generated: '2026-08-09'
method: probed
source: https://api.cobot.me/mcp
status: live
gated: true
summary: >-
  Cobot operates a hosted, remote MCP server at https://api.cobot.me/mcp. It is UNDOCUMENTED —
  it appears in no Cobot docs page, no blog post, no llms.txt and no search result — and was
  found by probing the API host: GET returns 405 (not 404), and an anonymous JSON-RPC POST
  returns 401 with an RFC 9728 WWW-Authenticate challenge naming its own protected-resource
  metadata document. The tool list therefore cannot be enumerated anonymously, but the server's
  real capability surface IS published, as the 14 OAuth scopes in that metadata.
server:
  name: Cobot MCP
  url: https://api.cobot.me/mcp
  transport: streamable-http
  hosting: remote-hosted
  vendor_operated: true
authentication:
  type: oauth2
  authorization_servers:
  - https://www.cobot.me
  resource: https://api.cobot.me/mcp
  resource_metadata: https://api.cobot.me/.well-known/oauth-protected-resource/mcp
  authorization_endpoint: https://www.cobot.me/oauth/authorize
  token_endpoint: https://www.cobot.me/oauth/access_token
  registration_endpoint: https://www.cobot.me/oauth/register
  pkce: S256
  dynamic_client_registration: true
  spec: RFC 9728 (OAuth 2.0 Protected Resource Metadata)
scopes_supported:
- read_allocations
- read_bookings
- read_check_ins
- read_contacts
- read_external_bookings
- read_invoices
- read_memberships
- read_products
- read_resources
- read_spaces
- read_teams
- read_user
- write_bookings
- write_check_ins
scope_analysis: >-
  The MCP server exposes 14 of the 58 scopes the REST API supports — a deliberately narrowed
  agent surface. Reads cover the operational core (spaces, memberships, teams, bookings,
  resources, allocations, check-ins, contacts, invoices, products, user). Writes are limited to
  bookings and check-ins: an agent can book a room and check a member in, but cannot issue an
  invoice, take a payment, refund, change a subscription, publish an event, or touch billing
  details. That is a meaningfully conservative choice and is recorded here as observed fact.
tools:
  enumerated: false
  reason: >-
    tools/list requires a bearer token. Anonymous POST {"jsonrpc":"2.0","id":1,"method":"tools/list"}
    returns 401 {"error":"A valid access token must be passed using the 'Authorization: Bearer
    token' header."}. No tool names are recorded here because none are published — deriving them
    would be fabrication. Authenticated introspection is required to capture the real
    inputSchemas; see mcp/cobot-tool-crosswalk.yml for the scope-level binding that CAN be
    evidenced.
x-evidence:
  fetched: '2026-08-09'
  probes:
  - method: GET
    url: https://api.cobot.me/mcp
    http_status: 405
    note: Path exists; GET not allowed. A non-existent path on this host returns 404.
  - method: POST
    url: https://api.cobot.me/mcp
    body: '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
    accept: application/json, text/event-stream
    http_status: 401
    www_authenticate: Bearer resource_metadata="https://api.cobot.me/.well-known/oauth-protected-resource/mcp"
  - method: POST
    url: https://api.cobot.me/mcp
    body: '{"jsonrpc":"2.0","id":1,"method":"initialize",...}'
    http_status: 401
  - method: GET
    url: https://api.cobot.me/.well-known/oauth-protected-resource/mcp
    http_status: 200
    content_type: application/json
    file: ../well-known/cobot-mcp-oauth-protected-resource.json
  - method: GET
    url: https://mcp.cobot.me/
    http_status: 404
    note: No dedicated MCP subdomain.