com.bronjoy/marketplace

Est-ce que com.bronjoy/marketplace est sûr ?

Au dernier audit MCP Hub, le serveur MCP « com.bronjoy/marketplace » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 6 outils

• book-appointment≈ 437 tokens

  Book a slot, using the code the user received from request-booking-code. WHEN TO USE: last step, once the user has confirmed the venue, service and exact time AND has read you their 6-digit code. Requires the same contact the code was sent to. The booking is created as "pending": the business still confirms it, so tell the user it is requested and they will hear back — not that it is guaranteed. If the venue takes prepayment, the response carries a link the user must open to pay; the slot is not held indefinitely. Only works for venues with `is_bookable: true`.

  Paramètres, retour & exemple (8)

  Paramètres

  • name · string · requis
    The user's name, as the business should see it.
  • slug · string · requis
    The venue slug.
  • email · string · optionnel
    The email the code was sent to, if that is the channel used.
  • notes · string · optionnel
    Anything the business should know, max 500 characters.
  • phone · string · optionnel
    The phone the code was sent to, if that is the channel used.
  • service_id · integer · requis
    Service id from check-availability.
  • start_time · string · requis
    Exact `start_time` value from a check-availability slot. Do not invent or round times.
  • verification_code · string · requis
    The 6-digit code the user received. Ask them for it — you never see it yourself.

  Exemple d'appel

  {"name": "book-appointment", "arguments": {"name": "texte", "slug": "texte", "service_id": 1, "start_time": "texte", "verification_code": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• check-availability≈ 276 tokens

  Bookable services and open time slots for a venue on a given date. WHEN TO USE: the user has picked a venue with `is_bookable: true` and wants a time. Call without `service_id` first to see the services and their prices, then again with one to get its slots. Returns an explicit refusal for venues that are not set up for online booking — do not try to work around it, offer the phone number instead. Slot times are in the venue's timezone and are exactly the values book-appointment expects.

  Paramètres, retour & exemple (3)

  Paramètres

  • date · string · requis
    Day to check, Y-m-d. Today or later, at most 30 days ahead.
  • slug · string · requis
    The venue slug from search-venues.
  • service_id · integer · optionnel
    Which service to check. Omit on the first call to list the services with their ids, durations and prices.

  Exemple d'appel

  {"name": "check-availability", "arguments": {"date": "texte", "slug": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get-venue≈ 232 tokens

  Full public profile for one venue: address, opening hours, what it offers, amenities, payment methods, website and whether it can be booked online. WHEN TO USE: after search-venues, when the user asks anything about a specific place — "are they open on Sunday", "do they do colouring", "where exactly is it", "how much". This is the right tool for the ~99% of the catalogue that is not bookable: it carries everything needed to answer a question or send the user there in person. The phone number is masked here — call reveal-phone only when the user actually wants to ring them.

  Paramètres, retour & exemple (1)

  Paramètres

  • slug · string · requis
    The venue slug from search-venues, e.g. "demo-barber".

  Exemple d'appel

  {"name": "get-venue", "arguments": {"slug": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• request-booking-code≈ 313 tokens

  Send the user a 6-digit confirmation code, which book-appointment then requires. WHEN TO USE: the user has chosen a venue, a service and a slot, and has given you their email address or phone number. Call this before book-appointment — a booking without a code is rejected. YOU DO NOT RECEIVE THE CODE. It goes to the user's own inbox or phone; ask them to read it back to you. That is the point: it proves the contact belongs to the person booking, so a business does not get appointments from numbers nobody answers. The code lasts 5 minutes and covers one booking. Only a few codes may be sent to one contact — do not loop.

  Paramètres, retour & exemple (3)

  Paramètres

  • slug · string · requis
    The venue slug the user is booking.
  • email · string · optionnel
    The user's email address. Give this or phone.
  • phone · string · optionnel
    The user's phone in international format, e.g. +998901234567. Preferred when the venue will need to call them.

  Exemple d'appel

  {"name": "request-booking-code", "arguments": {"slug": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• reveal-phone≈ 180 tokens

  The venue's real phone number. WHEN TO USE: the user wants to call — typically because the venue is not bookable online, or they want to ask something no profile field answers. Deliberately a separate call from get-venue, which returns a masked number. Reveals are rate limited per caller: request them one at a time, for a venue the user has actually chosen, never in bulk across search results.

  Paramètres, retour & exemple (1)

  Paramètres

  • slug · string · requis
    The venue slug from search-venues.

  Exemple d'appel

  {"name": "reveal-phone", "arguments": {"slug": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• search-venues≈ 408 tokens

  Search Bronjoy's catalogue of service businesses in Uzbekistan by keyword, city and category. WHEN TO USE: the user is looking for a place ("barbershop in Tashkent", "dentist near Chilanzar", "car wash open now"). Start here — every other tool takes the `slug` this returns. Results are ranked, compact, and include `is_bookable`, which decides what you can offer next: bookable venues can go through check-availability → request-booking-code → book-appointment, the rest can only be described and phoned. Names and addresses come back in Russian or Uzbek; quote them as-is.

  Paramètres, retour & exemple (5)

  Paramètres

  • city · string · optionnel
    City slug or name, e.g. "tashkent", "samarkand", "Бухара".
  • limit · integer · optionnel
    How many venues to return, 1-20. Default 5 — prefer a small number and refine.
  • query · string · optionnel
    Free text: a business name, a service ("стрижка", "haircut"), or a landmark. Matches across Latin and Cyrillic.
  • category · string · optionnel
    Category slug, e.g. "barber", "dental", "car-wash". Use the slug from a previous result when narrowing.
  • bookable_only · boolean · optionnel
    Return only venues that can take an online booking. Set this when the user wants to book rather than to be told about places — most of the catalogue cannot be booked, and without this the bookable ones are buried.

  Exemple d'appel

  {"name": "search-venues", "arguments": {"city": "texte", "limit": 1, "query": "texte", "category": "texte", "bookable_only": true}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://api.bronjoy.com/api/mcp