opentable-fpx

OpenTable via fpx (no MCP)

OpenTable fronts www.opentable.com with Akamai bot protection, and every booking/cancel action rides the user's own signed-in session (their loyalty account, saved cards) — there's no API key and no server-side login. fpx routes requests through the user's own signed-in browser tab (the Transporter extension), which already carries a cleared session, so the same requests the opentable.com web app makes succeed.

This is the same data/actions the opentable_* MCP tools expose, reached with one-shot CLI calls instead of a running server. Every body/header/hash below is transcribed verbatim from opentable-mcp's src/client.ts and src/tools/*.ts — not guessed.

One-time setup

npm install -g @fetchproxy/cli            # provides `fpx`
fpx profile add opentable --domain opentable.com
fpx pair -p opentable                     # prints a pair code → approve in Transporter

Requirements: the Transporter browser extension installed, an open www.opentable.com tab signed in, and its Chrome Site access allowing opentable.com. Pairing persists — after the first approval every later fpx call reuses it.

Core call pattern

Two response families:

• SSR HTML (/s, /r/{slug}, /user/dining-dashboard, /user/favorites, /booking/details) embeds the page's data as a window.__INITIAL_STATE__ = {...} (or "__INITIAL_STATE__":{...}) JSON blob inside the HTML — extract it with references/extract-initial-state.mjs before jq.
• /dapi/... JSON/GraphQL returns plain JSON on stdout — pipe straight to jq.

fpx get 'https://www.opentable.com/r/state-of-confusion-charlotte' -p opentable \
  | node references/extract-initial-state.mjs \
  | jq '.restaurantProfile.restaurant | {id: .restaurantId, name, bookable: (.type != "Listing")}'

Most GraphQL calls here are Apollo persisted queries — you send an operation name + a pre-registered sha256Hash, never GraphQL text. Write the body to a file first (a heredoc avoids shell-quoting the nested JSON), then fpx post-json <url> @file -p opentable.