← Back to search

io.github.chrischall/opentable-mcp

chrischall Scanned 23d ago

OpenTable reservation management: find slots, book, cancel, list reservations, manage favorites.

B
89.2 / 100

Versions

0.16.3latest
Jul 30, 2026
0.16.2
Jul 30, 2026
0.16.0
Jul 13, 2026
0.15.0
Jul 7, 2026
0.14.3
Jun 15, 2026
+ show 17 moreshow less
0.14.2
Jun 13, 2026
0.14.1
Jun 4, 2026
0.14.0
May 29, 2026
0.13.0
May 29, 2026
0.12.0
May 28, 2026
0.11.0
May 27, 2026
0.10.4
May 26, 2026
0.9.2
May 21, 2026
0.9.1
May 21, 2026
0.9.0
May 19, 2026
0.8.0
May 8, 2026
0.7.0
Apr 22, 2026
0.6.0
Apr 22, 2026
0.5.0
Apr 22, 2026
0.4.0
Apr 21, 2026
0.3.0
Apr 21, 2026
0.3.0-alpha.5
Apr 21, 2026
PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 13

opentable_remove_favorite
annotations: none low

Remove a restaurant from the user's Saved Restaurants list.

opentable_list_reservations
annotations: verified low

List the authenticated user\'s OpenTable reservations. Defaults to upcoming; pass scope="past" or scope="all" to broaden. Each entry includes the security_token needed to cancel or modify.

scope enum
readOnlyHint true
opentable_find_slots
annotations: verified low

List available reservation slots at a specific OpenTable restaurant for a date + party size. Returns each slot's reservation_token (use it with opentable_book — tokens expire quickly, book promptly). Slots may be attributes=['default'|'bar'|'highTop'|'outdoor'] and type=Standard|Experience|POP. You can pass a slot's reservation_token + slot_hash straight to opentable_book without a separate opentable_get_restaurant call — book auto-resolves the dining area. (OpenTable's availability response carries only the seating category, not the numeric dining-area id, so that id is resolved at book time from the booking-details page.) If this errors with \"operation ... not yet observed on this tab\", open any OpenTable restaurant page in your browser once (the graphql bridge needs to see the page's own availability query fire first), then retry.

date string time string
readOnlyHint true
opentable_book_preview
annotations: verified low

Preview an OpenTable booking BEFORE committing. Fetches the /booking/details SSR page and the slot-lock to surface: the cancellation policy (including any credit-card no-show fee), the saved payment card that would be charged/held, and a short-lived `booking_token` that opentable_book consumes. REQUIRED for CC-required slots — opentable_book refuses to commit without the token. Safe to call for standard slots too (the token skips a redundant re-lock in book). Holds the slot for ~60-90s; preview → book should happen within a minute. For Listing-type restaurants (Le Bernardin, etc.) this tool can't fetch a slot at all — callers should check `opentable_get_restaurant.bookable` first and surface the restaurant's phone/URL instead. For Experience-mandatory slots (find_slots returned booking_type=experience_mandatory), pass `experience_id` from the slot's `experience_ids` to route through the Experience slot-lock.

date string time string slot_hash string reservation_token string
readOnlyHint true
opentable_modify_preview
annotations: verified low

Preview a MODIFICATION to an existing OpenTable reservation. Takes the existing reservation's identity (restaurant_id + confirmation_number + security_token from opentable_list_reservations or the original opentable_book result) plus the NEW slot args (from a fresh opentable_find_slots call) and returns the new cancellation_policy, CC re-hold details, and a `modify_token` that opentable_modify consumes. Mirrors opentable_book_preview, but the /booking/details URL includes confirmationNumber + securityToken + isModify=true so OpenTable's SSR returns the modify state. REQUIRED before opentable_modify — no shortcut path. For Listing-type restaurants the modify can't proceed (no slot picker); check opentable_get_restaurant.bookable first.

date string time string slot_hash string dining_area_id number security_token string reservation_token string
readOnlyHint true
opentable_book
annotations: none low

Book an OpenTable reservation. Requires a fresh slot_hash + reservation_token from opentable_find_slots (tokens expire within minutes — call find_slots just before book). dining_area_id is OPTIONAL: when omitted it's auto-resolved to the default dining area from OpenTable's booking-details page, so find_slots → book works without a separate opentable_get_restaurant call. For CC-required slots (prime-time at busy restaurants), opentable_book refuses without a `booking_token` from opentable_book_preview — the preview step surfaces the cancellation policy and the saved card that would be held. Auto-fetches the user's profile (name/email/phone) from /user/dining-dashboard. Returns confirmation_number + security_token; save both — they're required to cancel. For Listing-type restaurants there's no slot to lock — callers should check `opentable_get_restaurant.bookable` first and surface the restaurant's phone/URL instead. Without confirm:true this returns a dry-run and makes NO booking; re-run with confirm:true to commit.

date string time string slot_hash string reservation_token string
opentable_modify
annotations: none low

Modify an existing OpenTable reservation in place. Requires the existing reservation's identity (restaurant_id + confirmation_number + security_token) plus a fresh modify_token from opentable_modify_preview — preview is mandatory because the new slot's cancellation policy / CC re-hold can differ from the original. Submits /dapi/booking/make-reservation with isModify: true + the existing confirmation_number + security_token; OpenTable preserves confirmation_number across modifies but may regenerate reservation_id and security_token. Returns the same shape as opentable_book plus was_modified: true so the agent can phrase the user confirmation accurately. For Listing-type restaurants there's no slot to lock — agents should check opentable_get_restaurant.bookable first. Without confirm:true this returns a dry-run and makes NO change to the reservation; re-run with confirm:true to submit the modification.

date string time string slot_hash string dining_area_id number security_token string reservation_token string
opentable_cancel
annotations: none low

Cancel an OpenTable reservation. Requires restaurant_id, confirmation_number, and security_token — all three come from opentable_list_reservations or opentable_book. Without confirm:true this returns a dry-run and takes NO cancellation action; re-run with confirm:true to cancel the reservation.

security_token string
opentable_get_restaurant
annotations: verified low

Get full details for a single OpenTable restaurant: cuisine, price band, description, address, hours, phone, payment options, features, rating/review count, and availability_token (used internally when booking). Accepts the slug, path, or full URL from opentable_search_restaurants — passing the search result\'s "url" verbatim always resolves, including legacy venues served at /{slug} instead of /r/{slug}.

readOnlyHint true
opentable_search_restaurants
annotations: verified low

Search OpenTable for restaurants. Returns matching restaurants with cuisine, neighborhood, price band, rating, description, and URL. Does NOT include bookable slot tokens — use opentable_find_slots for a specific venue to check availability.

date string term string time string latitude number metro_id number longitude number
readOnlyHint true
opentable_get_profile
annotations: verified low

Get the authenticated OpenTable user's profile: name, email, phones, loyalty points and tier, home metro, member-since date. Payment and credit-card details are never exposed.

readOnlyHint true
opentable_list_favorites
annotations: verified low

List the user's saved restaurants from OpenTable (Saved Restaurants list). Returns each entry's id, name, cuisine, neighborhood, price band, rating, and OpenTable URL.

readOnlyHint true
opentable_add_favorite
annotations: none low

Add a restaurant to the user's Saved Restaurants list.

Permissions 2

network medium
Server uses network capabilities via: fetch()
env_vars low
Server uses env_vars capabilities via: process.env

Scan Findings 40

info
Tool 'opentable_book_preview' annotations are consistent annotation_checker · 80%
info
Tool 'opentable_modify_preview' annotations are consistent annotation_checker · 80%
info
Tool 'opentable_list_reservations' annotations are consistent annotation_checker · 80%
info
Tool 'opentable_find_slots' annotations are consistent annotation_checker · 80%
low
Tool 'opentable_book' has no annotations annotation_checker · 100%
low
Tool 'opentable_modify' has no annotations annotation_checker · 100%
low
Tool 'opentable_cancel' has no annotations annotation_checker · 100%
info
Tool 'opentable_get_restaurant' annotations are consistent annotation_checker · 80%
info
Tool 'opentable_search_restaurants' annotations are consistent annotation_checker · 80%
info
Tool 'opentable_get_profile' annotations are consistent annotation_checker · 80%
info
Tool 'opentable_list_favorites' annotations are consistent annotation_checker · 80%
low
Tool 'opentable_add_favorite' has no annotations annotation_checker · 100%
low
Tool 'opentable_remove_favorite' has no annotations annotation_checker · 100%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Vulnerable dependency: esbuild@0.28.0 (GHSA-g7r4-m6w7-qqqr) dependency_analyzer · 95%
medium
Buffer.from base64 in chrischall-opentable-mcp-7e3311b/src/booking-token.ts:86 entropy_analyzer · 75%
medium
Hex string literal (>50 chars) in chrischall-opentable-mcp-7e3311b/src/tools/reservations.ts:145 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in chrischall-opentable-mcp-7e3311b/src/tools/reservations.ts:149 entropy_analyzer · 70%
medium
Hex string literal (>50 chars) in chrischall-opentable-mcp-7e3311b/src/tools/reservations.ts:151 entropy_analyzer · 70%
info
package.json metadata manifest_parser · 100%
info
Tool: opentable_list_reservations manifest_parser · 85%
info
Tool: opentable_find_slots manifest_parser · 85%
info
Tool: opentable_book_preview manifest_parser · 85%
info
Tool: opentable_modify_preview manifest_parser · 85%
info
Tool: opentable_book manifest_parser · 85%
info
Tool: opentable_modify manifest_parser · 85%
info
Tool: opentable_cancel manifest_parser · 85%
info
Tool: opentable_get_restaurant manifest_parser · 85%
info
Tool: opentable_search_restaurants manifest_parser · 85%
info
Tool: opentable_get_profile manifest_parser · 85%
info
Tool: opentable_list_favorites manifest_parser · 85%
info
Tool: opentable_add_favorite manifest_parser · 85%
info
Tool: opentable_remove_favorite manifest_parser · 85%
info
Transport: streamable-http manifest_parser · 80%
info
Required env vars (29) manifest_parser · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 70%
low
Permission: env_vars access detected permission_analyzer · 90%
info
SBOM generated: 242 components sbom_generator · 100%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%