Skip to content

brussels.toots/tickets

by toots.brussels · remote · no sign-in to list tools · v1.0.0 · published by brussels.toots

Agenda and ticketing for Toots Jazz Club, Brussels: browse concerts, check seats, reserve tickets.

Deletes · 1Final · 1Changes · 5
CompareRegistry entry

13 tools: 1 can delete or cancel things, 1 do something that can't be undone, 5 change things and 6 only read.

Scanned Oct 21, 2026

2 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http tickets https://toots.brussels/mcp

Findings

Matches of fixed checks, with the text they matched.

1 warn1 info

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

13 tools

Deletes or cancels 1Claude Code: deny
  • release_bookingGives an unpaid hold's seats back immediately, instead of letting them sit reserved until the 15-minute expiry.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Gives an unpaid hold's seats back immediately, instead of letting them sit reserved until the 15-minute expiry. Call this when the buyer changes their mind. Paid bookings cannot be released.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
Can't be undone 1Claude Code: ask
  • pay_with_shared_payment_tokenPays the remaining balance of a booking (after set_contact, and after any pass or gift card) with a Shared Payment Token from the buyer's Link agent wallet.Reads text others write1 finding

    Why it is in this group

    • The name "pay_with_shared_payment_token" says "pay": a word that usually means money moves, which cannot be taken back.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The description contains a 44-character base64 string.

      Matched text

      description: "...ork profile profile_61VNUTvZyhaQmxLgqA6VNUTv7A9CUusxmQZ0xC5doSoy; the buyer approves..."

      What this check looks for
    Description, as the server wrote it
    Pays the remaining balance of a booking (after set_contact, and after any pass or gift card) with a Shared Payment Token from the buyer's Link agent wallet. Request the token for exactly amount_to_pay_cents in EUR, scoped to the Stripe network profile profile_61VNUTvZyhaQmxLgqA6VNUTv7A9CUusxmQZ0xC5doSoy; the buyer approves that spend in Link. Charges the buyer, so only call it once they confirmed the purchase. On success the booking is paid and carries ticket_url; if the response says otherwise (payment_status, next_step) or errors, give the payment_url to the human buyer instead — the booking stays open until its hold expires.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
Changes things 5Claude Code: ask
  • hold_ticketsReserves tickets and returns a booking_uuid.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Reserves tickets and returns a booking_uuid. The hold expires after 15 minutes if the order is not paid, releasing the seats. Only call this once the buyer has chosen; do not hold speculatively.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
  • recover_ticketsFor a buyer who lost their tickets: sends the ticket links of their past paid orders to their email address.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    For a buyer who lost their tickets: sends the ticket links of their past paid orders to their email address. The links go to the inbox only — the response never contains them — so the inbox is the proof of ownership. Tell the buyer to check their email (and spam folder).

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
  • redeem_gift_cardApplies a Toots gift card code (given to you by the buyer) to a held booking, after set_contact.No findings

    Why it is in this group

    • The description's first verb is "apply": a word for a change.
    • The input takes a statement or command to run (input.code), which can change anything it can reach.
    Description, as the server wrote it
    Applies a Toots gift card code (given to you by the buyer) to a held booking, after set_contact. Uses as much of the card's balance as the order needs. Fully covered orders complete immediately (status paid); otherwise the response carries the payment_url for the balance.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
  • redeem_passApplies a Toots Pass code (given to you by the buyer; format XXX-XXXXXX-XXX) to a held booking, after set_contact.1 finding

    Why it is in this group

    • The description's first verb is "apply": a word for a change.
    • The input takes a statement or command to run (input.code), which can change anything it can reach.

    Findings

    • Info

      The description mentions "credential".

      Matched text

      description: "...rl for the balance. The code is a venue credential, not a payment instrument."

      What this check looks for
    Description, as the server wrote it
    Applies a Toots Pass code (given to you by the buyer; format XXX-XXXXXX-XXX) to a held booking, after set_contact. Covers as many tickets as the pass has concerts left. If the order is fully covered the booking completes immediately (status paid); otherwise the response carries the payment_url for the balance. The code is a venue credential, not a payment instrument.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
  • set_contactAttaches the buyer to a held booking and returns the payment_url.No findings

    Why it is in this group

    • The name "set_contact" says "set": a word for a change.
    Description, as the server wrote it
    Attaches the buyer to a held booking and returns the payment_url. Give that URL to the human buyer: payment (card or Bancontact) happens in their browser, never through this API. The tickets will be emailed to the address given here.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
Only reads 6Claude Code: allow
  • get_availabilityLive ticket availability for a concert, per session: the stock_id, category_id and price_id values that hold_tickets needs, with prices in euro cents and the maximum quantity per l…Reads text others writeNo findings

    Why it is in this group

    • The name "get_availability" says "get": a word for reading.

    What it can reach

    • untrusted-inputThe description's first sentence says "ticket": it reads issues, which other people can write.
    Description, as the server wrote it
    Live ticket availability for a concert, per session: the stock_id, category_id and price_id values that hold_tickets needs, with prices in euro cents and the maximum quantity per line.

    Annotations the server declares

    • readOnlyHint: true
  • get_booking_statusCurrent status of a booking: awaiting_contact, awaiting_payment (with payment_url and amount left), paid or expired.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "get_booking_status" says "get": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "contact": it reads contacts.
    • untrusted-inputThe description's first sentence says "url": it reads web pages, which anyone can write.
    Description, as the server wrote it
    Current status of a booking: awaiting_contact, awaiting_payment (with payment_url and amount left), paid or expired. A paid booking carries ticket_url — the one link to share with the buyer, which adapts to their device (wallet on a phone, PDF and choices elsewhere) — plus the explicit ticket_pdf_url and, when configured, apple_wallet_url / google_wallet_url.

    Annotations the server declares

    • readOnlyHint: true
  • get_eventFull details of one concert: bio, line-up, other dates of the same run, prices and availability.No findings

    Why it is in this group

    • The name "get_event" says "get": a word for reading.
    Description, as the server wrote it
    Full details of one concert: bio, line-up, other dates of the same run, prices and availability.

    Annotations the server declares

    • readOnlyHint: true
  • get_venue_infoAddress, contact details and the venue's FAQ (house rules, practical questions).Reads private dataNo findings

    Why it is in this group

    • The name "get_venue_info" says "get": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "contact": it reads contacts.
    Description, as the server wrote it
    Address, contact details and the venue's FAQ (house rules, practical questions). Use this to answer buyer questions about the club instead of guessing.

    Annotations the server declares

    • readOnlyHint: true
  • list_eventsAll upcoming concerts with date, line-up, genres and a price/availability summary.No findings

    Why it is in this group

    • The name "list_events" says "list": a word for reading.
    Description, as the server wrote it
    All upcoming concerts with date, line-up, genres and a price/availability summary. Amounts are euro cents.

    Annotations the server declares

    • readOnlyHint: true
  • wait_for_paymentLike get_booking_status, but holds the request open (up to 25 seconds) and returns as soon as the booking is paid.No findings

    Why it is in this group

    • The name "wait_for_payment" says "wait": a word for reading.
    Description, as the server wrote it
    Like get_booking_status, but holds the request open (up to 25 seconds) and returns as soon as the booking is paid. Call it after handing the buyer the payment_url instead of polling in a loop; repeat while status is still awaiting_payment and the hold has time left.

    Annotations the server declares

    • readOnlyHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged outbound.

Reads private data2
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write3
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out0
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http tickets https://toots.brussels/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__tickets__list_events",
      "mcp__tickets__get_event",
      "mcp__tickets__get_availability",
      "mcp__tickets__get_venue_info",
      "mcp__tickets__wait_for_payment",
      "mcp__tickets__get_booking_status"
    ],
    "ask": [
      "mcp__tickets__hold_tickets",
      "mcp__tickets__set_contact",
      "mcp__tickets__redeem_pass",
      "mcp__tickets__redeem_gift_card",
      "mcp__tickets__pay_with_shared_payment_token",
      "mcp__tickets__recover_tickets"
    ],
    "deny": [
      "mcp__tickets__release_booking"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as tickets. Review it before you use it.

Capability tags behind 4 rules
  • mcp__tickets__get_availability untrusted-input
  • mcp__tickets__get_venue_info private-data
  • mcp__tickets__pay_with_shared_payment_token untrusted-input
  • mcp__tickets__get_booking_status private-data, untrusted-input