Canopy by Copp Oak
REMOTE · CANOPY-MCP-PRODUCTION.UP.RAILWAY.APP
Book local service pros from your AI assistant: real availability, instant booking, easy cancels.
Available components
Last scanned (6 hours ago)
Scores higher than 44% of remote servers
Unreachable for 2 days in a row. Last reached 3 Nov 2026.
Category CRM and Sales
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security11
- TLS not yet verified: we couldn't open a connection to check the certificate. View diagnostics → Unverified
- Authorisation not yet verified: we couldn't confirm whether this endpoint requires it. View diagnostics → Unverified
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- HSTS not yet verified: we couldn't read the response headers to check for it. View diagnostics → Unverified
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability0
- Transport check failed: declared streamable-http, but we couldn't connect to verify it. See how to fix → View diagnostics → Fail
Schema Quality & AI Usability0
- Schema not yet verified: we couldn't read the endpoint's schema, or could read only part of its tool list.Unverified
Stability & Change Management0
- Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage0
- Tool coverage not yet verified: we couldn't read the endpoint's tools, or could read only part of the list.Unverified
Tool Safety0
- Tool safety not yet verified: we couldn't read the endpoint's tools, or could read only part of the list.Unverified
Capabilities0
- Capabilities not yet verified: we couldn't read the endpoint's capabilities.Unverified
Unverified: 5 categories
Categories scored 0 because we could not verify them: authentication we do not have, an unreachable endpoint, or not enough scan history. We only credit what we can confirm.
Checks we ran (3)
- HTTPS
- DNSSEC
- Transport
Checks we could not complete (8)
These are gaps on our side, not findings about this hosted endpoint. We only credit what we can confirm, so a category made up entirely of them scores 0.
- TLS certificate in Endpoint SecurityTLS not yet verified: we couldn't open a connection to check the certificate.
- Authorization in Endpoint SecurityAuthorisation not yet verified: we couldn't confirm whether this endpoint requires it.
- HSTS header in Endpoint SecurityHSTS not yet verified: we couldn't read the response headers to check for it.
- Schema quality in Schema Quality & AI Usability (scores 0 for this)Schema not yet verified: we couldn't read the endpoint's schema, or could read only part of its tool list.
- Stability in Stability & Change Management (scores 0 for this)Stability not yet verified: not enough scan history yet (needs a 30-day window).
- Tool coverage in Tool Coverage (scores 0 for this)Tool coverage not yet verified: we couldn't read the endpoint's tools, or could read only part of the list.
- Tool safety in Tool Safety (scores 0 for this)Tool safety not yet verified: we couldn't read the endpoint's tools, or could read only part of the list.
- Capabilities in Capabilities (scores 0 for this)Capabilities not yet verified: we couldn't read the endpoint's capabilities.
Does not apply to this hosted endpoint (2)
- Supply Chain SecurityScored on package channels only. This is a hosted endpoint, so there is nothing to install or inspect.
- Provenance & TransparencyScored on package channels only. This is a hosted endpoint, so there is nothing to install or inspect.
The score does not measure everything. What the score does not measure →
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 4 Nov 26 0
- Endpoint reachability: reachable → unreachable ▼ security
- Authorization: fail → unverified ▼ security
- HSTS header: fail → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- TLS certificate: pass → unverified ▼ security
- Stability: 0.03 → unverified ▼ security
- Transport: pass → fail ▼ security
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- First check of Schema quality: unverified functional
- 3 Nov 26 0
- Stability: unverified → 0.03 ▲ functional
- 2 Nov 26 63
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Probed https://canopy-mcp-production.up.railway.app/mcp/public
TLS unreached
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of canopy-mcp-production.up.railway.app. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | Trust anchor | 20326, 38696 | 8, 8 | Verified |
| app. | DS published | 23684 | 8 | Verified |
| railway.app. | No DS | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication Inconclusive
We could not reach the endpoint well enough to judge its authorisation posture.
| Result | Inconclusive |
|---|
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://canopy-mcp-production.up.railway.app/mcp/public | Unreachable | ||
| http (plaintext) | http://canopy-mcp-production.up.railway.app/mcp/public | HTTPS enforced |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
cancel_booking Cancel a booking ~143
Cancel a booking made through Canopy. The appointment is called off in the business's calendar right away and the customer is emailed. This cannot be undone: confirm with the customer before calling. An appointment that has already started cannot be cancelled here. Needs the manage_token that came back with the booking_id.
| Name | Type | Req | Description |
|---|---|---|---|
| booking_id | string | yes | booking_id of the booking to cancel (from request_booking or get_request_status). |
| manage_token | string | yes | manage_token returned with that booking_id (by request_booking when the booking was created, or as booking_manage_token by get_request_status). |
| reason | string | – | Short reason for cancelling, if the customer gave one. |
No output schema declared.
No examples provided.
canopy_check_bookable Check which businesses are bookable ~96
Given businesses you already found for the user (name plus phone, website or address), report which ones can be booked through Canopy and how (booking_mode). Results come back in exactly the order you sent them. Canopy never ranks, filters or recommends businesses. Results are returned in the same order as the input.
| Name | Type | Req | Description |
|---|---|---|---|
| businesses | array | yes | 1 to 50 businesses, in your order. Results keep this order. |
No output schema declared.
No examples provided.
get_availability Get open appointment times ~219
List open appointment slots for a Canopy business, optionally for one service and one location, between two dates. Slots are cached from the business calendar (see synced_at); the time is re-checked live when you book.
| Name | Type | Req | Description |
|---|---|---|---|
| customer_zip | string | – | Customer's ZIP code, if known. For a business with several locations, Canopy uses the location nearest to it unless location_id (or a slot or service tied to one location) decides. The result names t… |
| from_date | string | – | First day, YYYY-MM-DD. Default: today. |
| location_id | string | – | Location for multi-location businesses. |
| operator_id | string | yes | operator_id from canopy_check_bookable or resolve_business. |
| service_id | string | – | Only slots for this service. |
| timezone | string | – | IANA time zone for dates and returned times. |
| to_date | string | – | Last day (inclusive), YYYY-MM-DD, at most 31 days after from_date. Default: 13 days after from_date. |
No output schema declared.
No examples provided.
get_business_terms Get a business's prices and terms ~95
Get the prices of a Canopy business's bookable services, its fees and its cancellation terms, exactly as the business has them on file. Anything the business has not put on file comes back as on_file=false: tell the customer it is not on file (they can ask the business) and never estimate or fill in a value.
| Name | Type | Req | Description |
|---|---|---|---|
| operator_id | string | yes | operator_id from canopy_check_bookable or resolve_business. |
No output schema declared.
No examples provided.
get_request_status Check a booking request ~91
Check the status of a booking request (preferred times or callback). Returns pending, approved, rejected, counter_proposed, expired, or converted. Needs the manage_token that came back when the request was made.
| Name | Type | Req | Description |
|---|---|---|---|
| manage_token | string | yes | manage_token returned with that request_id when the request was created. |
| request_id | string | yes | request_id returned by request_booking, propose_times or request_callback. |
No output schema declared.
No examples provided.
propose_times Propose preferred times ~264
Propose preferred times to a business that reviews booking requests. The business will approve one time (that books it; the customer is emailed a confirmation) or propose an alternative (the customer confirms it from an emailed code). Check status with get_request_status.
| Name | Type | Req | Description |
|---|---|---|---|
| agent_callback_url | string | – | Optional HTTPS URL that receives a webhook when the business responds. |
| customer | object | yes | The customer the appointment or callback is for. |
| customer_zip | string | – | Customer's ZIP code, if known. For a business with several locations, Canopy uses the location nearest to it unless location_id (or a slot or service tied to one location) decides. The result names t… |
| idempotency_key | string | – | Optional. Reuse the same key when retrying so nothing is created twice. Derived automatically if omitted. |
| location_id | string | – | Location for multi-location businesses. |
| notes | string | – | Extra details for the business (added to the customer notes). |
| operator_id | string | yes | operator_id from canopy_check_bookable or resolve_business. |
| preferred_times | array | yes | 1 to 3 preferred time windows, in order of preference. |
| service_id | string | yes | Service the customer wants (from get_availability). |
No output schema declared.
No examples provided.
request_booking Start a booking ~316
Start a booking with a Canopy-connected business. Canopy automatically routes to the correct flow based on the operator's booking mode: auto-confirm (booked right away in the business's calendar; the customer is emailed a confirmation), request-times (propose preferred times), or submission-only (callback request). Summarize the booking and get the customer's go-ahead before calling.
| Name | Type | Req | Description |
|---|---|---|---|
| agent_callback_url | string | – | Optional HTTPS URL that receives a webhook when the business responds. |
| customer | object | yes | The customer the appointment or callback is for. |
| customer_zip | string | – | Customer's ZIP code, if known. For a business with several locations, Canopy uses the location nearest to it unless location_id (or a slot or service tied to one location) decides. The result names t… |
| idempotency_key | string | – | Optional. Reuse the same key when retrying so nothing is created twice. Derived automatically if omitted. |
| location_id | string | – | Location for multi-location businesses. |
| notes | string | – | Extra details for the business (added to the customer notes). |
| operator_id | string | yes | operator_id from canopy_check_bookable or resolve_business. |
| preferred_times | array | – | 1 to 3 preferred time windows (businesses that review requests). |
| service_id | string | – | Service to book (from get_availability). Needed for instant-confirm and preferred-times businesses. |
| slot_id | string | – | Open slot from get_availability (instant-confirm businesses). |
No output schema declared.
No examples provided.
request_callback Request a callback ~212
Request a callback from a business. They will contact the customer directly. No calendar booking is created.
| Name | Type | Req | Description |
|---|---|---|---|
| agent_callback_url | string | – | Optional HTTPS URL that receives a webhook when the business responds. |
| customer | object | yes | The customer the appointment or callback is for. |
| customer_zip | string | – | Customer's ZIP code, if known. For a business with several locations, Canopy uses the location nearest to it unless location_id (or a slot or service tied to one location) decides. The result names t… |
| idempotency_key | string | – | Optional. Reuse the same key when retrying so nothing is created twice. Derived automatically if omitted. |
| location_id | string | – | Location for multi-location businesses. |
| notes | string | – | Extra details for the business (added to the customer notes). |
| operator_id | string | yes | operator_id from canopy_check_bookable or resolve_business. |
| service_id | string | – | Service the customer is asking about, if known. |
No output schema declared.
No examples provided.
reschedule_booking Ask to move a booking to another time ~215
Ask to move a booking the customer already confirmed (booked with the business) to another open slot of the same service and location (slot_id from get_availability). Nothing moves right away: Canopy emails the customer a link to approve the new time, and the business calendar changes only after they approve. A hold the customer has not confirmed yet cannot be moved. Calling again with the same slot_id reports whether it was approved. Needs the manage_token that came back with the booking_id.
| Name | Type | Req | Description |
|---|---|---|---|
| booking_id | string | yes | booking_id of the confirmed booking to move (from request_booking or get_request_status). |
| manage_token | string | yes | manage_token returned with that booking_id (by request_booking when the booking was created, or as booking_manage_token by get_request_status). |
| reason | string | – | Short reason for the move, if the customer gave one. |
| slot_id | string | yes | The new open slot (from get_availability, same service and location). The customer must approve the move by email. |
No output schema declared.
No examples provided.
resolve_business Look up one business on Canopy ~154
Match one business the user named to its Canopy listing, by phone, website, or name (add the city, state or ZIP code when you know it). Returns at most one match, with its booking_mode and locations, or found=false. When a name alone is not certain, found=false comes with up to 5 candidates in alphabetical order for the user to choose from.
| Name | Type | Req | Description |
|---|---|---|---|
| address | object | – | City, state and ZIP code of the business. |
| business_name | string | – | Business name as you found it. With no phone or website, add the address city, state or ZIP when known. |
| phone | string | – | Business phone number. |
| website | string | – | Business website URL or domain. |
No output schema declared.
No examples provided.
How do I install the Canopy by Copp Oak MCP server?
Canopy by Copp Oak is a hosted endpoint at https://canopy-mcp-production.up.railway.app/mcp/public, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · canopy-mcp-production.up.railway.app
claude mcp add --transport http com-coppoak-canopy 'https://canopy-mcp-production.up.railway.app/mcp/public'
What is the Canopy by Copp Oak MCP server?
Canopy by Copp Oak is an MCP server listed in the public MCP registry as com.coppoak/canopy. Book local service pros from your AI assistant: real availability, instant booking, easy cancels. This page covers its hosted endpoint (https://canopy-mcp-production.up.railway.app/mcp/public).
Is the Canopy by Copp Oak MCP server safe to use?
Canopy by Copp Oak scores 63 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Canopy by Copp Oak MCP server expose?
Canopy by Copp Oak exposes 10 tools: canopy_check_bookable, resolve_business, get_availability, request_booking, propose_times, and 5 more. Their descriptions and schemas cost roughly 1,805 tokens of context every time the server is loaded.
Does the Canopy by Copp Oak MCP server require authentication?
Its publisher declares no required credentials for Canopy by Copp Oak. We have not been able to confirm that against the live endpoint, and a server can require authorisation without declaring it here.
Is the Canopy by Copp Oak MCP server still maintained?
Canopy by Copp Oak is still listed in the MCP registry, though our most recent checks did not reach this channel. We last reached this channel on 3 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What did VerifyMCP test on the Canopy by Copp Oak MCP server?
VerifyMCP ran 3 checks on Canopy by Copp Oak, covering HTTPS, DNSSEC and Transport. 8 items could not be completed, a gap on our side rather than a finding about Canopy by Copp Oak: TLS certificate, Authorization, HSTS header, Schema quality and 4 more. 5 categories score 0 for that reason, because we only credit what we can confirm. Supply Chain Security and Provenance & Transparency do not apply to a hosted endpoint, so they were not tested. The score does not measure everything, and the scoring documentation lists what it leaves out.