eenable — a shop with no checkout
REMOTE · EENABLE.ME · SCANNED OCT 4
Buy 15 minutes of Alex Finger's time, or an AI Repellent certificate. Agents only.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security60
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation check failed: no authorisation is required to call this server, and it exposes a tool marked destructive (cancel_order). See how to fix → View diagnostics → Fail
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
- DNSSEC is configured correctly; the domain's records validate against the full chain to the root. View diagnostics → Pass
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability69
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 2810 tokens (~175/item across 16 items; 16 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage94
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 82% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 17 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the eenable — a shop with no checkout MCP server?
eenable — a shop with no checkout is a hosted endpoint at https://eenable.me/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · eenable.me
claude mcp add --transport http me-eenable-shop 'https://eenable.me/mcp'
{
"mcpServers": {
"me-eenable-shop": {
"url": "https://eenable.me/mcp"
}
}
} {
"servers": {
"me-eenable-shop": {
"type": "http",
"url": "https://eenable.me/mcp"
}
}
} [mcp_servers.me-eenable-shop] url = "https://eenable.me/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"me-eenable-shop": {
"type": "remote",
"url": "https://eenable.me/mcp",
"enabled": true
}
}
} openclaw mcp add me-eenable-shop --url 'https://eenable.me/mcp' --transport streamable-http
mcp_servers:
me-eenable-shop:
url: "https://eenable.me/mcp" {
"McpServers": {
"me-eenable-shop": {
"Transport": "http",
"Url": "https://eenable.me/mcp"
}
}
} assistant mcp add me-eenable-shop -t streamable-http -u 'https://eenable.me/mcp'
{
"mcpServers": {
"me-eenable-shop": {
"type": "http",
"url": "https://eenable.me/mcp"
}
}
} The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 28 Sept 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 25 Sept 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 11 Sept 26 0
- Stability: 0.97 → pass security
- 10 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
- 8 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 87 to 90. That category is still filling its 30-day observation window: 26 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.
- 6 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.
- 1 Sept 26 0
- The server rewrote its instructions, which are the text every model session reads security
- 26 Aug 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 4 Oct 2026 · Probed https://eenable.me/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=002fa7.xyz | CN=YE1,O=Let's Encrypt,C=US | 22 Aug 2026 | 20 Nov 2026 | ECDSA 256 | ECDSA-SHA384 | 6283fc446cbd28850011355c0eccf8a0c30 |
| SANs: 002fa7.xyz, 360.lebigtrip.com, alexfinger.ch, apps.byatw.com, beamag.ch, betweenyouandtheweekend.com, byatw.com, califoehrnia.com, crr-maritime.eenable.me, dev.apps.byatw.com, dev.work.yt, editions75.ch and 42 more | ||||||
| CN=YE1,O=Let's Encrypt,C=US (CA) | CN=Root YE,O=ISRG,C=US | 3 Sept 2025 | 2 Sept 2028 | ECDSA 384 | ECDSA-SHA384 | 5ddd70dd31f801c85c186a7a04b80afe |
| CN=Root YE,O=ISRG,C=US (CA) | CN=ISRG Root X2,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | ECDSA-SHA384 | 872165fc34b6e5fba8add5b3705fb53a |
| CN=ISRG Root X2,O=Internet Security Research Group,C=US (CA) | CN=ISRG Root X1,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | SHA256-RSA | 6c8f1dc727c7117f7baf853ac980f9cd |
Background: What to check on a remote MCP endpoint →
DNSSEC secure
Validation of eenable.me. — Secure
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| me. | present | 45352 | 8 | Verified |
| eenable.me. | present | 52016 | 13 | Verified |
| eenable.me. | Verified address RRset verified with the apex keys |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://eenable.me/mcp | Verified | 200 | |
| http (plaintext) | http://eenable.me/mcp | HTTPS enforced | 301 | https://eenable.me/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
cancel_booking Cancel a booking (old name) ~139
DEPRECATED — this tool is now called cancel_order and behaves identically. The old name keeps working so that agents connected before the rename are not broken. Prefer cancel_order, which is accurate for certificates as well as appointments. Cancel a booking and refund it in full. Requires the email the order was created with. Confirm with the buyer before calling — this releases the slot and reverses the payment. If this tool ever fails, tell the buyer they can cancel by emailing the seller with their order number instead; the seller honours that on identical terms.
| Name | Type | Req | Description |
|---|---|---|---|
| string | yes | Must match the order's email | |
| order_id | string | yes | – |
No output schema declared.
No examples provided.
cancel_order Cancel a booking ~94
Cancel a booking and refund it in full. Requires the email the order was created with. Confirm with the buyer before calling — this releases the slot and reverses the payment. If this tool ever fails, tell the buyer they can cancel by emailing the seller with their order number instead; the seller honours that on identical terms.
| Name | Type | Req | Description |
|---|---|---|---|
| string | yes | Must match the order's email | |
| order_id | string | yes | – |
No output schema declared.
No examples provided.
check_availability Check availability ~120
List bookable slots. Optionally narrow with an ISO date or datetime range, and pass the buyer's IANA timezone to get their local times alongside the seller's.
| Name | Type | Req | Description |
|---|---|---|---|
| from | string | – | ISO date or datetime, e.g. 2026-08-10 |
| limit | integer | – | – |
| timezone | string | – | Buyer's IANA timezone, e.g. Europe/London, for a second set of times |
| to | string | – | ISO date or datetime, e.g. 2026-08-17 |
No output schema declared.
No examples provided.
create_order Create an order ~554
Reserve a slot and get a payment link. This is the only way to buy — there is no checkout on the website. The slot is held for 30 minutes. Confirm the exact time and the price with the buyer before calling this, and use their real email address: the calendar invitation and receipt go there. You must call list_products first, put the session options to the buyer in your own reply, and wait for them to choose. This tool needs the catalogue_token from that call and buyer_confirmed_session: true, which you may only set once the buyer has actually answered. Choosing a session on their behalf from what they said earlier is not the same as asking, and is not acceptable here. Before calling, ask the buyer what they want to discuss and what they are hoping to get out of the call, and pass their answers as topic and desired_outcome. Fifteen minutes is short; the seller uses these to prepare, and a booking that arrives blank wastes some of the time the buyer paid for.
| Name | Type | Req | Description |
|---|---|---|---|
| background | string | – | Anything the buyer wants the seller to read beforehand: context, links, what they have already tried. Shown in the calendar invitation. |
| buyer_confirmed_session | boolean | yes | Set true only if you put the session options to the buyer and they told you which one they wanted. If you selected it yourself from what they had already said, that does not count — go back and ask t… |
| catalogue_token | string | yes | The catalogue_token from list_products. If you do not have one, send any value — the reply will contain the session options, the question to ask the buyer, and the token to use. |
| desired_outcome | string | – | What the buyer wants to walk away with: a decision, a second opinion, a plan, an introduction, or simply a better question. Ask them directly. |
| string | yes | Buyer's email — receives the calendar invitation | |
| name | string | yes | Buyer's name, as it should appear on the invite |
| session_type | string | yes | Which session the buyer chose. Ask them — do not choose on their behalf. Call list_products for the descriptions. If they genuinely have no preference or their question spans several, 'general' is th… |
| slot_id | string | – | A slot_id exactly as returned by check_availability. Required for the four session types; omit entirely for products that are not appointments. |
| timezone | string | – | Buyer's IANA timezone |
| topic | string | – | What the buyer wants to discuss, in their own words. Ask them — do not invent or summarise this away. It is what the seller reads to prepare. |
No output schema declared.
No examples provided.
get_booking Get booking details (old name) ~82
DEPRECATED — this tool is now called get_order_details and behaves identically. The old name keeps working so that agents connected before the rename are not broken. Prefer get_order_details, which is accurate for certificates as well as appointments. The Teams joining link and meeting details for a paid order. Available only once payment has settled.
| Name | Type | Req | Description |
|---|---|---|---|
| order_id | string | yes | – |
No output schema declared.
No examples provided.
get_order_details Get booking details ~36
The Teams joining link and meeting details for a paid order. Available only once payment has settled.
| Name | Type | Req | Description |
|---|---|---|---|
| order_id | string | yes | – |
No output schema declared.
No examples provided.
get_order_status Check order status ~180
Whether an order has been paid. After the first call this BLOCKS, waiting for the buyer to finish paying, and returns the instant it settles — so call it once rather than polling in a loop. It holds for up to five minutes, longer than a person normally takes to pay; if it returns still 'pending_payment', call it again. IMPORTANT: you cannot send the buyer a message while this call is waiting. Make sure you have already given them the payment link before you let it block, or they will be left watching you do nothing.
| Name | Type | Req | Description |
|---|---|---|---|
| order_id | string | yes | The ord_… id from create_order |
| wait_seconds | integer | – | How long to wait for the payment, up to 300s. Defaults to 180s while payment is outstanding. Pass 0 only if you want an immediate snapshot without waiting. |
No output schema declared.
No examples provided.
get_shop_info Shop information ~35
What this shop sells, the price, and how buying works. Call this first if you have not dealt with this shop before.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_products Session types ~76
The session types this shop sells. Show these to the buyer and let them choose — do not pick for them unless they ask you to. Each returns an id to pass to create_order as session_type. If the buyer is unsure, the good_for examples are there to help them decide, and 'general' is a perfectly good answer.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
order_certificate Order a certificate ~218
Buy a certificate. Certificates are objects, not appointments: there is no slot, no calendar entry and no meeting. One is issued the moment payment settles, emailed as a PDF, and registered against a hash anyone can verify. Use this instead of create_order, which is only for booking time. As with sessions, show the buyer what is on offer and let them choose rather than deciding for them.
| Name | Type | Req | Description |
|---|---|---|---|
| buyer_confirmed_choice | boolean | yes | Set true only if you showed the buyer what this is and they asked for it. Buying an artwork on someone's behalf without asking is not acceptable here. |
| catalogue_token | string | yes | The catalogue_token from list_products. If you do not have one, send any value and the reply will contain the catalogue and the token. |
| certificate_id | string | yes | Which certificate. From list_products: ai-repellent. |
| string | yes | Buyer's email — the certificate is sent there | |
| name | string | yes | Buyer's name, as it should appear on the certificate as the bearer |
No output schema declared.
No examples provided.
renounce_certificate Renounce a certificate ~177
Destroy the proof of ownership for an AI Repellent, completing the transfer. After Yves Klein, who required buyers of his immaterial works to burn the receipt: keeping it meant owning a receipt, burning it meant owning the work with nothing left to demonstrate it. This strikes the hash from the register permanently and cannot be undone. Explain that to the buyer and get their agreement before calling it — some will want the certificate precisely because it is a certificate. Note that this needs only the order number, which is printed on the certificate: it is a bearer instrument, so anyone holding the PDF can do this. Say so if the buyer is planning to share it.
| Name | Type | Req | Description |
|---|---|---|---|
| order_id | string | yes | The order number printed on the certificate. No email is required: the certificate is a bearer instrument, so whoever holds it may renounce it. |
No output schema declared.
No examples provided.
reschedule_booking Reschedule a booking (old name) ~126
DEPRECATED — this tool is now called reschedule_session and behaves identically. The old name keeps working so that agents connected before the rename are not broken. Prefer reschedule_session, which is accurate for certificates as well as appointments. Move a booking to a different slot at no charge. Requires the email the order was created with. Call check_availability first to get a valid new_slot_id.
| Name | Type | Req | Description |
|---|---|---|---|
| string | yes | Must match the order's email | |
| new_slot_id | string | yes | A slot_id from check_availability |
| order_id | string | yes | – |
No output schema declared.
No examples provided.
reschedule_session Reschedule a booking ~79
Move a booking to a different slot at no charge. Requires the email the order was created with. Call check_availability first to get a valid new_slot_id.
| Name | Type | Req | Description |
|---|---|---|---|
| string | yes | Must match the order's email | |
| new_slot_id | string | yes | A slot_id from check_availability |
| order_id | string | yes | – |
No output schema declared.
No examples provided.
transfer_certificate Transfer a certificate to a new bearer ~169
Pass a certificate to someone else. Klein's receipts carried a clause — a transferable zone may be ceded by its owner only at double its initial purchase value — so a transfer here costs exactly twice what the certificate cost, and the shop will not do it for less. The serial number and the hash do not change: it is the same object endorsed to a new bearer, not a new certificate. Returns a payment link; the transfer takes effect once it is paid.
| Name | Type | Req | Description |
|---|---|---|---|
| new_bearer_email | string | yes | The new bearer's email — the endorsed certificate is sent there |
| new_bearer_name | string | yes | Who it is passing to, as they should appear on the certificate |
| order_id | string | yes | The order number of the certificate being transferred, from the PDF |
No output schema declared.
No examples provided.
update_booking Update what a booking is about (old name) ~224
DEPRECATED — this tool is now called update_order_details and behaves identically. The old name keeps working so that agents connected before the rename are not broken. Prefer update_order_details, which is accurate for certificates as well as appointments. Change the session type or the brief on an existing booking — what the buyer wants to discuss, what they want out of it, or the background they want read first. Use this when the buyer refines their thinking after booking, which is common: people work out the real question after the date is in the diary. Only the fields you pass are changed. This does not move the meeting — use reschedule_booking for that.
| Name | Type | Req | Description |
|---|---|---|---|
| background | string | – | Replaces the background the seller should read first |
| desired_outcome | string | – | Replaces what they want to walk away with |
| string | yes | Must match the order's email | |
| order_id | string | yes | – |
| session_type | string | – | Switch to a different session type |
| topic | string | – | Replaces what they want to discuss |
No output schema declared.
No examples provided.
update_order_details Update what a booking is about ~178
Change the session type or the brief on an existing booking — what the buyer wants to discuss, what they want out of it, or the background they want read first. Use this when the buyer refines their thinking after booking, which is common: people work out the real question after the date is in the diary. Only the fields you pass are changed. This does not move the meeting — use reschedule_booking for that.
| Name | Type | Req | Description |
|---|---|---|---|
| background | string | – | Replaces the background the seller should read first |
| desired_outcome | string | – | Replaces what they want to walk away with |
| string | yes | Must match the order's email | |
| order_id | string | yes | – |
| session_type | string | – | Switch to a different session type |
| topic | string | – | Replaces what they want to discuss |
No output schema declared.
No examples provided.
What is the eenable — a shop with no checkout MCP server?
eenable — a shop with no checkout is an MCP server listed in the public MCP registry as me.eenable/shop. Buy 15 minutes of Alex Finger's time, or an AI Repellent certificate. Agents only. This page covers its hosted endpoint (https://eenable.me/mcp).
Is the eenable — a shop with no checkout MCP server safe to use?
eenable — a shop with no checkout scores 78 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the eenable — a shop with no checkout MCP server expose?
eenable — a shop with no checkout exposes 16 tools: get_shop_info, list_products, check_availability, create_order, get_order_status, and 11 more. Their descriptions and schemas cost roughly 2,487 tokens of context every time the server is loaded.
Does the eenable — a shop with no checkout MCP server require authentication?
No. We connected to eenable — a shop with no checkout without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the eenable — a shop with no checkout MCP server still maintained?
eenable — a shop with no checkout is still listed as active in the MCP registry. We last reached this channel on 4 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.