io.github.junoventures/tatuape-sampa-br

Est-ce que io.github.junoventures/tatuape-sampa-br est sûr ?

Au dernier audit MCP Hub, le serveur MCP « io.github.junoventures/tatuape-sampa-br » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 28 outils

• create_booking≈ 416 tokens

  Book an appointment slot at a venue (Wix Bookings). NOTHING IS BOOKED UNTIL THE CUSTOMER PAYS: this returns a checkout URL, and the booking stays off the venue's calendar until a human opens that URL and completes payment on the venue's own site. Tell the user they must open the link. Call get_availability immediately before this — the slot is re-validated server-side and a taken slot is rejected. The contact email is NOT verified at this step; the checkout is what confirms it.

  Paramètres, retour & exemple (6)

  Paramètres

  • contact · object · requis
    Who the booking is for. All three are required by the venue to confirm or reschedule.
  • endDate · string · requis
    Slot end as an ISO instant, exactly as returned by get_availability.
  • serviceId · string · requis
    Service ID from list_booking_services (called with the same place_slug).
  • startDate · string · requis
    Slot start as an ISO instant, exactly as returned by get_availability.
  • place_slug · string · requis
    Venue place slug from search_places.
  • resourceId · string · optionnel
    Optional staff/resource ID from the slot, when the user picked a specific professional.

  Exemple d'appel

  {"name": "create_booking", "arguments": {"contact": {}, "endDate": "texte", "serviceId": "texte", "startDate": "texte", "place_slug": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• create_checkout≈ 147 tokens

  Create a direct checkout URL for one or more store products (Wix Stores). The user clicks the URL to complete payment on the site — no login required on the AI agent side.

  Paramètres, retour & exemple (1)

  Paramètres

  • items · array · requis
    Products to add to cart.

  Exemple d'appel

  {"name": "create_checkout", "arguments": {"items": []}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_availability≈ 181 tokens

  Get available time slots for a bookable service on a given date (Wix Bookings). Pass the serviceId from list_booking_services and a date in YYYY-MM-DD. Pass the same `place_slug` you used there — slot times are returned in the VENUE's timezone, which is not necessarily the directory's.

  Paramètres, retour & exemple (3)

  Paramètres

  • date · string · requis
    Date in YYYY-MM-DD format (e.g. "2026-06-25").
  • serviceId · string · requis
    Service ID from list_booking_services.
  • place_slug · string · optionnel
    Venue place slug — use the same one passed to list_booking_services.

  Exemple d'appel

  {"name": "get_availability", "arguments": {"date": "texte", "serviceId": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_event_tickets≈ 94 tokens

  Get ticket types and prices for a specific event (Wix Events). Pass the event slug from list_events. Returns ticket names, prices, sale status, and how many are left.

  Paramètres, retour & exemple (1)

  Paramètres

  • event_slug · string · requis
    Event slug from list_events.

  Exemple d'appel

  {"name": "get_event_tickets", "arguments": {"event_slug": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_loyalty_info≈ 70 tokens

  Get the loyalty/rewards program details for this site (Wix Loyalty). Returns program name, points currency name, and tier structure with required points per tier.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "get_loyalty_info", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_place≈ 123 tokens

  Get full details for a specific place by its URL slug, including opening hours, a precomputed `open_now` boolean, amenity `attributes` (slugs), a `delivery` array of curated delivery-app deep-links (ifood, rappi, uber-eats — each `{ platform, url }`), ratings, address, and neighborhood.

  Paramètres, retour & exemple (1)

  Paramètres

  • slug · string · requis
    URL slug of the place, e.g. "cafe-example".

  Exemple d'appel

  {"name": "get_place", "arguments": {"slug": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_restaurant_menus≈ 128 tokens

  Get the food menu for a specific restaurant on this site. Returns menus with their sections, dishes, descriptions, prices, and dietary labels (vegan, gluten-free, etc). Use search_places or list_categories first to find the restaurant's place_slug.

  Paramètres, retour & exemple (1)

  Paramètres

  • place_slug · string · requis
    The slug of the restaurant, e.g. "bar-do-ze" (from search_places or a place URL).

  Exemple d'appel

  {"name": "get_restaurant_menus", "arguments": {"place_slug": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_reviews≈ 75 tokens

  Get published reviews for this site (Wix Reviews). Returns reviewer name, rating, title, and content.

  Paramètres, retour & exemple (1)

  Paramètres

  • limit · number · optionnel
    Max reviews to return (default 10, max 50).

  Exemple d'appel

  {"name": "get_reviews", "arguments": {"limit": 1}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_showtimes≈ 140 tokens

  Get showtimes for a specific movie at cinemas in this neighborhood, for a given date. Returns each cinema with session times, format (e.g. "Laser", "3D"), and language (Dublado/Legendado). Requires movies_enabled on this site.

  Paramètres, retour & exemple (2)

  Paramètres

  • date · string · optionnel
    Date in YYYY-MM-DD format. Defaults to today (BRT).
  • movie_slug · string · requis
    Movie slug from list_movies (e.g. "o-corvo-1016084").

  Exemple d'appel

  {"name": "get_showtimes", "arguments": {"movie_slug": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• get_site_info≈ 104 tokens

  Returns basic information about this neighborhood directory: name, locale, domain, description, canonical URLs for key sections, plus the current LOCAL TIME and CURRENT WEATHER at the neighborhood (temperature, condition). Use this for any "what time is it there" or "what's the weather like" context.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "get_site_info", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• list_blog_posts≈ 116 tokens

  List recent published blog posts for this site (Wix Blog). Returns title, excerpt, author, published date, reading time, categories, and the post URL.

  Paramètres, retour & exemple (2)

  Paramètres

  • limit · number · optionnel
    Max posts to return (default 10, max 50).
  • category · string · optionnel
    Filter by category label. Case-insensitive substring match.

  Exemple d'appel

  {"name": "list_blog_posts", "arguments": {"limit": 1, "category": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• list_booking_services≈ 258 tokens

  List a venue's services — what it offers, with price and duration. Pass `place_slug` (from search_places) to list the services of a specific VENUE — a salon, clinic or studio listed in this directory; that is what you want in almost every case, and it is the only form whose serviceId works with create_booking. Omitting `place_slug` lists the directory site's own services instead, which most sites do not have. Returns name, description, price, duration in minutes, and `bookableViaMcp`. Services are listed for EVERY venue, including those with no online booking system — check `bookableViaMcp`: when it is false, `id` is null and you cannot book through create_booking, so point the user at `bookingUrl` or the venue's page instead.

  Paramètres, retour & exemple (1)

  Paramètres

  • place_slug · string · optionnel
    Venue place slug from search_places. Strongly recommended — without it you get the directory's own services, not a venue's.

  Exemple d'appel

  {"name": "list_booking_services", "arguments": {"place_slug": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• list_categories≈ 69 tokens

  Returns the full category taxonomy of this directory site: top-level groups with their subcategories, localized labels, schema.org types, and live place counts.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "list_categories", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• list_events≈ 303 tokens

  List upcoming events in this neighborhood with date, venue, price, and URL. Events within the next 7 days include a weatherForecast (condition + min/max temperature) for the event day — use it to tell users e.g. "the event is at X and it will be raining". Pass `filter` to narrow by time or price; `filter: "agora"` answers "what can I go to right now" and is resolved live on every call, which no cached page can do.

  Paramètres, retour & exemple (3)

  Paramètres

  • limit · number · optionnel
    Max events to return (default 20, max 50).
  • filter · string · optionnel · agora | hoje | amanha | fim-de-semana | gratis
    Narrow the list: "agora" = on stage at this exact moment (season runs and day-granular sources are excluded, because their stored window says nothing about whether a session is on right now); "hoje"/"amanha"/"fim-de-semana" = running on those days, including multi-day runs; "gratis" = free to attend, including externally-ticketed events priced at 0.
  • upcoming_only · boolean · optionnel
    Only return upcoming or in-progress events (default true).

  Exemple d'appel

  {"name": "list_events", "arguments": {"limit": 1, "filter": "agora", "upcoming_only": true}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• list_faqs≈ 70 tokens

  Get all FAQ questions and answers for this site (Wix FAQ). Grouped by category. Use this to answer common questions about the site — opening hours, parking, policies, etc.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "list_faqs", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• list_forms≈ 74 tokens

  List available contact/signup forms on this site (Wix Forms). Returns form name, ID, and field definitions (label, type, required). Use before submit_form to discover which fields to fill.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "list_forms", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• list_guides≈ 93 tokens

  List curated editorial guides ("best of" lists) published by this site — ranked places with editorial notes. The best source for "best X in this neighborhood" questions.

  Paramètres, retour & exemple (1)

  Paramètres

  • limit · number · optionnel
    Max guides to return (default 20, max 50).

  Exemple d'appel

  {"name": "list_guides", "arguments": {"limit": 1}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• list_movies≈ 200 tokens

  List movies available in this neighborhood (only on sites with movies_enabled). Returns now-showing films (with actual showtimes at local cinemas), coming-soon films, and streaming availability. Includes title, genres, TMDB rating, runtime, and detail URL.

  Paramètres, retour & exemple (2)

  Paramètres

  • limit · number · optionnel
    Max movies to return (default 20, max 100).
  • status · string · optionnel · now_showing | coming_soon | streaming | all
    Filter by status. "now_showing" = films with upcoming showtimes at local cinemas. "coming_soon" = unreleased or not yet playing locally. "streaming" = available on streaming services in Brazil. "all" = full catalog (default).

  Exemple d'appel

  {"name": "list_movies", "arguments": {"limit": 1, "status": "now_showing"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• list_offers≈ 152 tokens

  List active promotions and deals available in this neighborhood directory. Returns discount label, promo code (if any), CTA link, validity window, and which business/place it belongs to. FLASH offers have a countdown deadline.

  Paramètres, retour & exemple (2)

  Paramètres

  • kind · string · optionnel · STANDARD | FLASH
    Filter by offer kind. FLASH = time-limited flash sale with countdown. Omit to return all active offers.
  • limit · number · optionnel
    Max offers to return (default 20, max 60).

  Exemple d'appel

  {"name": "list_offers", "arguments": {"kind": "STANDARD", "limit": 1}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• list_pricing_plans≈ 186 tokens

  List membership or subscription plans (Wix Pricing Plans). Pass `place_slug` (from search_places) to list the plans of a specific VENUE — a gym, studio or clinic listed in this directory (e.g. its monthly/annual membership); that is what you want in almost every case. Omitting `place_slug` lists the directory site's own plans instead, which most sites do not have. Returns plan name, description, price, billing cycle, perks, and a direct checkout URL.

  Paramètres, retour & exemple (1)

  Paramètres

  • place_slug · string · optionnel
    Venue place slug from search_places. Strongly recommended — without it you get the directory's own plans, not a venue's.

  Exemple d'appel

  {"name": "list_pricing_plans", "arguments": {"place_slug": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• list_products≈ 100 tokens

  List products in this site's store (Wix Stores). Returns name, price, stock status, and product type.

  Paramètres, retour & exemple (2)

  Paramètres

  • q · string · optionnel
    Optional search term matched against product name.
  • limit · number · optionnel
    Max products to return (default 20, max 100).

  Exemple d'appel

  {"name": "list_products", "arguments": {"q": "texte", "limit": 1}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• list_profiles≈ 106 tokens

  List solo service-provider profiles on this site — businesses without a fixed physical location (e.g. dog walkers, tutors, personal trainers). Returns name, profile URL, category, and any available metadata (age, height, etc.).

  Paramètres, retour & exemple (1)

  Paramètres

  • limit · number · optionnel
    Max profiles to return (default 50).

  Exemple d'appel

  {"name": "list_profiles", "arguments": {"limit": 1}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• request_reservation≈ 338 tokens

  Request a table at a restaurant. THE RESTAURANT IS NOT NOTIFIED YET: the request is held and a confirmation email is sent to the address you provide, and only when that person clicks the link does the restaurant receive it. Tell the user to check their inbox — the link expires in 24 hours. Use a real address belonging to the person you are acting for; the confirmation link is deliberately not returned to you. This is a request, not a confirmed booking: the restaurant confirms out of band.

  Paramètres, retour & exemple (7)

  Paramètres

  • name · string · requis
    Name the table is under.
  • email · string · requis
    The guest's own email — the confirmation link is sent here.
  • phone · string · optionnel
    Optional phone number for the restaurant to reach the guest.
  • message · string · optionnel
    Optional note (occasion, dietary needs, seating preference).
  • partySize · number · requis
    Number of people (1–30).
  • place_slug · string · requis
    Restaurant place slug from search_places.
  • requestedAt · string · requis
    Desired date and time as an ISO instant. Must be in the future.

  Exemple d'appel

  {"name": "request_reservation", "arguments": {"name": "texte", "email": "texte", "partySize": 1, "place_slug": "texte", "requestedAt": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• reserve_event_tickets≈ 260 tokens

  Hold tickets for an event sold through this site (Wix Events) and return a checkout URL. THE HOLD IS TEMPORARY AND NOTHING IS PAID: the tickets are not the user's until a human opens the URL and completes checkout, and the hold expires on its own if they don't. Max 10 tickets and 10 ticket types per reservation. Only works for events this site sells directly — for events sold elsewhere (Sympla, Ingresse, Sesc), use the event's own ticketUrl instead.

  Paramètres, retour & exemple (2)

  Paramètres

  • tickets · array · requis
    Ticket types and quantities to hold.
  • event_slug · string · requis
    Event slug from list_events.

  Exemple d'appel

  {"name": "reserve_event_tickets", "arguments": {"tickets": [], "event_slug": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• rsvp_event≈ 214 tokens

  RSVP to a free event on this site (Wix Events). NOBODY IS ON THE GUEST LIST YET: a confirmation email goes to the address you provide, and the RSVP is only submitted when that person clicks the link (expires in 24 hours). Tell the user to check their inbox. Use a real address belonging to the person you are acting for — the confirmation link is deliberately not returned to you.

  Paramètres, retour & exemple (4)

  Paramètres

  • email · string · requis
    The guest's own email — the confirmation link is sent here.
  • lastName · string · requis
    Guest last name.
  • firstName · string · requis
    Guest first name.
  • event_slug · string · requis
    Event slug from list_events.

  Exemple d'appel

  {"name": "rsvp_event", "arguments": {"email": "texte", "lastName": "texte", "firstName": "texte", "event_slug": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• search_dishes≈ 172 tokens

  Find which restaurants serve a dish in this neighborhood. Searches every menu item across all restaurants on the site, grouped by dish — e.g. query "feijoada" returns each restaurant serving it with price, description, dietary labels, and the place URL. Omit the query to list the most-served dishes. Use this for any "where can I eat X" question.

  Paramètres, retour & exemple (2)

  Paramètres

  • limit · number · optionnel
    Max dishes to return (default 20, max 50).
  • query · string · optionnel
    Dish name or part of it, e.g. "feijoada", "pizza margherita". Omit to list top dishes.

  Exemple d'appel

  {"name": "search_dishes", "arguments": {"limit": 1, "query": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• search_places≈ 468 tokens

  Search for places (restaurants, cafes, shops, etc.) in this neighborhood. The `q` match is accent-insensitive and typo-tolerant ("acai" finds "Açaí", "restaurnt" finds "Restaurante"), ranked by relevance. Compose filters for multi-condition queries: `category`, `neighborhood`, `open_now` (true = open at this exact moment), and `attributes` (amenity slugs, ALL must match). Each result includes a precomputed `open_now` boolean, an `attributes` array (amenity slugs), a `delivery` array of curated delivery-app deep-links (ifood, rappi, 99food, uber-eats — each `{ platform, url }`), rating, and structured `hours` (Google Maps periods: day 0=Sun–6=Sat, time "HHMM"). Common amenity slugs: wifi, outdoor-seating, wheelchair, dog-friendly, delivery, takeaway, reservations, live-music, vegan, gluten-free (availability varies per place).

  Paramètres, retour & exemple (6)

  Paramètres

  • q · string · optionnel
    Free-text term matched against place name and address — accent-insensitive and typo-tolerant.
  • limit · number · optionnel
    Max results to return (default 20, max 100).
  • category · string · optionnel
    Filter by category label (e.g. "Café"). Case-insensitive substring match.
  • open_now · boolean · optionnel
    When true, return only places open at the current local time (computed server-side from their opening hours).
  • attributes · array · optionnel
    Amenity slugs a place must ALL have, e.g. ["wifi","outdoor-seating"]. Common slugs: wifi, outdoor-seating, wheelchair, dog-friendly, delivery, takeaway, reservations, live-music, vegan, gluten-free.
  • neighborhood · string · optionnel
    Filter by neighborhood name. Case-insensitive substring match.

  Exemple d'appel

  {"name": "search_places", "arguments": {"q": "texte", "limit": 1, "category": "texte", "open_now": true, "attributes": [], "neighborhood": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• submit_form≈ 139 tokens

  Submit a form on behalf of the user (Wix Forms). Call list_forms first to get the formId and field keys. Returns a submissionId on success.

  Paramètres, retour & exemple (2)

  Paramètres

  • fields · object · requis
    Key-value pairs matching the field keys from list_forms. Example: { "field_1": "João", "field_2": "joao@email.com" }
  • formId · string · requis
    Form ID from list_forms.

  Exemple d'appel

  {"name": "submit_form", "arguments": {"fields": {}, "formId": "texte"}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://www.tatuape.sampa.br/mcp