# BOP (remote · mcp.srct.tw)

Search gyms and personal trainers in Taiwan, check open time slots, and book or cancel sessions.

- Trust score: 60/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

## Components

- remote · `mcp.srct.tw`: 60/100 (this document), [markdown](https://verifymcp.io/servers/tw-srct-bop/mcp.md), [page](https://verifymcp.io/servers/tw-srct-bop/mcp)

## Channel facts

- Endpoint: `https://mcp.srct.tw/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `1.0.0`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Endpoint Security**: 46/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation check failed: no authorisation is required to call this server, and it exposes a tool marked destructive (modify_booking).
  - HTTPS enforcement could not be verified: the plaintext port answered with HTTP 406, which proves neither a plaintext path nor enforcement.
  - HSTS check failed: the Strict-Transport-Security header is absent.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 68/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 1839 tokens (~204/item across 9 items; 9 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 10/100
  - Stability observed for 3 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.
  - An AI judge read all 10 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### How do I install the BOP MCP server?

BOP is a hosted endpoint at https://mcp.srct.tw/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http tw-srct-bop 'https://mcp.srct.tw/mcp'
```

### Cursor

```json
{
  "mcpServers": {
    "tw-srct-bop": {
      "url": "https://mcp.srct.tw/mcp"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "tw-srct-bop": {
      "type": "http",
      "url": "https://mcp.srct.tw/mcp"
    }
  }
}
```

### Codex

```toml
[mcp_servers.tw-srct-bop]
url = "https://mcp.srct.tw/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "tw-srct-bop": {
      "type": "remote",
      "url": "https://mcp.srct.tw/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add tw-srct-bop --url 'https://mcp.srct.tw/mcp' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  tw-srct-bop:
    url: "https://mcp.srct.tw/mcp"
```

### Netclaw

```json
{
  "McpServers": {
    "tw-srct-bop": {
      "Transport": "http",
      "Url": "https://mcp.srct.tw/mcp"
    }
  }
}
```

### Vellum

```bash
assistant mcp add tw-srct-bop -t streamable-http -u 'https://mcp.srct.tw/mcp'
```

### Other

```json
{
  "mcpServers": {
    "tw-srct-bop": {
      "type": "http",
      "url": "https://mcp.srct.tw/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-05 (score 60, 0)

- [security] Tool “cancel_booking” rewrote its description, which is the text the model reads

### 2026-11-04 (score 60, +1)

- [security] The server rewrote its instructions, which are the text every model session reads
- [security] Tool “cancel_booking” rewrote its description, which is the text the model reads
- [security] Tool “complete_booking” rewrote its description, which is the text the model reads
- [security] Tool “get_availability” rewrote its description, which is the text the model reads
- [security] Tool “get_booking_status” rewrote its description, which is the text the model reads
- [security] Tool “get_business” rewrote its description, which is the text the model reads
- [security] Tool “modify_booking” rewrote its description, which is the text the model reads
- [security] Tool “request_booking” rewrote its description, which is the text the model reads
- [security] Tool “search_businesses” rewrote its description, which is the text the model reads
- [functional regression] Schema quality: 166 → 204
- [cosmetic] “search_businesses” reworded the description of “keyword”

### 2026-11-03 (score 59, 0)

- [functional improvement] Stability: unverified → 0.03

### 2026-11-02 (score 59)

First indexed and scored.

## MCP tools (9)

### `search_businesses` (~258 tokens)

Search businesses

Find businesses listed on BOP in Taiwan (personal trainers and coaches, gyms, group-class studios, saunas, recovery services) by keyword and/or category, with a few of their services and prices. Use this when the user wants to find a coach, gym, class or studio in Taiwan, or wants to book or check times but has not named a business, e.g. 「幫我找台北的健身教練」 or 「週日想上重訓課」. keyword takes place and class words in Chinese or English (business name, city or district, type of class); booking and time words such as 訂、預約、週日 are ignored, so check times with get_availability. Returns up to 10 businesses. If nothing matches the keyword, it returns the listed businesses anyway with matched: false. Read-only.

Input parameters:

- `category` (string): gym, coaching (personal trainers), sauna, or recovery
- `keyword` (string): Place or class words in Chinese or English, e.g. '健身教練 台北', '重訓', 'personal training' or 'Taipei'
- `limit` (integer): Maximum results, default 5

### `get_business` (~79 tokens)

Get business details

Get one business's public profile (city, address, hours, booking and cancellation policy, contact, FAQ) and its active services with prices, durations and weekly schedules. Use this after search_businesses, or when the user names a business, before checking open times. Read-only.

Input parameters:

- `business_id` (string, required): business_id from search_businesses

### `get_availability` (~147 tokens)

Check open time slots

List open time slots (Asia/Taipei) for one service in the next 1–14 days, with remaining capacity. Use this when the user asks when they can go or wants a particular day or time (e.g. 「週日早上有空嗎」), and pick the slots on that day and time. Use the returned slot value as-is in request_booking. Read-only.

Input parameters:

- `business_id` (string, required): business_id from search_businesses
- `days` (integer): How many days ahead, default 14
- `service_id` (string, required): service_id from get_business
- `teacher` (string): Only slots taught by this teacher or trainer

### `request_booking` (~354 tokens)

Request a booking

Create a booking (訂課、預約) for one open slot on behalf of the customer, after the customer has agreed to the service, time, quantity and contact details. Sends the customer's name, phone and email to the business. The result is either 'confirmed' or 'pending' (waiting for the business to confirm). Payment is at the venue, unless the business takes online payment (payment in get_business): then the status is 'awaiting_payment' with amount, currency, expires_at and payment_handlers, and the place is held until expires_at for complete_booking. Returns booking_id and a one-time status_token for get_booking_status, complete_booking, modify_booking and cancel_booking. Repeating the call for the same contact details, service and slot is rejected as a duplicate.

Input parameters:

- `business_id` (string, required): business_id from search_businesses
- `customer_name` (string, required): Name the business should use
- `email` (string, required): Customer's email, for the business to reach them
- `idempotency_key` (string): Optional key (8–64 letters, digits, _ . : -) that makes retries safe: the same key with the same parameters returns the original result
- `note` (string): Optional request for the business, e.g. 'first time, please arrive early'. Do not include health or medical information.
- `phone` (string, required): Customer's mobile phone, for the business to reach them
- `quantity` (integer, required): Number of people or places
- `service_id` (string, required): service_id from get_business
- `slot` (string, required): slot value from get_availability, e.g. 2026-10-20T19:30

### `complete_booking` (~236 tokens)

Pay for a booking

Pay for a booking (付款) whose status is awaiting_payment, with a payment credential the customer approved for the booking's amount and currency. payment.handler_id must come from the booking's payment_handlers ("stripe_payments"), and credential is {type: "stripe_payment_token", token: "spt_…"}: a Stripe shared payment token issued to the handler's business_profile. Charges the customer once (repeating the call does not charge twice). Returns the booking (confirmed, or pending if the business confirms it) and the payment result; if payment.status is requires_action, open payment.redirect_url for the customer and call again with the same credential.

Input parameters:

- `booking_id` (string, required): booking_id returned by request_booking
- `business_id` (string, required): business_id from search_businesses
- `idempotency_key` (string): Optional key (8–64 letters, digits, _ . : -) that makes retries safe: the same key with the same parameters returns the original result
- `payment` (object, required): Payment credential for this booking
- `status_token` (string, required): status_token returned once by request_booking

### `modify_booking` (~200 tokens)

Change a booking

Change the slot or quantity (改時間、改人數) of a pending, awaiting_payment or confirmed booking, when the customer asks to. Replaces the booking's time or quantity and frees the old place. Use a slot value from get_availability. A booking paid online can change its slot but not its quantity (cancel and rebook instead). Changes close at the same cutoff as online cancellation.

Input parameters:

- `booking_id` (string, required): booking_id returned by request_booking
- `business_id` (string, required): business_id from search_businesses
- `idempotency_key` (string): Optional key (8–64 letters, digits, _ . : -) that makes retries safe: the same key with the same parameters returns the original result
- `quantity` (integer): New number of people or places
- `slot` (string): New slot value from get_availability
- `status_token` (string, required): status_token returned once by request_booking

### `get_booking_status` (~96 tokens)

Check booking status

Get the current status of a booking made with request_booking (查預約狀態: confirmed, waiting for the business, awaiting online payment, declined, or cancelled), including payment and refund details. Read-only.

Input parameters:

- `booking_id` (string, required): booking_id returned by request_booking
- `business_id` (string, required): business_id from search_businesses
- `status_token` (string, required): status_token returned once by request_booking

### `cancel_booking` (~146 tokens)

Cancel a booking

Cancel (取消預約) a confirmed, pending or awaiting_payment booking made with request_booking, when the customer asks to. Frees the place for others and cannot be undone; a booking paid online is refunded minus the card processing fee Stripe charged and BOP's fee (5.5% + NT$10). Online cancellation closes at the business's cutoff (online_cancellation in get_business; 120 minutes before the start time unless the business sets its own cutoff).

Input parameters:

- `booking_id` (string, required): booking_id returned by request_booking
- `business_id` (string, required): business_id from search_businesses
- `status_token` (string, required): status_token returned once by request_booking

### `get_booking_link` (~75 tokens)

Get external booking link

For businesses whose booking_mode is external_link: get a link to the business's own booking page for one service. The click is counted for the business. Booking and payment happen on that page.

Input parameters:

- `business_id` (string, required): business_id from search_businesses
- `service_id` (string, required): service_id from get_business

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/tw-srct-bop/mcp#diagnostics

## Score history

- 2026-11-05: 60
- 2026-11-04: 60
- 2026-11-03: 59
- 2026-11-02: 59

## Common questions

### What is the BOP MCP server?

BOP is an MCP server listed in the public MCP registry as tw.srct/bop. Search gyms and personal trainers in Taiwan, check open time slots, and book or cancel sessions. This page covers its hosted endpoint (https://mcp.srct.tw/mcp).

### Is the BOP MCP server safe to use?

BOP scores 60 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the BOP MCP server expose?

BOP exposes 9 tools: search_businesses, get_business, get_availability, request_booking, complete_booking, and 4 more. Their descriptions and schemas cost roughly 1,591 tokens of context every time the server is loaded.

### Does the BOP MCP server require authentication?

No. We connected to BOP without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

### Is the BOP MCP server still maintained?

BOP is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

## Links

- Remote endpoint: https://mcp.srct.tw/mcp
- Website: https://mcp.srct.tw/docs
- Changelog RSS feed: https://verifymcp.io/servers/tw-srct-bop/mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/tw-srct-bop/mcp.json
- HTML version of this page: https://verifymcp.io/servers/tw-srct-bop/mcp