Bowmark
REMOTE · API.BOWMARK.AI · 3 COMPONENTS · SCANNED AUG 3
Do things on live websites: prices, availability, quotes, bookings, anything behind a form or login.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score →
Endpoint Security63
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- No authorisation is required to call this server. Every tool declares its destructiveHint and none is destructive, so open access doesn't expose one. See how to fix → View diagnostics → Partial
- HTTPS not yet verified: we couldn't determine whether a plaintext access path exists. View diagnostics → Unverified
- HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability53
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 1836 tokens (~918/item across 2 items; 2 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management13
- Stability observed for 4 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
- Structured output schemas are declared (50% of tools); any adoption earns full credit.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.
remote · api.bowmark.ai
claude mcp add --transport http ai-bowmark-bowmark https://api.bowmark.ai/mcp/registry
[mcp_servers.ai-bowmark-bowmark] url = "https://api.bowmark.ai/mcp/registry"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"ai-bowmark-bowmark": {
"type": "remote",
"url": "https://api.bowmark.ai/mcp/registry",
"enabled": true
}
}
} openclaw mcp add ai-bowmark-bowmark --url https://api.bowmark.ai/mcp/registry --transport streamable-http
mcp_servers:
ai-bowmark-bowmark:
url: "https://api.bowmark.ai/mcp/registry" {
"mcpServers": {
"ai-bowmark-bowmark": {
"type": "http",
"url": "https://api.bowmark.ai/mcp/registry"
}
}
} The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 3 Aug 26 +1
- The server rewrote its instructions, which are the text every model session reads security
- Tool “get_library” rewrote its description, which is the text the model reads security
- Server version: 8.3.31 → 8.4.0 functional
- Server version: 8.3.28 → 8.3.31 functional
- Server version: 8.3.25 → 8.3.28 functional
- Server version: 8.3.22 → 8.3.25 functional
- Server version: 8.3.20 → 8.3.22 functional
- Server version: 8.3.18 → 8.3.20 functional
- Server version: 8.3.15 → 8.3.18 functional
- Server version: 8.3.12 → 8.3.15 functional
- Server version: 8.3.10 → 8.3.12 functional
- Server version: 8.3.7 → 8.3.10 functional
- Server version: 8.3.5 → 8.3.7 functional
- Server version: 8.3.3 → 8.3.5 functional
- Server version: 8.3.2 → 8.3.3 functional
- Server version: 8.3.1 → 8.3.2 functional
- Server version: 8.3.0 → 8.3.1 functional
- Server version: 8.2.22 → 8.3.0 functional
- “get_library” reworded the description of “query” cosmetic
- 2 Aug 26 0
- Server version: 8.2.21 → 8.2.22 functional
- Server version: 8.2.20 → 8.2.21 functional
- Server version: 8.2.19 → 8.2.20 functional
- 1 Aug 26 +1
- Server version: 8.2.18 → 8.2.19 functional
- Server version: 8.2.17 → 8.2.18 functional
- Server version: 8.2.15 → 8.2.17 functional
- Server version: 8.2.13 → 8.2.15 functional
- Server version: 8.2.12 → 8.2.13 functional
- Server version: 8.2.11 → 8.2.12 functional
- Server version: 8.2.10 → 8.2.11 functional
- Server version: 8.2.9 → 8.2.10 functional
- Server version: 8.2.7 → 8.2.9 functional
- Server version: 8.2.5 → 8.2.7 functional
- Server version: 8.2.3 → 8.2.5 functional
- Server version: 8.2.1 → 8.2.3 functional
- Server version: 8.1.7 → 8.2.1 functional
- Server version: 8.1.5 → 8.1.7 functional
- Server version: 8.1.4 → 8.1.5 functional
- Server version: 8.1.2 → 8.1.4 functional
- Server version: 8.1.1 → 8.1.2 functional
- Server version: 8.0.4 → 8.1.1 functional
- Server version: 8.0.2 → 8.0.4 functional
- 31 Jul 26 +2
- The server rewrote its instructions, which are the text every model session reads security
- Tool “run” rewrote its description, which is the text the model reads security
- Tool “get_library” rewrote its description, which is the text the model reads security
- Schema quality: 767 → 876 ▼ functional
- Stability: unverified → 0.03 ▲ functional
- Schema quality: excellent → good functional
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- Server version: 8.0.0 → 8.0.2 functional
- Server version: 7.0.2 → 8.0.0 functional
- Server version: 7.0.0 → 7.0.2 functional
- Server version: 6.5.4 → 7.0.0 functional
- Server version: 6.5.2 → 6.5.4 functional
- Server version: 6.5.0 → 6.5.2 functional
- Server version: 6.4.9 → 6.5.0 functional
- Server version: 6.4.8 → 6.4.9 functional
- Server version: 6.4.5 → 6.4.8 functional
- Server version: 6.4.4 → 6.4.5 functional
- Server version: 6.4.2 → 6.4.4 functional
- Server version: 6.4.1 → 6.4.2 functional
- Server version: 6.3.7 → 6.4.1 functional
- Server version: 6.3.4 → 6.3.6 functional
- Server version: 6.3.1 → 6.3.4 functional
- Server version: 6.2.24 → 6.3.1 functional
- Server version: 6.2.22 → 6.2.24 functional
- Server version: 6.2.19 → 6.2.22 functional
- Server version: 6.2.16 → 6.2.19 functional
- Server version: 6.2.12 → 6.2.16 functional
- Server version: 6.2.11 → 6.2.12 functional
- Server version: 6.2.9 → 6.2.11 functional
- “run” reworded the description of “script” cosmetic
- “get_library” reworded the description of “query” cosmetic
- 30 Jul 26 59
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 3 Aug 2026 · Probed https://api.bowmark.ai/mcp/registry
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=bowmark.ai | CN=YE2,O=Let's Encrypt,C=US | 19 Jul 2026 | 17 Oct 2026 | ECDSA 256 | ECDSA-SHA384 | 566cdfe0a9cdd184eb0bdcdd63e2158d70b |
| SANs: *.bowmark.ai, bowmark.ai | ||||||
| CN=YE2,O=Let's Encrypt,C=US (CA) | CN=Root YE,O=ISRG,C=US | 3 Sept 2025 | 2 Sept 2028 | ECDSA 384 | ECDSA-SHA384 | 4df3b15dd6c0784c507cd37b58e6f115 |
| CN=Root YE,O=ISRG,C=US (CA) | CN=ISRG Root X2,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | ECDSA-SHA384 | 872165fc34b6e5fba8add5b3705fb53a |
| CN=ISRG Root X2,O=Internet Security Research Group,C=US (CA) | CN=ISRG Root X1,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | SHA256-RSA | 6c8f1dc727c7117f7baf853ac980f9cd |
DNSSEC insecure
Validation of api.bowmark.ai. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| ai. | present | 3799 | 8 | Verified |
| bowmark.ai. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://api.bowmark.ai/mcp/registry | Verified | 200 | |
| http (plaintext) | http://api.bowmark.ai/mcp/registry | Inconclusive | 406 |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.
get_library Check what can be done on a live website for this task ~682
**Use this whenever a task touches a live website.** It answers, definitively and cheaply, whether Bowmark can already DO the thing: look up current prices, check real availability or stock, search a site, get a quote or a fare, drive a configurator, start a booking, or pull anything that only exists behind a form, a filter, or a login. **Checking is cheap, so check.** One read-only call, no site is touched, and an unrecognized query returns a one-line index instead of an error, so the check never dead-ends and never costs you an attempt. If nothing fits, you have lost one cheap call and can use your normal approach. What comes back is the callable **function library** you write against: the runtime globals (`log`) PLUS, for each capability your query named, its namespace, TypeScript types, functions, and worked examples. Everything listed is real and callable. The language rules and how to run a script are on the `run` tool description. Pass `query` — what you want to DO (`"flights"`, `"price a GPU"`) or, if you have one in mind, the COMPANY or site (`"Kayak"`, `"newegg.com"`). A phrase in the user's own words is fine; it is matched against the whole library. **You get what you asked about and nothing else.** If nothing matches — or you send no query — you get instead a one-line index: pick whichever entry fits and CALL AGAIN with its name to get the types and examples you need to write a script. **Every response is bounded, and it says so when it is a slice.** A broad query can match more than one response carries; when that happens the answer opens with a partial-answer line naming what it left out. **Read it before concluding anything** — absence from a sliced list means nothing, and the fix is one narrower query (a single task, or a single company by name), which always returns that entry in full. Only an answer that does NOT say it is a slice supports the conclusion that a task is uncovered. **Two tiers come back.** CAPABILITIES (`bowmark.flights.search(…
| Name | Type | Req | Description |
|---|---|---|---|
| query | string | — | Optional, but pass one — it decides how much detail comes back. What the user wants to do, in their words ("flights", "price a GPU", "book a table", "check stock"), or a company/site if they named on… |
No output schema declared.
No examples provided.
run Do the task on the live websites and return the result ~958
**Executes the task on the real websites** (the search, the price check, the availability lookup, the configurator, the booking flow) and returns what came back. Runs a script you authored against the `get_library` vocabulary, on the live sites, and returns `{ ok, result, logs, error, ms }`. Call `get_library` FIRST — it gives the exact function names, argument shapes, and return types; this description is the LANGUAGE + how-to (get_library is just the vocabulary). THE LANGUAGE — plain async JavaScript: • `bowmark` is a ready global (no import). Call capabilities off it — `await bowmark.<capability>.<method>(...)` — always `await`, they're async. • Individual sites are callable too, at `await bowmark.providers.<provider>.<fn>(...)`. Use one when you specifically want THAT site; otherwise prefer the capability, which fans out across sites and routes around failures. • Real control flow: `await`, `if`, loops, array methods (`map`/`filter`/`sort`/`slice`), and `Promise.all` for fan-out. • `return` a value to get it back (JSON-serialized). `log(...)` for progress lines. • `bowmark` is the ONLY I/O — no `fetch`, `process`, filesystem, or `import`/`require`. Write a plain async body, not a wrapping function. • Keep scripts small and deterministic — no infinite loops. Runs in a hard sandbox with CPU + memory + wall-clock limits. SENDING IT: pass the script text as `run({ script })` — `script` is the only argument (there is no `site` argument; the library exposes every capability under `bowmark`). `result` is whatever you returned; `logs` are your `log()` lines in order; on a throw/timeout `ok:false` and `error` is set. CHECK `status` BEFORE `ok`. It is `ok` | `error` | `needs_user`. • `needs_user` means a site needs the USER signed in — it is NOT a failure and NOT something you can fix by editing the script. `needs` lists the sites; `meta.handoff.url` is a single-use link that expires (`meta.handoff.expiresAt`). Give the user that URL, say which sites it covers, and WA…
| Name | Type | Req | Description |
|---|---|---|---|
| script | string | yes | The JavaScript script body to execute (async, against the `bowmark` global). e.g. `const { flights, warnings } = await bowmark.flights.search({from:'SFO',to:'JFK',depart:'2026-09-01'}); return { best… |
| Name | Type | Req | Description |
|---|---|---|---|
| error | string|null | — | — |
| logs | array | — | — |
| meta | — | — | — |
| ms | number | — | — |
| needs | array | — | — |
| ok | boolean | yes | — |
| result | — | — | — |
| status | string | — | — |
No examples provided.