AgentRoam
REMOTE · AGENTROAM.AI · SCANNED SEP 21
Buy travel eSIMs, gift cards and mobile top-ups with crypto — user confirms before any order.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security63
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation check failed: no authorisation is required to call this server, and it exposes a tool marked destructive (create_order). See how to fix → View diagnostics → Fail
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability86
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (excellent).Pass
- Tool/resource definitions use about 1402 tokens (~100/item across 14 items; 11 tools + 3 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage98
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 94% of tool parameters carry a description.Partial
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 11 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 13 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities60
- Spec-recency check failed: implements MCP spec 2025-03-26; the latest is 2026-07-28. See how to fix → Fail
- Supports UI / widget rendering.Pass
How do I install the AgentRoam MCP server?
AgentRoam is a hosted endpoint at https://agentroam.ai/api/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · agentroam.ai
claude mcp add --transport http ai-agentroam-agentroam 'https://agentroam.ai/api/mcp'
{
"mcpServers": {
"ai-agentroam-agentroam": {
"url": "https://agentroam.ai/api/mcp"
}
}
} {
"servers": {
"ai-agentroam-agentroam": {
"type": "http",
"url": "https://agentroam.ai/api/mcp"
}
}
} [mcp_servers.ai-agentroam-agentroam] url = "https://agentroam.ai/api/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"ai-agentroam-agentroam": {
"type": "remote",
"url": "https://agentroam.ai/api/mcp",
"enabled": true
}
}
} openclaw mcp add ai-agentroam-agentroam --url 'https://agentroam.ai/api/mcp' --transport streamable-http
mcp_servers:
ai-agentroam-agentroam:
url: "https://agentroam.ai/api/mcp" {
"McpServers": {
"ai-agentroam-agentroam": {
"Transport": "http",
"Url": "https://agentroam.ai/api/mcp"
}
}
} assistant mcp add ai-agentroam-agentroam -t streamable-http -u 'https://agentroam.ai/api/mcp'
{
"mcpServers": {
"ai-agentroam-agentroam": {
"type": "http",
"url": "https://agentroam.ai/api/mcp"
}
}
} The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 21 Sept 26 0
- Stability: 0.97 → pass security
- 20 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
- 18 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 87 to 90. That category is still filling its 30-day observation window: 26 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.
- 16 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.
- 14 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 73 to 77. That category is still filling its 30-day observation window: 22 days of observed history at the previous scan, 23 at this one. The score rises as the window fills, whether or not the server changes.
- 12 Sept 26 +1
- Tool “create_order” changed its title: Place order cosmetic
- Tool “get_currencies” changed its title: List payment coins cosmetic
- Tool “get_order_status” changed its title: Check order status cosmetic
- Tool “get_payment_methods” changed its title: List payment networks cosmetic
- Tool “get_price” changed its title: Get crypto price cosmetic
- Tool “list_brands” changed its title: List brands by country cosmetic
- Tool “list_esim_plans” changed its title: List eSIM plans cosmetic
- Tool “list_products” changed its title: List brand products cosmetic
- Tool “purchase_wizard” changed its title: Guided purchase (text) cosmetic
- Tool “search_products” changed its title: Search catalog cosmetic
- Tool “validate_order” changed its title: Prepare order for approval cosmetic
11 cosmetic changes on this day. Switch on “Show cosmetic changes” to see them.
- 10 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 60 to 63. That category is still filling its 30-day observation window: 18 days of observed history at the previous scan, 19 at this one. The score rises as the window fills, whether or not the server changes.
- 8 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 53 to 57. That category is still filling its 30-day observation window: 16 days of observed history at the previous scan, 17 at this one. The score rises as the window fills, whether or not the server changes.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 21 Sept 2026 · Probed https://agentroam.ai/api/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=agentroam.ai | CN=YE1,O=Let's Encrypt,C=US | 5 Sept 2026 | 4 Dec 2026 | ECDSA 256 | ECDSA-SHA384 | 692edc160c20418f0161e80503d8a3fcee4 |
| SANs: agentroam.ai, www.agentroam.ai | ||||||
| CN=YE1,O=Let's Encrypt,C=US (CA) | CN=Root YE,O=ISRG,C=US | 3 Sept 2025 | 2 Sept 2028 | ECDSA 384 | ECDSA-SHA384 | 5ddd70dd31f801c85c186a7a04b80afe |
| CN=Root YE,O=ISRG,C=US (CA) | CN=ISRG Root X2,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | ECDSA-SHA384 | 872165fc34b6e5fba8add5b3705fb53a |
| CN=ISRG Root X2,O=Internet Security Research Group,C=US (CA) | CN=ISRG Root X1,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | SHA256-RSA | 6c8f1dc727c7117f7baf853ac980f9cd |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of agentroam.ai. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| ai. | present | 3799 | 8 | Verified |
| agentroam.ai. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
| Header | Value |
|---|---|
| strict-transport-security | max-age=31536000 |
| x-content-type-options | nosniff |
| x-frame-options | SAMEORIGIN |
| referrer-policy | strict-origin-when-cross-origin |
| permissions-policy | camera=(), microphone=(), geolocation=() |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://agentroam.ai/api/mcp | Verified | 200 | |
| http (plaintext) | http://agentroam.ai/api/mcp | HTTPS enforced | 301 | https://agentroam.ai/api/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
create_order Place order ~109
Create the real order (requires confirm_token from validate_order, after user approval). Returns the payment wallet address, exact crypto amount, 30-minute expiry, and an order-status URL. The purchased code/QR is emailed by Cryptorefills to the buyer — it is never returned here.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm_token | string | yes | One-time token returned by validate_order (valid 10 minutes) |
| full_name | string | – | Buyer full legal name — only if a previous attempt returned FULLNAME_MISSING |
| Name | Type | Req | Description |
|---|---|---|---|
| coin | string | – | – |
| error | string | – | Present on failure: KYC_MISSING | FULLNAME_MISSING | PHONE_MISSING | CONFIRM_TOKEN_* |
| external_order_id | string | – | – |
| instructions | string | – | – |
| kyc_url | string | – | Hosted verification link when error=KYC_MISSING |
| network | string | – | Exact network — funds sent elsewhere are lost |
| network_label | string | – | – |
| pay_amount | number | – | EXACT amount to send |
| pay_to_address | string | – | Wallet address to send funds to |
| payment_expires_at | string | – | ISO timestamp; 30-minute window |
| payment_url | string | – | Payment page with QR |
| qr_url | string | – | QR code PNG of the address |
| state | string | – | CREATED | WAITING_FOR_PAYMENT | PARTIAL | COMPLETED | CANCELED | EXPIRED |
| status_token | string | – | – |
| status_url | string | – | Live order-status page |
No examples provided.
get_currencies List payment coins ~22
List all supported payment cryptocurrencies (the response carries the current set).
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| currencies | array | yes | – |
No examples provided.
get_order_status Check order status ~63
Poll order state (WAITING_FOR_PAYMENT → PARTIAL → COMPLETED, or CANCELED/EXPIRED). Requires the status_token from create_order.
| Name | Type | Req | Description |
|---|---|---|---|
| external_order_id | string | yes | – |
| status_token | string | yes | statusToken returned by create_order |
| Name | Type | Req | Description |
|---|---|---|---|
| brand | string | – | – |
| coin | string | – | – |
| denomination | string | – | – |
| error | string | – | not_found when id/token mismatch |
| external_order_id | string | – | – |
| network | string | – | – |
| payment_expires_at | string | – | – |
| state | string | – | WAITING_FOR_PAYMENT | PARTIAL | COMPLETED | CANCELED | EXPIRED | REFUNDED |
| status_url | string | – | – |
No examples provided.
get_payment_methods List payment networks ~45
Full payment matrix: every supported coin × network combination currently available, with the exact network strings orders require. The response includes live totals — report those, never a memorized count.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| combinations | array | yes | – |
| payment_via | string | – | – |
No examples provided.
get_price Get crypto price ~215
Live crypto price for one product/denomination. Payment coins include USDT, USDC, BTC (incl. Lightning), ETH, SOL, DAI, PYUSD, LTC, TRX, TON, DOGE and SUI across many networks — call get_payment_methods for the current list. Never creates an order.
| Name | Type | Req | Description |
|---|---|---|---|
| amount_usd | number | yes | USD amount (for dynamic-range products) |
| brand_slug | string | yes | brandSlug from search_products |
| coin | string | yes | Payment coin, e.g. USDC, USDT, BTC, SOL |
| country_code | string | yes | countryCode from search_products |
| denomination_label | string | yes | Exact denomination label (e.g. "100 USD", "60 UC", "1 GB 7 days") |
| dynamic | boolean | yes | true for dynamic-range amounts, false for fixed denomination labels |
| network | string | yes | Exact network string from get_price/networks, e.g. "Solana", "Tron", "ETH Mainnet" |
| Name | Type | Req | Description |
|---|---|---|---|
| coin | string | yes | – |
| estimate | boolean | – | true = indicative only; exact amount fixed at order creation |
| faceValueUsd | number | – | – |
| feePct | number | – | Fee percent over USD face value (0 for volatile coins) |
| network | string | yes | – |
| payAmount | number | yes | Amount to pay in the chosen coin |
No examples provided.
list_brands List brands by country ~73
Browse all available brands/carriers for a country: gift cards (500+ US brands) and mobile top-up carriers (100+ countries). Never creates an order.
| Name | Type | Req | Description |
|---|---|---|---|
| country_code | string | yes | ISO country code, e.g. "us", "mx" |
| kind | string | – | Filter by product type |
| Name | Type | Req | Description |
|---|---|---|---|
| brands | array | – | – |
| count | number | – | – |
| country | string | – | – |
No examples provided.
list_esim_plans List eSIM plans ~134
PREFERRED for any eSIM request: live eSIM data plans for a destination (110+ countries, plus "eu" Europe and "ww" Global multi-country plans) with USD prices and crypto amounts. Renders an interactive plan-picker widget where the user can complete the purchase directly. Never creates an order by itself.
| Name | Type | Req | Description |
|---|---|---|---|
| coin | string | – | Coin for live pricing (default USDC) |
| destination | string | yes | Destination: 2-letter country code (e.g. "il", "jp", "fr"), or "eu" (Europe region plan) / "ww" (Global plan) |
| Name | Type | Req | Description |
|---|---|---|---|
| brand | string | – | – |
| coin | string | – | – |
| country | string | – | Destination code — pass as country_code to validate_order |
| destination_name | string | – | – |
| error | string | – | – |
| flag | string | – | – |
| products | array | – | – |
| url | string | – | – |
No examples provided.
list_products List brand products ~90
List a brand's live products/denominations with prices in the chosen coin — exact labels to use with get_price/validate_order (for eSIM use list_esim_plans instead). Never creates an order.
| Name | Type | Req | Description |
|---|---|---|---|
| brand_slug | string | yes | brandSlug from list_brands/search_products |
| coin | string | – | Coin for live pricing (default USDC) |
| country_code | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| brand | string | – | – |
| brand_slug | string | – | – |
| coin | string | – | – |
| country | string | – | – |
| country_name | string | – | – |
| destination_name | string | – | – |
| error | string | – | product_not_found |
| flag | string | – | – |
| is_esim | boolean | – | – |
| kind | string | – | giftcard | esim | topup |
| logoUrl | string | – | – |
| products | array | – | – |
| url | string | – | Product page on the AgentRoam site |
No examples provided.
purchase_wizard Guided purchase (text) ~134
Text-only fallback purchase flow for clients WITHOUT widget support. In ChatGPT prefer list_esim_plans / list_products + validate_order + create_order instead. Stateful: call repeatedly with the same session_token, answering one question at a time, until status is "complete". First call: empty arguments. The final "confirm" answer creates a REAL order — get explicit user approval first.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | – | "back" to return to the previous step |
| answer | string | – | Answer to the current question |
| session_token | string | – | Omit on the first call — a new session is minted |
| Name | Type | Req | Description |
|---|---|---|---|
| error | string | – | – |
| hint | string | – | – |
| options | array | – | – |
| question | string | – | Ask the user this |
| result | object | – | – |
| session_token | string | yes | Pass back on every call of this session |
| status | string | yes | in_progress | complete | error |
| step | string | – | – |
| summary | string | – | – |
No examples provided.
search_products Search catalog ~123
Search the AgentRoam travel-crypto catalog: gift cards (Airbnb, Uber, airlines, 500+ US brands), eSIM data plans (110+ destinations incl. Europe/Global region plans) and mobile top-ups (carriers in 100+ countries). Returns product handles for get_price/validate_order. Never creates an order.
| Name | Type | Req | Description |
|---|---|---|---|
| country | string | – | ISO country code filter (e.g. "us", "mx") |
| kind | string | – | Product type filter |
| query | string | yes | Brand, carrier or destination to search for |
| Name | Type | Req | Description |
|---|---|---|---|
| hint | string | – | – |
| results | array | – | – |
No examples provided.
validate_order Prepare order for approval ~229
Dry-run an order and mint a one-time confirm_token (valid 10 minutes). Returns a human-readable summary that MUST be shown to the user for approval before calling create_order. Does NOT create the order or reserve funds.
| Name | Type | Req | Description |
|---|---|---|---|
| amount_usd | number | yes | USD amount (for dynamic-range products) |
| brand_slug | string | yes | brandSlug from search_products |
| coin | string | yes | Payment coin, e.g. USDC, USDT, BTC, SOL |
| country_code | string | yes | countryCode from search_products |
| denomination_label | string | yes | Exact denomination label (e.g. "100 USD", "60 UC", "1 GB 7 days") |
| dynamic | boolean | yes | true for dynamic-range amounts, false for fixed denomination labels |
| string | yes | Delivery email for the buyer | |
| network | string | yes | Exact network string from get_price/networks, e.g. "Solana", "Tron", "ETH Mainnet" |
| phone | string | – | Phone number to recharge (REQUIRED for mobile top-ups, with country code) |
| Name | Type | Req | Description |
|---|---|---|---|
| confirm_token | string | – | One-time token for create_order, valid 10 minutes |
| error | string | – | product_not_found | out_of_stock | PHONE_MISSING |
| expires_in_seconds | number | – | – |
| instructions | string | – | – |
| message | string | – | – |
| price | object | – | – |
| summary | string | – | Human-readable purchase summary — show to the user for approval |
| valid | boolean | – | – |
No examples provided.
What is the AgentRoam MCP server?
AgentRoam is an MCP server listed in the public MCP registry as ai.agentroam/agentroam. Buy travel eSIMs, gift cards and mobile top-ups with crypto, user confirms before any order. This page covers its hosted endpoint (https://agentroam.ai/api/mcp).
Is the AgentRoam MCP server safe to use?
AgentRoam scores 81 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the AgentRoam MCP server expose?
AgentRoam exposes 11 tools: search_products, get_price, validate_order, create_order, list_esim_plans, and 6 more. Their descriptions and schemas cost roughly 1,237 tokens of context every time the server is loaded.
Does the AgentRoam MCP server require authentication?
No. We connected to AgentRoam without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the AgentRoam MCP server still maintained?
AgentRoam is still listed as active in the MCP registry. We last reached this channel on 21 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.