brussels.toots/tickets
REMOTE · TOOTS.BRUSSELS · SCANNED OCT 4
Agenda and ticketing for Toots Jazz Club, Brussels: browse concerts, check seats, reserve tickets.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security57
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation check failed: no authorisation is required to call this server, and it exposes a tool marked destructive (release_booking). See how to fix → View diagnostics → Fail
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability83
- 98% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Partial
- AI-judged instruction clarity (good).Pass
- Tool/resource definitions use about 3133 tokens (~45/item across 69 items; 13 tools + 56 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage90
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 65% of tool parameters carry a description.Partial
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 15 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities60
- Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28. See how to fix → Fail
How do I install the brussels.toots/tickets MCP server?
brussels.toots/tickets is a hosted endpoint at https://toots.brussels/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · toots.brussels
claude mcp add --transport http brussels-toots-tickets 'https://toots.brussels/mcp'
{
"mcpServers": {
"brussels-toots-tickets": {
"url": "https://toots.brussels/mcp"
}
}
} {
"servers": {
"brussels-toots-tickets": {
"type": "http",
"url": "https://toots.brussels/mcp"
}
}
} [mcp_servers.brussels-toots-tickets] url = "https://toots.brussels/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"brussels-toots-tickets": {
"type": "remote",
"url": "https://toots.brussels/mcp",
"enabled": true
}
}
} openclaw mcp add brussels-toots-tickets --url 'https://toots.brussels/mcp' --transport streamable-http
mcp_servers:
brussels-toots-tickets:
url: "https://toots.brussels/mcp" {
"McpServers": {
"brussels-toots-tickets": {
"Transport": "http",
"Url": "https://toots.brussels/mcp"
}
}
} assistant mcp add brussels-toots-tickets -t streamable-http -u 'https://toots.brussels/mcp'
{
"mcpServers": {
"brussels-toots-tickets": {
"type": "http",
"url": "https://toots.brussels/mcp"
}
}
} The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 4 Oct 26 −1
- Resource “concert-14232” was removed ▼ functional
- Resource “concert-14309” was removed ▼ functional
- 3 Oct 26 0
- Resource “concert-14228” was removed ▼ functional
- Resource “concert-14264” was removed ▼ functional
- New resource “concert-13954” functional
- New resource “concert-14905” functional
- New resource “concert-14909” functional
- New resource “concert-15253” functional
- New resource “concert-15258” functional
- New resource “concert-15265” functional
- New resource “concert-15276” functional
- New resource “concert-7092” functional
- 2 Oct 26 +7
- Judged manipulation: unverified → pass ▲ security
- Resource “concert-14226” was removed ▼ functional
- Resource “concert-14257” was removed ▼ functional
- Resource “concert-14259” was removed ▼ functional
- Schema quality: unverified → good ▲ functional
- New resource “concert-14897” functional
- New resource “concert-14899” functional
- New resource “concert-14901” functional
- New resource “concert-15179” functional
- New resource “concert-15185” functional
- New resource “concert-15206” functional
- New resource “concert-15208” functional
- New resource “concert-15212” functional
- 1 Oct 26 −6
- Judged manipulation: pass → unverified ▼ security
- Schema quality: good → unverified ▼ functional
- Resource “concert-14052” was removed ▼ functional
- Schema quality: 57 → 48 ▲ functional
- New resource “concert-10519” functional
- New resource “concert-13932” functional
- New resource “concert-13938” functional
- New resource “concert-13957” functional
- New resource “concert-14184” functional
- New resource “concert-14256” functional
- New resource “concert-14871” functional
- New resource “concert-14881” functional
- New resource “concert-14885” functional
- New resource “concert-14887” functional
- New resource “concert-14889” functional
- New resource “concert-14893” functional
- New resource “concert-15096” functional
- New resource “concert-15151” functional
- New resource “concert-5732” functional
- New resource “concert-8322” functional
- New resource “concert-8421” functional
- 30 Sept 26 0
- Resource “concert-14047” was removed ▼ functional
- 28 Sept 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 27 Sept 26 +1
- Resource “concert-14165” was removed ▼ functional
- Resource “concert-14184” was removed ▼ functional
- 26 Sept 26 0
- Resource “concert-13838” was removed ▼ functional
- Resource “concert-14034” was removed ▼ functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 4 Oct 2026 · Probed https://toots.brussels/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=toots.brussels | CN=YE2,O=Let's Encrypt,C=US | 25 Aug 2026 | 23 Nov 2026 | ECDSA 256 | ECDSA-SHA384 | 5bc4486018cd71d2f923c551640975061bf |
| SANs: toots.brussels | ||||||
| CN=YE2,O=Let's Encrypt,C=US (CA) | CN=Root YE,O=ISRG,C=US | 3 Sept 2025 | 2 Sept 2028 | ECDSA 384 | ECDSA-SHA384 | 4df3b15dd6c0784c507cd37b58e6f115 |
| CN=Root YE,O=ISRG,C=US (CA) | CN=ISRG Root X2,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | ECDSA-SHA384 | 872165fc34b6e5fba8add5b3705fb53a |
| CN=ISRG Root X2,O=Internet Security Research Group,C=US (CA) | CN=ISRG Root X1,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | SHA256-RSA | 6c8f1dc727c7117f7baf853ac980f9cd |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of toots.brussels. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| brussels. | present | 64008 | 13 | Verified |
| toots.brussels. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://toots.brussels/mcp | Verified | 200 | |
| http (plaintext) | http://toots.brussels/mcp | HTTPS enforced | 301 | https://toots.brussels/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
get_availability Live seat availability ~81
Live ticket availability for a concert, per session: the stock_id, category_id and price_id values that hold_tickets needs, with prices in euro cents and the maximum quantity per line.
| Name | Type | Req | Description |
|---|---|---|---|
| event_id | string | yes | The event_id from list_events. |
| locale | string | – | Language for titles, labels and the returned URLs. Defaults to fr. |
| Name | Type | Req | Description |
|---|---|---|---|
| result | object | yes | – |
No examples provided.
get_booking_status Booking status ~113
Current status of a booking: awaiting_contact, awaiting_payment (with payment_url and amount left), paid or expired. A paid booking carries ticket_url — the one link to share with the buyer, which adapts to their device (wallet on a phone, PDF and choices elsewhere) — plus the explicit ticket_pdf_url and, when configured, apple_wallet_url / google_wallet_url.
| Name | Type | Req | Description |
|---|---|---|---|
| booking_uuid | string | yes | – |
| locale | string | – | Language for titles, labels and the returned URLs. Defaults to fr. |
| Name | Type | Req | Description |
|---|---|---|---|
| result | object | yes | – |
No examples provided.
get_event Concert details ~64
Full details of one concert: bio, line-up, other dates of the same run, prices and availability.
| Name | Type | Req | Description |
|---|---|---|---|
| event_id | string | yes | The event_id from list_events. |
| locale | string | – | Language for titles, labels and the returned URLs. Defaults to fr. |
| Name | Type | Req | Description |
|---|---|---|---|
| result | object | yes | – |
No examples provided.
get_venue_info Venue information ~59
Address, contact details and the venue's FAQ (house rules, practical questions). Use this to answer buyer questions about the club instead of guessing.
| Name | Type | Req | Description |
|---|---|---|---|
| locale | string | – | Language for titles, labels and the returned URLs. Defaults to fr. |
| Name | Type | Req | Description |
|---|---|---|---|
| result | object | yes | – |
No examples provided.
hold_tickets Reserve tickets ~131
Reserves tickets and returns a booking_uuid. The hold expires after 15 minutes if the order is not paid, releasing the seats. Only call this once the buyer has chosen; do not hold speculatively.
| Name | Type | Req | Description |
|---|---|---|---|
| event_id | string | yes | The event_id from list_events. |
| idempotency_key | string | – | Optional deduplication key of your choosing. Retrying a timed-out hold with the same key returns the original booking instead of reserving twice. |
| items | array | yes | – |
| locale | string | – | Language for titles, labels and the returned URLs. Defaults to fr. |
| Name | Type | Req | Description |
|---|---|---|---|
| result | object | yes | – |
No examples provided.
list_events List upcoming concerts ~51
All upcoming concerts with date, line-up, genres and a price/availability summary. Amounts are euro cents.
| Name | Type | Req | Description |
|---|---|---|---|
| locale | string | – | Language for titles, labels and the returned URLs. Defaults to fr. |
| Name | Type | Req | Description |
|---|---|---|---|
| result | array | yes | – |
No examples provided.
pay_with_shared_payment_token Pay with a Link Shared Payment Token ~213
Pays the remaining balance of a booking (after set_contact, and after any pass or gift card) with a Shared Payment Token from the buyer's Link agent wallet. Request the token for exactly amount_to_pay_cents in EUR, scoped to the Stripe network profile profile_61VNUTvZyhaQmxLgqA6VNUTv7A9CUusxmQZ0xC5doSoy; the buyer approves that spend in Link. Charges the buyer, so only call it once they confirmed the purchase. On success the booking is paid and carries ticket_url; if the response says otherwise (payment_status, next_step) or errors, give the payment_url to the human buyer instead — the booking stays open until its hold expires.
| Name | Type | Req | Description |
|---|---|---|---|
| booking_uuid | string | yes | – |
| locale | string | – | Language for titles, labels and the returned URLs. Defaults to fr. |
| shared_payment_token | string | yes | The spt_… token granted by the buyer's Link wallet. |
| Name | Type | Req | Description |
|---|---|---|---|
| result | object | yes | – |
No examples provided.
recover_tickets Re-send tickets by email ~100
For a buyer who lost their tickets: sends the ticket links of their past paid orders to their email address. The links go to the inbox only — the response never contains them — so the inbox is the proof of ownership. Tell the buyer to check their email (and spam folder).
| Name | Type | Req | Description |
|---|---|---|---|
| string | yes | The email address the buyer ordered with. | |
| locale | string | – | Language for titles, labels and the returned URLs. Defaults to fr. |
| Name | Type | Req | Description |
|---|---|---|---|
| result | object | yes | – |
No examples provided.
redeem_gift_card Pay with a gift card ~114
Applies a Toots gift card code (given to you by the buyer) to a held booking, after set_contact. Uses as much of the card's balance as the order needs. Fully covered orders complete immediately (status paid); otherwise the response carries the payment_url for the balance.
| Name | Type | Req | Description |
|---|---|---|---|
| booking_uuid | string | yes | – |
| code | string | yes | The gift card code, exactly as the buyer gave it. |
| locale | string | – | Language for titles, labels and the returned URLs. Defaults to fr. |
| Name | Type | Req | Description |
|---|---|---|---|
| result | object | yes | – |
No examples provided.
redeem_pass Pay with a Toots Pass ~136
Applies a Toots Pass code (given to you by the buyer; format XXX-XXXXXX-XXX) to a held booking, after set_contact. Covers as many tickets as the pass has concerts left. If the order is fully covered the booking completes immediately (status paid); otherwise the response carries the payment_url for the balance. The code is a venue credential, not a payment instrument.
| Name | Type | Req | Description |
|---|---|---|---|
| booking_uuid | string | yes | – |
| code | string | yes | The Toots Pass code, exactly as the buyer gave it. |
| locale | string | – | Language for titles, labels and the returned URLs. Defaults to fr. |
| Name | Type | Req | Description |
|---|---|---|---|
| result | object | yes | – |
No examples provided.
release_booking Release a hold ~73
Gives an unpaid hold's seats back immediately, instead of letting them sit reserved until the 15-minute expiry. Call this when the buyer changes their mind. Paid bookings cannot be released.
| Name | Type | Req | Description |
|---|---|---|---|
| booking_uuid | string | yes | – |
| locale | string | – | Language for titles, labels and the returned URLs. Defaults to fr. |
| Name | Type | Req | Description |
|---|---|---|---|
| result | object | yes | – |
No examples provided.
set_contact Attach the buyer ~170
Attaches the buyer to a held booking and returns the payment_url. Give that URL to the human buyer: payment (card or Bancontact) happens in their browser, never through this API. The tickets will be emailed to the address given here.
| Name | Type | Req | Description |
|---|---|---|---|
| booking_uuid | string | yes | – |
| country | string | – | Two-letter ISO code, e.g. BE. |
| string | yes | The buyer's email; the tickets are sent there. | |
| firstname | string | yes | – |
| lastname | string | yes | – |
| newsletter_opt_in | boolean | – | Only true if the buyer explicitly asked to subscribe. |
| promo_code | string | – | – |
| terms_accepted | boolean | yes | Must be true, and only after the buyer explicitly accepted the terms of sale. |
| zip | string | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | object | yes | – |
No examples provided.
wait_for_payment Wait for the payment ~102
Like get_booking_status, but holds the request open (up to 25 seconds) and returns as soon as the booking is paid. Call it after handing the buyer the payment_url instead of polling in a loop; repeat while status is still awaiting_payment and the hold has time left.
| Name | Type | Req | Description |
|---|---|---|---|
| booking_uuid | string | yes | – |
| locale | string | – | Language for titles, labels and the returned URLs. Defaults to fr. |
| timeout_seconds | integer | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | object | yes | – |
No examples provided.
What is the brussels.toots/tickets MCP server?
brussels.toots/tickets is an MCP server listed in the public MCP registry as brussels.toots/tickets. Agenda and ticketing for Toots Jazz Club, Brussels: browse concerts, check seats, reserve tickets. This page covers its hosted endpoint (https://toots.brussels/mcp).
Is the brussels.toots/tickets MCP server safe to use?
brussels.toots/tickets scores 77 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the brussels.toots/tickets MCP server expose?
brussels.toots/tickets exposes 13 tools: list_events, get_event, get_availability, get_venue_info, hold_tickets, and 8 more. Their descriptions and schemas cost roughly 1,407 tokens of context every time the server is loaded.
Does the brussels.toots/tickets MCP server require authentication?
No. We connected to brussels.toots/tickets without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the brussels.toots/tickets MCP server still maintained?
brussels.toots/tickets is still listed as active in the MCP registry. We last reached this channel on 4 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.