# AgentBookable (remote · agentbookable.com)

Find local services, check live availability, and book real appointments with consent.

- Trust score: 72/100 (medium)
- Change this week: +4
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-09-27

> **Recent critical change**: Authorization (2026-09-10). See the changelog below before you install this server.

## Components

- remote · `agentbookable.com`: 72/100 (this document), [markdown](https://verifymcp.io/servers/com-agentbookable-mcp/agentbookable.md), [page](https://verifymcp.io/servers/com-agentbookable-mcp/agentbookable)

## Channel facts

- Endpoint: `https://agentbookable.com/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `3.0.0`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-09-27.

- **Endpoint Security**: 63/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation check failed: no authorisation is required to call this server, and it exposes a tool marked destructive (create_booking).
  - HTTPS is enforced; there's no plaintext access path.
  - The HSTS (Strict-Transport-Security) header is present.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 68/100
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 1170 tokens (~130/item across 9 items; 9 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 53/100
  - Stability check failed: schema churn in the 18 days we've observed: 0 tool removals, 1 breaking changes, 0 auth/transport breaks, 0 additions.
- **Tool Coverage**: 84/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 51% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 9 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 9 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### How do I install the AgentBookable MCP server?

AgentBookable is a hosted endpoint at https://agentbookable.com/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http com-agentbookable-mcp 'https://agentbookable.com/mcp'
```

### Cursor

```json
{
  "mcpServers": {
    "com-agentbookable-mcp": {
      "url": "https://agentbookable.com/mcp"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "com-agentbookable-mcp": {
      "type": "http",
      "url": "https://agentbookable.com/mcp"
    }
  }
}
```

### Codex

```toml
[mcp_servers.com-agentbookable-mcp]
url = "https://agentbookable.com/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "com-agentbookable-mcp": {
      "type": "remote",
      "url": "https://agentbookable.com/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add com-agentbookable-mcp --url 'https://agentbookable.com/mcp' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  com-agentbookable-mcp:
    url: "https://agentbookable.com/mcp"
```

### Netclaw

```json
{
  "McpServers": {
    "com-agentbookable-mcp": {
      "Transport": "http",
      "Url": "https://agentbookable.com/mcp"
    }
  }
}
```

### Vellum

```bash
assistant mcp add com-agentbookable-mcp -t streamable-http -u 'https://agentbookable.com/mcp'
```

### Other

```json
{
  "mcpServers": {
    "com-agentbookable-mcp": {
      "type": "http",
      "url": "https://agentbookable.com/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-09-27 (score 72, +1)

No change was recorded against any check on this day. Stability & Change Management went from 50 to 53.

### 2026-09-25 (score 71, +1)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-09-23 (score 70, +1)

No change was recorded against any check on this day. Stability & Change Management went from 36 to 40.

### 2026-09-21 (score 69, +1)

No change was recorded against any check on this day. Stability & Change Management went from 30 to 33.

### 2026-09-19 (score 68, +1)

No change was recorded against any check on this day. Stability & Change Management went from 23 to 26.

### 2026-09-17 (score 67, +1)

No change was recorded against any check on this day. Stability & Change Management went from 16 to 20.

### 2026-09-14 (score 66, +1)

No change was recorded against any check on this day. Stability & Change Management went from 6 to 10.

### 2026-09-13 (score 65, −1)

- [security regression] Stability: 0.10 → fail
- [security regression] A breaking change shipped without a version bump: still 3.0.0
- [security] Tool “get_booking” rewrote its description, which is the text the model reads
- [functional regression] “get_booking” added a required parameter “mandateRef”, so existing callers break

## MCP tools (9)

### `find_businesses` (~137 tokens)

Search the AgentBookable registry for businesses that accept AI bookings. Search by free text, category, city, service name or geo radius. ALWAYS start here — the results include capability flags and _links telling you the exact next endpoints.

Input parameters:

- `category` (string)
- `city` (string): e.g. 'Civray'
- `latitude` (number)
- `longitude` (number)
- `query` (string): Free text on name/category/description/services, e.g. 'hairdresser'
- `radiusKm` (number)
- `service` (string): Service name, e.g. 'Haircut'

### `get_business` (~98 tokens)

Get one business's record by id (ab_bus_*) or slug. Includes capabilities (availability/booking/reschedule/cancellation/payment) — NEVER promise an action whose flag is false — plus _links to the service list, availability endpoint and booking flow, and per-service bookingRequirements (e.g. whether customer phone is required).

Input parameters:

- `businessId` (string, required): ab_bus_* id or public slug, e.g. 'agentbookable-demo'

### `list_services` (~58 tokens)

List the services a business has opened to AI booking. Each service has a durationMinutes and bookingRequirements telling you what customer details to collect (name/email/phone) BEFORE booking.

Input parameters:

- `businessId` (string, required): ab_bus_* id or slug

### `get_availability` (~115 tokens)

Find LIVE availability for a service. Always call this immediately before create_booking — slots are temporary (~60s) and revalidated at booking. Pass an ISO-8601 window; use a slot id from the result when booking.

Input parameters:

- `businessId` (string, required)
- `from` (string, required): ISO-8601 window start, e.g. 2026-09-01T00:00:00Z
- `serviceId` (string, required)
- `to` (string, required): ISO-8601 window end

### `create_booking` (~253 tokens)

Create a REAL appointment. CONSEQUENCEFUL: only after the user has explicitly chosen a slot and authorized the booking in their own words. Flow: (1) check the service's bookingRequirements and collect any required customer details (e.g. phone); (2) create a mandate via the create_mandate tool with the user's exact instruction; (3) call this tool with the mandateRef. The mandate is single-use and expires in 15 minutes. On SLOT_NO_LONGER_AVAILABLE offer the returned alternatives — never rebook unilaterally.

Input parameters:

- `businessId` (string, required)
- `customer` (object, required)
- `draftId` (string): Booking draft the user consented to (from prepare_booking). When given, the request must match the draft exactly or booking fails with CONSENT_DRAFT_MISMATCH.
- `idempotencyKey` (string): Stable key; safe retries return the original booking
- `mandateRef` (string, required): From create_mandate (or create_mandate_for_draft) — records the user's authorization
- `serviceId` (string, required)
- `slot` (object)
- `slotId` (string): Slot id from get_availability (preferred)

### `prepare_booking` (~167 tokens)

Prepare a booking draft: the concrete proposal (business, service, time, customer) to show the user. Validates live availability and customer requirements — if requirements are missing you get MISSING_CUSTOMER_REQUIREMENT: ask the user for those details first, then call again. Show the returned draft to the user as the final proposal (business, service, duration, date/time), then obtain explicit affirmative consent. The draft expires after 30 minutes; consent binds to this exact proposal.

Input parameters:

- `actorRef` (string, required): Your agent/session identifier for the audit trail
- `businessId` (string, required)
- `customer` (object, required)
- `serviceId` (string, required)
- `slot` (object)
- `slotId` (string): Slot id from get_availability (preferred)

### `create_mandate_for_draft` (~142 tokens)

After the user explicitly agrees to the exact proposal in the draft (an affirmative reply such as 'yes, book it' — the user having already seen business, service, date and time), assert consent here to get a single-use mandate bound to that draft. consentObtained must be true; this assertion is audited. If anything consequential changes (different time, service or business), prepare a NEW draft and get fresh consent.

Input parameters:

- `actorRef` (string, required): Your agent/session identifier, recorded in the audit trail
- `consent` (object, required)
- `draftId` (string, required): The draft the user consented to (from prepare_booking)

### `get_booking` (~74 tokens)

Retrieve a booking by its AgentBookable id (bb_bkg_*). Requires the mandateRef issued for that booking (from create_booking / create_mandate). Provider identity is never returned.

Input parameters:

- `bookingId` (string, required)
- `mandateRef` (string, required): Mandate ref returned when the booking was authorized/created

### `create_mandate` (~126 tokens)

Legacy: record the user's authorization WITHOUT a booking draft. Prefer the draft flow: prepare_booking → show proposal → user agrees → create_mandate_for_draft → create_booking with draftId. The draft flow binds consent to the exact appointment the user saw.

Input parameters:

- `action` (string, required)
- `actorRef` (string, required): Your agent/session identifier, recorded in the audit trail
- `businessId` (string, required): Bind the mandate to this business
- `instruction` (string, required): The user's exact words — never fabricate or paraphrase
- `serviceId` (string)

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/com-agentbookable-mcp/agentbookable#diagnostics

## Score history

- 2026-09-27: 72
- 2026-09-26: 71
- 2026-09-25: 71
- 2026-09-24: 70
- 2026-09-23: 70
- 2026-09-22: 69
- 2026-09-21: 69
- 2026-09-20: 68
- 2026-09-19: 68
- 2026-09-18: 67
- 2026-09-17: 67
- 2026-09-16: 66
- 2026-09-15: 66
- 2026-09-14: 66
- 2026-09-13: 65
- 2026-09-12: 66
- 2026-09-11: 66
- 2026-09-10: 65
- 2026-09-09: 65

## Common questions

### What is the AgentBookable MCP server?

AgentBookable is an MCP server listed in the public MCP registry as com.agentbookable/mcp. Find local services, check live availability, and book real appointments with consent. This page covers its hosted endpoint (https://agentbookable.com/mcp).

### Is the AgentBookable MCP server safe to use?

AgentBookable scores 72 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the AgentBookable MCP server expose?

AgentBookable exposes 9 tools: find_businesses, get_business, list_services, get_availability, create_booking, and 4 more. Their descriptions and schemas cost roughly 1,170 tokens of context every time the server is loaded.

### Does the AgentBookable MCP server require authentication?

No. We connected to AgentBookable without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

### Is the AgentBookable MCP server still maintained?

AgentBookable is still listed as active in the MCP registry. We last reached this channel on 27 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

## Links

- Remote endpoint: https://agentbookable.com/mcp
- Website: https://agentbookable.com/
- Changelog RSS feed: https://verifymcp.io/servers/com-agentbookable-mcp/agentbookable.xml
- Changelog JSON feed: https://verifymcp.io/servers/com-agentbookable-mcp/agentbookable.json
- HTML version of this page: https://verifymcp.io/servers/com-agentbookable-mcp/agentbookable