BOP
REMOTE · MCP.SRCT.TW
Search gyms and personal trainers in Taiwan, check open time slots, and book or cancel sessions.
Available components
Last scanned (4 hours ago)
Scores higher than 43% of remote servers
Reachable. Last reached 5 Nov 2026.
Category E-commerce
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security46
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation check failed: no authorisation is required to call this server, and it exposes a tool marked destructive (modify_booking). See how to fix → View diagnostics → Fail
- HTTPS enforcement could not be verified: the plaintext port answered with HTTP 406, which proves neither a plaintext path nor enforcement. View diagnostics → Unverified
- HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability68
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 1839 tokens (~204/item across 9 items; 9 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management10
- Stability observed for 3 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 10 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 5 Nov 26 0
- Tool “cancel_booking” rewrote its description, which is the text the model reads security
- 4 Nov 26 +1
- The server rewrote its instructions, which are the text every model session reads security
- Tool “cancel_booking” rewrote its description, which is the text the model reads security
- Tool “complete_booking” rewrote its description, which is the text the model reads security
- Tool “get_availability” rewrote its description, which is the text the model reads security
- Tool “get_booking_status” rewrote its description, which is the text the model reads security
- Tool “get_business” rewrote its description, which is the text the model reads security
- Tool “modify_booking” rewrote its description, which is the text the model reads security
- Tool “request_booking” rewrote its description, which is the text the model reads security
- Tool “search_businesses” rewrote its description, which is the text the model reads security
- Schema quality: 166 → 204 ▼ functional
- “search_businesses” reworded the description of “keyword” cosmetic
- 3 Nov 26 0
- Stability: unverified → 0.03 ▲ functional
- 2 Nov 26 59
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Probed https://mcp.srct.tw/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=srct.tw | CN=WE1,O=Google Trust Services,C=US | 16 Oct 2026 | 14 Jan 2027 | ECDSA 256 | ECDSA-SHA256 | d19700cf86a90bbb0e8eb57e822bcac4 |
| SANs: srct.tw, mcp.srct.tw, *.mcp.srct.tw | ||||||
| CN=WE1,O=Google Trust Services,C=US (CA) | CN=GTS Root R4,O=Google Trust Services LLC,C=US | 13 Dec 2023 | 20 Feb 2029 | ECDSA 256 | ECDSA-SHA384 | 7ff31977972c224a76155d13b6d685e3 |
| CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) | CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE | 15 Nov 2023 | 28 Jan 2028 | ECDSA 384 | SHA256-RSA | 7fe530bf331343bedd821610493d8a1b |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of mcp.srct.tw. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| tw. | present | 46902 | 13 | Verified |
| srct.tw. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://mcp.srct.tw/mcp | Verified | 200 | |
| http (plaintext) | http://mcp.srct.tw/mcp | Inconclusive | 406 |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
cancel_booking Cancel a booking ~146
Cancel (取消預約) a confirmed, pending or awaiting_payment booking made with request_booking, when the customer asks to. Frees the place for others and cannot be undone; a booking paid online is refunded minus the card processing fee Stripe charged and BOP's fee (5.5% + NT$10). Online cancellation closes at the business's cutoff (online_cancellation in get_business; 120 minutes before the start time unless the business sets its own cutoff).
| Name | Type | Req | Description |
|---|---|---|---|
| booking_id | string | yes | booking_id returned by request_booking |
| business_id | string | yes | business_id from search_businesses |
| status_token | string | yes | status_token returned once by request_booking |
No output schema declared.
No examples provided.
complete_booking Pay for a booking ~236
Pay for a booking (付款) whose status is awaiting_payment, with a payment credential the customer approved for the booking's amount and currency. payment.handler_id must come from the booking's payment_handlers ("stripe_payments"), and credential is {type: "stripe_payment_token", token: "spt_…"}: a Stripe shared payment token issued to the handler's business_profile. Charges the customer once (repeating the call does not charge twice). Returns the booking (confirmed, or pending if the business confirms it) and the payment result; if payment.status is requires_action, open payment.redirect_url for the customer and call again with the same credential.
| Name | Type | Req | Description |
|---|---|---|---|
| booking_id | string | yes | booking_id returned by request_booking |
| business_id | string | yes | business_id from search_businesses |
| idempotency_key | string | – | Optional key (8–64 letters, digits, _ . : -) that makes retries safe: the same key with the same parameters returns the original result |
| payment | object | yes | Payment credential for this booking |
| status_token | string | yes | status_token returned once by request_booking |
No output schema declared.
No examples provided.
get_availability Check open time slots ~147
List open time slots (Asia/Taipei) for one service in the next 1–14 days, with remaining capacity. Use this when the user asks when they can go or wants a particular day or time (e.g. 「週日早上有空嗎」), and pick the slots on that day and time. Use the returned slot value as-is in request_booking. Read-only.
| Name | Type | Req | Description |
|---|---|---|---|
| business_id | string | yes | business_id from search_businesses |
| days | integer | – | How many days ahead, default 14 |
| service_id | string | yes | service_id from get_business |
| teacher | string | – | Only slots taught by this teacher or trainer |
No output schema declared.
No examples provided.
get_booking_link Get external booking link ~75
For businesses whose booking_mode is external_link: get a link to the business's own booking page for one service. The click is counted for the business. Booking and payment happen on that page.
| Name | Type | Req | Description |
|---|---|---|---|
| business_id | string | yes | business_id from search_businesses |
| service_id | string | yes | service_id from get_business |
No output schema declared.
No examples provided.
get_booking_status Check booking status ~96
Get the current status of a booking made with request_booking (查預約狀態: confirmed, waiting for the business, awaiting online payment, declined, or cancelled), including payment and refund details. Read-only.
| Name | Type | Req | Description |
|---|---|---|---|
| booking_id | string | yes | booking_id returned by request_booking |
| business_id | string | yes | business_id from search_businesses |
| status_token | string | yes | status_token returned once by request_booking |
No output schema declared.
No examples provided.
get_business Get business details ~79
Get one business's public profile (city, address, hours, booking and cancellation policy, contact, FAQ) and its active services with prices, durations and weekly schedules. Use this after search_businesses, or when the user names a business, before checking open times. Read-only.
| Name | Type | Req | Description |
|---|---|---|---|
| business_id | string | yes | business_id from search_businesses |
No output schema declared.
No examples provided.
modify_booking Change a booking ~200
Change the slot or quantity (改時間、改人數) of a pending, awaiting_payment or confirmed booking, when the customer asks to. Replaces the booking's time or quantity and frees the old place. Use a slot value from get_availability. A booking paid online can change its slot but not its quantity (cancel and rebook instead). Changes close at the same cutoff as online cancellation.
| Name | Type | Req | Description |
|---|---|---|---|
| booking_id | string | yes | booking_id returned by request_booking |
| business_id | string | yes | business_id from search_businesses |
| idempotency_key | string | – | Optional key (8–64 letters, digits, _ . : -) that makes retries safe: the same key with the same parameters returns the original result |
| quantity | integer | – | New number of people or places |
| slot | string | – | New slot value from get_availability |
| status_token | string | yes | status_token returned once by request_booking |
No output schema declared.
No examples provided.
request_booking Request a booking ~354
Create a booking (訂課、預約) for one open slot on behalf of the customer, after the customer has agreed to the service, time, quantity and contact details. Sends the customer's name, phone and email to the business. The result is either 'confirmed' or 'pending' (waiting for the business to confirm). Payment is at the venue, unless the business takes online payment (payment in get_business): then the status is 'awaiting_payment' with amount, currency, expires_at and payment_handlers, and the place is held until expires_at for complete_booking. Returns booking_id and a one-time status_token for get_booking_status, complete_booking, modify_booking and cancel_booking. Repeating the call for the same contact details, service and slot is rejected as a duplicate.
| Name | Type | Req | Description |
|---|---|---|---|
| business_id | string | yes | business_id from search_businesses |
| customer_name | string | yes | Name the business should use |
| string | yes | Customer's email, for the business to reach them | |
| idempotency_key | string | – | Optional key (8–64 letters, digits, _ . : -) that makes retries safe: the same key with the same parameters returns the original result |
| note | string | – | Optional request for the business, e.g. 'first time, please arrive early'. Do not include health or medical information. |
| phone | string | yes | Customer's mobile phone, for the business to reach them |
| quantity | integer | yes | Number of people or places |
| service_id | string | yes | service_id from get_business |
| slot | string | yes | slot value from get_availability, e.g. 2026-10-20T19:30 |
No output schema declared.
No examples provided.
search_businesses Search businesses ~258
Find businesses listed on BOP in Taiwan (personal trainers and coaches, gyms, group-class studios, saunas, recovery services) by keyword and/or category, with a few of their services and prices. Use this when the user wants to find a coach, gym, class or studio in Taiwan, or wants to book or check times but has not named a business, e.g. 「幫我找台北的健身教練」 or 「週日想上重訓課」. keyword takes place and class words in Chinese or English (business name, city or district, type of class); booking and time words such as 訂、預約、週日 are ignored, so check times with get_availability. Returns up to 10 businesses. If nothing matches the keyword, it returns the listed businesses anyway with matched: false. Read-only.
| Name | Type | Req | Description |
|---|---|---|---|
| category | string | – | gym, coaching (personal trainers), sauna, or recovery |
| keyword | string | – | Place or class words in Chinese or English, e.g. '健身教練 台北', '重訓', 'personal training' or 'Taipei' |
| limit | integer | – | Maximum results, default 5 |
No output schema declared.
No examples provided.
How do I install the BOP MCP server?
BOP is a hosted endpoint at https://mcp.srct.tw/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · mcp.srct.tw
claude mcp add --transport http tw-srct-bop 'https://mcp.srct.tw/mcp'
What is the BOP MCP server?
BOP is an MCP server listed in the public MCP registry as tw.srct/bop. Search gyms and personal trainers in Taiwan, check open time slots, and book or cancel sessions. This page covers its hosted endpoint (https://mcp.srct.tw/mcp).
Is the BOP MCP server safe to use?
BOP scores 60 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the BOP MCP server expose?
BOP exposes 9 tools: search_businesses, get_business, get_availability, request_booking, complete_booking, and 4 more. Their descriptions and schemas cost roughly 1,591 tokens of context every time the server is loaded.
Does the BOP MCP server require authentication?
No. We connected to BOP without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the BOP MCP server still maintained?
BOP is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.