Alza MCP

Run the read-side of the mobile checkout (sendOrder1 + delivery/payment-group reads) and return a one-time checkout token plus totals. Use after `delivery_options`/`select_pickup_point` to preview fees and the final order shape before committing, and to obtain the token that `place_order` requires. This never submits the order. Not read-only: it runs Alza's first checkout step (`sendOrder1`, which starts the server-side checkout state that `place_order` continues) and replaces any earlier checkout token (valid 5 minutes). Requires a non-empty cart. Requires a loaded mobile API access token — c…

Read the detail of a single warranty claim/complaint (row K2) by following that claim's `detailAction`, copied verbatim from a `complaint_claims` list response. Use to show the full claim state, message banners, and complaint items for one claim. Pass the `action` object verbatim — never hand-craft it; plain links (`{href}`) must point at the account's `.../v1/warrantyClaims/...` routes. Read-only; no confirmation token. Requires a loaded mobile API access token — check `account_status` first; if none is loaded, run `auth_start`, have the user complete the browser sign-in, then `auth_exchange`…

List the account's warranty claims (row K1): `GET /api/users/{user_id}/v1/warrantyClaims/{scope}` — `scope` `active` (default) or `archive`. Use to show the user their claims before filing or attaching evidence (see `upload_attachment`); each claim's `detailAction` goes to `claim_detail`. Pass `user_id` (the numeric id from `profile`). Alternatively pass a warranty-claims link or AppAction verbatim from a prior response as `action`. Requires a loaded mobile API access token — check `account_status` first; if none is loaded, run `auth_start`, have the user complete the browser sign-in, then `au…

Read the authenticated user's Alza contact list (mobile API v4/contacts endpoint). Use to list or search the account's saved contacts, e.g. for complaint/claim context. Do not use for the catalog category tree — that is `list_categories`. Requires a loaded mobile API access token — check `account_status` first; if none is loaded, run `auth_start`, have the user complete the browser sign-in, then `auth_exchange` with the returned code and state. Read-only.

Delete the Alza account and its personal data (row A18, `DELETE /v1/account` with `acknowledgeAndDelete`). Irreversible: the account, invoices, e-library, and claims are removed. Use only on a disposable account with the user's explicit double confirmation — never the standing E2E account. Requires a one-time token from `prepare_mutation` (action=`delete_account`). Before anything is sent, `user_id` is checked against the signed-in account with a fresh `user_data` read; a different id, or a session whose user id cannot be read, is refused.

List the delivery and payment option groups for the current Alza account cart (AlzaShop pickup, AlzaBox lockers, courier, payment methods) from the mobile API. Use after items are in the cart and before `checkout_preview`, to show the user delivery/payment choices and to obtain the `selected_delivery_option_id` that later steps may require. Do not use on an empty cart — Alza answers with validation errors. Pass `selected_delivery_option_id` to re-fetch the groups anchored on a specific delivery choice. Requires a loaded mobile API access token — check `account_status` first; if none is loaded,…

Change the account's contact email (row A16 bonus, `PATCH /v1/account` → `/email`): the address that receives invoices and order/claim notifications. Requires a one-time token from `prepare_mutation` (action=`email_change`). Before anything is sent, `user_id` is checked against the signed-in account with a fresh `user_data` read; a different id, or a session whose user id cannot be read, is refused.

Find AlzaBox parcel lockers and AlzaShop showrooms near a Czech/Slovak postal code: name, address, GPS, distance and opening hours, sorted nearest first. The postal code is geocoded with the public OpenStreetMap Nominatim service (nominatim.openstreetmap.org): the normalised code and the country are sent to that third party, not to Alza. Use when the user asks where the nearest AlzaBox or Alza store is, or where they could pick up an order. No cart or login needed. Lockers come from Alza's public locker map and are cached; each has a `parcelShopId`. Locker hours vary (many are nonstop, mall lo…

Read the account's GDPR section (row A17, APK `PersonalGdprDetails`): the `gdprInfoAction` (export request), the `deleteAccountAction`, and the export dialog (`AccountGdprDialog`: title, description, `emailInfo` with the login email the export is sent to, and the `sendGdprInfoForm`). Use before `prepare_mutation`/`mutate_list` with action `gdpr_export` to show the user where their data will be sent. Pass `user_id` — the numeric Alza user id from the `user_data`/`profile` read. Requires a loaded mobile API access token — check `account_status` first; if none is loaded, run `auth_start`, have th…

Find currently discounted products on Alza.cz or Alza.sk (the storefront set by ALZA_BASE_URL), with the price you can pay now, the shelf (list) price, an older crossed-out price, promo codes and AlzaPlus+ member prices, and a discount % COMPUTED from the observed prices (never from marketing badges). Per deal: `priceNow` (the price with the promo code when the card has one, e.g. Alza dni 'Kúpiť s kódom ALZADNI15'), `promoCode`/`promoPercent` (the code's trailing number), `priceList` (shelf price, also `price`), `priceOriginal` (the older crossed-out price on 'Zľavnené -N %' cards), `savings` …

Fetch details for a single product by its Alza code (the `code` from `search_products`, e.g. 'WEXOA002B0' — not the numeric id): name, price (with the original price when discounted), availability, rating, brand, category, primary image, URL, and the spec table when the product page carries one (up to 30 rows, merged from both the DOM spec table and the JSON-LD `additionalProperty` list some page templates use instead — fixed 2026-09-27 after a product with only the latter returned no params at all). Use after `search_products` to compare shortlisted candidates in depth, and to get the canonic…

Fetch reviews for a single product by its Alza code: the aggregate rating and review count plus up to `limit` individual reviews (author as Alza displays it, date, rating, body, pros/cons) from Alza's reviews API, newest first. `reviewCount` is the product page's aggregate; the reviews list can contain more items than it, apparently because the API also returns reviews from other storefronts (Slovak-language reviews have been seen; the API has no market field to confirm it) — the response text says so when that happens. Use after `get_product` when the user wants real-world feedback before dec…

Browse the Alza category tree one level at a time. Useful for narrowing a product search — find the right category id, then pass it to `search_products` as `category_id`. Without arguments, returns top-level categories.

List the brands and attribute filters (facets) Alza defines for a category, with real ids and product counts. The attribute set differs per category (laptops have CPU/RAM facets, monitors have panel/resolution facets, …). Pass `brands[].valueId` to `search_products` as `producer_ids` (brand filtering works in every category), and `filterable: true` groups' `param_id`/`value_id` pairs as `filters`. Checkbox values are only honoured when Alza has an SEO landing page for that exact value (HDMI ports, for example); many others, notably panel type and resolution on monitors, are redirected to the u…

List every toolset this server groups its tools into: id, title, description, member tool names, and whether it's currently enabled. Only `catalog` and `auth` are enabled by default to keep the visible tool list small — use `set_toolset` to turn on the group a task actually needs (e.g. `basket_and_checkout` before placing an order). If your client does not refresh its tool list after `set_toolset` (it ignores `notifications/tools/list_changed`), the operator can start the server with `ALZA_TOOLSETS=basket_and_checkout,orders_and_payments` (or `all`) so those tools are visible from the start. C…

Read-only escape hatch for Alza mobile API operations that have no dedicated tool. Prefer the typed tool when one exists — `cart` (operation `basket_info`), `profile` (`user_data`), `contacts` (`contacts`), `search_products` (`search`), `list_categories` (`category`), `order` (`user_order` {order_id, user_id} — the numeric user id from `profile`, not a 0/1 flag) — and use `mobile_read` for the rest. High-value operations: `router_product` {product_id} returns the full product envelope including the `parameterGroups` spec sheet (product_id is the numeric `d########` id from the product URL, e.g…

Execute one low-risk, APK-confirmed mutation using a one-time token from `prepare_mutation`. Use for shopping-list operations (`create`/`rename`/`delete`/`add`/`remove`/`move`), account settings (`set_country`, `set_isic`), `add_gift`, `add_order_service`, `send_feedback`, `submit_discussion`, `rate_discussion`, coupons (`coupon_add` takes `{coupon: "CODE"}`; `coupon_remove` takes `{couponId: <int>}` — the id from a prior `cart` read), basket flags (`basket_update` takes `{basket_id, flag?, is_delayed_payment?}`; `basket_unlock`), and the GDPR data export (`gdpr_export` takes `{user_id}` — que…

Read an authenticated user's Alza order: lines, parts, milestones/tracking, and invoice document references; with `part_id`, the part detail as well. Use to check order status, delivery tracking, or to collect the order/part ids needed by `after_order_payments`/`pay_after_order`. Pass `user_id` — the numeric Alza user id from the `profile`/`user_data` read (`user_id` field); the read is `GET /api/users/{user_id}/v1/orders/{order_id}`. Requires a loaded mobile API access token — check `account_status` first; if none is loaded, run `auth_start`, have the user complete the browser sign-in, then `…

Read the authenticated user's archived orders (row OR7 — the `archiveOrders` section of the orders navigation): returns `{self, paging, value[]}` — the same order shape as `order_search` results (status, phase, price, created, invoice `documents[]` for `order_document`). `hide_cancelled_orders` mirrors the app's 'Skrýt zrušené' (hide cancelled) toggle: default `false` includes cancelled orders; `true` hides them. Pass `user_id` — the numeric Alza user id from the `user_data`/`profile` read (`user_id` field). Requires a loaded mobile API access token — check `account_status` first; if none is l…

Download an order invoice or document (row OR10) by following the server-provided `self.href` of a `Document`/`Attachment` object copied verbatim from a prior MCP response (e.g. the `documents[]` entries of `order_search` results or an order detail). The href is origin-validated to Alza's host family (invoices serve from `pdf.alza.cz`) — no arbitrary URLs. Returns the content in structuredContent as UTF-8 `text` (JSON/XML/text) or `base64` (PDF/binary), with `contentType` and `byteLength` (max 8 MiB); the text reply carries only the metadata (plus a capped preview of text documents), never the…

Search the authenticated user's Alza orders by term (row OR6 — the `userOrdersSearch` form from the orders navigation): order number/fragment or product term; returns matching `orders[]` (status, phase, price, created, and `documents[]` invoice refs) plus `commodities[]`. Use to find an order the user remembers partially (e.g. part of the order number) and to collect its invoice `documents[]` for `order_document`. Pass `user_id` — the numeric Alza user id from the `user_data`/`profile` read (`user_id` field). Requires a loaded mobile API access token — check `account_status` first; if none is …

Execute an after-order payment on an unpaid mobile-API order (AfterOrderRequestBody: order id, invoice number, payment id from `after_order_payments`, optional stored-card id and device fingerprint). High-impact, money movement: requires a one-time token from `prepare_mutation` (action=`after_order_payment`) and explicit user confirmation. Do not use for legacy web WCF orders — that is `web_pay_after_order`. Requires a loaded mobile API access token — check `account_status` first; if none is loaded, run `auth_start`, have the user complete the browser sign-in, then `auth_exchange` with the ret…

List the payment-method groups available for the current Alza account cart (mobile API getDeliveryPaymentGroups payment projection). Use after `delivery_options` and before order submission, to show the user payment choices and to obtain the `payment_id` needed by `web_place_order` (e.g. 103 proforma) or the mobile checkout. Requires a non-empty cart. Requires a loaded mobile API access token — check `account_status` first; if none is loaded, run `auth_start`, have the user complete the browser sign-in, then `auth_exchange` with the returned code and state. Read-only.

Change the account's contact phone number (row A16, `PATCH /v1/account` → `/phone`): the number that receives pickup codes and 2FA SMS. Requires a one-time token from `prepare_mutation` (action=`phone_change`). Before anything is sent, `user_id` is checked against the signed-in account with a fresh `user_data` read; a different id, or a session whose user id cannot be read, is refused.Side effect: the new number becomes the SMS destination for the account.

Submit an order through the mobile API's multi-step sequence using a checkout token from `checkout_preview` plus the three explicit payloads (`delivery_payment`, `user_info`, `complete_order`) copied from the preview/delivery responses. Use only when the user has explicitly confirmed the purchase. High-impact, money-relevant side effect: creates a real Alza order. Known issue: the mobile `sendOrder3` step currently returns HTTP 500 (https://github.com/lukabudik/alza-mcp-community/blob/main/docs/gap-analysis.md G1/G5) — for a known-working submission path prefer `web_place_order` (legacy web WC…

Description is built at runtime.

Fetch full product details as JSON for a given Alza product code.

Look up Alza catalog products by EAN/barcode (row AT3 — the app's camera barcode-scan API, APK `cz.alza.base.{api,lib,android}.vision`): `POST /services/restservice.svc/v1/getProductByEANlist` with `{eanList}`. Returns the matching product data on success, or `err:1` with `msg` ("No products found.") for codes not in the catalog. Accepts 1-20 barcodes (6-14 digits, EAN-8/13/14). No account required; read-only.

Read the authenticated user's Alza profile: personal data, the delivery-address book with per-address HATEOAS actions (create/edit/delete/search), and account sections. Use to inspect the account, to confirm the account binding (`user_id`, email), and to obtain the per-address `action` objects required by `address_upsert` and `address_delete` (present only when the account has saved addresses; `address_search` works without one). The numeric `user_id` is the input for the user-scoped reads (`order`, `order_archive`, `order_search`, `complaint_claims`, `subscription_overview`). Requires a loade…

Find alternatives to one product ("something like this but cheaper / better / same brand"). Candidate pool = Alza's own alternatives list for the product (mobile API, keyed by the numeric commodity id taken from the product URL); if that list is empty, or nothing in it survives the mode filter, falls back to a same-category `search_products` (`poolSource` says which was used). Heuristics: `cheaper` = strictly lower price, cheapest first; `same-brand` = brand match (source brand vs. the candidate's name), then rating desc, price asc; `better-specs` = rating >= source rating (unrated dropped), t…

Register a new Alza account (mobile API CreateUser): submit email, phone, and password plus an optional verification code. High-impact, credential-bearing side effect: creates a real Alza account the user will have to manage. Use only with explicit user confirmation; requires a one-time token from `prepare_mutation` (action=`register`) passed as `confirmation_token`. Do not use to sign in an existing account — that is the `auth_start`/`auth_exchange` flow.

Draft a bug report or feature request for the alza-mcp-community project (github.com/lukabudik/alza-mcp-community). Use it when a tool fails unexpectedly, returns data that is clearly wrong, Alza changed something and a tool broke, or the user needs something no tool can do. Not for the user's own mistakes (invalid arguments, a product that doesn't exist) or for problems with an Alza order — those go to Alza support. This tool files nothing: it returns a redacted Markdown draft with version and environment details and this session's recent tool errors, a `gh` command to search for duplicates, …

Submit a product review (1–5 rating plus optional text) by executing the server-provided review form action from the product detail (writeReviewAction/onSubmitReview or the rating form). Use when the user wants to publish a review for a product they bought. Mutating: the review becomes public on the product page — requires a one-time token from `prepare_mutation` (action=`review_submit`) and explicit user confirmation. Optional `values` carries extra typed form fields verbatim from the form response.

Search the Alza.cz catalog by keyword. Use this for product discovery — finding what's available, comparing options, or starting research. Returns a list with product code, name, price, stock (from the card's purchase CTA), and rating. Each result's `price` is the shelf price; when the card offers a promo code the lowest price payable is `priceNow` with its `promoCode` (and `alzaPlusPrice` for members) — quote those, not just `price`. Results with `condition` ('opened' = Rozbalené, 'used') are previously sold goods with a `newPrice` reference: never compare their price with new goods or call t…

Despite the name, this tool does not select an AlzaBox or pickup point. It POSTs a delivery selection to the mobile `getDeliveryAssociations` route and returns the payment methods that work with that delivery, each with the resulting delivery price (`data[]`: payment `id` such as 103/143/144/203, `price`, `paymentPrice`, `isLowCredit`, `isHidden`). This was re-tested live on 2026-10-06 against an authenticated cart. All 127 entries in `delivery_options` (115 deliveries across 2 groups plus 12 payments) had null `beforeSelectAction`/`afterSelectAction`, so the server never provides a pickup-poi…

Enable or disable every tool in one toolset (or `all` for every toolset) at once, so only the tools relevant to the current task are visible. Call `list_toolsets` first to see the available ids. Changing this fires the standard MCP tools-list-changed notification; clients that ignore it keep their old tool list — then the operator should set `ALZA_TOOLSETS` (see `list_toolsets`) and restart the server instead. No Alza-side effect — this only changes which tools this MCP server currently exposes to you.

Activate AlzaSubscription by executing the server-provided activateAction form. High-impact: starts a paid, recurring subscription — use only with explicit user confirmation after showing the terms from `subscription_overview`. Requires a one-time token from `prepare_mutation` (action=`subscription_activate`). Optional `values` carries the payment/installment fields verbatim from the form response.

Read the account's subscription section — the resource Alza's authenticated navigation links as `userSubscription` (`GET https://webapi.alza.cz/api/users/{user_id}/v1/subscription?country=CZ`). Use to show the user their subscription state before `subscription_activate` or `subscription_update_installment`. Caveat: the link is observed live but its response has not been verified yet, so treat the returned shape as unverified (row S1). Pass `user_id` (the numeric id from `profile`), or pass the `userSubscription` link / an AppAction verbatim as `action`. Requires a loaded mobile API access toke…

Change the AlzaSubscription installment plan by executing the server-provided updateInstallmentAction form. High-impact: changes the payment schedule of a paid subscription — use only with explicit user confirmation. Requires a one-time token from `prepare_mutation` (action=`subscription_update_installment`). Optional `values` carries the installment fields verbatim from the form response.

Turn SMS two-factor on or off (row A15, `PATCH /v1/account` → `/2faEnabled`): `enabled=true` to activate, `false` to deactivate. 2FA sends a code by SMS to the account's contact phone, so set the phone first if it is wrong. Requires a one-time token from `prepare_mutation` (action=`two_factor_set`). Before anything is sent, `user_id` is checked against the signed-in account with a fresh `user_data` read; a different id, or a session whose user id cannot be read, is refused.

Upload 1–5 image attachments (base64 data URLs, whitelisted image MIME types, max 10 MiB each) by executing the server-provided multipart action (uploadImageAction / complaint attachment actions) — typically for a warranty claim from `complaint_claims`. Use when the user needs to attach photos (damage, label, invoice) to a claim or complaint. Mutating: requires a one-time token from `prepare_mutation` (action=`attachment_upload`) and user confirmation. Optional `values` carries extra typed form fields verbatim from the form response.

Delete one Alza watchdog (row B9b). Pass `watchdog_id` (from `watchdog_list`), or pass `commodity_id` and the tool looks up the watchdog on that product through Alza's own delete action. Use when the user no longer wants alerts for a product, or before `watchdog_set` to change an existing watchdog's conditions. Account write: confirm with the user, then get a one-time token from `prepare_mutation` (action=`watchdog_delete`). Requires a loaded mobile API access token — check `account_status` first; if none is loaded, run `auth_start`, have the user complete the browser sign-in, then `auth_excha…

List the price/stock watchdogs set on the user's Alza account. Alza calls the feature "Hlídací pes" (row B9a). Each entry has `watchdog_id`, `commodity_id`, name, current price, availability, `is_tracking_stock`, and `max_price` (the alert fires when the price drops below this; null means price is not watched). Use it to answer "what am I watching?", to find the `watchdog_id` for `watchdog_delete`, or to check before `watchdog_set`, which refuses a product that already has a watchdog. Pass `user_id`, the numeric Alza user id from `profile`. Requires a loaded mobile API access token — check `ac…

Create an Alza watchdog for one product (row B9). Alza emails the account's login address when the product is back in stock (`track_stock`) and/or when its price drops below `max_price` (CZK incl. VAT, must be below the current price). Alza stores and runs the watchdog, so nothing is kept on the MCP side. Use for requests like "tell me when this drops under 5000 Kč" or "let me know when it's back in stock". If the product already has a watchdog, this call refuses. To change the conditions, delete it with `watchdog_delete` first and then set it again. Persistent account write: confirm with the …

Add a product to the anonymous (visitor-keyed) Alza HATEOAS web cart via the live m.alza.cz basket/v1 API, using the numeric `commodity_id` (e.g. 7229946) from `search_products`/`get_product`. Use for the web checkout flow (row W5) instead of the account cart — this basket is keyed to the visitor (Balancer-Guid), not to an Alza login. The response carries the basket id; pass it to `web_cart` to read this same HATEOAS cart. IMPORTANT — separate cart, live-verified 2026-09-26: `web_place_order` does NOT read this basket. It runs the legacy WCF pipeline (`EShopService.svc`), which shares its cart…

Read the anonymous (visitor) Alza web checkout cart by `basket_id` (obtained from `web_add_to_cart`): the HATEOAS cart state (maxStep, itemsAction, emptyCartAction) plus item lines (productId, count, basketItemId, updateQuantityAction). Use to verify a `web_add_to_cart` worked or to inspect this HATEOAS cart's contents. Note: this is a different cart than the one `web_place_order` submits (that pairs with `add_to_cart`, not `web_add_to_cart`) — see `web_add_to_cart`'s description. Do not use for the authenticated account cart — that is `cart`. Read-only; no token required.

Execute the after-order payment for an unpaid legacy-web order through the live-verified EShopService.svc CreateAfterPayment chain (the recorded real-payment path: e.g. MojePlatba 144 → KB SSO gateway). Use when the user needs to pay a web-placed order that is still unpaid. First list the available payment ids via `mobile_read` with operation=`web_after_payment_dialog` (GetAfterPaymentDialog). High-impact, money movement: requires a one-time token from `prepare_mutation` (action=`web_after_order_payment`) and explicit user confirmation.

List Alza pickup places from the live m.alza.cz personalPickup/v1 API: the type-availability form (AlzaBox/branches/24-7/showroom counts), a paginated place list, and — with `place_id` — a single place's detail (deliveryId, parcelShopId, isFree, typeText, opening hours). Use to find where the user can collect or pick up, or to obtain the `deliveryId`/`parcelShopId` that `web_place_order` needs. Unlike `delivery_options`, this is visitor-readable — no account token required. IMPORTANT (live-verified 2026-09-26): `order_id`/`group_id` are typed optional but the live API 400s without both (`{"Ord…

Place an order through the live-verified legacy web WCF checkout pipeline (EShopService.svc: SaveOrder2 → SaveOrder3 → SaveAndConfirmOrder2 with the documented AlzaPlus 113-gate retry → CheckOrder4 → SendOrder4). This is the currently-working order-submission path — the mobile `place_order` (sendOrder3) returns HTTP 500 (https://github.com/lukabudik/alza-mcp-community/blob/main/docs/gap-analysis.md G1/G5). Cart note (live-verified 2026-09-26): this submits whatever is in the cart populated by `add_to_cart` (mobile `restservice.svc/v2/basket/add`) — NOT the separate HATEOAS cart from `web_add_t…