Nookal MCP by usefulapi
REMOTE · NOOKAL.USEFULAPI.IO
Read Nookal locations, practitioners, availability, appointments, clients, cases and invoices.
Available components
Last scanned (21 minutes ago)
Scores higher than 47% of remote servers
Reachable. Last reached 17 Oct 2026.
Category Health and Science
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security78
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation is enforced on tool calls, advertised via RFC 9728 protected-resource metadata. Discovery is public, which costs nothing: no tool can be invoked without a token. View diagnostics → Pass
- HTTPS enforcement could not be verified: the plaintext port redirected somewhere other than https, so enforcement is unproven. View diagnostics → Unverified
- HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
- The authorisation server offers only Dynamic Client Registration (RFC 7591), which MCP 2026-07-28 deprecated in favour of Client ID Metadata Documents. View diagnostics → Partial
Transport & Reachability0
- Transport check failed: declared streamable-http, but the endpoint redirected instead of responding directly. See how to fix → View diagnostics → Fail
Schema Quality & AI Usability76
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 2448 tokens (~222/item across 11 items; 11 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management23
- Stability observed for 7 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 11 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 12 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities60
- Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28. See how to fix → Fail
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 17 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 20 to 23. That category is still filling its 30-day observation window: 6 days of observed history at the previous scan, 7 at this one. The score rises as the window fills, whether or not the server changes.
- 15 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 13 to 17. That category is still filling its 30-day observation window: 4 days of observed history at the previous scan, 5 at this one. The score rises as the window fills, whether or not the server changes.
- 14 Oct 26 +2
- The server rewrote its instructions, which are the text every model session reads security
- The server now declares the “prompts” capability functional
- First check of Schema quality: 100 functional
- New prompt “getting_started” functional
- Server version: 1.4.0 → 1.5.0 functional
- 13 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes.
- 12 Oct 26 +1
- Stability: unverified → 0.07 ▲ functional
- 10 Oct 26 59
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 17 Oct 2026 · Probed https://nookal.usefulapi.io/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=usefulapi.io | CN=WE1,O=Google Trust Services,C=US | 13 Sept 2026 | 12 Dec 2026 | ECDSA 256 | ECDSA-SHA256 | d9be3287b0fde9630e825ba1f79bff3f |
| SANs: usefulapi.io, *.usefulapi.io | ||||||
| CN=WE1,O=Google Trust Services,C=US (CA) | CN=GTS Root R4,O=Google Trust Services LLC,C=US | 13 Dec 2023 | 20 Feb 2029 | ECDSA 256 | ECDSA-SHA384 | 7ff31977972c224a76155d13b6d685e3 |
| CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) | CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE | 15 Nov 2023 | 28 Jan 2028 | ECDSA 384 | SHA256-RSA | 7fe530bf331343bedd821610493d8a1b |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of nookal.usefulapi.io. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| io. | present | 57355 | 8 | Verified |
| usefulapi.io. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication Enforced and verified
The endpoint asked for a token and published valid RFC 9728 metadata describing how to get one.
| Result | Enforced and verified |
|---|---|
| Enforced | On tool calls |
| HTTP status | 302 |
WWW-Authenticate challenge Bearer realm="OAuth", resource_metadata="https://nookal.usefulapi.io/.well-known/oauth-protected-resource/mcp"
Bearer realm="OAuth", resource_metadata="https://nookal.usefulapi.io/.well-known/oauth-protected-resource/mcp"Protected resource metadata
| Document | https://nookal.usefulapi.io/.well-known/oauth-protected-resource/mcp |
|---|---|
| Retrieved | Yes |
| Resource | https://nookal.usefulapi.io/mcp |
| Authorisation server | https://nookal.usefulapi.io |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://nookal.usefulapi.io/mcp | Redirected | 302 | https://usefulapi.io/nookal/ |
| http (plaintext) | http://nookal.usefulapi.io/mcp | Inconclusive | 302 | http://nookal.usefulapi.io/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
nookal_get_availability Get appointment availability ~203
Get the free appointment slots per date between two dates (max 60 days, Nookal's limit), optionally for given locations, practitioners and a service. Each slot has its date, start time (24h, clinic local time), provider id and location id. Read-only: it does not book anything. Nookal GraphQL: availabilities.
| Name | Type | Req | Description |
|---|---|---|---|
| date_from | string | yes | First date, YYYY-MM-DD. |
| date_to | string | yes | Last date, YYYY-MM-DD (at most 60 days after date_from). |
| location_ids | array | – | Only these locations (numeric Nookal ids, up to 100). |
| service_id | integer | – | Only slots for this service / appointment type id (from list_services). |
| slot_duration | integer | – | Override the slot length in minutes. |
| staff_ids | array | – | Only these practitioners (staff ids) (numeric Nookal ids, up to 100). |
No output schema declared.
No examples provided.
nookal_get_client Get a client (patient) ~122
Get one client (patient) by id: name, date of birth, contact details, addresses, alerts, allergies, notes, occupation, referring doctor and their treatment cases; optionally a summary of their invoices (totals and balances). Health-fund, pension and online-booking codes are not returned. Nookal GraphQL: clients.
| Name | Type | Req | Description |
|---|---|---|---|
| client_id | integer | yes | Nookal client id (from search_clients). |
| include_invoices | boolean | – | true = also list the client's invoices (number, date, total, paid, balance). |
No output schema declared.
No examples provided.
nookal_list_appointments List appointments ~354
List appointments (date, start/end time, status, type, client, practitioner, case, location, arrived / did-not-arrive flags, notes), filtered by date range, location, client, practitioner, type and status. Dates are clinic local. Nookal GraphQL: appointments.
| Name | Type | Req | Description |
|---|---|---|---|
| appointment_ids | array | – | Only these appointments (numeric Nookal ids, up to 100). |
| appt_statuses | array | – | Statuses as Nookal names them, e.g. ["Completed"], ["Cancelled"], ["DNA"] (did not arrive), ["Pending"]. |
| appt_types | array | – | Appointment kinds, e.g. ["Consultation"] or ["Class"]. |
| client_ids | array | – | Only these clients (patients) (numeric Nookal ids, up to 100). |
| date_from | string | – | Appointments on or after this date, YYYY-MM-DD. |
| date_to | string | – | Appointments on or before this date, YYYY-MM-DD. |
| location_ids | array | – | Only these locations (numeric Nookal ids, up to 100). |
| modified_from | string | – | Only appointments created/updated after this (YYYY-MM-DD or YYYY-MM-DD HH:MM:SS). |
| modified_to | string | – | Only appointments created/updated before this (YYYY-MM-DD or YYYY-MM-DD HH:MM:SS). |
| page | integer | – | Page number (default 1). |
| page_length | integer | – | Items per page, 1-100 (default 50). |
| provider_ids | array | – | Only these practitioners (staff ids) (numeric Nookal ids, up to 100). |
No output schema declared.
No examples provided.
nookal_list_cases List treatment cases ~158
List treatment cases (id, client, title, start and referral dates, referrer, primary practitioner, notes), filtered by client, case or practitioner. Nookal GraphQL: cases.
| Name | Type | Req | Description |
|---|---|---|---|
| case_ids | array | – | Only these cases (numeric Nookal ids, up to 100). |
| client_ids | array | – | Only these clients' cases (numeric Nookal ids, up to 100). |
| page | integer | – | Page number (default 1). |
| page_length | integer | – | Items per page, 1-100 (default 50). |
| primary_provider_ids | array | – | Only these primary practitioners' cases (staff ids) (numeric Nookal ids, up to 100). |
No output schema declared.
No examples provided.
nookal_list_classes List class types ~153
List the class types offered (id, name, category, duration, price, location, online-booking settings) — the class definitions, not individual sessions. Nookal GraphQL: classes.
| Name | Type | Req | Description |
|---|---|---|---|
| class_ids | array | – | Only these class types (numeric Nookal ids, up to 100). |
| location_ids | array | – | Only these locations' classes (numeric Nookal ids, up to 100). |
| online_bookings | boolean | – | true = only classes bookable online, false = only diary-only classes. |
| page | integer | – | Page number (default 1). |
| page_length | integer | – | Items per page, 1-100 (default 50). |
No output schema declared.
No examples provided.
nookal_list_invoices List invoices ~248
List invoices with their line items and payments (number, client, case, location, practitioner, date, subtotal, tax, total, paid, balance), filtered by location, invoice id or creation date. For one client's invoices use get_client with include_invoices. Nookal GraphQL: invoices.
| Name | Type | Req | Description |
|---|---|---|---|
| created_from | string | – | Invoices created on/after this (YYYY-MM-DD = from 00:00:00, or YYYY-MM-DD HH:MM:SS; clinic local time). |
| created_to | string | – | Invoices created on/before this (YYYY-MM-DD = until 23:59:59, or YYYY-MM-DD HH:MM:SS; clinic local time). |
| invoice_ids | array | – | Only these invoices (numeric Nookal ids, up to 100). |
| location_ids | array | – | Only these locations' invoices (numeric Nookal ids, up to 100). |
| page | integer | – | Page number (default 1). |
| page_length | integer | – | Items per page, 1-100 (default 50). |
| voided_only | boolean | – | true = only voided invoices. |
No output schema declared.
No examples provided.
nookal_list_locations List locations ~127
List the clinic's locations (id, name, address, time zone, active). Location ids are needed by most other tools. Only the locations your API client was granted are returned. Nookal GraphQL: locations.
| Name | Type | Req | Description |
|---|---|---|---|
| active | boolean | – | true = only active locations, false = only inactive. |
| location_ids | array | – | Only these locations (numeric Nookal ids, up to 100). |
| page | integer | – | Page number (default 1). |
| page_length | integer | – | Items per page, 1-100 (default 50). |
No output schema declared.
No examples provided.
nookal_list_payments List invoice payments ~163
List payments received against invoices (method, amount, date, reference, invoice, client, location), filtered by invoice or payment date. Nookal GraphQL: payments.
| Name | Type | Req | Description |
|---|---|---|---|
| date_from | string | – | Payments on/after this (YYYY-MM-DD or YYYY-MM-DD HH:MM:SS, clinic local time). |
| date_to | string | – | Payments on/before this (YYYY-MM-DD or YYYY-MM-DD HH:MM:SS, clinic local time). |
| invoice_ids | array | – | Only these invoices' payments (numeric Nookal ids, up to 100). |
| page | integer | – | Page number (default 1). |
| page_length | integer | – | Items per page, 1-100 (default 50). |
No output schema declared.
No examples provided.
nookal_list_services List services (appointment types) ~156
List the appointment types / services offered (id, name, category, duration in minutes, price, location, online-booking settings). Use a service id in get_availability. Nookal GraphQL: services.
| Name | Type | Req | Description |
|---|---|---|---|
| location_ids | array | – | Only these locations' services (numeric Nookal ids, up to 100). |
| online_bookings | boolean | – | true = only services bookable online, false = only diary-only services. |
| page | integer | – | Page number (default 1). |
| page_length | integer | – | Items per page, 1-100 (default 50). |
| service_ids | array | – | Only these services (numeric Nookal ids, up to 100). |
No output schema declared.
No examples provided.
nookal_list_staff List practitioners and staff ~224
List staff members and practitioners (id, name, title, speciality, email, location ids, whether they are a provider / bookable online / active). Use the staff ids as provider_ids in list_appointments and staff_ids in get_availability. Nookal GraphQL: staff.
| Name | Type | Req | Description |
|---|---|---|---|
| active | boolean | – | true = only active staff, false = only inactive (Nookal status 1/0). |
| location_ids | array | – | Only these locations' staff (numeric Nookal ids, up to 100). |
| online_bookings | boolean | – | true = only staff bookable online, false = only staff not bookable online. |
| page | integer | – | Page number (default 1). |
| page_length | integer | – | Items per page, 1-100 (default 50). |
| providers_only | boolean | – | true = only clinical providers (practitioners), false = only non-providers. |
| staff_ids | array | – | Only these staff members (numeric Nookal ids, up to 100). |
No output schema declared.
No examples provided.
nookal_search_clients Search clients (patients) ~330
Find clients (patients) by name, date of birth, mobile, email or id. Returns id, name, date of birth, location, active/deceased flags and contact details. With partial_match, names match on their first letters (e.g. 'Sm' finds Smith). Nookal GraphQL: clients.
| Name | Type | Req | Description |
|---|---|---|---|
| active | boolean | – | true = only active clients, false = only inactive. |
| client_ids | array | – | Only these clients (numeric Nookal ids, up to 100). |
| date_of_birth | string | – | Date of birth, YYYY-MM-DD. |
| deceased | boolean | – | true = only deceased clients, false = only living clients. |
| string | – | Email address. | |
| first_name | string | – | First name (exact, or its first letters with partial_match). |
| last_name | string | – | Last name (exact, or its first letters with partial_match). |
| location_ids | array | – | Only these locations' clients (numeric Nookal ids, up to 100). |
| mobile | string | – | Mobile number, digits only with no spaces. |
| modified_from | string | – | Only clients created/updated after this (YYYY-MM-DD or YYYY-MM-DD HH:MM:SS). |
| online_quick_code | string | – | The client's online quick code. |
| page | integer | – | Page number (default 1). |
| page_length | integer | – | Items per page, 1-100 (default 50). |
| partial_match | boolean | – | true = match names that start with the given letters. |
No output schema declared.
No examples provided.
How do I install the Nookal MCP by usefulapi server?
Nookal MCP by usefulapi is a hosted endpoint at https://nookal.usefulapi.io/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · nookal.usefulapi.io
claude mcp add --transport http io-usefulapi-nookal 'https://nookal.usefulapi.io/mcp'
What is the Nookal MCP by usefulapi server?
Nookal MCP by usefulapi is listed in the public MCP registry as io.usefulapi/nookal. Read Nookal locations, practitioners, availability, appointments, clients, cases and invoices. This page covers its hosted endpoint (https://nookal.usefulapi.io/mcp).
Is the Nookal MCP by usefulapi server safe to use?
Nookal MCP by usefulapi scores 65 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Nookal MCP by usefulapi server expose?
Nookal MCP by usefulapi exposes 11 tools: nookal_list_locations, nookal_list_staff, nookal_list_services, nookal_list_classes, nookal_get_availability, and 6 more. Their descriptions and schemas cost roughly 2,238 tokens of context every time the server is loaded.
Does the Nookal MCP by usefulapi server require authentication?
Yes. Nookal MCP by usefulapi asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.
Is the Nookal MCP by usefulapi server still maintained?
Nookal MCP by usefulapi is still listed as active in the MCP registry. We last reached this channel on 17 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.