com.agentbookable/mcp

Est-ce que com.agentbookable/mcp est sûr ?

Au dernier audit MCP Hub, le serveur MCP « com.agentbookable/mcp » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 9 outils

• create_booking≈ 488 tokens

  Create a REAL appointment. CONSEQUENCEFUL: only after the user has explicitly chosen a slot and authorized the booking in their own words. Flow: (1) check the service's bookingRequirements and collect any required customer details (e.g. phone); (2) create a mandate via the create_mandate tool with the user's exact instruction; (3) call this tool with the mandateRef. The mandate is single-use and expires in 15 minutes. On SLOT_NO_LONGER_AVAILABLE offer the returned alternatives — never rebook unilaterally.

  Paramètres, retour & exemple (8)

  Paramètres

  • slot · object · optionnel
  • slotId · string · optionnel
    Slot id from get_availability (preferred)
  • draftId · string · optionnel
    Booking draft the user consented to (from prepare_booking). When given, the request must match the draft exactly or booking fails with CONSENT_DRAFT_MISMATCH.
  • customer · object · requis
  • serviceId · string · requis
  • businessId · string · requis
  • mandateRef · string · requis
    From create_mandate (or create_mandate_for_draft) — records the user's authorization
  • idempotencyKey · string · optionnel
    Stable key; safe retries return the original booking

  Exemple d'appel

  {"name": "create_booking", "arguments": {"customer": {}, "serviceId": "texte", "businessId": "texte", "mandateRef": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• create_mandate≈ 257 tokens

  Legacy: record the user's authorization WITHOUT a booking draft. Prefer the draft flow: prepare_booking → show proposal → user agrees → create_mandate_for_draft → create_booking with draftId. The draft flow binds consent to the exact appointment the user saw.

  Paramètres, retour & exemple (5)

  Paramètres

  • action · string · requis · create_booking | reschedule_booking | cancel_booking
  • actorRef · string · requis
    Your agent/session identifier, recorded in the audit trail
  • serviceId · string · optionnel
  • businessId · string · requis
    Bind the mandate to this business
  • instruction · string · requis
    The user's exact words — never fabricate or paraphrase

  Exemple d'appel

  {"name": "create_mandate", "arguments": {"action": "create_booking", "actorRef": "texte", "businessId": "texte", "instruction": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• create_mandate_for_draft≈ 368 tokens

  After the user explicitly agrees to the exact proposal in the draft (an affirmative reply such as 'yes, book it' — the user having already seen business, service, date and time), assert consent here to get a single-use mandate bound to that draft. consentObtained must be true; this assertion is audited. If anything consequential changes (different time, service or business), prepare a NEW draft and get fresh consent.

  Paramètres, retour & exemple (3)

  Paramètres

  • consent · object · requis
  • draftId · string · requis
    The draft the user consented to (from prepare_booking)
  • actorRef · string · requis
    Your agent/session identifier, recorded in the audit trail

  Exemple d'appel

  {"name": "create_mandate_for_draft", "arguments": {"consent": {}, "draftId": "texte", "actorRef": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• find_businesses≈ 224 tokens

  Search the AgentBookable registry for businesses that accept AI bookings. Search by free text, category, city, service name or geo radius. ALWAYS start here — the results include capability flags and _links telling you the exact next endpoints.

  Paramètres, retour & exemple (7)

  Paramètres

  • city · string · optionnel
    e.g. 'Civray'
  • query · string · optionnel
    Free text on name/category/description/services, e.g. 'hairdresser'
  • service · string · optionnel
    Service name, e.g. 'Haircut'
  • category · string · optionnel
  • latitude · number · optionnel
  • radiusKm · number · optionnel
  • longitude · number · optionnel

  Exemple d'appel

  {"name": "find_businesses", "arguments": {"city": "texte", "query": "texte", "service": "texte", "category": "texte", "latitude": 1, "radiusKm": 1}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_availability≈ 192 tokens

  Find LIVE availability for a service. Always call this immediately before create_booking — slots are temporary (~60s) and revalidated at booking. Pass an ISO-8601 window; use a slot id from the result when booking.

  Paramètres, retour & exemple (4)

  Paramètres

  • to · string · requis
    ISO-8601 window end
  • from · string · requis
    ISO-8601 window start, e.g. 2026-09-01T00:00:00Z
  • serviceId · string · requis
  • businessId · string · requis

  Exemple d'appel

  {"name": "get_availability", "arguments": {"to": "texte", "from": "texte", "serviceId": "texte", "businessId": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_booking≈ 158 tokens

  Retrieve a booking by its AgentBookable id (bb_bkg_*). Requires the mandateRef issued for that booking (from create_booking / create_mandate). Provider identity is never returned.

  Paramètres, retour & exemple (2)

  Paramètres

  • bookingId · string · requis
  • mandateRef · string · requis
    Mandate ref returned when the booking was authorized/created

  Exemple d'appel

  {"name": "get_booking", "arguments": {"bookingId": "texte", "mandateRef": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_business≈ 182 tokens

  Get one business's record by id (ab_bus_*) or slug. Includes capabilities (availability/booking/reschedule/cancellation/payment) — NEVER promise an action whose flag is false — plus _links to the service list, availability endpoint and booking flow, and per-service bookingRequirements (e.g. whether customer phone is required).

  Paramètres, retour & exemple (1)

  Paramètres

  • businessId · string · requis
    ab_bus_* id or public slug, e.g. 'agentbookable-demo'

  Exemple d'appel

  {"name": "get_business", "arguments": {"businessId": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• list_services≈ 140 tokens

  List the services a business has opened to AI booking. Each service has a durationMinutes and bookingRequirements telling you what customer details to collect (name/email/phone) BEFORE booking.

  Paramètres, retour & exemple (1)

  Paramètres

  • businessId · string · requis
    ab_bus_* id or slug

  Exemple d'appel

  {"name": "list_services", "arguments": {"businessId": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• prepare_booking≈ 374 tokens

  Prepare a booking draft: the concrete proposal (business, service, time, customer) to show the user. Validates live availability and customer requirements — if requirements are missing you get MISSING_CUSTOMER_REQUIREMENT: ask the user for those details first, then call again. Show the returned draft to the user as the final proposal (business, service, duration, date/time), then obtain explicit affirmative consent. The draft expires after 30 minutes; consent binds to this exact proposal.

  Paramètres, retour & exemple (6)

  Paramètres

  • slot · object · optionnel
  • slotId · string · optionnel
    Slot id from get_availability (preferred)
  • actorRef · string · requis
    Your agent/session identifier for the audit trail
  • customer · object · requis
  • serviceId · string · requis
  • businessId · string · requis

  Exemple d'appel

  {"name": "prepare_booking", "arguments": {"actorRef": "texte", "customer": {}, "serviceId": "texte", "businessId": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://agentbookable.com/mcp