, max 10 MiB each) by executing the server-provided multipart action (uploadImageAction / complaint attachment actions) — typically for a warranty claim from `complaint_claims`.

• watchdog_deletewrite action

  Delete one Alza watchdog (row B9b). Pass `watchdog_id` (from `watchdog_list`), or pass `commodity_id` and the tool looks up the watchdog on that product through Alza's own delete action.

• watchdog_list

  List the price/stock watchdogs set on the user's Alza account. Alza calls the feature "Hlídací pes" (row B9a). Each entry has `watchdog_id`, `commodity_id`, name, current price, availability, `is_tracking_stock`, and `max_price` (the alert fires when the price drops below this; null means price is not watched).

• watchdog_setwrite action

  Create an Alza watchdog for one product (row B9). Alza emails the account's login address when the product is back in stock (`track_stock`) and/or when its price drops below `max_price` (CZK incl. VAT, must be below the current price). Alza stores and runs the watchdog, so nothing is kept on the MCP side.

• web_add_to_cart

  Add a product to the anonymous (visitor-keyed) Alza HATEOAS web cart via the live m.alza.cz basket/v1 API, using the numeric `commodity_id` (e.g. 7229946) from `search_products`/`get_product`.

• web_cart

  Read the anonymous (visitor) Alza web checkout cart by `basket_id` (obtained from `web_add_to_cart`): the HATEOAS cart state (maxStep, itemsAction, emptyCartAction) plus item lines (productId, count, basketItemId, updateQuantityAction).

• web_pay_after_orderwrite action

  Execute the after-order payment for an unpaid legacy-web order through the live-verified EShopService.svc CreateAfterPayment chain (the recorded real-payment path: e.g. MojePlatba 144 → KB SSO gateway).

• web_pickup_places

  List Alza pickup places from the live m.alza.cz personalPickup/v1 API: the type-availability form (AlzaBox/branches/24-7/showroom counts), a paginated place list, and — with `place_id` — a single place's detail (deliveryId, parcelShopId, isFree, typeText, opening hours).

• web_place_orderwrite action

  Place an order through the live-verified legacy web WCF checkout pipeline (EShopService.svc: SaveOrder2 → SaveOrder3 → SaveAndConfirmOrder2 with the documented AlzaPlus 113-gate retry → CheckOrder4 → SendOrder4).

• Code scan107 source files scanned15/25
• –Live reliabilityno gateway calls yet and no remote to proben/a
• –Tool poisoningtools not inspected (local package is not executed); not countedn/a
• Auth qualitylocal package, no credentials required12/15
• Maintenancelast push 2 days ago15/15
• Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10

Safety score

77/100

higher than 55% of 3,259 Web search servers

Tools

65

the typical Web search server has 5

Tools that change things

34%

typical: 0%. Fewer write tools means less an agent can break

GitHub stars

79

more than 94% of 1,720 Web search servers

Downloads a week

481

more than 87% of 734 Web search servers with a package

Alza: common questions

Is Alza MCP server safe?

Mostly: it is graded B (77/100). Read the Alza safety report

How do I install Alza?

It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.

Does Alza need an API key?

Not as far as the registry entry and our scan can tell: no credentials are declared or required.

Is Alza maintained?

The last commit was 14 days ago (2026-10-11). The latest release is v0.5.0.

What can I use instead of Alza?

Servers from other publishers that do the same job: Chatroost — unofficial Telegram MCP server, LetsFG — Flights & Hotels MCP server and searxNcrawl MCP server.

How does Alza compare with other Web search MCP servers?

safety score 77/100 (higher than 55% of 3,259 Web search servers); tools 65 (the typical Web search server has 5); tools that change things 34% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.