Back to Browse

Tock MCP Server

Developer ToolsModerate6.0Local
Free

Tock (exploretock.com): discover restaurants, search a city, get venue details and availability.

About

Tock (exploretock.com): discover restaurants, search a city, get venue details and availability.

Security Report

6.0
Moderate6.0Moderate Risk

This is a well-structured MCP server for the Tock restaurant discovery platform with appropriate security controls for its use case. The server uses a browser-mediated proxy pattern (fetchproxy extension) to avoid handling credentials directly, implements proper input validation, and includes thoughtful error handling for authentication states. Minor code quality observations around broad exception handling and sensitive data logging do not materially affect the security posture. Supply chain analysis found 2 known vulnerabilities in dependencies (0 critical, 1 high severity). Package verification found 1 issue.

7 files analyzed · 7 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

HTTP Network Access

Connects to external APIs or services over the internet.

env_vars

Check that this permission is expected for this type of plugin.

File System Read

Reads files on your machine. Normal for tools that analyze or process local data.

How to Install

Add this to your MCP configuration file:

{
  "mcpServers": {
    "io-github-chrischall-tock-mcp": {
      "args": [
        "-y",
        "tock-mcp"
      ],
      "command": "npx"
    }
  }
}

Documentation

View on GitHub

From the project's GitHub README.

tock-mcp

MCP server for Tock (exploretock.com) — restaurant discovery and availability for Claude. List cities, search a metro, and get a venue's details plus its bookable experiences, prices, party sizes, and open dates/times.

Every request is relayed through your own signed-in browser tab via the fetchproxy extension — no cookie paste, no bot-wall dance, no password handling. This project was developed and is maintained by AI (Claude Code).

Tock publishes no official consumer API, and exploretock.com sits behind a Cloudflare challenge. tock-mcp fetches the same server-rendered pages the Tock web app uses (parsing their embedded window.$REDUX_STATE store) through your signed-in tab. It is read-only — Tock reservations are prepaid tickets, so booking stays on exploretock.com. Use at your own discretion.

Install

// .mcp.json
{
  "mcpServers": {
    "tock": { "command": "npx", "args": ["-y", "tock-mcp"] }
  }
}

You also need the fetchproxy browser extension (shared across the fleet) running in a Chrome/Safari tab. The first tool call prints a one-time pair code to approve in the extension popup — run tock_healthcheck to trigger it. Discovery works signed-out; the account tools need you signed in to exploretock.com.

Tools

  • tock_list_metros — Tock cities/metros with business counts; filter by name/country.
  • tock_search_restaurants — venues in a metro slug (cuisine, price, neighborhood, slug).
  • tock_get_restaurant — venue details + its bookable experiences.
  • tock_get_availability — a venue's bookable calendar (experiences, prices, open dates/times).
  • tock_list_reservations / tock_get_profile — the signed-in user's purchases and profile.
  • tock_verify_reservation — after a booking attempt, re-query the account and return an explicit confirmed / cancelled / not_found verdict. A success screen is not proof; this is.
  • tock_healthcheck — bridge status + the one-time pair code.

Develop

npm install
npm run build     # tsc + esbuild bundle → dist/bundle.js
npm test          # vitest

Architecture and the reverse-engineered Tock surface are documented in docs/TOCK-API.md.

License

MIT

Reviews

No reviews yet

Be the first to review this server!