Search the Alza.cz catalog by keyword. Use this for product discovery — finding what's available, comparing options, or starting research. Returns a list with product code, name, price, stock (from the card's purchase CTA), and rating. To get full details for one product, follow up with get_product. Sorting: Alza's search page ignores server-side sort, so price-asc / price-desc / rating scan up to ~72 top-ranked candidates (3 pages) and sort them client-side — candidatesScanned reports how many were scanned; for an absolute price floor also pass max_price. in_stock: true keeps only products with a live purchase CTA. Read-only.

Fetch details for a single product by its Alza code (the code from search_products, e.g. 'WEXOA002B0' — not the numeric id): name, price (with the original price when discounted), availability, rating, brand, category, primary image, URL, and the scraped spec table when the product page carries one (up to 30 spec rows). Use after search_products to compare shortlisted candidates in depth, and to get the canonical URL to show the user. For reviews use get_product_reviews; for the complete spec sheet (parameterGroups) use mobile_read with operation=router_product and product_id = the numeric d######## id from the product URL. Sourced from the product page's JSON-LD schema, so values are accurate and stable. Read-only.

Fetch reviews for a single product by its Alza code: the aggregate rating and review count plus up to limit individual reviews (author, date, rating, body) scraped from the product's reviews section. Use after get_product when the user wants real-world feedback before deciding. If the reviews section is not rendered on the page you receive the aggregate only (empty reviews array) — in that case rely on the rating/count. Do not use for the aggregate rating alone when you already have it from search_products/get_product. Read-only.

Find Alza brick-and-mortar showrooms (AlzaShop) near a Czech/Slovak postal code: name, address, distance, and opening hours. Use when the user wants to browse in person, get on-site advice, or find where an AlzaShop branch is. Note: types accepts alzabox, but AlzaBox locker discovery is not yet implemented — only branch results are returned. For AlzaBox parcel shops in a checkout flow use web_pickup_places instead. Read-only. Example: find_pickup_points({postal_code: '110 00', radius_km: 10})

Browse the Alza category tree one level at a time. Useful for narrowing a product search — find the right category id, then pass it to search_products as category_id. Without arguments, returns top-level categories.

Read the live OpenID Connect discovery document that the Alza mobile app uses (issuer, authorization endpoint, token endpoint). Use only when debugging the OAuth flow or verifying which identity endpoints Alza exposes before calling auth_start. Do not use for everyday shopping — it returns a configuration document, not account data, and changes nothing. Read-only; no credentials are ever sent.

Start an OAuth 2.0 PKCE sign-in for the Alza mobile API: returns an authorization URL plus a state value. Use when account_status reports no loaded token, or when account tools start failing with authentication errors. Flow: open the returned authorization URL in a browser, sign in to Alza, the app redirects to alza://identity?code=...&state=... — then call auth_exchange with that code and this state. This call only creates a local PKCE session: the user's credentials never enter the MCP and nothing changes on Alza's side. Do not call it repeatedly for one sign-in — each call supersedes the previous state.

Complete the OAuth 2.0 PKCE sign-in: exchange the authorization code for mobile API tokens and load them into this server. Use immediately after the user finishes the auth_start flow in the browser. Pass exactly the code and state from the alza://identity redirect — never a password and never a refresh token here. Fails if the state does not match a pending auth_start session (start over from auth_start in that case). Side effect: replaces the token set currently loaded in this process; afterwards account tools such as cart, profile, and order are authenticated.

Read-only escape hatch for Alza mobile API operations that have no dedicated tool. Prefer the typed tool when one exists — cart (operation basket_info), profile (user_data), contacts (contacts), search_products (search), list_categories (category), order (user_order) — and use mobile_read for the rest. High-value operations: router_product {product_id} returns the full product envelope including the parameterGroups spec sheet (product_id is the numeric d######## id from the product URL, e.g. 13078770 from https://www.alza.cz/...-d13078770.htm); legacy_product {product_id, ucik, pgrik, country} is the same with the server-required UCÍK/PGŘÍK values (copy them from a router_product response); also alternatives {product_id}, ean_lookup, facets, hierarchical_filter, commodity_list(s), cost_estimate, delivery_countries, web_after_payment_dialog {order_id}, order_part/order2_info {order_id, ...}, order_helpdesk_questions, user_review, discussion_posts, premium_trial, validate_login_name, validate_isic, o3_info, quick_order_summary, home_categories (requires the server-side pgri/ui query values — copy them from an upstream self href in a navigation response, e.g. ?pgri=p__…&ui=u__…), zip_codes/web_zip_codes, branches, visitor_navigation/user_navigation/catalog_user_navigation, anonymous_orders/anonymous_order, url_info. This tool never accepts arbitrary URLs or credentials, and never mutates state. Account-scoped operations Requires a loaded mobile API access token — check account_status first; if none is loaded, run auth_start, have the user complete the browser sign-in, then auth_exchange with the returned code and state. Returns the raw upstream envelope (err/msg/data); err:1 with a msg is an Alza-side validation (e.g. unknown product id).

Start a two-step mutation by returning a one-time confirmation token bound to exactly one action. This call itself sends nothing to Alza. Use it before the high-impact typed mutations — register (action register), address_upsert (address_create or address_edit), address_delete (address_delete), pay_after_order (after_order_payment), web_place_order (web_place_order), web_pay_after_order (web_after_order_payment), review_submit (review_submit), subscription_activate (subscription_activate), subscription_update_installment (subscription_update_installment), upload_attachment (attachment_upload) — and before any low-risk mutate_list action (create, rename, delete, add, remove, move, set_country, set_isic, add_gift, add_order_service, set_watchdog, send_feedback, submit_discussion, rate_discussion, coupon_add, coupon_remove, basket_update, basket_unlock). Pass the returned token as confirmation_token on the matching call; the token is single-use and only valid for the exact action you prepared. Do not use for read-only tools, and not for add_to_cart (which is a low-risk cart write that needs no token).

Execute one low-risk, APK-confirmed mutation using a one-time token from prepare_mutation. Use for shopping-list operations (create/rename/delete/add/remove/move), account settings (set_country, set_isic), add_gift, add_order_service, set_watchdog, send_feedback, submit_discussion, rate_discussion, coupons (coupon_add takes {coupon: "CODE"}; coupon_remove takes {couponId: <int>} — the id from a prior cart read), and basket flags (basket_update takes {basket_id, flag?, is_delayed_payment?}; basket_unlock). Do not use for high-impact mutations (order, payment, registration, address, review, subscription, attachment) — each has its own typed tool with its own token. The payload fields must match the mobile DTO for the chosen action exactly. Side effect: persists the change on the user's Alza account. Example: mutate_list({action: "coupon_add", confirmation_token: "...", payload: {coupon: "WELCOME10"}}).

Report whether a mobile API access token is loaded in this server process. Use as a first check before account-scoped tools (cart, profile, order, add_to_cart), or to diagnose "not authenticated" failures. If no token is loaded, run auth_start, have the user complete the browser sign-in, then auth_exchange. Read-only; no network call.

Read the authenticated user's Alza shopping cart: item lines with quantities and prices, applied discounts, vouchers, and the basket/order identifiers later checkout steps need. Use to verify an add_to_cart worked, to inspect coupon/voucher state, or to collect ids for mutate_list (e.g. coupon_remove.couponId) and basket_update. Do not use for the anonymous web/visitor cart — that is web_cart. Requires a loaded mobile API access token — check account_status first; if none is loaded, run auth_start, have the user complete the browser sign-in, then auth_exchange with the returned code and state. Read-only. The response envelope is large (item lines + order summary); the basket_cnt, pricePay, and items fields are the signal.

Add one product to the authenticated user's Alza account cart by its Alza product code (the code from search_products/get_product, e.g. RI054b1 — not the numeric id). Use when the user wants a product put into their Alza account; pass quantity (default 1, max 99). Side effect: mutates the user's cart — the item stays there until removed or ordered (there is no basket-remove tool). Do not use for the anonymous web checkout cart — that is web_add_to_cart. Requires a loaded mobile API access token — check account_status first; if none is loaded, run auth_start, have the user complete the browser sign-in, then auth_exchange with the returned code and state. The response echoes the added line and the new basket count; verify with cart if in doubt. Example: add_to_cart({code: "RI054b1", quantity: 1}).

List the delivery and payment option groups for the current Alza account cart (AlzaShop pickup, AlzaBox lockers, courier, payment methods) from the mobile API. Use after items are in the cart and before checkout_preview, to show the user delivery/payment choices and to obtain the selected_delivery_option_id that later steps may require. Do not use on an empty cart — Alza answers with validation errors. Pass selected_delivery_option_id to re-fetch the groups anchored on a specific delivery choice. Requires a loaded mobile API access token — check account_status first; if none is loaded, run auth_start, have the user complete the browser sign-in, then auth_exchange with the returned code and state. Read-only.

Associate a chosen pickup point (AlzaBox parcel shop or AlzaShop) with the current checkout by submitting the mobile API's DeliveryPaymentAssociation payload. Use after delivery_options has returned the association object and the user has picked a concrete pickup point. The association object must be copied verbatim from the current delivery_options response — never hand-craft it. Side effect: updates the delivery selection for the current checkout session (does not submit the order — that is place_order or web_place_order). Requires a loaded mobile API access token — check account_status first; if none is loaded, run auth_start, have the user complete the browser sign-in, then auth_exchange with the returned code and state.

Run the read-side of the mobile checkout (sendOrder1 + delivery/payment-group reads) and return a one-time checkout token plus totals. Use after delivery_options/select_pickup_point to preview fees and the final order shape before committing, and to obtain the token that place_order requires. This never submits the order. Requires a non-empty cart. Requires a loaded mobile API access token — check account_status first; if none is loaded, run auth_start, have the user complete the browser sign-in, then auth_exchange with the returned code and state. Note: the mobile submission step (sendOrder3) currently returns HTTP 500 (docs/gap-analysis.md G1/G5) — the known-working submission path is web_place_order.

Submit an order through the mobile API's multi-step sequence using a checkout token from checkout_preview plus the three explicit payloads (delivery_payment, user_info, complete_order) copied from the preview/delivery responses. Use only when the user has explicitly confirmed the purchase. High-impact, money-relevant side effect: creates a real Alza order. Known issue: the mobile sendOrder3 step currently returns HTTP 500 (docs/gap-analysis.md G1/G5) — for a known-working submission path prefer web_place_order (legacy web WCF). Requires a loaded mobile API access token — check account_status first; if none is loaded, run auth_start, have the user complete the browser sign-in, then auth_exchange with the returned code and state.

List Alza pickup places from the live m.alza.cz personalPickup/v1 API: the type-availability form (AlzaBox/branches/24-7/showroom counts), a paginated place list, and — with place_id — a single place's detail (deliveryId, parcelShopId, isFree, typeText, opening hours). Use to find where the user can collect or pick up, or to obtain the deliveryId/parcelShopId that web_place_order needs. Unlike delivery_options, this is visitor-readable — no account token required. Pass order_id/group_id from the current basket checkout context when available. Read-only. Example: web_pickup_places({latitude: 50.08, longitude: 14.42, types: [1], limit: 10}).

Add a product to the anonymous (visitor-keyed) Alza web cart via the live m.alza.cz basket/v1 API, using the numeric commodity_id (e.g. 7229946) from search_products/get_product. Use for the web checkout flow (row W5) instead of the account cart — this basket is keyed to the visitor (Balancer-Guid), not to an Alza login. The response carries the basket id; pass it to web_cart to read the cart, and the place/payment ids flow into web_place_order. Side effect: creates or extends the visitor basket. No account token required. Example: web_add_to_cart({commodity_id: 7229946, count: 1}).

Read the anonymous (visitor) Alza web checkout cart by basket_id (obtained from web_add_to_cart): the HATEOAS cart state (maxStep, itemsAction, emptyCartAction) plus item lines (productId, count, basketItemId, updateQuantityAction). Use to verify a web_add_to_cart worked or to inspect the web cart before web_place_order. Do not use for the authenticated account cart — that is cart. Read-only; no token required.

Read the live chatbotapi.alza.cz navigation for the current visitor (row W18): chatbotInitializeChatAction / chatbotReinitializeChatAction / metadata / rating actions with their server-provided hrefs and parameters. Use when inspecting what Alza's live chatbot offers for a page, or before chat_send to discover the current actions. The country query field is required by the server (defaults to CZ). Read-only; no token required.

Open or continue an Alza chatbot session via chatbotapi.alza.cz /v1/chat (row W18): returns the chat configuration (configId, teamName, welcomeText, messages, allowTextInput) and showChat. Use to start a support-style conversation with page context (product detail, checkout steps). Pass page_type per the 2026-09-09 capture: 1=product detail, 5=Order1, 6=Order2, 24=Order4; initial_input carries the user's first message. Session-scoped, visitor-keyed write — no account state and no token required (like web_add_to_cart). Example: chat_send({page_type: 1, initial_input: 'Is this in stock?'}).

Read the authenticated user's Alza profile: personal data, the delivery-address book with per-address HATEOAS actions (create/edit/delete/search), and account sections. Use to inspect the account, to confirm the account binding (user_id, email), and to obtain the action objects required by address_upsert, address_delete, address_search, complaint_claims, and the subscription tools. Requires a loaded mobile API access token — check account_status first; if none is loaded, run auth_start, have the user complete the browser sign-in, then auth_exchange with the returned code and state. Read-only. Honest caveat: with a stale or missing token the API may still answer HTTP 200 with an anonymous shape (user_id: -1, null email) — treat user_id as the binding signal, and refresh the token via auth_start/auth_exchange if it is -1.

Read the authenticated user's Alza contact list (mobile API v4/contacts endpoint). Use to list or search the account's saved contacts, e.g. for complaint/claim context. Do not use for the catalog category tree — that is list_categories. Requires a loaded mobile API access token — check account_status first; if none is loaded, run auth_start, have the user complete the browser sign-in, then auth_exchange with the returned code and state. Read-only.

Register a new Alza account (mobile API CreateUser): submit email, phone, and password plus an optional verification code. High-impact, credential-bearing side effect: creates a real Alza account the user will have to manage. Use only with explicit user confirmation; requires a one-time token from prepare_mutation (action=register) passed as confirmation_token. Do not use to sign in an existing account — that is the auth_start/auth_exchange flow.

Create or edit a delivery address on the Alza account by executing the server-provided address form action from profile (createAddressAction for create, the address's editAction for edit) with typed fields. Use when the user wants to add a new shipping address or fix an existing one. Mutating: requires a one-time token from prepare_mutation (action=address_create or address_edit); kind=edit additionally requires address_id. Side effect: persists the address to the account's address book.

Delete a delivery address from the Alza account by executing the per-address delete action from the profile response. Destructive: removes the address (id=address_id) from the account's address book. Use only with explicit user confirmation, after showing which address will be deleted. Requires a one-time token from prepare_mutation (action=address_delete).

Search the address database (zip/city) by following the server-provided addressSearchAction from the profile response. Use to suggest a valid address before address_upsert, or to verify a zip/city combination. Pass the action object verbatim from profile — never hand-craft it. Read-only; no confirmation token required (but the profile action needs a loaded access token).

List the payment-method groups available for the current Alza account cart (mobile API getDeliveryPaymentGroups payment projection). Use after delivery_options and before order submission, to show the user payment choices and to obtain the payment_id needed by web_place_order (e.g. 103 proforma) or the mobile checkout. Requires a non-empty cart. Requires a loaded mobile API access token — check account_status first; if none is loaded, run auth_start, have the user complete the browser sign-in, then auth_exchange with the returned code and state. Read-only.

List the after-order payment options for an unpaid order part (mobile API getafterorderpayments). Use when the user has an unpaid order (see order) and wants to pay it through the mobile API; pass the returned payment id to pay_after_order. Do not use for legacy web WCF orders — that path is web_pay_after_order (list ids via mobile_read operation=web_after_payment_dialog). Requires a loaded mobile API access token — check account_status first; if none is loaded, run auth_start, have the user complete the browser sign-in, then auth_exchange with the returned code and state. Read-only.

Execute an after-order payment on an unpaid mobile-API order (AfterOrderRequestBody: order id, invoice number, payment id from after_order_payments, optional stored-card id and device fingerprint). High-impact, money movement: requires a one-time token from prepare_mutation (action=after_order_payment) and explicit user confirmation. Do not use for legacy web WCF orders — that is web_pay_after_order. Requires a loaded mobile API access token — check account_status first; if none is loaded, run auth_start, have the user complete the browser sign-in, then auth_exchange with the returned code and state.

Execute the after-order payment for an unpaid legacy-web order through the live-verified EShopService.svc CreateAfterPayment chain (the recorded real-payment path: e.g. MojePlatba 144 → KB SSO gateway). Use when the user needs to pay a web-placed order that is still unpaid. First list the available payment ids via mobile_read with operation=web_after_payment_dialog (GetAfterPaymentDialog). High-impact, money movement: requires a one-time token from prepare_mutation (action=web_after_order_payment) and explicit user confirmation.

Read an authenticated user's Alza order: lines, parts, milestones/tracking, and invoice document references; with part_id, the part detail as well. Use to check order status, delivery tracking, or to collect the order/part ids needed by after_order_payments/pay_after_order. user_flag 0/1 selects the order scope exactly as the mobile app does. Requires a loaded mobile API access token — check account_status first; if none is loaded, run auth_start, have the user complete the browser sign-in, then auth_exchange with the returned code and state. Read-only.

Submit a product review (1–5 rating plus optional text) by executing the server-provided review form action from the product detail (writeReviewAction/onSubmitReview or the rating form). Use when the user wants to publish a review for a product they bought. Mutating: the review becomes public on the product page — requires a one-time token from prepare_mutation (action=review_submit) and explicit user confirmation. Optional values carries extra typed form fields verbatim from the form response.

List the account's active warranty claims by following the server-provided warranty-claims action (activeWarrantyClaimsAction / showActiveWarrantyClaimsAction) from authenticated navigation or order detail. Use to show the user their open claims before filing or attaching evidence (see upload_attachment). Pass the action object verbatim — never hand-craft it. Read-only.

Read the AlzaSubscription overview (phases, savings, trial settings) by following the server-provided subscriptionAction from the account menu or authenticated navigation. Use to show the user their subscription state before subscription_activate or subscription_update_installment. Pass the action object verbatim — never hand-craft it. Read-only.

Activate AlzaSubscription by executing the server-provided activateAction form. High-impact: starts a paid, recurring subscription — use only with explicit user confirmation after showing the terms from subscription_overview. Requires a one-time token from prepare_mutation (action=subscription_activate). Optional values carries the payment/installment fields verbatim from the form response.

Change the AlzaSubscription installment plan by executing the server-provided updateInstallmentAction form. High-impact: changes the payment schedule of a paid subscription — use only with explicit user confirmation. Requires a one-time token from prepare_mutation (action=subscription_update_installment). Optional values carries the installment fields verbatim from the form response.

Upload 1–5 image attachments (base64 data URLs, whitelisted image MIME types, max 10 MiB each) by executing the server-provided multipart action (uploadImageAction / complaint attachment actions) — typically for a warranty claim from complaint_claims. Use when the user needs to attach photos (damage, label, invoice) to a claim or complaint. Mutating: requires a one-time token from prepare_mutation (action=attachment_upload) and user confirmation. Optional values carries extra typed form fields verbatim from the form response.

Place an order through the live-verified legacy web WCF checkout pipeline (EShopService.svc: SaveOrder2 → SaveOrder3 → SaveAndConfirmOrder2 with the documented AlzaPlus 113-gate retry → CheckOrder4 → SendOrder4). This is the currently-working order-submission path — the mobile place_order (sendOrder3) returns HTTP 500 (docs/gap-analysis.md G1/G5). Typed inputs only: delivery_id/delivery_group_id from delivery_options, parcel_shop_id from web_pickup_places, payment_id from payment_methods, plus the contact/address block. High-impact, money-relevant: creates a real Alza order — use only with explicit user confirmation, with a one-time token from prepare_mutation (action=web_place_order). Example: web_place_order({delivery_id: 2680, parcel_shop_id: "1128203", payment_id: 103, name: "Jan Novák", street: "Praha 110 00", city: "Praha", zip_code: "110 00", phone: "+420 777 123 456", email: "jan@example.cz", confirmation_token: "..."}).