Canopy by Copp Oak
com.coppoak/canopycoppoak.comstreamable-httpv0.1.0Scanned
Book local service pros from your AI assistant: real availability, instant booking, easy cancels.
10 tools: 1 can delete or cancel things, 5 change things and 4 only read.
- Reads private data · 1
- Reads text others write · 10
- Can send data out · 3
- No findings
Anlyon alternative
6 of these tools change something. Run those as governed actions.
Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.
Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.
Import an OpenAPI spec →Tools
Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.
10 tools
Deletes or cancels 1Claude Code: deny
cancel_bookingCancel a booking made through Canopy.Reads text others writeNo findings
Why it is in this group
- The name "cancel_booking" says "cancel": a word for removing or ending something.
- The description says "cannot be undone".
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Cancel a booking made through Canopy. The appointment is called off in the business's calendar right away and the customer is emailed. This cannot be undone: confirm with the customer before calling. An appointment that has already started cannot be cancelled here. Needs the manage_token that came back with the booking_id.
Annotations the server declares
- title: Cancel a booking
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: true
Changes things 5Claude Code: ask
canopy_check_bookableGiven businesses you already found for the user (name plus phone, website or address), report which ones can be booked through Canopy and how (booking_mode).Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Given businesses you already found for the user (name plus phone, website or address), report which ones can be booked through Canopy and how (booking_mode). Results come back in exactly the order you sent them. Canopy never ranks, filters or recommends businesses. Results are returned in the same order as the input.
Annotations the server declares
- title: Check which businesses are bookable
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
propose_timesPropose preferred times to a business that reviews booking requests.Reads text others writeCan send data outNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a destination (input.customer.phone): what the tool writes goes there.
Description, as the server wrote it Propose preferred times to a business that reviews booking requests. The business will approve one time (that books it; the customer is emailed a confirmation) or propose an alternative (the customer confirms it from an emailed code). Check status with get_request_status.
Annotations the server declares
- title: Propose preferred times
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
request_bookingStart a booking with a Canopy-connected business.Reads text others writeCan send data outNo findings
Why it is in this group
- The name "request_booking" says "request": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a destination (input.customer.phone): what the tool writes goes there.
Description, as the server wrote it Start a booking with a Canopy-connected business. Canopy automatically routes to the correct flow based on the operator's booking mode: auto-confirm (booked right away in the business's calendar; the customer is emailed a confirmation), request-times (propose preferred times), or submission-only (callback request). Summarize the booking and get the customer's go-ahead before calling.
Annotations the server declares
- title: Start a booking
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
request_callbackRequest a callback from a business.Reads text others writeCan send data outNo findings
Why it is in this group
- The name "request_callback" says "request": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a destination (input.customer.phone): what the tool writes goes there.
Description, as the server wrote it Request a callback from a business. They will contact the customer directly. No calendar booking is created.
Annotations the server declares
- title: Request a callback
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
reschedule_bookingAsk to move a booking the customer already confirmed (booked with the business) to another open slot of the same service and location (slot_id from get_availability).Reads text others writeNo findings
Why it is in this group
- The name "reschedule_booking" says "reschedule": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Ask to move a booking the customer already confirmed (booked with the business) to another open slot of the same service and location (slot_id from get_availability). Nothing moves right away: Canopy emails the customer a link to approve the new time, and the business calendar changes only after they approve. A hold the customer has not confirmed yet cannot be moved. Calling again with the same slot_id reports whether it was approved. Needs the manage_token that came back with the booking_id.
Annotations the server declares
- title: Ask to move a booking to another time
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
Only reads 4Show 4 read-only tools
get_availabilityList open appointment slots for a Canopy business, optionally for one service and one location, between two dates.Reads text others writeNo findings
Why it is in this group
- The name "get_availability" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it List open appointment slots for a Canopy business, optionally for one service and one location, between two dates. Slots are cached from the business calendar (see synced_at); the time is re-checked live when you book.
Annotations the server declares
- title: Get open appointment times
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
get_business_termsGet the prices of a Canopy business's bookable services, its fees and its cancellation terms, exactly as the business has them on file.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "get_business_terms" says "get": a word for reading.
What it can reach
- private-dataThe description's first sentence says "get" and "file": it reads files.
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Get the prices of a Canopy business's bookable services, its fees and its cancellation terms, exactly as the business has them on file. Anything the business has not put on file comes back as on_file=false: tell the customer it is not on file (they can ask the business) and never estimate or fill in a value.
Annotations the server declares
- title: Get a business's prices and terms
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
get_request_statusCheck the status of a booking request (preferred times or callback).Reads text others writeNo findings
Why it is in this group
- The name "get_request_status" says "get": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it Check the status of a booking request (preferred times or callback). Returns pending, approved, rejected, counter_proposed, expired, or converted. Needs the manage_token that came back when the request was made.
Annotations the server declares
- title: Check a booking request
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
resolve_businessMatch one business the user named to its Canopy listing, by phone, website, or name (add the city, state or ZIP code when you know it).Reads text others writeNo findings
Why it is in this group
- The name "resolve_business" says "resolve": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- untrusted-inputThe description's first sentence says "website": it reads web pages, which anyone can write.
Description, as the server wrote it Match one business the user named to its Canopy listing, by phone, website, or name (add the city, state or ZIP code when you know it). Returns at most one match, with its booking_mode and locations, or found=false. When a name alone is not certain, found=false comes with up to 5 candidates in alphabetical order for the user to choose from.
Annotations the server declares
- title: Look up one business on Canopy
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Exfil surface
Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.
30 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 1 private-data tool breaks every one.
- Reads private data1
- Reads files, mail, messages, databases, secrets, calendars or repositories.
- Reads text others write10
- Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
- Can send data out3
- Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
{
"permissions": {
"deny": [
"mcp__canopy__get_business_terms"
]
}
}Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.
Findings
Matches of fixed checks, with the text they matched.
No check matched anything in these tool definitions. That is not a safety guarantee.
History
Changes to its tool definitions and to its remote endpoint, newest first.
No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.
Install
Pinned to version 0.1.0. Values in angle brackets are yours to fill in.
claude mcp add --transport http canopy https://canopy-mcp-production.up.railway.app/mcp/publicclaude mcp add --transport http canopy https://canopy-mcp-production.up.railway.app/mcp/publicRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__canopy__resolve_business",
"mcp__canopy__get_availability",
"mcp__canopy__get_request_status",
"mcp__canopy__get_business_terms"
],
"ask": [
"mcp__canopy__canopy_check_bookable",
"mcp__canopy__request_booking",
"mcp__canopy__propose_times",
"mcp__canopy__request_callback",
"mcp__canopy__reschedule_booking"
],
"deny": [
"mcp__canopy__cancel_booking"
]
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as canopy. Review it before you use it.
Capability tags behind 10 rules
- mcp__canopy__canopy_check_bookable untrusted-input
- mcp__canopy__resolve_business untrusted-input
- mcp__canopy__get_availability untrusted-input
- mcp__canopy__request_booking untrusted-input, outbound
- mcp__canopy__propose_times untrusted-input, outbound
- mcp__canopy__request_callback untrusted-input, outbound
- mcp__canopy__get_request_status untrusted-input
- mcp__canopy__reschedule_booking untrusted-input
- mcp__canopy__cancel_booking untrusted-input
- mcp__canopy__get_business_terms private-data, untrusted-input
Pin
Keep the decision: fail CI when the tools change, follow every change, or show a badge.
Pin in CI
Fail a build when the tools you reviewed are not the tools the server serves today.
curl -s "https://anlyon.dev/api/v1/servers/com.coppoak/canopy/verify?hash=2f9859b67538cb814233c0be798e98d44e920940ab67626b658231eba45dc9f8" | jq -e '.changed == false'Pinned hash 2f9859b67538, from Nov 2, 2026, 19:18 UTC.
Watch
Get told when its tools change: a new tool, a new description, a new class.
https://anlyon.dev/servers/com.coppoak/canopy/changes.xmlAn Atom feed. Works in any feed reader or Slack's RSS app.
Badge
[](https://anlyon.dev/servers/com.coppoak/canopy)Source: MCP Registry. Synced Nov 2, 2026, 19:17 UTC.