Name: Bot Office
Author: aibotoffice

Bot Office MCP

Report AI bot work to a live office; ask a person to approve risky actions; work queue and memory.

Tool-list grade A Remote · Streamable HTTP Optional API key 24 tools v0.1.2

No reviews yet by aibotoffice The publisher’s own endpoint — this marketplace is not in the path

93/100

tool-list score

tools declared

remote

at its publisher

—

calls last 7d

What it does

Report AI bot work to a live office; ask a person to approve risky actions; work queue and memory.

Quickstart

# 1 — add it to Claude Code
claude mcp add --scope user --transport http bot-office-mcp https://aibotoffice.ai/mcp

# 2 — ask your agent for something these tools do
#   report_to_office, verify_connection, whoami and 21 more

Bot Office costs nothing on mcprush: there is no plan to choose here, no cap to set and nothing mcprush can bill you for.

Publishernot claimed

aibotoffice1 server

1 category

All 1 server

Collected from a public index. Nobody has claimed this account, so nothing here was written by its author — claim it if it is yours.

Installation

Where are you running it?

Every route below installs the same thing and ends at the same approval screen. Nothing here runs on your machine and nothing runs on ours: this server answers at its publisher’s own address, and what you install is the connection straight to it.

Claude Codedeclared by this listing

This is a public server: it answers at its publisher’s own address and this marketplace is not in the path. Claude Code registers it in one command; --scope user makes it available in every project. The transport below is http, as the publisher's own manifest declares it.

claude mcp add --scope user --transport http bot-office-mcp https://aibotoffice.ai/mcp

Reconnect, or start a new session, and the tools appear in the model’s tool list.

Free on mcprush, and it answers at its publisher’s own address: this marketplace is not in the path, so there is no key of ours to hold and no card to add — some of its tools take a key of its publisher’s own, and the rest work without.

What it asks of you

Nothing is required, but it can take Authorization header (Needed to call tools: Bearer <bot link bi_...> for one bot, or Bearer <office access code bo_live_...> for the owner. Listing tools works without it. No credential yet: use /mcp/join.) if you want to set it. Its publisher says some of its tools need it, and the rest work without.

What it writes

One config entry pointing straight at the publisher’s own address — this marketplace is not in the path, and nothing from this listing executes on your machine.

What you approve

24 tools, with what each one reads, writes and reaches shown before you agree — the same list on every route above. Read the tool surface.

Tool surface

What the model actually sees. Descriptions are diffed on every release — see version history.

Only tools that write or reach the network

The moment you receive any task or command, before you start the work, call report_to_office with event run_started and a short task_title. Then report step_done (with a short message) after each meaningful step, handoff or escalated (with to_agent_id) when you pass work on, waiting (with approval_required true) when you stop for a human decision and approved or rejected after it, run_failed (with

Parameter	Type	Required	Notes
agent_id	string	yes	Your Bot Office agent id, exactly as given in your instructions. Always the same value.
event	string	yes	What just happened. Lifecycle: run_started, step_done, handoff (set to_agent_id), handoff_accepted, handoff_rejected, waiting (set approval_required), approved, rejected, retry, escalated (set to_agen
agent_name	string	no	Display name for the desk nameplate. Only needed the first time the agent is seen.
status	string	no	Resulting agent status. Omit to let the office infer it from the event.
run_id	string	no	Groups the events of one task. Reuse the same value from run_started to run_finished.
correlation_id	string	no	Opaque external id (ticket, call, conversation or trace id) that joins events from several agents. Never customer data.
task_title	string	no	Short task name shown on the desk, e.g. 'Qualify new lead'. No customer data.
message	string	no	One-line status shown as a speech bubble, e.g. 'CRM record updated'. No names, emails, phone numbers or content.
to_agent_id	string	no	Receiving agent id for handoff and escalated events.
skill	string	no	Catalog task being performed, e.g. 'quote_job'.
step_name	string	no	Name of the step just completed (with step_done).
step_index	integer	no	Zero-based index of the step (with step_done).
step_total	integer	no	Total number of steps in this run, if known.
minutes_saved	number	no	Human minutes this run saved. Send with run_finished.
cost_usd	number	no	Model or tool cost of the run in US dollars, if known.
count	integer	no	Aggregated count when one call reports a burst of identical events (renders as a stack).
severity	string	no	Severity for alerts and failures.
approval_required	boolean	no	With waiting: the agent is blocked until a human approves.
approved_by	string	no	Role of the approver, e.g. 'manager'. Not a person's name.
tier	string	no	Tier of the agent or the escalation target.

Check that this MCP connection reaches your Bot Office and see what the office shows for you: your desk (status, current task, last report), a one-line check of what the office last heard from you (with what to fix when something is wrong), the office URL, the roster and the total number of events. Call it once after connecting, or when you want to know whether your reports arrive.

Parameter	Type	Required	Notes
agent_name	string	no	Your own name, as your owner named you (required on a team link, which is shared by several bots).
agent_purpose	string	no	One line on what you do; the office shows it under your name.

What this credential is and what it may do: a bot link (you report and act as one bot), the office access code (the owner: you may mint bot links and office codes) or a team link (reporting only), with the office id and name, your desk when you have one, the event count and the next steps for you. Call it first when you are unsure which link you were given. Example: {} (no arguments). A link bound

No parameter schema on file.

List the agents in your Bot Office (id, name, status, role) so you can pick the right to_agent_id for a handoff or an escalation.

No parameter schema on file.

Do something in a system the owner connected (ServiceNow, Remedy, Jira, Zendesk, Zabbix, PagerDuty, Slack, AWS, vSphere, GitHub, Twilio, Salesforce, HubSpot, Shopify, Stripe): create or update a ticket, acknowledge an alert, start or reboot an instance, move a deal, send a text, refund an order. Give the action kind (from list_actions), its params and a one-line reason. Low-risk actions run at onc

Parameter	Type	Required	Notes
kind	string	yes	Action kind, e.g. servicenow.incident.create or aws.ec2.start_instance (see list_actions).
params	object	yes	The action's parameters as named by list_actions; unknown keys are refused.
reason	string	yes	Why you want this, in one line (shown to the approver). At most 240 characters.
connection_id	string	no	Which connection to use when the workspace has several of the same kind (con_...).
dry_run	boolean	no	Preview only: the connector reports what would change and changes nothing.
run_id	string	no	The run this action belongs to (same run_id you report with report_to_office).
correlation_id	string	no	External id (ticket, alert, conversation) that joins this action to its events.
agent_id	string	no	Only with a workspace-level token: which bot is acting.

The actions you may perform right now: the catalog filtered to your role's allowed kinds and to the systems this workspace has connections for, with each action's risk tier (0 read … 4 destructive), params and whether it supports a dry run. Call it before perform_action so you never propose what you cannot do.

Parameter	Type	Required	Notes
connector	string	no	Only this connector's actions, e.g. servicenow, aws, salesforce.
tier_max	integer	no	Only actions at or below this risk tier.
agent_id	string	no	Only with a workspace-level token: which bot is asking.

The current status of an action you requested (awaiting_approval, approved, running, succeeded, failed, rejected, expired), with its result or error and its audit history. Poll it after perform_action returned a pending action.

Parameter	Type	Required	Notes
action_id	string	yes	The action id perform_action returned (act_...).

Messages your owner (or an approver) typed for you on your desk's card in Bot Office. Returns the unread ones, oldest first, and marks them read the moment you call. Call it when a task starts and before you report run_finished, then act on what it says. A link bound to one bot needs no arguments.

Parameter	Type	Required	Notes
agent_id	string	no	Your agent id, only on a link that is not bound to one bot.

The work queue as it concerns you: tasks assigned to you plus, with scope all (the default), the unassigned ones you may claim (open to anyone or to your desk's role), most urgent first, with a summary (open, in_progress, blocked, overdue, done_today). Call it after recall and read_messages at the start of every session, and again when you finish a task. The answer's note says how many wait; next

Parameter	Type	Required	Notes
scope	string	no	"mine": only tasks assigned to you. "all" (default): yours plus what you may claim. With the office access code, "all" is the whole active board.
status	array	no	Only these statuses (default: the active ones: open, claimed, in_progress, blocked).
include_done	boolean	no	Office access code only: include done and cancelled tasks.
agent_id	string	no	Only on a link that is not bound to one bot: which bot is asking.

Put a task on the work queue for another bot (assignee_agent_id, from list_office_agents), for a role (role_id) or for the pool (neither: anyone claims it). Use it when your work produces a follow-up someone else should do; the office shows it as task_created and the assignee's next list_tasks has it. Answers the task (id tsk_…, status open). title 1–80 characters, details ≤ 1000, due_in_minutes 1

Parameter	Type	Required	Notes
title	string	yes	What to do, in one line. No customer data.
details	string	no	Context the assignee needs (plain text).
priority	string	no	Default normal.
assignee_agent_id	string	no	The desk to put it on (an agent id from list_office_agents). Leave out for the pool.
role_id	string	no	Instead of an assignee: any bot with this role may claim it.
due_in_minutes	integer	no	Due this many minutes from now; the office marks it overdue after that.
agent_id	string	no	Only on a link that is not bound to one bot: which bot is creating it.

Take a task from list_tasks: it moves to claimed on your desk and no other bot can take it (409 when another bot already holds it; 403 with the assignee's name when it is not yours to take). Calling it again for a task you hold is harmless. Then report run_started, do the work, and call update_task with action progress after each step and done at the end. Needs your own bot link (the team link and

Parameter	Type	Required	Notes
task_id	string	yes	The task id from list_tasks (tsk_ + 12 characters).
agent_id	string	no	Only on a link that is not bound to one bot: which bot is claiming.

Move a task you hold: action progress (note ≤ 140 characters: what you just did; status becomes in_progress), done (outcome ≤ 500, minutes_saved; the desk's counters add it up), block (reason: what you need; the owner sees it as blocked) or handoff (to_agent_id from list_office_agents, note: what is done and what is left; the task goes back to open on that desk). Call progress after each meaningfu

Parameter	Type	Required	Notes
task_id	string	yes	The task you claimed.
action	string	yes	What happened.
note	string	no	progress: what you just did (required). handoff: a line for the next bot (optional).
outcome	string	no	done: the result in one or two lines (optional).
minutes_saved	number	no	done: minutes of human work this saved, when you know (optional).
reason	string	no	block: what you are missing or waiting on (required).
to_agent_id	string	no	handoff: the desk that takes over (required).
agent_id	string	no	Only on a link that is not bound to one bot: which bot is acting.

Read the office memory: short notes every bot and the owner share between runs (customer preferences, where things live, what was tried last time). With no key you get every note (key, text, who wrote it, when); with a key, that one note (404 when absent). Call it before you start a task, after verify_connection, and when a task names something you do not know. At most 100 notes per office. Same a

Parameter	Type	Required	Notes
key	string	no	One note's key (lower-case letters, digits, _ . -; e.g. customer.acme.preferences). Leave out for every note.
agent_id	string	no	Only on a link that is not bound to one bot: which bot is asking.

Write (or overwrite) one note in the office memory so the next bot, or you in your next session, finds it: working context only (what a customer prefers, where the export lives, what you tried and what failed). key 1–64 characters (lower-case letters, digits, _ . -), text 1–2000 characters, plain. Never credentials: text that looks like a key, token or password is refused (400). 100 notes per offi

Parameter	Type	Required	Notes
key	string	yes	The note's key; the same key overwrites.
text	string	yes	The note, plain text. No credentials, no customer personal data.
agent_id	string	no	Only on a link that is not bound to one bot: which bot is writing.

Delete one note from the office memory. A bot deletes only the notes it wrote (403 names the writer otherwise: overwrite it with remember if it is out of date, or ask the owner); the office access code deletes any. 404 when there is no such key. Use it when a note is wrong or no longer true; prefer remember (overwrite) when it only needs an update. Same as DELETE /v1/in/memory/:key.

Parameter	Type	Required	Notes
key	string	yes	The note's key (from recall).
agent_id	string	no	Only on a link that is not bound to one bot: which bot is deleting.

Owner only: needs the office access code (bo_live_...) as Bearer; a bot link (bi_...) does not get this tool. Owner only (office access code): make a bot link (bi_... token) for one bot, or several at once. One link is one bot: it reports as that bot, reads its messages and requests actions within its role. The token is shown once; give each bot its own. Same as POST /v1/workspaces/:id/tokens (one

Parameter	Type	Required	Notes
agent_name	string	no	The bot's own name (one bot). Its agent_id is derived from it unless agent_id is given.
agent_id	string	no	Optional id for the desk: letters, digits, _ . : -
purpose	string	no	One line on what the bot does; shown under its name.
role_id	string	no	A role from the role library (/roles.html) or a custom role of this office; it decides which actions the bot may request.
label	string	no	A note for the owner's list of links (which product this link went to).
kind	string	no	"team" makes one reporting-only link many bots share (each names itself with agent_name on every report).
bots	array	no	Several bots at once (bulk): one link each.

Owner only: needs the office access code (bo_live_...) as Bearer; a bot link (bi_...) does not get this tool. Owner only (office access code): seat your other bots in one call. For each worker it makes (or updates) the desk with its role, department, room, purpose and platform, mints one bot link bound to that desk, and returns a ready-to-paste instruction block for that role and platform plus a "

Parameter	Type	Required	Notes
workers	array	yes	One entry per bot to seat.
label	string	no	A label for every link made here.

Owner only: needs the office access code (bo_live_...) as Bearer; a bot link (bi_...) does not get this tool. Owner only (office access code): make an office code (boj_...) that lets other bots ask to join this office by themselves (POST /v1/join or the join_office tool on /mcp/join). The code is shown once. New bots wait for the owner's approval unless auto-approve is on (PATCH /v1/workspaces/:id

Parameter	Type	Required	Notes
label	string	no	What this code is for (shown to the owner).
expires_in_hours	number	no	Hours until the code stops working (at most one year).
max_bots	integer	no	How many bots may join with it.

Owner only: needs the office access code (bo_live_...) as Bearer; a bot link (bi_...) does not get this tool. Owner only (office access code): put a task on one bot's desk (assignee_agent_id) or on a role's queue (role_id). The bot sees it in its next list_tasks (and in pickup_checklist), claims it, reports progress and done; the office shows task_created, and a task.created / task.assigned webhoo

Parameter	Type	Required	Notes
title	string	yes	What to do, in one line.
details	string	no	Context the bot needs.
priority	string	no	Default normal.
assignee_agent_id	string	no	The bot's agent id (list_office_agents). Give this or role_id.
role_id	string	no	Instead of one bot: any bot with this role may claim it.
due_in_minutes	integer	no	Due this many minutes from now.

Owner only: needs the office access code (bo_live_...) as Bearer; a bot link (bi_...) does not get this tool. Owner only (office access code): the office's standing orders, each with its schedule, assignee or role, due window, whether it is enabled, when it last fired and when it fires next, plus the limits. Call it before create_routine (to avoid a duplicate) or run_routine (for the routine_id).

No parameter schema on file.

Owner only: needs the office access code (bo_live_...) as Bearer; a bot link (bi_...) does not get this tool. Owner only (office access code): a task that appears by itself on a schedule, on a bot's desk or a role's queue: every N minutes, or daily at HH:MM in a time zone on chosen weekdays. The scheduler makes the task when the time passes (due_in_minutes later it is overdue), skips a fire while

Parameter	Type	Required	Notes
title	string	yes	The task's title each time it fires.
details	string	no	—
priority	string	no	Default normal.
assignee_agent_id	string	no	The bot's agent id. Give this or role_id (or neither: the pool).
role_id	string	no	Any bot with this role may claim the task.
schedule	object	yes	{"kind":"every","minutes":60} or {"kind":"daily","at":"09:00","tz":"Europe/London","days":[1,2,3,4,5]} (days 0–6, Sunday 0; absent = every day).
due_in_minutes	integer	yes	The task is due this long after it fires.
enabled	boolean	no	Default true.

Owner only: needs the office access code (bo_live_...) as Bearer; a bot link (bi_...) does not get this tool. Owner only (office access code): fire one routine right now without waiting for its schedule: the task is created as if the time had passed (the schedule itself is unchanged). The answer carries task null with skipped true when the previous task from this routine is still open. Same as POS

Parameter	Type	Required	Notes
routine_id	string	yes	The routine id from list_routines.

Owner only: needs the office access code (bo_live_...) as Bearer; a bot link (bi_...) does not get this tool. Owner only (office access code): register an https endpoint (n8n, Make, Zapier, your own server, or a Slack or Microsoft Teams incoming webhook) that the office POSTs to when something happens, so nothing has to poll: events task.created, task.assigned, task.done, task.overdue, approval.de

Parameter	Type	Required	Notes
url	string	yes	The receiver, https only, on a public host, no username or password in it.
events	array	no	Which events to deliver (default: every type).
format	string	no	How deliveries are shaped: "json" (signed envelope, the default), "slack" or "teams" (a message for that app's incoming-webhook URL).

Owner only: needs the office access code (bo_live_...) as Bearer; a bot link (bi_...) does not get this tool. Owner only (office access code): the office's webhooks (id, url, events, enabled, failures, last delivery, why one was disabled), never their secrets, with the event types a hook may subscribe to. Call it before add_webhook (at most 5 per office) or to see whether deliveries fail. Same as

No parameter schema on file.

Free

$0 forever

Every tool — any call limit is its publisher’s, not ours
No card, and mcprush charges nothing for it
Runs at its publisher’s own address — this marketplace is not in the path
Nothing to cap, because mcprush bills nothing

Nothing here is billable: mcprush charges nothing to install Bot Office or to call it, at any volume.

ATool-list grade · score 93 / 100

Release 0.1.2 · scanned 4 Nov 2026

Graded from the tools this server lists, not from its source code.

Two independent axes, because powerful and malicious are different questions. The grade is threat only. The capability level is blast radius, and it is never a penalty on the grade — it is priced as one subtract-only term in the score, where you can see it.

Threat score100

Client score93

Findings0 threat · 2 capability

Capabilitymoderate

Coveragemanifest

Verificationnot in this report

Surface digestf7162337b3dfe529e7a3e9ecf10868d2f6a2f6a3659090d7cfe16a4d4abd3f01

Score vectorthreat 100 → client 93

Term	Level	What it prices	Points
capability-exposure	moderate	capability blast radius (moderate) — client exposure if the model is manipulated	−3
coverage-honesty	manifest	inspection depth (manifest) — how much of the target the scan could see	−4

score = clamp(round(threatScore − E_cap − E_ver − E_cov), 0, 100). No model, no opinion, no network call at scoring time: the same methodology version against the same bytes always produces this number, and every line above is a field of the report rather than a summary of it.

What the scan could actually read

A grade is only as meaningful as its coverage, so the scanner publishes its own depth before it publishes its result.

The scan read each tool’s name, description, input schema and annotations exactly as the server listed them the last time it answered us; no code was reviewed. We ask the server again about once a month, and a list that changed is graded again.

Tool surfaceread

Implementation sourcenot available

Package metadatanot available

Live transportnot available

The implementation source was not read — this reflects the declared tool metadata only.

Capability — what it could do if the model were manipulated

Tags derived from each tool’s schema and the implementation, not from what the tool calls itself. moderate is the level these add up to.

Tool	Capability tags	Why the tag was assigned
report_to_office	state-write	state-write: declares readOnlyHint: false
verify_connection	no tags
whoami	no tags
list_office_agents	no tags
perform_action	external-sink	external-sink: declares readOnlyHint: false, destructiveHint: true, openWorldHint: true
list_actions	no tags
check_action	no tags
read_messages	untrusted-inputstate-write	untrusted-input: keyword "read_message"; state-write: declares readOnlyHint: false
list_tasks	no tags
create_task	state-write	state-write: declares readOnlyHint: false
claim_task	state-write	state-write: declares readOnlyHint: false
update_task	state-write	state-write: declares readOnlyHint: false
recall	no tags
remember	state-write	state-write: declares readOnlyHint: false
forget	state-write	state-write: declares readOnlyHint: false, destructiveHint: true
mint_bot_links	state-write	state-write: declares readOnlyHint: false
assign_team	state-write	state-write: declares readOnlyHint: false
create_office_code	state-write	state-write: declares readOnlyHint: false
assign_task	external-sinkstate-write	external-sink: keyword "webhook"; state-write: declares readOnlyHint: false
list_routines	no tags
create_routine	state-write	state-write: declares readOnlyHint: false
run_routine	state-write	state-write: declares readOnlyHint: false
add_webhook	external-sink	external-sink: keyword "webhook", declares readOnlyHint: false, openWorldHint: true
list_webhooks	no tags

Toxic-flow graph

The lethal trifecta, checked as a graph rather than as a checklist: untrusted input, a sensitive source and an external sink have to meet before there is a path worth worrying about.

flow-1

Untrusted input can drive an external action even though no sensitive source is exposed.

Supply chain and provenance

Integrityfirst-seen

Surface digestf7162337b3dfe529

Scanned2026-11-04

This is the first scan of this surface here, so there is nothing yet to compare it against.

Every result on this tab comes from one deterministic pass over the published package — offline, rule by rule, and auditable line by line above. Same methodology version, same bytes, same score.

Bot Office MCP

What it does

Quickstart

Where are you running it?

Tool surface

What counts against your monthly calls

What the scan could actually read

Capability — what it could do if the model were manipulated

Toxic-flow graph

Supply chain and provenance

Release history

See also