Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

Booksy by Cotlet

REMOTE · COTLET.DEV · 3 COMPONENTS

Bookings, clients, reviews and reports for beauty businesses.

69 Trust /100

Last scanned (1 hour ago)

Scores higher than 58% of remote servers

Reachable. Last reached 24 Oct 2026.

Category CRM and Sales

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →

Endpoint Security66
Transport & Reachability100
Schema Quality & AI Usability82
  • 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
  • AI-judged instruction clarity (good).Pass
  • Context-footprint check failed: tool/resource definitions use about 5936 tokens (~129/item across 46 items; 45 tools + 1 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management0
  • Stability check failed: schema churn in the 1 day we've observed: 3 tool removals, 0 breaking changes, 0 auth/transport breaks, 0 additions. See how to fix → Fail
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • All 3 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
  • An AI judge read all 47 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a current MCP spec version (2026-07-28).Pass
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 24 Oct 26 0
    • Stability: unverified → fail ▼ security
    • A breaking change shipped without a version bump: still 0.1.0 ▼ security
    • Tool “cotlet_balance” was removed ▼ security
    • Tool “cotlet_browser_connect” was removed ▼ security
    • Tool “cotlet_browser_sessions” was removed ▼ security
    • The server rewrote its instructions, which are the text every model session reads security
    • Tool “add_client” rewrote its description, which is the text the model reads security
    • Tool “add_client_note” rewrote its description, which is the text the model reads security
    • Tool “add_time_off” rewrote its description, which is the text the model reads security
    • Tool “cancel_appointment” rewrote its description, which is the text the model reads security
    • Tool “cotlet_browser_click” rewrote its description, which is the text the model reads security
    • Tool “cotlet_browser_close” rewrote its description, which is the text the model reads security
    • Tool “cotlet_browser_navigate” rewrote its description, which is the text the model reads security
    • Tool “cotlet_browser_open” rewrote its description, which is the text the model reads security
    • Tool “cotlet_browser_press” rewrote its description, which is the text the model reads security
    • Tool “cotlet_browser_read” rewrote its description, which is the text the model reads security
    • Tool “cotlet_browser_screenshot” rewrote its description, which is the text the model reads security
    • Tool “cotlet_browser_scroll” rewrote its description, which is the text the model reads security
    • Tool “cotlet_browser_select” rewrote its description, which is the text the model reads security
    • Tool “cotlet_browser_type” rewrote its description, which is the text the model reads security
    • Tool “cotlet_browser_upload” rewrote its description, which is the text the model reads security
    • Tool “create_appointment” rewrote its description, which is the text the model reads security
    • Tool “delete_client” rewrote its description, which is the text the model reads security
    • Tool “estimate_message_blast” rewrote its description, which is the text the model reads security
    • Tool “find_client” rewrote its description, which is the text the model reads security
    • Tool “find_open_slots” rewrote its description, which is the text the model reads security
    • Tool “get_appointment” rewrote its description, which is the text the model reads security
    • Tool “get_business_hours” rewrote its description, which is the text the model reads security
    • Tool “get_business_profile” rewrote its description, which is the text the model reads security
    • Tool “get_client” rewrote its description, which is the text the model reads security
    • Tool “get_report” rewrote its description, which is the text the model reads security
    • Tool “get_settings” rewrote its description, which is the text the model reads security
    • Tool “list_appointments” rewrote its description, which is the text the model reads security
    • Tool “list_clients” rewrote its description, which is the text the model reads security
    • Tool “list_message_blasts” rewrote its description, which is the text the model reads security
    • Tool “list_notifications” rewrote its description, which is the text the model reads security
    • Tool “list_reviews” rewrote its description, which is the text the model reads security
    • Tool “list_services” rewrote its description, which is the text the model reads security
    • Tool “list_staff” rewrote its description, which is the text the model reads security
    • Tool “list_time_off” rewrote its description, which is the text the model reads security
    • Tool “remove_time_off” rewrote its description, which is the text the model reads security
    • Tool “reply_to_review” rewrote its description, which is the text the model reads security
    • Tool “reschedule_appointment” rewrote its description, which is the text the model reads security
    • Tool “send_message_blast” rewrote its description, which is the text the model reads security
    • Tool “update_client” rewrote its description, which is the text the model reads security
    • Schema quality: pass → fail ▼ functional
  • 23 Oct 26 69

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 24 Oct 2026 · Probed https://cotlet.dev/mcp/v1/booksy

TLS valid

Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .

Subject Issuer Valid from Valid until Key Signature Serial
CN=cotlet.dev CN=YE1,O=Let's Encrypt,C=US 12 Oct 2026 10 Jan 2027 ECDSA 256 ECDSA-SHA384 6afd7585ee8e24a40f5683c10835ec990a8
SANs: *.cotlet.dev, cotlet.dev
CN=YE1,O=Let's Encrypt,C=US (CA) CN=Root YE,O=ISRG,C=US 3 Sept 2025 2 Sept 2028 ECDSA 384 ECDSA-SHA384 5ddd70dd31f801c85c186a7a04b80afe
CN=Root YE,O=ISRG,C=US (CA) CN=ISRG Root X2,O=Internet Security Research Group,C=US 13 May 2026 2 Sept 2032 ECDSA 384 ECDSA-SHA384 872165fc34b6e5fba8add5b3705fb53a
CN=ISRG Root X2,O=Internet Security Research Group,C=US (CA) CN=ISRG Root X1,O=Internet Security Research Group,C=US 13 May 2026 2 Sept 2032 ECDSA 384 SHA256-RSA 6c8f1dc727c7117f7baf853ac980f9cd

Background: What to check on a remote MCP endpoint →

DNSSEC secure

Validation of cotlet.dev. — Secure

Zone DS Keys Algorithms Outcome
. trust_anchor 20326, 38696 8, 8 Verified
dev. present 60074 8 Verified
cotlet.dev. present 2371 13 Verified
cotlet.dev. Verified address RRset verified with the apex keys
Authentication No authorisation required

The endpoint answered without asking for a token. Anyone who knows the URL can reach it.

Result No authorisation required
HTTP status 200
Header Value
strict-transport-security max-age=31536000; includeSubDomains
x-content-type-options nosniff

Background: How OAuth 2.1 works in the 2026 MCP spec →

Transports 2 probes
Transport URL Outcome Status Location
streamable-http https://cotlet.dev/mcp/v1/booksy Verified 200
http (plaintext) http://cotlet.dev/mcp/v1/booksy HTTPS enforced 301 https://cotlet.dev/mcp/v1/booksy
MCP tools · 45 exposed · ~5,751 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
add_client ~183

Add a client card to your client list. Needs a phone or an email. Adds one client card with a name, a phone or an email (Booksy needs one of them), and optionally a private note and a birthday. The client is not invited to the Booksy app and gets no message, so add_client runs without asking first. delete_client removes the card again. A card deleted earlier with the same email or phone comes back with its old visits, note and birthday unless new ones are given.

NameTypeReqDescription
birthdaystring–YYYY-MM-DD.
emailstring–Email address.
namestringyesFull name; the last word is the last name.
notestring–Private note, seen only by the business.
phonestring–Mobile phone, best in international format (+48 600 100 200).

No output schema declared.

No examples provided.

add_client_note ~85

Add a dated line to a client's private note, keeping what is there. Booksy keeps one private note per client card, seen only by the business. This adds a new line starting with today's date under the existing text. The client is not told.

NameTypeReqDescription
client_idintegeryesFrom list_clients or find_client.
textstringyesThe line to add.

No output schema declared.

No examples provided.

add_time_off ~200

Block a staff member's calendar so no one can book it: whole days off or a few hours. Two dates (YYYY-MM-DD) add whole days of time off, like Staff > Shifts. Two date-times on the same day block those hours in the calendar, like a time reservation. Booksy refuses a block over existing appointments. It reaches no client; remove_time_off takes it back.

NameTypeReqDescription
endstringyesLast day off, inclusive (YYYY-MM-DD), or the end of the blocked hours on the same day.
reasonstring–Whole days: vacation, sick_day, personal_day, training or other (other text is kept as a note). Hours: any label, e.g. Lunch.
staff_idstringyesStaff ID from list_staff.
startstringyesA day (YYYY-MM-DD) for whole days off, or an ISO 8601 date-time to block hours.

No output schema declared.

No examples provided.

cancel_appointment ~140

Cancel an appointment and free its time in the calendar. Cancels one appointment as the business. The client is told only with notify_client. A deposit, if any, follows the business's deposit settings. Booksy refuses appointments it no longer lets you cancel (can in get_appointment). There is no undo; book again with create_appointment. Waits for the owner's approval.

NameTypeReqDescription
appointment_idstringyesAppointment ID from list_appointments.
notify_clientboolean–Tell the client by email and SMS through Booksy. Default: false.
reasonstring–Why it is cancelled; saved as the appointment's note.

No output schema declared.

No examples provided.

cotlet_apps ~89

The apps of the user's workspace and whether each works now: access granted or requested, the app account in the user's Cloud Browser (connected, signed out, not enabled for agents), and the one step the user has to take, with the console link. Free. Needs the user's Cotlet API key or sign-in.

NameTypeReqDescription
appstring–Only this app, e.g. skool.

No output schema declared.

No examples provided.

cotlet_browser_click ~120

Clicks a link, button or other element of the current page in the user's Booksy Cloud Browser, by its number in the page's element list, and returns the URL and title after the click. It acts as the user on that site. Buttons that pay or buy and buttons on account or sign-in pages are refused. Every started minute of the session costs credits; it ends when closed or 3 minutes after the last call in the browser.

NameTypeReqDescription
elementintegeryesThe element's number in the element list of the current page.

No output schema declared.

No examples provided.

cotlet_browser_close ~45

Ends the session in the user's Booksy Cloud Browser: the browser keeps its cookies, goes to sleep and the per-minute charge stops. Returns the session's minutes and credits.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

cotlet_browser_navigate ~99

Opens a public http or https address in the user's Booksy Cloud Browser and returns the URL and title it ended on. Only Booksy pages open. Every started minute of the session costs credits; it ends when closed or 3 minutes after the last call in the browser.

NameTypeReqDescription
urlstringyesA public http or https address, e.g. https://example.com. In an app's browser, a page of that app.

No output schema declared.

No examples provided.

cotlet_browser_open ~128

Wakes the user's Booksy Cloud Browser, a real Chrome hosted on Cotlet and signed in to Booksy as the user. Use it for what the Booksy tools do not cover. Opens `url` when given and returns the page's URL and title. The user watches every step live. Every started minute of the session costs credits; it ends when closed or 3 minutes after the last call in the browser.

NameTypeReqDescription
urlstring–A public http or https address, e.g. https://example.com. In an app's browser, a page of that app.

No output schema declared.

No examples provided.

cotlet_browser_press ~109

Presses one key on the current page in the user's Booksy Cloud Browser, on the element that has focus: Tab to the next field, Enter to send, Escape to close a dialog or pop-up, arrows to move through a suggestion list. Returns the URL and title after it. Enter on account pages is refused. Every started minute of the session costs credits; it ends when closed or 3 minutes after the last call in the browser.

NameTypeReqDescription
keystringyesThe key.

No output schema declared.

No examples provided.

cotlet_browser_read ~98

Returns the current page of the user's Booksy Cloud Browser: its readable text, up to 20,000 characters, and a numbered list of its links, buttons and fields. Field values, cookies and storage are never returned. On a page longer than that, both start near where it is scrolled to. Every started minute of the session costs credits; it ends when closed or 3 minutes after the last call in the browser.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

cotlet_browser_screenshot ~76

Returns a JPEG image of the visible part of the current page in the user's Booksy Cloud Browser, with its URL and title: boards, canvases and layouts that the page text does not show. Every started minute of the session costs credits; it ends when closed or 3 minutes after the last call in the browser.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

cotlet_browser_scroll ~176

Scrolls the current page in the user's Booksy Cloud Browser with the mouse wheel, as a person does: down or up by `screens` viewport heights (default 0.8), to the top or the bottom, or until element `element` is in view. Content that loads on scroll appears, and the next read lists it. Returns the URL, title and scroll position (at_top, at_bottom). Every started minute of the session costs credits; it ends when closed or 3 minutes after the last call in the browser.

NameTypeReqDescription
directionstring–Where to scroll. Default: down.
elementinteger–Scroll until this element of the element list is in view.
screensnumber–How far, in viewport heights, for down and up. Default: 0.8.

No output schema declared.

No examples provided.

cotlet_browser_select ~123

Chooses an option of a drop-down list on the current page in the user's Booksy Cloud Browser, by the list's number in the element list and the option's label as read lists it (or its value). Returns the URL and title after it. Card fields and account pages are refused. Every started minute of the session costs credits; it ends when closed or 3 minutes after the last call in the browser.

NameTypeReqDescription
elementintegeryesThe element's number in the element list of the current page.
optionstringyesThe option.

No output schema declared.

No examples provided.

cotlet_browser_type ~149

Types text into a field of the current page in the user's Booksy Cloud Browser, by the field's number in the page's element list, and with `submit` presses Enter. Returns the URL and title after it. Password, card and one-time code fields and sign-in pages are refused: the user fills those in themselves. Every started minute of the session costs credits; it ends when closed or 3 minutes after the last call in the browser.

NameTypeReqDescription
elementintegeryesThe element's number in the element list of the current page.
submitboolean–Press Enter after typing, e.g. to search.
textstringyesThe text to type.

No output schema declared.

No examples provided.

cotlet_browser_upload ~152

Puts files into a file field of the current page in the user's Booksy Cloud Browser, or into the file picker that an upload button opens, by its number in the element list. A file is given as {"url": "https://..."} for a file online or {"file_id": "..."} for one uploaded to Cotlet first; up to 10 files, 20 MB each. Returns the URL and title after it. Every started minute of the session costs credits; it ends when closed or 3 minutes after the last call in the browser.

NameTypeReqDescription
elementintegeryesThe element's number in the element list of the current page.
filesarrayyesThe files.

No output schema declared.

No examples provided.

cotlet_get_call ~76

Status of an earlier Cotlet call, by its call_id: pending (waits for the owner's approval in the Cotlet console), approved, running, success, rejected, expired, blocked or failed. For a call that answered with status pending or running.

NameTypeReqDescription
call_idstringyescall_id from the earlier call

No output schema declared.

No examples provided.

cotlet_report_issue ~276

Sends a report straight to the Cotlet team: a tool that failed or returned wrong data, an error you could not get past, or a tool, field or app the task needed and Cotlet lacks. The report carries the error text and call_id when there is one, never passwords or tokens. Needs the user's Cotlet API key or sign-in.

NameTypeReqDescription
app––App slug the report is about, e.g. 'skool'.
call_id––call_id of the call that went wrong, if any.
client––Agent or tool sending this, e.g. 'Claude Code'.
descriptionstringyesWhat you tried, what you expected and what happened, with the error text if there was one. No passwords, tokens or other secrets.
kindstringyesbug: a tool did the wrong thing or returned wrong data. error: a call failed or returned an error you could not get past. feature_request: something new the user wants. missing_feature: an app is her…
titlestringyesOne line, e.g. 'skool_list_members stops after 50 members'.
tool––Tool or endpoint name, e.g. 'skool_list_members'.

No output schema declared.

No examples provided.

cotlet_request_apps ~102

Requests access to apps for the user's workspace, as Request access in the console: a live app is granted at once, any other goes to the Cotlet team, who answer within 72 hours. Takes app slugs as listed at https://cotlet.dev/api/v1/apps. Free. Needs the user's Cotlet API key or sign-in.

NameTypeReqDescription
appsarrayyesApp slugs, e.g. ["skool", "substack"].

No output schema declared.

No examples provided.

cotlet_upload_file ~115

Returns a one-time upload_url and a file_id for a local file (an image for a post, an attachment). The file is sent to upload_url with an HTTP PUT; an argument that takes a file accepts {"file_id": "..."}. Up to 25 MB, the URL works once. Free. Needs the user's Cotlet API key or sign-in.

NameTypeReqDescription
content_typestring–MIME type, e.g. image/jpeg.
namestring–File name, e.g. photo.jpg.

No output schema declared.

No examples provided.

cotlet_whoami ~63

The Cotlet account this connection acts as: email, workspace, access status, the API key or OAuth client in use with its scope, the apps the workspace may call and its credit balance. Free. Needs the user's Cotlet API key or sign-in.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

create_appointment ~240

Book a client for one service at a start time; Booksy checks the slot first. Books one client card for one service. The end follows the service's duration. Booksy's dry run checks the staff member is free first; a busy slot is refused, never double-booked. The client gets Booksy's confirmation only with notify_client. dry_run returns the same answer with saved false and keeps nothing. Waits for the owner's approval.

NameTypeReqDescription
client_idstringyesClient ID from list_clients or add_client.
dry_runboolean–Only check the time and price; nothing is saved. Default: false.
notestring–Internal note, only staff see it.
notify_clientboolean–Send Booksy's booking confirmation to the client. Default: false.
service_idstringyesservice_id from list_services (its first variant), or a variant_id.
staff_idstring–Staff ID from list_staff. Default: the first one who offers the service.
startstringyesISO 8601. Without a time zone it is the business's local time.

No output schema declared.

No examples provided.

delete_client ~56

Remove a client card from your client list. Deletes the card the way the panel's Delete button does. The client is not told. Past appointments stay in the calendar.

NameTypeReqDescription
client_idintegeryesFrom list_clients or find_client.

No output schema declared.

No examples provided.

estimate_message_blast ~146

Count who a Message Blast would reach and its SMS cost, without sending it. Asks Booksy what send_message_blast would do with the same clients, channel and text: how many clients it reaches, how many emails, texts or push notifications go out and what the texts cost beyond the plan's free allowance. Where the law asks for marketing consent (EU), consented counts only the clients who agreed; send_message_blast sends to those. Nothing is sent.

NameTypeReqDescription
channelstringyesemail, sms or push.
client_idsarrayyesRecipients from list_clients.
messagestringyesMessage text; its length sets the SMS parts.

No output schema declared.

No examples provided.

find_client ~105

Client cards matching a name, email or phone. Searches the client list the way the Clients page's search box does and returns the matching cards with contact details, note and visit counts. A card added a moment ago can take a few seconds to show up in search; get_client reads it by ID at once.

NameTypeReqDescription
limitinteger–Most matches to return. Default: 10.
querystringyesName, email or phone (or a part of one).

No output schema declared.

No examples provided.

find_open_slots ~172

Free start times for a service on one day, from working hours, bookings, blocks and time off. Returns free start times for one service on one day, earliest first, for each staff member who offers it (or only staff_id). Starts follow the service's time slot interval and leave room for its duration; past times are left out. Booksy's own booking check confirms every slot returned. Pass start and staff_id to create_appointment.

NameTypeReqDescription
datestringyesDay to check.
limitinteger–1 to 30 slots, earliest first. Default: 12.
service_idstringyesservice_id from list_services (its first variant), or a variant_id.
staff_idstring–Only this staff member. Default: anyone who offers the service.

No output schema declared.

No examples provided.

get_appointment ~99

One appointment: services, staff, times, price, client and notes. Returns one appointment with each service's staff member, times and price, the client, the total and the notes. note is the internal note only staff see; client_note is the note shown to the client. can lists what Booksy allows now (cancel, change, confirm, decline, no_show).

NameTypeReqDescription
appointment_idstringyesAppointment ID from list_appointments.

No output schema declared.

No examples provided.

get_business_hours ~72

Weekly opening hours, time zone and booking lead times of the business. Reads the opening hours set in Business details: open ranges for each day (an empty list is closed), the note shown with them, the business's time zone and address, and how early and how late clients may book or change a visit.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

get_business_profile ~92

Your business's name, address, contact, opening hours, booking policy, rating and plan status. Reads the business record behind your Booksy profile: name, address and time zone, phone, public email, website, description, weekly opening hours, how far ahead clients can book and change, review rating, whether the profile is visible in the Booksy marketplace, and the plan status with the trial end date.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

get_client ~132

One client card: contact details, private note, counts and visit history. Reads one client card of the business by ID: name, email, phone, birthday, private note, tags, whether the client is blocked or uses the Booksy app, visit, no-show and cancellation counts, revenue, and the visits (past and upcoming appointments) with times, services, staff, status and total. A visit's appointment_uid is the appointment_id of get_appointment.

NameTypeReqDescription
client_idintegeryesFrom list_clients or find_client.
visits_limitinteger–Visits to return. Default: 20.

No output schema declared.

No examples provided.

get_report ~265

Numbers from Stats & Reports for a day, week, month or year, as JSON. Returns one Stats & Reports category for a period: dashboard gives the totals for appointments, revenue and clients with the change against the previous period; any other category gives its highlight tables and the list of its reports. Pass report with a key from that list for the full report. Booksy counts one day, one Monday-to-Sunday week, one calendar month or one calendar year, so from and to must be such a period. Amounts come formatted in the business's currency. Booksy Biz Lite has the dashboard, revenue, appointments and clients; cash_flow, inventory, staff_members and marketing need Booksy Biz Pro.

NameTypeReqDescription
categorystringyesdashboard (totals), appointments, clients, revenue, cash_flow, staff_members, marketing, tips or inventory.
fromstringyesFirst day, inclusive.
reportstring–Report key from `reports` of the category (e.g. appointments_summary) for its full tables.
staff_idinteger–Staff member, only for the report performance_per_staffer.
tostringyesLast day, inclusive: the same day, a Monday-to-Sunday week, a calendar month or year.

No output schema declared.

No examples provided.

get_settings ~77

Text message allowance and usage, client message channels and your notification settings. Reads the settings an agent needs before messaging clients: whether SMS and email to clients are on, the free and paid text allowance with this period's usage and price per text part, and which booking events notify you by email or push. Changes stay in the Booksy app.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

list_appointments ~130

Appointments in a date range with client, service, staff, time and status. Lists the Booksy calendar between two days (31 at most), in start order, including unconfirmed requests. Times carry the business's time zone. A walk-in has an empty client. An appointment with several services is one row listing them all; get_appointment returns prices and notes.

NameTypeReqDescription
fromstringyesFirst day, inclusive.
staff_idstring–Only one staff member, from list_staff.
tostringyesLast day, inclusive. At most 31 days after from.

No output schema declared.

No examples provided.

list_clients ~185

Clients with contact details, visit counts and last visit, plus Booksy's client groups. Reads the Clients list of the business, A to Z: name, email, phone, private note, tags, visits, no-shows, cancellations, revenue and the last visit. Search by name, email or phone, or keep only clients who have not visited for a number of days (filtered on each page). `groups` gives Booksy's smart groups (new, most loyal, slipping away, prospects, upcoming birthdays ...) with their counts.

NameTypeReqDescription
cursorstring–next_cursor from the previous call.
limitinteger–Page size. Default: 50.
not_visited_daysinteger–Only clients whose last visit is older than this many days (or who never visited).
querystring–Name, email or phone to search for.

No output schema declared.

No examples provided.

list_message_blasts ~81

Message Blast templates (automated and one-time) and the blasts scheduled to go out. Reads Promotion > Message Blasts: every automated template with its trigger and whether it is on, every one-time template, and the blasts scheduled for later. send_message_blast sends a one-time message; estimate_message_blast counts recipients and SMS cost first.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

list_notifications ~101

Notifications from the panel's bell: new bookings, changes, cancellations, reviews. Reads the notifications Booksy shows under the bell in the panel, newest first. Client chat is not included. Reading does not mark them seen.

NameTypeReqDescription
pageinteger–Page, from 1. Default: 1.
per_pageinteger–Per page. Default: 20.
unread_onlyboolean–Only the new ones. Default: false.

No output schema declared.

No examples provided.

list_reviews ~129

Client reviews of your business with rating, text, services, staff and your reply. Reads the reviews on your Booksy profile, newest first by default: star rating, text, the client's name as Booksy shows it, services, staff, visit date and your reply if you wrote one. Also returns the average rating and the count per star. Reply with reply_to_review.

NameTypeReqDescription
pageinteger–Page, from 1. Default: 1.
per_pageinteger–Reviews per page. Default: 20.
sortstring–Order. Default: newest.

No output schema declared.

No examples provided.

list_services ~97

Your service menu with category, variants, duration, price and the staff who offer each. Reads the services of the business: name, category, description, whether clients can book it online, and its variants with duration in minutes, price (number and as shown, with currency), price type and the staff IDs who perform it. create_appointment and find_open_slots take service_id (its first variant) or a variant_id for another variant.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

list_staff ~108

Staff members with their working hours for a week and the services they offer. Reads the staff of the business: name, position, email, phone, access level, whether clients see them, the services each one performs, and working hours for each day of one week (Monday to Sunday, from Shifts, time off included). Use staff_id in other tools.

NameTypeReqDescription
week_start_datestring–Any day of the week to show hours for, YYYY-MM-DD. Default: this week.

No output schema declared.

No examples provided.

list_time_off ~120

Staff time off and blocked hours in a date range. Lists time off from Shifts (kind time_off: dates, hours only when it is part of a day) and blocked hours in the calendar (kind block: date-times) between two days, 31 at most. time_off_id goes to remove_time_off.

NameTypeReqDescription
fromstringyesFirst day, inclusive.
staff_idstring–Only one staff member, from list_staff.
tostringyesLast day, inclusive. At most 31 days after from.

No output schema declared.

No examples provided.

remove_time_off ~86

Remove time off or a blocked period so the time can be booked again. Deletes one time off (off-…) or one calendar block (block-…). It reaches no client.

NameTypeReqDescription
staff_idstringyesStaff ID the time off belongs to.
time_off_idstringyesID from add_time_off or list_time_off (off-… or block-…).

No output schema declared.

No examples provided.

reply_to_review ~110

Post or change your public reply to a client's review. Writes your reply under one review on your Booksy profile, the way the Reviews page does. A second call replaces the reply. Everyone who sees your profile sees it and the reviewer is told, so by default you confirm each call; you can switch that off for this tool. Waits for the owner's approval.

NameTypeReqDescription
replystringyesReply text, public on your profile.
review_idintegeryesReview ID from list_reviews.

No output schema declared.

No examples provided.

reschedule_appointment ~176

Move an appointment to a new start time, and optionally to another staff member. Moves every service of the appointment by the same amount, so the first one starts at start. Booksy's dry run checks the new slot first and a busy one is refused. The client hears about it only with notify_client. Booksy refuses appointments it no longer lets you change (can in get_appointment). Waits for the owner's approval.

NameTypeReqDescription
appointment_idstringyesAppointment ID from list_appointments.
notify_clientboolean–Tell the client about the new time through Booksy. Default: false.
staff_idstring–New staff member from list_staff. Default: unchanged.
startstringyesNew start, ISO 8601. Without a time zone it is the business's local time.

No output schema declared.

No examples provided.

send_message_blast ~216

Send one message to chosen clients by email, SMS or push notification. Sends one Message Blast now to the clients you list, by email, SMS or a push notification to the Booksy Client App, as Promotion > Message Blasts > Create your own message does. Where the law asks for marketing consent (EU), only the listed clients who agreed get it; the call fails when none can. SMS comes from an automated number, so clients cannot reply, and uses the plan's text allowance. Run estimate_message_blast first to see the count and cost. Needs a paid Booksy plan: on the free trial Booksy refuses one-time messages. By default you confirm each call; you can switch that off for this tool. Waits for the owner's approval.

NameTypeReqDescription
channelstringyesemail, sms or push.
client_idsarrayyesRecipients from list_clients.
messagestringyesMessage text.
subjectstring–Email subject and push title. Default: the message's start.

No output schema declared.

No examples provided.

update_client ~152

Change a client card's name, phone, email, birthday or private note. Changes only the fields given and leaves the rest of the card as it is. The note replaces the card's private note; add_client_note adds a line instead. The client is not told.

NameTypeReqDescription
birthdaystring–YYYY-MM-DD.
client_idintegeryesFrom list_clients or find_client.
emailstring–Email address; empty string removes it.
namestring–Full name; the last word is the last name.
notestring–Private note, replaces the old one; add_client_note appends.
phonestring–Mobile phone; empty string removes it.

No output schema declared.

No examples provided.

Install

How do I install the Booksy by Cotlet MCP server?

Booksy by Cotlet is a hosted endpoint at https://cotlet.dev/mcp/v1/booksy, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

remote · cotlet.dev

# add to Claude Code
claude mcp add --transport http dev-cotlet-booksy 'https://cotlet.dev/mcp/v1/booksy'
Common questions

What is the Booksy by Cotlet MCP server?

Booksy by Cotlet is an MCP server listed in the public MCP registry as dev.cotlet/booksy. Bookings, clients, reviews and reports for beauty businesses. This page covers its hosted endpoint (https://cotlet.dev/mcp/v1/booksy).

Is the Booksy by Cotlet MCP server safe to use?

Booksy by Cotlet scores 69 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the Booksy by Cotlet MCP server expose?

Booksy by Cotlet exposes 45 tools: cotlet_whoami, cotlet_apps, cotlet_request_apps, cotlet_get_call, cotlet_upload_file, and 40 more. Their descriptions and schemas cost roughly 5,751 tokens of context every time the server is loaded.

Does the Booksy by Cotlet MCP server require authentication?

No. We connected to Booksy by Cotlet without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

Is the Booksy by Cotlet MCP server still maintained?

Booksy by Cotlet is still listed as active in the MCP registry. We last reached this channel on 24 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.