{"name":"io.github.Smartoire/paxaver-mcp","slug":"smartoire-paxaver-mcp","title":null,"description":"MCP adapter for the Paxaver school community platform. Streamable HTTP, OAuth 2.1, capability auth.","url":"https://mcp.market/server/smartoire-paxaver-mcp","rating":null,"grade":"B","score":81,"certified":false,"status":"active","category":"security","tags":["security"],"presence":{"score":20,"stars":0,"forks":0,"downloads_week":null,"last_push_at":"2026-09-19T04:58:17.000Z","license":"Apache-2.0"},"uptime":null,"claimed":false,"transport":"remote","callable_via_gateway":true,"default_price_micros":0,"repository":"https://github.com/Smartoire/paxaver-mcp","website":null,"version":"2.4.3","remotes":[{"type":"streamable-http","url":"https://mcp.paxaver.com/mcp"}],"packages":[],"tools":[{"name":"cancel_event","description":"ADMIN: Cancels a school event outright; cancelled events cannot be reactivated. For schedule, capacity, or price changes use update_event instead. Requires pac_cordinator or event_cordinator role. DESTRUCTIVE - confirm with the user. Get event_id from get_upcoming_events.","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{"event_id":{"type":"string","description":"Event ID - from get_upcoming_events; cancelling is permanent and cannot be undone"}},"required":["event_id"],"additionalProperties":false}},{"name":"cancel_event_registration","description":"Cancels one of the authenticated user's own event tickets (ticket_id from get_my_event_registrations). Releases the reserved seats; for paid tickets the full amount is refunded to the user's wallet at that school. Only the ticket owner or a coordinator can cancel. DESTRUCTIVE - confirm with the user before cancelling.","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{"ticket_id":{"type":"string","description":"Ticket ID from get_my_event_registrations - must belong to the caller and still be cancellable"}},"required":["ticket_id"],"additionalProperties":false}},{"name":"cancel_order","description":"Cancels a finalized order and refunds the charge to the wallet. Only works before order labels have been sent; after that the request is rejected and the order stands. DESTRUCTIVE - confirm with the user before cancelling.","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{"order_id":{"type":"string","description":"ID of a finalized order - from get_orders; the order must still be finalized and not yet have labels sent"}},"required":["order_id"],"additionalProperties":false}},{"name":"cancel_volunteer_signup","description":"Cancels one of the authenticated user's own volunteer signups (signup_id from get_my_volunteer_signups) and frees the shift slot for others. No payment is involved. Only the volunteer themselves or an admin can cancel. DESTRUCTIVE - confirm with the user before cancelling.","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{"signup_id":{"type":"string","description":"Signup ID from get_my_volunteer_signups - must belong to the caller and still be active"}},"required":["signup_id"],"additionalProperties":false}},{"name":"create_draft_order","description":"Creates an unpaid draft lunch order with one or more items - nothing is charged until finalize_order commits it. Use for multi-item orders or when the user should review the total first; for a single item paid immediately, order_lunch is simpler. Each items entry pairs a menu_item_id from get_menu with a quantity; the draft total is the sum of item prices times quantities plus nothing else until finalize_order. To change or abandon the draft, use update_draft_order or discard_draft_order. FINANCIAL - confirm student, items, and date before calling.","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{"student_id":{"type":"string","description":"Student ID (must be your own student; from get_user_info); required when the user has more than one student, defaults to their only student"},"school_slug":{"type":"string","description":"School slug (from get_user_info); defaults to the active school"},"menu_date":{"type":"string","description":"Date the lunch is served, YYYY-MM-DD"},"items":{"type":"array","description":"Line items to order; get IDs and prices from get_menu","items":{"type":"object","properties":{"menu_item_id":{"type":"string","description":"Menu item ID from get_menu"},"menu_item_name":{"type":"string","description":"Item display name from get_menu"},"price_cents":{"type":"integer","description":"Unit price in cents from get_menu"},"quantity":{"type":"integer","description":"Number of servings","minimum":1}},"required":["menu_item_id","menu_item_name","price_cents","quantity"]}}},"required":["student_id","school_slug","menu_date","items"],"additionalProperties":false}},{"name":"create_event","description":"ADMIN: Creates a school event, optionally ticketed, at the active school. To change an existing event use update_event; to register a parent for an event use register_event. Requires pac_cordinator or event_cordinator role. WRITE - only create on explicit user request.","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{"school_slug":{"type":"string","description":"School slug (defaults to active school)"},"name":{"type":"string","description":"Event name shown to parents"},"description":{"type":"string","description":"Optional event description"},"event_date":{"type":"string","description":"Event date, YYYY-MM-DD"},"starts_at":{"type":"string","description":"Start time (e.g. 18:30)"},"ends_at":{"type":"string","description":"End time (e.g. 20:00)"},"location":{"type":"string","description":"Event location (e.g. Gymnasium)"},"max_capacity":{"type":"integer","description":"Maximum attendees/tickets; omit for unlimited"},"ticket_price_cents":{"type":"integer","description":"Ticket price in cents (0 = free)"}},"required":["name","event_date"],"additionalProperties":false}},{"name":"create_menu_item","description":"ADMIN: Creates a new menu item on a restaurant. Only restaurant_id and name are required - set price_cents before the item can be meaningfully ordered. New items start active and available; use update_menu_item to change them later. Requires pac_cordinator or lunch_cordinator role. WRITE operation - confirm with the user. Get restaurant_id from list_school_restaurants.","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{"restaurant_id":{"type":"string","description":"Restaurant ID - from list_school_restaurants"},"name":{"type":"string","description":"Item display name shown to parents"},"description":{"type":"string","description":"Optional item description"},"cost_cents":{"type":"integer","description":"Kitchen cost in cents (internal margin tracking)"},"price_cents":{"type":"integer","description":"Sale price in cents (e.g. 550 = $5.50)"},"ingredients":{"type":"string","description":"Ingredient list text"},"calories":{"type":"integer","description":"Calorie count"}},"required":["restaurant_id","name"],"additionalProperties":false}},{"name":"create_restaurant","description":"ADMIN: Adds a restaurant to the active school so it can offer menu items via create_menu_item. To change an existing restaurant there is no update tool - recreate or manage it in the Paxaver admin. Requires pac_cordinator role. WRITE - confirm with the user.","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{"school_slug":{"type":"string","description":"School slug - defaults to the active school"},"name":{"type":"string","description":"Restaurant display name"},"description":{"type":"string","description":"Optional restaurant description"},"tax_percent":{"type":"number","description":"Sales tax percentage applied to orders (e.g. 5 for 5%)"}},"required":["name"],"additionalProperties":false}},{"name":"delete_menu_item","description":"ADMIN: Soft-deletes a menu item so it can no longer be ordered. To only hide it temporarily, prefer update_menu_item with is_available=false. Requires pac_cordinator or lunch_cordinator role. DESTRUCTIVE operation - confirm with the user. Get restaurant_id from list_school_restaurants and menu_item_id from list_menu_items.","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{"restaurant_id":{"type":"string","description":"Restaurant ID - from list_school_restaurants"},"menu_item_id":{"type":"string","description":"Menu item ID - from list_menu_items"}},"required":["restaurant_id","menu_item_id"],"additionalProperties":false}},{"name":"discard_draft_order","description":"Permanently discards an unpaid draft order - the caller must own it and it must still be in draft status (order_id from create_draft_order). Nothing was ever charged, so there is no refund; the draft is simply deleted. For a finalized order use cancel_order instead. DESTRUCTIVE - confirm with the user before discarding.","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{"order_id":{"type":"string","description":"Draft order ID from create_draft_order - must still be in draft status"}},"required":["order_id"],"additionalProperties":false}},{"name":"finalize_order","description":"Commits a draft order from create_draft_order and charges the wallet for the item total plus optional tip_cents (donated to the school's PAC). Not for new orders - use order_lunch or create_draft_order first. FINANCIAL - confirm the total before calling.","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{"order_id":{"type":"string","description":"Draft order ID from create_draft_order - must still be in draft status; already-finalized orders are rejected"},"tip_cents":{"type":"integer","description":"Tip in cents (donated to school PAC)","default":0}},"required":["order_id"],"additionalProperties":false}},{"name":"get_menu","description":"Returns the orderable lunch menu for the user's active school - item names, prices, dietary tags, and remaining quantity. Pass date for a single day or month for a per-day listing across the whole month (today if neither is given); if both are passed, date wins. The menu_item_id values returned are required by order_lunch and create_draft_order. For orders already placed, use get_orders.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"date":{"type":"string","description":"Single day to show, YYYY-MM-DD; omit when using month"},"month":{"type":"string","description":"Calendar month to show, YYYY-MM; omit when using date. Today is used when neither is given"}},"additionalProperties":false}},{"name":"get_my_event_registrations","description":"Read-only, no side effects. Returns the authenticated user's own event tickets at their active school - ticket id, event name/date/location, quantity, total paid, and status (paid or checked_in). Cancelled tickets are excluded. The id values returned are required by cancel_event_registration. Pair with get_upcoming_events for events the user has not registered for.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{},"additionalProperties":false}},{"name":"get_my_volunteer_signups","description":"Read-only, no side effects. Returns the authenticated user's active volunteer signups at their school - signup id, shift title/date/times, and the parent event. Cancelled signups are excluded. The id values returned are required by cancel_volunteer_signup.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{},"additionalProperties":false}},{"name":"get_orders","description":"Returns lunch orders already placed - items, menu date, status, and total - for the authenticated user's students, newest first (up to ~100 most recent). Filters combine with AND: student_id narrows to one student; menu_date and month narrow the date range, and if both are given menu_date wins. With no filters returns recent orders across all of the user's students. Admins (pac_cordinator, lunch_cordinator) see school-wide orders; parents only their own students. For what can be ordered (menu and prices), use get_menu.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"student_id":{"type":"string","description":"Filter to a specific student (must be your own student, from get_user_info; admins may filter any student in the school)"},"menu_date":{"type":"string","description":"Single day to query, YYYY-MM-DD; omit when using month"},"month":{"type":"string","description":"Calendar month to query, YYYY-MM; omit when using menu_date"}},"additionalProperties":false}},{"name":"get_upcoming_events","description":"Returns upcoming events for the user's active school: date, times, location, volunteer shifts, and whether registration is closed. The event IDs returned feed register_event; shift IDs feed sign_up_to_volunteer. To review or undo your own registrations and signups, use get_my_event_registrations / cancel_event_registration and get_my_volunteer_signups / cancel_volunteer_signup. Optionally filter by date range.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"start_date":{"type":"string","description":"First day of the range, YYYY-MM-DD (inclusive); omit for all upcoming events"},"end_date":{"type":"string","description":"Last day of the range, YYYY-MM-DD (inclusive); omit for all upcoming events"}},"additionalProperties":false}},{"name":"get_user_info","description":"Read-only lookup with no side effects and no rate-limit concerns - safe to call repeatedly. Requires authentication: returns only the caller's own context (never another user's data): first name, active school, the students they are a guardian for, and their role codes at that school. This is the context-discovery call - most other tools need a student_id or school_slug from here, and admin-role checks come from roles. Returns live account state, so call again if the user may have switched schools or had roles changed.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{},"additionalProperties":false}},{"name":"get_wallet_balance","description":"Read-only lookup - never moves funds or has side effects. Requires authentication: returns only the caller's spendable wallet balance at their active school (wallets are scoped per school, so a balance at one school does not apply elsewhere), in cents and formatted. Live value reflecting orders and refunds up to the current moment - recheck before assuming funds are still available. Call before order_lunch, finalize_order, or register_event to confirm the user can cover the charge; not needed for read-only lookups.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{},"additionalProperties":false}},{"name":"list_menu_items","description":"ADMIN: Lists the full menu-item catalog for a restaurant, including inactive and unavailable items - this is the catalog, not what parents can order on a date (use get_menu for that). Provides menu_item_id values for update_menu_item, delete_menu_item, and set_daily_menu. Requires pac_cordinator or lunch_cordinator role. Get restaurant_id from list_school_restaurants.","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{"restaurant_id":{"type":"string","description":"Restaurant ID - from list_school_restaurants"}},"required":["restaurant_id"],"additionalProperties":false}},{"name":"list_school_restaurants","description":"ADMIN: Lists the active restaurants attached to a school (defaults to the active school). Inactive restaurants are not returned. The restaurant_id values returned are required by list_menu_items, create_menu_item, update_menu_item, delete_menu_item, and set_daily_menu. Requires pac_cordinator, pac_member, or lunch_cordinator role.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"school_slug":{"type":"string","description":"School slug (defaults to active school)"}},"additionalProperties":false}},{"name":"order_lunch","description":"Places and pays for a single-item lunch order for one student - the wallet is charged immediately. For a multi-item order or an order the user should review before paying, use create_draft_order then finalize_order instead. Requires menu_item_id from get_menu and menu_date; student_id is required when the user has more than one student and defaults to the user's only student otherwise (IDs from get_user_info). FINANCIAL - confirm student, item, date, and quantity before calling.","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{"student_id":{"type":"string","description":"Student ID (must be your own student; from get_user_info); required when the user has more than one student, defaults to their only student"},"menu_item_id":{"type":"string","description":"Menu item ID from get_menu"},"menu_date":{"type":"string","description":"Date the lunch is served, YYYY-MM-DD"},"quantity":{"type":"integer","description":"Number of servings (default 1)","minimum":1,"default":1}},"required":["menu_item_id","menu_date"],"additionalProperties":false}},{"name":"register_event","description":"Registers the authenticated user for a school event and issues tickets to the caller (quantity is the number of tickets bought for the caller, minimum 1 - there is no per-student split). For paid events quantity times the ticket price is charged to the user's wallet - the call fails on insufficient balance or when the event is sold out or registration is closed. To volunteer at an event rather than attend, use sign_up_to_volunteer. FINANCIAL for paid events - confirm before registering.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"event_id":{"type":"string","description":"Event ID from get_upcoming_events - registration must still be open (check the closed flag)"},"quantity":{"type":"integer","description":"Number of tickets","minimum":1,"default":1}},"required":["event_id"],"additionalProperties":false}},{"name":"set_daily_menu","description":"ADMIN: Puts a restaurant menu item on the orderable menu for a given date, optionally capping portions. This only schedules the item - to retire it entirely use update_menu_item (is_active) or delete_menu_item. Requires pac_cordinator or lunch_cordinator role. WRITE - confirm with the user. Get IDs from list_school_restaurants and list_menu_items.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"restaurant_id":{"type":"string","description":"Restaurant ID - from list_school_restaurants"},"menu_item_id":{"type":"string","description":"Menu item ID - from list_menu_items"},"menu_date":{"type":"string","description":"Date the item is orderable, YYYY-MM-DD"},"available_qty":{"type":"integer","description":"Maximum portions for the day; omit for unlimited"}},"required":["restaurant_id","menu_item_id","menu_date"],"additionalProperties":false}},{"name":"sign_up_to_volunteer","description":"Signs the authenticated user up for a specific volunteer shift - no payment involved. shift_id identifies one shift within an event, not the event itself: get it from the event's volunteer shifts in get_upcoming_events. The call fails when the shift is full or cancelled. To attend an event as a guest instead, use register_event. WRITE - confirm with the user before signing up.","write_action":false,"price_micros":0,"input_schema":{"type":"object","properties":{"shift_id":{"type":"string","description":"Volunteer shift ID - from the event's volunteer shifts (get_upcoming_events)"}},"required":["shift_id"],"additionalProperties":false}},{"name":"update_draft_order","description":"Replaces the items and/or menu_date of an unpaid draft order before it is finalized - the caller must own the draft and it must still be in draft status (order_id from create_draft_order). Pass the complete items list: it replaces the draft's items wholesale and the total is recomputed from price times quantity. Only draft orders can be updated; once finalized, use cancel_order. WRITE - confirm the new contents with the user.","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{"order_id":{"type":"string","description":"Draft order ID from create_draft_order - must still be in draft status"},"items":{"type":"array","description":"Replacement line items (menu_item_id from get_menu + quantity); replaces all existing items when provided"},"menu_date":{"type":"string","description":"New date the lunch is served, YYYY-MM-DD"}},"required":["order_id"],"additionalProperties":false}},{"name":"update_event","description":"ADMIN: Partially updates an existing school event - only the provided fields change; omitted fields keep their current values. Use for reschedules, capacity or price changes, and status transitions (cancelled/completed). Prefer cancel_event to cancel outright. Requires pac_cordinator or event_cordinator role. WRITE operation - confirm changes with the user. Get event_id from get_upcoming_events.","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{"event_id":{"type":"string","description":"Event ID - from get_upcoming_events"},"name":{"type":"string","description":"New event name"},"description":{"type":"string","description":"New event description shown to parents"},"event_date":{"type":"string","description":"Event date, YYYY-MM-DD"},"starts_at":{"type":"string","description":"Start time (e.g. 18:30)"},"ends_at":{"type":"string","description":"End time (e.g. 20:00)"},"location":{"type":"string","description":"Event location (e.g. Gymnasium)"},"max_capacity":{"type":"integer","description":"Maximum number of attendees/tickets"},"ticket_price_cents":{"type":"integer","description":"Ticket price in cents; 0 for free events"},"status":{"type":"string","enum":["active","cancelled","completed"],"description":"Event status - cancelled stops sales, completed closes the event"}},"required":["event_id"],"additionalProperties":false}},{"name":"update_menu_item","description":"ADMIN: Partially updates an existing menu item - only the provided fields change; omitted fields keep their current values. Use for renames, description edits, price changes (price_cents - FINANCIAL, confirm the new price), nutrition updates, or toggling availability (is_available for out-of-stock, is_active to retire an item). Use delete_menu_item to remove the item permanently. Requires pac_cordinator or lunch_cordinator role. WRITE operation - confirm changes with the user. Get restaurant_id from list_school_restaurants and menu_item_id from list_menu_items.","write_action":true,"price_micros":0,"input_schema":{"type":"object","properties":{"restaurant_id":{"type":"string","description":"Restaurant ID - from list_school_restaurants"},"menu_item_id":{"type":"string","description":"Menu item ID - from list_menu_items"},"name":{"type":"string","description":"New display name for the item"},"description":{"type":"string","description":"New item description shown to parents"},"cost_cents":{"type":"integer","description":"Kitchen cost in cents (internal margin tracking)"},"ingredients":{"type":"string","description":"Ingredient list text"},"calories":{"type":"integer","description":"Calorie count"},"is_active":{"type":"boolean","description":"Whether the item stays on the restaurant menu - set false to retire it"},"price_cents":{"type":"integer","description":"Sale price in cents (e.g. 550 = $5.50)"},"is_available":{"type":"boolean","description":"Whether the item can be ordered - set false while out of stock"}},"required":["restaurant_id","menu_item_id"],"additionalProperties":false}}],"scan":{"score":81,"grade":"B","scanned_at":"2026-09-19T10:14:43.220Z","report":{"scannerVersion":"0.1.3","scannedAt":"2026-09-19T10:14:43.165Z","components":{"code":{"score":-1,"max":25,"notes":["remote-only server, no package to scan"]},"reliability":{"score":20,"max":20,"notes":["remote reachable in 140ms"]},"poisoning":{"score":15,"max":15,"notes":["27 tool descriptions checked"]},"auth":{"score":3,"max":15,"notes":["open endpoint exposes 16 write-action tools with no auth"]},"maintenance":{"score":15,"max":15,"notes":["last push 0 days ago"]},"identity":{"score":8,"max":10,"notes":["registry namespace matches repository owner","GitHub account older than a year"]}},"findings":[{"id":"auth.open-write","severity":"high","component":"auth","title":"Write-action tools reachable without authentication"}],"inputs":{"probes":[{"url":"https://mcp.paxaver.com/mcp","reachable":true,"authRequired":false,"latencyMs":140,"serverInfo":{"name":"paxaver-mcp","version":"2.4.5"}}],"packages":[],"repo":{"found":true,"owner":"Smartoire","repo":"paxaver-mcp","archived":false,"pushedAt":"2026-09-19T04:58:17Z","stars":0,"forks":0,"openIssues":0,"ownerType":"User","ownerAvatarUrl":"https://avatars.githubusercontent.com/u/103969468?v=4","ownerCreatedAt":"2022-04-18T22:49:58Z","license":"Apache-2.0"},"icon":{"url":"https://avatars.githubusercontent.com/u/103969468?v=4&s=128","source":"github"},"presence":{"stars":0,"forks":0,"downloadsWeek":null,"license":"Apache-2.0","lastPushAt":"2026-09-19T04:58:17.000Z","score":20}}}},"grade_history":[],"reviews":[]}