CCAPI
REMOTE · API.CCAPI.AI · SCANNED SEP 20
Image, video, music and text generation across 100+ models through one endpoint.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security89
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation is enforced on tool calls, but the challenge carries no valid RFC 9728 metadata, so a client cannot discover where to get a token. See how to fix → View diagnostics → Fail
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability65
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 2845 tokens (~258/item across 11 items; 11 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "chat_completion" implies "send" and declares readOnlyHint instead, contradicting what its own name says it does. See how to fix → Fail
- An AI judge read all 12 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the CCAPI MCP server?
CCAPI is a hosted endpoint at https://api.ccapi.ai/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · api.ccapi.ai
claude mcp add --transport http ai-ccapi-mcp 'https://api.ccapi.ai/mcp'
{
"mcpServers": {
"ai-ccapi-mcp": {
"url": "https://api.ccapi.ai/mcp"
}
}
} {
"servers": {
"ai-ccapi-mcp": {
"type": "http",
"url": "https://api.ccapi.ai/mcp"
}
}
} [mcp_servers.ai-ccapi-mcp] url = "https://api.ccapi.ai/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"ai-ccapi-mcp": {
"type": "remote",
"url": "https://api.ccapi.ai/mcp",
"enabled": true
}
}
} openclaw mcp add ai-ccapi-mcp --url 'https://api.ccapi.ai/mcp' --transport streamable-http
mcp_servers:
ai-ccapi-mcp:
url: "https://api.ccapi.ai/mcp" {
"McpServers": {
"ai-ccapi-mcp": {
"Transport": "http",
"Url": "https://api.ccapi.ai/mcp"
}
}
} assistant mcp add ai-ccapi-mcp -t streamable-http -u 'https://api.ccapi.ai/mcp'
{
"mcpServers": {
"ai-ccapi-mcp": {
"type": "http",
"url": "https://api.ccapi.ai/mcp"
}
}
} The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 0
- Server version: 20260918-2fccb96 → 20260919-ae963de functional
- 19 Sept 26 0
- Server version: 20260916-5cbdca8 → 20260918-2fccb96 functional
- 17 Sept 26 0
- Server version: 20260914-a370a01 → 20260916-5cbdca8 functional
- 15 Sept 26 0
- Server version: 20260912-127289c → 20260914-a370a01 functional
- 13 Sept 26 0
- Server version: 20260901-d10ff95 → 20260912-127289c functional
- 2 Sept 26 0
- Server version: 20260901-654a94c → 20260901-d10ff95 functional
- 1 Sept 26 +1
- Stability: 0.97 → pass security
- Server version: 20260829-e8b9e49 → 20260901-654a94c functional
- 30 Aug 26 +1
- Server version: 20260825-34aec5f → 20260829-e8b9e49 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Probed https://api.ccapi.ai/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_256_GCM_SHA384 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=ccapi.ai | CN=YR1,O=Let's Encrypt,C=US | 11 Sept 2026 | 10 Dec 2026 | RSA 2048 | SHA256-RSA | 64d2789b11c140bd568d786fb6aa69e35ba |
| SANs: api.ccapi.ai, ccapi.ai | ||||||
| CN=YR1,O=Let's Encrypt,C=US (CA) | CN=Root YR,O=ISRG,C=US | 3 Sept 2025 | 2 Sept 2028 | RSA 2048 | SHA256-RSA | a20253f15f2691c05dc1ce13b9bcca4e |
| CN=Root YR,O=ISRG,C=US (CA) | CN=ISRG Root X1,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | RSA 4096 | SHA256-RSA | f24b6d17f9d9ad7cb1c9fea78782699f |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of api.ccapi.ai. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| ai. | present | 3799 | 8 | Verified |
| ccapi.ai. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication Challenged, unverified
The endpoint asked for a token, but we could not retrieve and validate the RFC 9728 metadata that tells a client how to obtain one.
| Result | Challenged, unverified |
|---|---|
| Enforced | On tool calls |
| HTTP status | 200 |
| Header | Value |
|---|---|
| strict-transport-security | max-age=31536000; includeSubDomains |
Protected resource metadata
| Retrieved | No |
|---|---|
| Problem | no_resource_metadata |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://api.ccapi.ai/mcp | Verified | 200 | |
| http (plaintext) | http://api.ccapi.ai/mcp | HTTPS enforced | 308 | https://api.ccapi.ai/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
chat_completion Call a text model ~231
Send a conversation to any text model available through CCAPI (Claude, GPT, Gemini, DeepSeek, GLM, MiniMax, Kimi, Qwen…) and get the reply. Useful for consulting a second model for a different perspective, running a cheap model over bulk work, or reaching a model the current client does not have configured. Responses are non-streaming.
| Name | Type | Req | Description |
|---|---|---|---|
| max_tokens | null|integer | – | Maximum tokens to generate. Omit for the model default. |
| messages | null|array | yes | Conversation so far, oldest first. Must contain at least one message. |
| model | string | yes | Exact model name, e.g. claude-sonnet-5 or deepseek-v4-pro. Call list_models with category 'text' if unsure. |
| stop | null|array | – | Up to 4 sequences that stop generation. |
| temperature | null|number | – | Sampling temperature, typically 0-2. Omit for the model default. |
| top_p | null|number | – | Nucleus sampling probability mass, 0-1. Omit for the model default. |
| Name | Type | Req | Description |
|---|---|---|---|
| content | string | yes | The model's reply text. |
| finish_reason | string | – | Why generation stopped, e.g. stop or length. |
| model | string | yes | Model that actually served the request. |
| usage | object | yes | Token accounting for this call. |
No examples provided.
edit_image Edit an image ~398
Edit existing images according to an instruction, using the dedicated image edit endpoint. Provide at least one source image. For pure text-to-image, or for models that take references through the generation endpoint, use generate_image instead.
| Name | Type | Req | Description |
|---|---|---|---|
| aspect_ratio | string | – | Z-Image only: required output aspect ratio. Supported values: 1:1, 4:3, 3:4, 16:9, 9:16. |
| async | boolean | – | Submit asynchronously and return a task_id instead of waiting. Use when the client times out on slow models; poll with get_task using platform 'image'. |
| images | null|array | – | Optional reference images as HTTPS URLs or data URLs, for image-to-image generation. Not all models accept references. |
| model | string | yes | Exact model name, e.g. gpt-image-2 or nano-banana-pro. Call list_models with category 'image' if unsure. |
| n | null|integer | – | How many images to generate. Defaults to 1. Each one is billed. |
| nsfw_checker | null|boolean | – | Z-Image only: enable or disable the upstream NSFW checker. Explicit false is preserved. |
| prompt | string | yes | Description of the image to generate. |
| quality | string | – | Quality hint, e.g. low, medium, high or auto. Model-dependent. |
| response_format | string | – | 'url' (default) returns links; 'b64_json' returns base64 data, which is far larger and usually unnecessary. |
| size | string | – | Output size, e.g. 1024x1024, 1536x1024, or 'auto'. Model-dependent; omit for the model default. |
| wait_seconds | null|integer | – | Only with async: poll server-side for up to this many seconds (max 240) and return the finished image if it completes in time. |
| Name | Type | Req | Description |
|---|---|---|---|
| images | null|array | – | Generated images, when the call completed. |
| model | string | yes | Model that served the request. |
| note | string | – | What to do next. |
| platform | string | – | Pass this to get_task together with task_id. |
| status | string | yes | One of: completed, queued, in_progress, failed. |
| task_id | string | – | Task identifier, when submitted asynchronously and still running. |
No examples provided.
extend_music Extend a song ~182
Continue an existing song from a given timestamp, producing a longer version. Requires the clip_id of a previously generated song, which appears in the 'raw' payload of a completed generate_music task. Asynchronous — poll with get_task.
| Name | Type | Req | Description |
|---|---|---|---|
| clip_id | string | yes | ID of the song to extend, taken from the 'raw' clip list of a completed generate_music task. |
| continue_at | number | yes | Timestamp in seconds within the original song to continue from. |
| prompt | string | – | Lyrics for the extended section. |
| provider | string | – | Music backend: 'suno' (default) or 'producer'. |
| tags | string | – | Style tags for the extension. |
| title | string | – | New title for the extended song. |
| wait_seconds | null|integer | – | Poll server-side for up to this many seconds (max 240). |
| Name | Type | Req | Description |
|---|---|---|---|
| audio_urls | null|array | – | Finished audio URLs, when the task completed within wait_seconds. |
| note | string | yes | What to do next. |
| platform | string | yes | 'suno' or 'producer'. Pass to get_task. |
| raw | – | – | Full result payload when completed — clip IDs, lyrics text and per-clip metadata. Clip IDs from here are what extend_music takes. |
| status | string | yes | One of: queued, in_progress, completed, failed. |
| task_id | string | yes | Pass this to get_task together with platform to check progress. |
No examples provided.
generate_image Generate an image ~418
Generate an image from a text prompt, optionally guided by reference images (image-to-image). Returns image URLs directly. Most models finish in 10-60 seconds; if your client times out, set async=true to get a task_id you can poll instead. This call costs money — do not retry speculatively.
| Name | Type | Req | Description |
|---|---|---|---|
| aspect_ratio | string | – | Z-Image only: required output aspect ratio. Supported values: 1:1, 4:3, 3:4, 16:9, 9:16. |
| async | boolean | – | Submit asynchronously and return a task_id instead of waiting. Use when the client times out on slow models; poll with get_task using platform 'image'. |
| images | null|array | – | Optional reference images as HTTPS URLs or data URLs, for image-to-image generation. Not all models accept references. |
| model | string | yes | Exact model name, e.g. gpt-image-2 or nano-banana-pro. Call list_models with category 'image' if unsure. |
| n | null|integer | – | How many images to generate. Defaults to 1. Each one is billed. |
| nsfw_checker | null|boolean | – | Z-Image only: enable or disable the upstream NSFW checker. Explicit false is preserved. |
| prompt | string | yes | Description of the image to generate. |
| quality | string | – | Quality hint, e.g. low, medium, high or auto. Model-dependent. |
| response_format | string | – | 'url' (default) returns links; 'b64_json' returns base64 data, which is far larger and usually unnecessary. |
| size | string | – | Output size, e.g. 1024x1024, 1536x1024, or 'auto'. Model-dependent; omit for the model default. |
| wait_seconds | null|integer | – | Only with async: poll server-side for up to this many seconds (max 240) and return the finished image if it completes in time. |
| Name | Type | Req | Description |
|---|---|---|---|
| images | null|array | – | Generated images, when the call completed. |
| model | string | yes | Model that served the request. |
| note | string | – | What to do next. |
| platform | string | – | Pass this to get_task together with task_id. |
| status | string | yes | One of: completed, queued, in_progress, failed. |
| task_id | string | – | Task identifier, when submitted asynchronously and still running. |
No examples provided.
generate_lyrics Generate lyrics ~147
Write song lyrics from a description, without generating audio. Useful as a first step before generate_music with custom=true, so the user can approve the words before paying for audio. Asynchronous — poll with get_task.
| Name | Type | Req | Description |
|---|---|---|---|
| lyrics_model | string | – | Lyrics model: classic or remi. |
| prompt | string | yes | Description of the lyrics to write, e.g. 'a love song about meeting someone at a coffee shop'. |
| provider | string | – | Music backend: 'suno' (default) or 'producer'. |
| wait_seconds | null|integer | – | Poll server-side for up to this many seconds (max 240). Lyrics usually finish in under 30 seconds. |
| Name | Type | Req | Description |
|---|---|---|---|
| audio_urls | null|array | – | Finished audio URLs, when the task completed within wait_seconds. |
| note | string | yes | What to do next. |
| platform | string | yes | 'suno' or 'producer'. Pass to get_task. |
| raw | – | – | Full result payload when completed — clip IDs, lyrics text and per-clip metadata. Clip IDs from here are what extend_music takes. |
| status | string | yes | One of: queued, in_progress, completed, failed. |
| task_id | string | yes | Pass this to get_task together with platform to check progress. |
No examples provided.
generate_music Generate a song ~338
Generate a song with vocals or instrumental. Two modes: simple (custom=false) where you describe the song and the model writes the lyrics, or custom (custom=true) where you supply lyrics, title and style tags. Asynchronous — returns a task_id you poll with get_task; generation usually takes 30-120 seconds and normally yields two variations.
| Name | Type | Req | Description |
|---|---|---|---|
| custom | boolean | – | false (default) lets the model write the lyrics from your description; true means prompt contains lyrics you wrote and you should also set title and tags. |
| instrumental | boolean | – | Generate without vocals. |
| model | string | – | Suno model version, e.g. chirp-v5 or chirp-v4-5-plus. Omit for the platform default. |
| negative_tags | string | – | Styles to avoid, e.g. 'heavy metal, rap'. |
| prompt | string | yes | In simple mode (custom=false) a description of the song, e.g. 'a dreamy lo-fi track about late-night trains'. In custom mode (custom=true) the actual lyrics, with section markers like [Verse] and [Ch… |
| provider | string | – | Music backend: 'suno' (default) or 'producer'. |
| tags | string | – | Comma-separated style tags, e.g. 'pop, upbeat, guitar'. Max 200 characters. |
| title | string | – | Song title. Used in custom mode. |
| wait_seconds | null|integer | – | Poll server-side for up to this many seconds (max 240) and return finished audio if it completes in time. Omit to return a task_id immediately. |
| Name | Type | Req | Description |
|---|---|---|---|
| audio_urls | null|array | – | Finished audio URLs, when the task completed within wait_seconds. |
| note | string | yes | What to do next. |
| platform | string | yes | 'suno' or 'producer'. Pass to get_task. |
| raw | – | – | Full result payload when completed — clip IDs, lyrics text and per-clip metadata. Clip IDs from here are what extend_music takes. |
| status | string | yes | One of: queued, in_progress, completed, failed. |
| task_id | string | yes | Pass this to get_task together with platform to check progress. |
No examples provided.
generate_video Generate a video ~458
Generate a video from a text prompt, optionally driven by reference images (image-to-video, first/last frame). This is asynchronous: it returns a task_id you poll with get_task(platform='video'). Generation usually takes 30-180 seconds. Pass wait_seconds to have the server poll for you. Video generation is the most expensive capability here — confirm the prompt with the user before spending on retries.
| Name | Type | Req | Description |
|---|---|---|---|
| audios | null|array | – | Optional Seedance reference audio URLs or asset:// URIs returned by the trusted asset catalog. Reference audio cannot be used alone. |
| duration | null|integer | – | Clip length in seconds. Model-dependent, typically 4-15; an unsupported value is rejected with a message naming the supported ones. Omit for the model default. |
| generate_audio | null|boolean | – | Generate a synchronised soundtrack. Only some models support this. |
| image_roles | null|array | – | Role of each entry in images, positionally: first_frame, last_frame or reference_image. |
| images | null|array | – | Optional reference image URLs. A single image is used as the first frame; use image_roles to control multiple. |
| model | string | yes | Exact model name, e.g. doubao-seedance-2-0-260128, veo-3.1-quality or viduq3-pro. Call list_models with category 'video' if unsure. |
| prompt | string | yes | Description of the video to generate. |
| ratio | string | – | Aspect ratio, e.g. 16:9, 9:16, 1:1, 21:9 or adaptive. Which values a model accepts varies; an unsupported one is rejected with a message naming the valid ones. |
| resolution | string | – | Output resolution: 480p, 720p (widest compatibility) or 1080p. Model-dependent. |
| videos | null|array | – | Optional Seedance reference video URLs or asset:// URIs returned by the trusted asset catalog. |
| wait_seconds | null|integer | – | Poll server-side for up to this many seconds (max 240) and return the finished video if it completes in time. Omit to return a task_id immediately. |
| Name | Type | Req | Description |
|---|---|---|---|
| model | string | yes | Model that accepted the request. |
| note | string | yes | What to do next. |
| platform | string | yes | Always 'video'. Pass to get_task. |
| status | string | yes | One of: queued, in_progress, completed, failed. |
| task_id | string | yes | Pass this to get_task together with platform to check progress. |
| video_urls | null|array | – | Finished video URLs, when the task completed within wait_seconds. |
No examples provided.
get_balance Get account balance ~39
Report the remaining and used balance for this CCAPI key. Useful before starting an expensive batch of generations, or to explain a quota failure to the user.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| currency | string | yes | Unit of the amounts above, e.g. USD. |
| note | string | – | Guidance when the balance is low, unlimited, or scoped to a token. |
| remaining_amount | number | – | Remaining balance, in the account's display currency. Omitted when unlimited. |
| total_amount | number | – | Remaining plus used. Omitted when unlimited. |
| unlimited | boolean | yes | True when this token has no spending cap, in which case the amount fields are not meaningful. |
| used_amount | number | yes | Balance consumed to date, in the same unit. |
No examples provided.
get_task Check an async task ~166
Check the status of an asynchronous generation task submitted by generate_video, generate_music, generate_lyrics, extend_music, or generate_image with async=true. Pass the platform and task_id exactly as they were returned. Status is one of queued, in_progress, completed or failed; poll every few seconds until it settles, or pass wait_seconds to have the server wait for you.
| Name | Type | Req | Description |
|---|---|---|---|
| platform | string | yes | Platform the task belongs to, exactly as returned by the submit tool: image, video, suno or producer. |
| task_id | string | yes | Task identifier returned by the submit tool. |
| wait_seconds | null|integer | – | Poll server-side for up to this many seconds (max 240) and return once the task finishes. Omit for a single immediate status check. |
| Name | Type | Req | Description |
|---|---|---|---|
| fail_reason | string | – | Why the task failed, when status is failed. |
| note | string | – | What to do next. |
| platform | string | yes | Platform the task belongs to. |
| progress | string | – | Progress indication, when the backend reports one. |
| raw | – | – | Backend payload, for details this summary does not cover (lyrics text, per-clip metadata, seeds). |
| result_urls | null|array | – | Finished asset URLs. May expire; download anything worth keeping. |
| status | string | yes | One of: queued, in_progress, completed, failed, unknown. |
| task_id | string | yes | The task this status refers to. |
No examples provided.
list_models List available models ~128
List the AI models this CCAPI key can actually call, with their capability category and the MCP tool that drives them. Call this before generating anything if you are unsure a model name is valid — availability depends on the key's group and changes over time. Never guess model names.
| Name | Type | Req | Description |
|---|---|---|---|
| category | string | – | Filter by capability. One of: text, image, video, music, embedding, other. Omit to list every model this key can use. |
| search | string | – | Case-insensitive substring match on the model name, e.g. 'claude' or 'seedance'. |
| Name | Type | Req | Description |
|---|---|---|---|
| models | null|array | yes | Models available to the calling key. |
| note | string | – | Guidance about the result set. |
| total | integer | yes | Number of models returned. |
No examples provided.
upscale_image Upscale an image ~145
Increase the resolution of an existing image 2x with ccapi-upscale-v1. Input must be between 256x256 and 1024x1024 and under 5 MB; for larger inputs, regenerate with a high-resolution model instead.
| Name | Type | Req | Description |
|---|---|---|---|
| image | string | yes | The image to upscale, as an HTTPS URL, data URL, or raw base64. Width and height must each be 256-1024 px and the file at most 5 MB. |
| model_quality | string | – | Upscale quality hint: HQ, MQ (default) or LQ. |
| response_format | string | – | 'url' (default) or 'b64_json'. |
| Name | Type | Req | Description |
|---|---|---|---|
| images | null|array | – | Generated images, when the call completed. |
| model | string | yes | Model that served the request. |
| note | string | – | What to do next. |
| platform | string | – | Pass this to get_task together with task_id. |
| status | string | yes | One of: completed, queued, in_progress, failed. |
| task_id | string | – | Task identifier, when submitted asynchronously and still running. |
No examples provided.
What is the CCAPI MCP server?
CCAPI is an MCP server listed in the public MCP registry as ai.ccapi/mcp. Image, video, music and text generation across 100+ models through one endpoint. This page covers its hosted endpoint (https://api.ccapi.ai/mcp).
Is the CCAPI MCP server safe to use?
CCAPI scores 88 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the CCAPI MCP server expose?
CCAPI exposes 11 tools: chat_completion, edit_image, extend_music, generate_image, generate_lyrics, and 6 more. Their descriptions and schemas cost roughly 2,650 tokens of context every time the server is loaded.
Does the CCAPI MCP server require authentication?
Yes. CCAPI asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.
Is the CCAPI MCP server still maintained?
CCAPI is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.