Bowmark
REMOTE · API.BOWMARK.AI · 3 COMPONENTS · SCANNED SEP 21
Do things on live websites: prices, availability, quotes, bookings, anything behind a form or login.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security46
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation check failed: no authorisation is required to call this server, and it exposes a tool marked destructive (run). See how to fix → View diagnostics → Fail
- HTTPS enforcement could not be verified: the plaintext port answered with HTTP 405, which proves neither a plaintext path nor enforcement. View diagnostics → Unverified
- HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability59
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 4585 tokens (~655/item across 7 items; 7 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management67
- Stability check failed: schema churn in the 30 days we've observed: 1 tool removals, 0 breaking changes, 0 auth/transport breaks, 5 additions. See how to fix → Fail
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
- Structured output schemas are declared (29% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 7 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 8 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the Bowmark MCP server?
Bowmark is a hosted endpoint at https://api.bowmark.ai/mcp/registry, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · api.bowmark.ai
claude mcp add --transport http ai-bowmark-bowmark 'https://api.bowmark.ai/mcp/registry'
{
"mcpServers": {
"ai-bowmark-bowmark": {
"url": "https://api.bowmark.ai/mcp/registry"
}
}
} {
"servers": {
"ai-bowmark-bowmark": {
"type": "http",
"url": "https://api.bowmark.ai/mcp/registry"
}
}
} [mcp_servers.ai-bowmark-bowmark] url = "https://api.bowmark.ai/mcp/registry"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"ai-bowmark-bowmark": {
"type": "remote",
"url": "https://api.bowmark.ai/mcp/registry",
"enabled": true
}
}
} openclaw mcp add ai-bowmark-bowmark --url 'https://api.bowmark.ai/mcp/registry' --transport streamable-http
mcp_servers:
ai-bowmark-bowmark:
url: "https://api.bowmark.ai/mcp/registry" {
"McpServers": {
"ai-bowmark-bowmark": {
"Transport": "http",
"Url": "https://api.bowmark.ai/mcp/registry"
}
}
} assistant mcp add ai-bowmark-bowmark -t streamable-http -u 'https://api.bowmark.ai/mcp/registry'
{
"mcpServers": {
"ai-bowmark-bowmark": {
"type": "http",
"url": "https://api.bowmark.ai/mcp/registry"
}
}
} The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 21 Sept 26 0
- The server rewrote its instructions, which are the text every model session reads security
- Tool “get_secret_link” rewrote its description, which is the text the model reads security
- Tool “list_secrets” rewrote its description, which is the text the model reads security
- Tool “run” rewrote its description, which is the text the model reads security
- Tool “request_secret” rewrote its description, which is the text the model reads security
- Server version: 8.145.12 → 8.145.14 functional
- Server version: 8.145.11 → 8.145.12 functional
- Server version: 8.145.10 → 8.145.11 functional
- Server version: 8.145.7 → 8.145.10 functional
- Server version: 8.145.5 → 8.145.7 functional
- Server version: 8.145.3 → 8.145.5 functional
- Server version: 8.145.2 → 8.145.3 functional
- Server version: 8.145.0 → 8.145.2 functional
- 20 Sept 26 0
- Server version: 8.144.20 → 8.145.0 functional
- Server version: 8.144.19 → 8.144.20 functional
- Server version: 8.144.17 → 8.144.19 functional
- 19 Sept 26 0
- Server version: 8.144.16 → 8.144.17 functional
- Server version: 8.144.14 → 8.144.16 functional
- Server version: 8.144.12 → 8.144.14 functional
- Server version: 8.144.10 → 8.144.12 functional
- Server version: 8.144.6 → 8.144.10 functional
- Server version: 8.144.5 → 8.144.6 functional
- Server version: 8.144.2 → 8.144.5 functional
- Server version: 8.144.1 → 8.144.2 functional
- 18 Sept 26 −1
- The server rewrote its instructions, which are the text every model session reads security
- Tool “run” rewrote its description, which is the text the model reads security
- Schema quality: 564 → 637 ▼ functional
- Server version: 8.143.0 → 8.144.1 functional
- Server version: 8.142.6 → 8.143.0 functional
- Server version: 8.142.5 → 8.142.6 functional
- Server version: 8.142.3 → 8.142.5 functional
- Server version: 8.142.2 → 8.142.3 functional
- Server version: 8.142.1 → 8.142.2 functional
- Server version: 8.142.0 → 8.142.1 functional
- Server version: 8.141.1 → 8.142.0 functional
- Server version: 8.141.0 → 8.141.1 functional
- Server version: 8.140.1 → 8.141.0 functional
- Server version: 8.140.0 → 8.140.1 functional
- Server version: 8.139.2 → 8.140.0 functional
- Server version: 8.139.1 → 8.139.2 functional
- 17 Sept 26 0
- Tool “get_library” rewrote its description, which is the text the model reads security
- Tool “run” rewrote its description, which is the text the model reads security
- Schema quality: 496 → 564 ▼ functional
- Server version: 8.139.0 → 8.139.1 functional
- Server version: 8.138.0 → 8.139.0 functional
- Server version: 8.137.1 → 8.138.0 functional
- Server version: 8.137.0 → 8.137.1 functional
- Server version: 8.136.0 → 8.137.0 functional
- Server version: 8.135.5 → 8.136.0 functional
- Server version: 8.135.4 → 8.135.5 functional
- Server version: 8.135.3 → 8.135.4 functional
- Server version: 8.135.2 → 8.135.3 functional
- Server version: 8.135.1 → 8.135.2 functional
- Server version: 8.134.2 → 8.135.1 functional
- Server version: 8.134.1 → 8.134.2 functional
- Server version: 8.134.0 → 8.134.1 functional
- Server version: 8.132.0 → 8.134.0 functional
- Server version: 8.131.0 → 8.132.0 functional
- Server version: 8.130.3 → 8.131.0 functional
- Server version: 8.130.2 → 8.130.3 functional
- “get_library” reworded the description of “query” cosmetic
- 16 Sept 26 +1
- Tool coverage: 67% → 29% ▼ functional
- Schema quality: 916 → 496 ▲ functional
- Server version: 8.130.1 → 8.130.2 functional
- Server version: 8.130.0 → 8.130.1 functional
- Server version: 8.129.21 → 8.130.0 functional
- Server version: 8.129.20 → 8.129.21 functional
- Server version: 8.129.19 → 8.129.20 functional
- Server version: 8.129.18 → 8.129.19 functional
- Server version: 8.129.17 → 8.129.18 functional
- Server version: 8.129.16 → 8.129.17 functional
- Server version: 8.129.13 → 8.129.16 functional
- Server version: 8.129.12 → 8.129.13 functional
- Server version: 8.129.10 → 8.129.12 functional
- Server version: 8.129.9 → 8.129.10 functional
- New tool “list_connections” functional
- New tool “request_secret” functional
- New tool “list_secrets” functional
- New tool “get_secret_link” functional
- 15 Sept 26 −5
- Stability: pass → fail ▼ security
- Tool “register” was removed ▼ security
- The server rewrote its instructions, which are the text every model session reads security
- Tool coverage: 75% → 67% ▼ functional
- Schema quality: 3660 → 2749 ▲ functional
- Server version: 8.129.7 → 8.129.9 functional
- Server version: 8.129.6 → 8.129.7 functional
- Server version: 8.129.5 → 8.129.6 functional
- Server version: 8.129.3 → 8.129.5 functional
- Server version: 8.129.2 → 8.129.3 functional
- Server version: 8.128.2 → 8.129.2 functional
- Server version: 8.128.0 → 8.128.2 functional
- Server version: 8.127.0 → 8.128.0 functional
- Server version: 8.126.5 → 8.127.0 functional
- Server version: 8.126.3 → 8.126.5 functional
- Server version: 8.126.2 → 8.126.3 functional
- Server version: 8.126.1 → 8.126.2 functional
- 14 Sept 26 0
- Server version: 8.125.3 → 8.126.1 functional
- Server version: 8.125.2 → 8.125.3 functional
- Server version: 8.125.1 → 8.125.2 functional
- Server version: 8.125.0 → 8.125.1 functional
- Server version: 8.124.7 → 8.125.0 functional
- Server version: 8.124.5 → 8.124.7 functional
- Server version: 8.124.3 → 8.124.5 functional
- Server version: 8.124.2 → 8.124.3 functional
- Server version: 8.124.1 → 8.124.2 functional
- Server version: 8.123.1 → 8.124.1 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 21 Sept 2026 · Probed https://api.bowmark.ai/mcp/registry
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=bowmark.ai | CN=YE1,O=Let's Encrypt,C=US | 16 Sept 2026 | 15 Dec 2026 | ECDSA 256 | ECDSA-SHA384 | 50b43b57cc00e1f45d66ad5458b6e845b47 |
| SANs: *.bowmark.ai, bowmark.ai | ||||||
| CN=YE1,O=Let's Encrypt,C=US (CA) | CN=Root YE,O=ISRG,C=US | 3 Sept 2025 | 2 Sept 2028 | ECDSA 384 | ECDSA-SHA384 | 5ddd70dd31f801c85c186a7a04b80afe |
| CN=Root YE,O=ISRG,C=US (CA) | CN=ISRG Root X2,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | ECDSA-SHA384 | 872165fc34b6e5fba8add5b3705fb53a |
| CN=ISRG Root X2,O=Internet Security Research Group,C=US (CA) | CN=ISRG Root X1,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | SHA256-RSA | 6c8f1dc727c7117f7baf853ac980f9cd |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of api.bowmark.ai. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| ai. | present | 3799 | 8 | Verified |
| bowmark.ai. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://api.bowmark.ai/mcp/registry | Verified | 200 | |
| http (plaintext) | http://api.bowmark.ai/mcp/registry | Inconclusive | 405 |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
get_library Check what Bowmark can do for this task ~961
**Use this whenever a task touches a live website.** It answers, definitively and cheaply, whether Bowmark can already DO the thing: look up current prices, check real availability or stock, search a site, get a quote or a fare, drive a configurator, start a booking, or pull anything that only exists behind a form, a filter, or a login. **Use this for Bowmark questions too.** Before answering how to write or run a Bowmark script, what the sandbox supports, or how to start when no site or task is named, call it with the caller's words. The matching entry gives the platform guidance; guessing from general programming knowledge does not. **Checking is cheap, so check.** One read-only call, no site is touched, and an unrecognized query returns a one-line index instead of an error, so the check never dead-ends and never costs you an attempt. If nothing fits, you have lost one cheap call and can use your normal approach. What comes back is the callable **function library** you write against: the runtime globals (`log`) PLUS, for each capability your query named, its namespace, TypeScript types, functions, and worked examples. Everything listed is real and callable. The language rules and how to run a script are on the `run` tool description. Pass `query` — what you want to DO (`"flights"`, `"price a GPU"`) or, if you have one in mind, the COMPANY or site (`"Kayak"`, `"newegg.com"`). If the caller gave only a URL, use its hostname as the query — the query parameters identify a page state, not the company. A phrase in the user's own words is fine; it is matched against the whole library. **You get what you asked about and nothing else.** If nothing matches — or you send no query — you get instead a one-line index: pick whichever entry fits and CALL AGAIN with its name to get the types and examples you need to write a script. **Every response is bounded, and it says so when it is a slice.** A broad query can match more than one response carries; when that happens the a…
| Name | Type | Req | Description |
|---|---|---|---|
| query | string | – | Optional, but pass one — it decides how much detail comes back. What the user wants to do, in their words ("flights", "price a GPU", "book a table", "check stock"), or a company/site if they named on… |
No output schema declared.
No examples provided.
get_secret_link Get the user a link to one of their own stored logins ~97
Return the dashboard link for one stored secret this account holds, so you can answer "where is my Acme password?" with somewhere to go. **It returns a URL, never a value** — opening it requires the user to be signed in and to confirm who they are, and only their own browser can read what comes back.
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | yes | The stored secret's name, as `list_secrets` shows it. |
No output schema declared.
No examples provided.
list_connections See which sites Bowmark is already signed in to ~121
List the saved logins this account holds — which site, which account, whether it is still good, and when it was last used. A live one means a script can reach that site's signed-in pages with no sign-in step and usually no browser. Useful before a task that needs an account: a connection marked `needs_reauth` or `expired` is why a run would pause and ask the user to sign in again. Revoking one is deliberately not a tool — it is the user's to do, at https://bowmark.ai/dashboard/connections.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_secrets See which of the user's logins Bowmark already holds ~108
List the stored secrets this account holds, by NAME. Returns name, type, which hosts each may be used against, when it expires and when it was last used — never a value, and no Bowmark endpoint returns one. **Call this BEFORE `request_secret`.** A secret the user has already set is ready to use; asking for it again sends them to a page for nothing. In a script, refer to one by name: `bowmark.secret('acme_pw')`.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
report Report what Bowmark could not do for this task ~106
Record what was missing, wrong, or incomplete so Bowmark can build it. Pass the `runId` returned by `run` when this report is about a run; omit it when `get_library` did not cover the task. This records feedback only and does not retry a run.
| Name | Type | Req | Description |
|---|---|---|---|
| report | string | yes | What Bowmark could not do or returned incorrectly. |
| runId | string | – | Optional `runId` returned by `run` for the result you are reporting. |
| Name | Type | Req | Description |
|---|---|---|---|
| ok | boolean | yes | – |
No examples provided.
request_secret Ask the user to set a login Bowmark will need ~400
Create a named, empty slot for a secret and get back a link the user opens to fill it in. They type the value on a Bowmark page and choose how long it lives, from 5 minutes to never. It is encrypted in their own browser before it leaves, so nothing on the way — this connection included — ever sees it. **Give the user the link. Never ask them to type a password, API key or one-time code to you.** A secret in this conversation is in your context, in the transcript and in the logs. **Name it for the person, not for your script.** The name you pass is the heading on the page they open and the row they see in their secret list months later, so make it `<site>_<what it is>`: `letterboxd_password`, `stripe_api_key`, `acme_totp_seed`. A run id, a timestamp, a uuid or a bare `password` is refused. Call `list_secrets` first: if the name already exists and is set, use it instead. `name` is lowercase letters, digits, `_`, `.` and `-`. `hosts` narrows where the value may be used and is worth passing — a secret is refused against any other site.
| Name | Type | Req | Description |
|---|---|---|---|
| hosts | array | – | Hosts the value may be used against, e.g. ["acme.com"]. Refused elsewhere. |
| name | string | yes | Lowercase name, `<site>_<what it is>` — `letterboxd_password`, `stripe_api_key`, `acme_totp_seed`. Letters, digits, _ . - only. THE USER READS THIS: it is the heading on the page they open and the ro… |
| type | string | yes | What kind of value the person will be asked for. |
No output schema declared.
No examples provided.
run Do the task on the live websites and return the result ~2,259
**Executes the task on the real websites** (the search, the price check, the availability lookup, the configurator, the booking flow) and returns what came back. Runs a script you authored against the `get_library` vocabulary, on the live sites, and returns `{ ok, result, logs, error, ms }`. Call `get_library` FIRST — it gives the exact function names, argument shapes, and return types; this description is the LANGUAGE + how-to (get_library is just the vocabulary). THE LANGUAGE — plain async JavaScript: • `bowmark` is a ready global (no import). Call capabilities off it — `await bowmark.<capability>.<method>(...)` — always `await`, they're async. • Individual sites are callable too, at `await bowmark.providers.<provider>.<fn>(...)`. Use one when you specifically want THAT site; otherwise prefer the capability, which fans out across sites and routes around failures. • Real control flow: `await`, `if`, loops, array methods (`map`/`filter`/`sort`/`slice`), and `Promise.all` for fan-out. • `return` a value to get it back (JSON-serialized). `log(...)` for progress lines. • Standard JavaScript built-ins are there (`JSON`, `Math`, `Date`, `RegExp`, `Intl`, `Promise`), plus `URL` and `URLSearchParams` — use them to resolve a relative link against the page it came from and to build query strings. Nothing else from the Web platform exists: no `fetch`, `setTimeout`, `TextEncoder` or `crypto`. • `bowmark` is the ONLY I/O — no `fetch`, `process`, filesystem, or `import`/`require`. Write a plain async body, not a wrapping function. • Keep scripts small and deterministic — no infinite loops. Runs in a hard sandbox with CPU + memory + wall-clock limits. **Your own tool-call budget is tighter than you'd guess, and it decides how many calls fit in one script.** Most MCP clients time a single tool call out at around 55 seconds, and ONE ordinary capability call already spends 30-55 seconds of that fanning out to live sites — see COMPOSITION below before calling a second capability i…
| Name | Type | Req | Description |
|---|---|---|---|
| script | string | yes | The JavaScript script body to execute (async, against the `bowmark` global). e.g. `const { flights, warnings } = await bowmark.flights.search({from:'SFO',to:'JFK',depart:'2026-09-01'}); return { best… |
| Name | Type | Req | Description |
|---|---|---|---|
| emptyHanded | – | – | – |
| error | string|null | – | – |
| incomplete | – | – | – |
| logs | array | – | – |
| meta | – | – | – |
| ms | number | – | – |
| needs | array | – | – |
| notice | – | – | – |
| ok | boolean | yes | – |
| result | – | – | – |
| runId | string | – | – |
| savedFiles | array | – | – |
| savedSecrets | array | – | – |
| secretNeeds | array | – | – |
| status | string | – | – |
No examples provided.
What is the Bowmark MCP server?
Bowmark is an MCP server listed in the public MCP registry as ai.bowmark/bowmark. Do things on live websites: prices, availability, quotes, bookings, anything behind a form or login. This page covers its hosted endpoint (https://api.bowmark.ai/mcp/registry).
Is the Bowmark MCP server safe to use?
Bowmark scores 66 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Bowmark MCP server expose?
Bowmark exposes 7 tools: get_library, run, report, list_secrets, request_secret, and 2 more. Their descriptions and schemas cost roughly 4,052 tokens of context every time the server is loaded.
Does the Bowmark MCP server require authentication?
No. We connected to Bowmark without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the Bowmark MCP server still maintained?
Bowmark is still listed as active in the MCP registry. We last reached this channel on 21 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.