// SCAN REPORT

Food402

22 tools. 8 can modify or destroy data without limits.

3 destructive tools with no built-in limits. Policy required.

Last updated: 11 Jun 2026

8 can modify or destroy data

14 read-only

22 tools total

Community server · catalogue entry verified 11/06/2026

How to control Food402 ↓

TOOL MAP

What Food402 exposes to your agents

Read (14) Write / Execute (5) Destructive / Financial (3)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS

Critical Risk

The most dangerous Food402 tools

Financial · High checkout_ready This tool prepares a basket for financial transaction (food order payment). Financial · Critical place_order This tool directly commits a financial transaction by charging a saved payment card to place a food order. Destructive · Medium clear_basket Clearing the entire cart removes all items without the ability to recover them, making it a destructive action. Write · Medium remove_from_basket Removing an item from a shopping cart modifies the cart state, but is reversible (the item can be re-added).

8 of Food402's 22 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control Food402

PolicyLayer is an MCP gateway — it sits between your AI agents and Food402, and nothing reaches the server without passing your rules. These are the rules we recommend:

Block financial tools by default

{
  "place_order": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Requires human approval."
      }
    ]
  }
}

Financial tools should be explicitly enabled per use case, not open by default.

Deny destructive operations

{
  "clear_basket": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Blocked by default. Requires approval."
      }
    ]
  }
}

Destructive tools should never be available to autonomous agents without human approval.

Rate limit write operations

{
  "remove_from_basket": {
    "limits": [
      {
        "counter": "remove_from_basket_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations

{
  "get_addresses": {
    "limits": [
      {
        "counter": "get_addresses_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

Create a free account and register Food402 — nothing to install.
Add these rules — paste them, or build them visually. Tune the limits to your setup.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

ENFORCE POLICY ON FOOD402 →

Free to start. No card required.

FULL CATALOGUE

All 22 Food402 tools

FINANCIAL 2 tools

Financial place_order Place the order using a saved card with 3D Secure. Opens browser for bank verification if needed. Financial checkout_ready Get basket ready for checkout with payment context. Call this before placing an order.

DESTRUCTIVE 1 tools

Destructive clear_basket Clear the entire cart

WRITE 5 tools

Write remove_from_basket Remove an item from the cart Write add_address Add a new delivery address. Use get_cities, get_districts, get_neighborhoods to find location IDs first. Write add_to_basket Add items to the shopping cart. Requires select_address to be called first. Write select_address Select a delivery address. MUST be called before get_restaurants or add_to_basket. Sets the shipping address f Write set_order_note Set order note and service preferences. Call before place_order.

READ 14 tools

Read get_addresses Get user Read get_basket Get current cart contents Read get_cities Get list of all cities for address selection Read get_districts Get districts for a city Read get_google_reviews Fetch Google Maps rating and reviews for a restaurant. Uses branch matching to find the correct location. Retu Read get_neighborhoods Get neighborhoods for a district Read get_order_detail Get detailed information about a specific order including delivery status Read get_orders Get user Read get_product_details Get product customization options (ingredients, modifiers) Read get_product_recommendations Get Read get_restaurant_menu Get a restaurant Read get_restaurants List restaurants near a location. Requires select_address first. Each restaurant includes: rating, distance, Read get_saved_cards Get user Read search_restaurants Search restaurants and products by keyword. IMPORTANT: Results include an

EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

FAQ

Questions about Food402

Can an AI agent move money through the Food402 MCP server? +

Yes. The Food402 server exposes 2 financial tools including place_order, checkout_ready. Without a policy, an autonomous agent can call these with no spend caps, no rate limits, and no approval flow. PolicyLayer lets you block financial tools by default, require human approval, or set per-tool rate limits — enforced on every call.

Can an AI agent delete data through the Food402 MCP server? +

Yes. The Food402 server exposes 1 destructive tools including clear_basket. These permanently remove resources with no undo. PolicyLayer blocks destructive tools by default so they never reach the upstream server.

How do I prevent bulk modifications through Food402? +

The Food402 server has 5 write tools including remove_from_basket, add_address, add_to_basket. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach Food402.

How many tools does the Food402 MCP server expose? +

22 tools across 3 categories: Destructive, Read, Write. 14 are read-only. 8 can modify, create, or delete data.

How do I enforce a policy on Food402? +

Register the Food402 MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every Food402 tool call.

Deterministic rules across all 22 Food402 tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON FOOD402 →

Free to start. No card required.

22 Food402 tools catalogued and risk-classified — across an index of 43,000+ MCP servers.