---
title: "Test an AI booking agent against a sandbox over MCP"
description: "Point your AI agent at a Bookatu sandbox through the MCP server. It books and cancels for made-up clients, and no real client or real money is ever touched."
url: "https://bookatu.com/en-nz/blog/test-an-ai-booking-agent-in-a-sandbox"
language: "en"
section: "Blog"
category: "Grow your business"
author: "The Bookatu team"
published: "2026-10-30"
updated: "2026-10-30"
tags: ["test mcp server", "ai agent booking testing", "mcp sandbox", "test an ai agent", "booking agent test mode"]
---

# Test an AI booking agent against a sandbox over MCP

Point your AI agent at a Bookatu sandbox through the MCP server. It books and cancels for made-up clients, and no real client or real money is ever touched.

> **The short version**
>
> - Connect with a sandbox's test key, or sign in with OAuth and pick the sandbox.
> - The agent gets the same tools and booking rules as at a live business, plus three sandbox tools.
> - Every message it causes stays in the outbox, and payments are simulated.
> - A live business never lists the sandbox tools.

An AI agent that books appointments chooses for itself which tool to call. You want to watch it find a time, book and cancel before it does any of that at a real business. A sandbox gives it somewhere safe to practise, and gives you a way to test an MCP server integration from start to finish.

## Connect your MCP client

The business MCP server has one address for every business: https://bookatu.com/api/mcp. A credential reaches only its own business, so a sandbox's test key reaches that sandbox and nothing else. Send the key as a Bearer token, and send Bookatu-Livemode: false where your client allows it, so a live key pasted in by mistake is refused before anything runs.

```http
POST https://bookatu.com/api/mcp
Authorization: Bearer bk_test_YOUR_KEY
Bookatu-Livemode: false
Content-Type: application/json
MCP-Protocol-Version: 2025-06-18

{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}
```

With OAuth, the client signs in instead, and Bookatu's consent page lists your sandboxes marked (test). Claude Desktop adds the server as a custom connector, Cursor reads it from its MCP config file, and the MCP Inspector calls each tool by hand. Our developer guide Test your AI agent has the setup for each.

## The three sandbox tools

- sandbox_outbox reads every message the sandbox kept instead of sending, newest first. It needs customers:read.
- sandbox_simulate makes one event happen to one booking: a deposit paid, a card declined, a checkout abandoned, the client cancelling, a no-show, or reminders coming due.
- sandbox_reset wipes the sandbox and puts the sample data back. It takes the sandbox's own test key, never a connected app.

They appear in tools/list only at a sandbox. At a live business each name is an unknown tool, so its tool list stays exactly as it was.

## A test run, start to finish

1. **Find a time.** Ask for a haircut slot on Tuesday afternoon. The agent should call list_services and get_availability, and answer on the business's clock.
2. **Book it.** Ask it to book Mia, with an email at example.com. create_booking answers a ref and an appointmentId.
3. **Check what she was sent.** sandbox_outbox shows the confirmation that would have gone out.
4. **Cancel it.** cancel_booking cancels as the business, and the client is sent no message about it. If your agent says she was told, you have found a bug.
5. **Start again.** Ask it to reset the sandbox. A good agent asks you first.

To test a client's own cancellation, use sandbox_simulate with booking.client_cancelled. It emails her a notice, kept in the outbox, only when Email clients when they cancel online is on in the sandbox's settings. That setting starts off.

## Read livemode and the refusals

At a sandbox, every answer carries the Bookatu-Livemode header, set to false. Every tool result, a refusal included, says livemode in its _meta, and a successful one says it in structuredContent too. A refusal comes back with its code, such as APPOINTMENT_NOT_FOUND for a booking that is not the sandbox's, or NO_OPEN_CHECKOUT when deposit.paid finds no open test checkout. A good agent reads the code and tries something else.

## Questions owners ask

### Can an agent tested in a sandbox touch my real business?

Not with its test credential, which reaches its own sandbox only. To work on your business, it needs a live key or a connection you approve.

### Will my clients get test messages?

No. A sandbox's clients are made up, and its messages are kept, never sent.

### Will the sandbox tools show up at my business?

No. They exist only at a sandbox, and your business's tool list stays as it was.

## Where to start

Make a sandbox, connect your client with its test key and run the five steps above. When the agent behaves, our developer guide Going live covers the switch to a live key.