Daystruct
REMOTE · API.DAYSTRUCT.AI · SCANNED OCT 4
Find source-package workflows, inspect live prices and evidence, and connect with a scoped key.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security74
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- No authorisation is required to call this server. Every tool declares its destructiveHint and none is destructive, so open access doesn't expose one. See how to fix → View diagnostics → Partial
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability65
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 2677 tokens (~116/item across 23 items; 23 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management83
- Stability observed for 25 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage67
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 0% of tool parameters carry a description.Fail
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 23 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 24 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the Daystruct MCP server?
Daystruct is a hosted endpoint at https://api.daystruct.ai/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · api.daystruct.ai
claude mcp add --transport http ai-daystruct-api-daystruct 'https://api.daystruct.ai/mcp'
{
"mcpServers": {
"ai-daystruct-api-daystruct": {
"url": "https://api.daystruct.ai/mcp"
}
}
} {
"servers": {
"ai-daystruct-api-daystruct": {
"type": "http",
"url": "https://api.daystruct.ai/mcp"
}
}
} [mcp_servers.ai-daystruct-api-daystruct] url = "https://api.daystruct.ai/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"ai-daystruct-api-daystruct": {
"type": "remote",
"url": "https://api.daystruct.ai/mcp",
"enabled": true
}
}
} openclaw mcp add ai-daystruct-api-daystruct --url 'https://api.daystruct.ai/mcp' --transport streamable-http
mcp_servers:
ai-daystruct-api-daystruct:
url: "https://api.daystruct.ai/mcp" {
"McpServers": {
"ai-daystruct-api-daystruct": {
"Transport": "http",
"Url": "https://api.daystruct.ai/mcp"
}
}
} assistant mcp add ai-daystruct-api-daystruct -t streamable-http -u 'https://api.daystruct.ai/mcp'
{
"mcpServers": {
"ai-daystruct-api-daystruct": {
"type": "http",
"url": "https://api.daystruct.ai/mcp"
}
}
} The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 3 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 77 to 80. That category is still filling its 30-day observation window: 23 days of observed history at the previous scan, 24 at this one. The score rises as the window fills, whether or not the server changes.
- 1 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 70 to 73. That category is still filling its 30-day observation window: 21 days of observed history at the previous scan, 22 at this one. The score rises as the window fills, whether or not the server changes.
- 29 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 63 to 67. That category is still filling its 30-day observation window: 19 days of observed history at the previous scan, 20 at this one. The score rises as the window fills, whether or not the server changes.
- 28 Sept 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 26 Sept 26 +1
- The server rewrote its instructions, which are the text every model session reads security
- Tool “answer_software_questions” rewrote its description, which is the text the model reads security
- Tool “check_release_support” rewrote its description, which is the text the model reads security
- Tool “check_security_exposure” rewrote its description, which is the text the model reads security
- Tool “daystruct_status” rewrote its description, which is the text the model reads security
- Tool “get_context_contract” rewrote its description, which is the text the model reads security
- Tool “get_entity_evidence” rewrote its description, which is the text the model reads security
- Tool “lookup_vulnerability” rewrote its description, which is the text the model reads security
- Tool “read_recent_evidence_changes” rewrote its description, which is the text the model reads security
- Tool “search_entities” rewrote its description, which is the text the model reads security
- Tool “select_model” rewrote its description, which is the text the model reads security
- Schema quality: pass → fail ▼ functional
- Server version: 1.1.0 → 1.2.0 functional
- 25 Sept 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 24 Sept 26 +1
- Schema quality: 1752 → 2097 ▼ functional
- New tool “compat_check” functional
- New tool “get_compat_verify_kit” functional
- 22 Sept 26 +1
- Tool “discover_daystruct_capabilities” rewrote its description, which is the text the model reads security
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 4 Oct 2026 · Probed https://api.daystruct.ai/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=daystruct.ai | CN=WE1,O=Google Trust Services,C=US | 17 Aug 2026 | 15 Nov 2026 | ECDSA 256 | ECDSA-SHA256 | 278878261237a77e1309c0ec6eb7b84d |
| SANs: daystruct.ai, *.daystruct.ai | ||||||
| CN=WE1,O=Google Trust Services,C=US (CA) | CN=GTS Root R4,O=Google Trust Services LLC,C=US | 13 Dec 2023 | 20 Feb 2029 | ECDSA 256 | ECDSA-SHA384 | 7ff31977972c224a76155d13b6d685e3 |
| CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) | CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE | 15 Nov 2023 | 28 Jan 2028 | ECDSA 384 | SHA256-RSA | 7fe530bf331343bedd821610493d8a1b |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of api.daystruct.ai. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| ai. | present | 3799 | 8 | Verified |
| daystruct.ai. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
| Header | Value |
|---|---|
| content-security-policy | default-src 'none'; frame-ancestors 'none' |
| x-content-type-options | nosniff |
| x-frame-options | DENY |
| referrer-policy | no-referrer |
| permissions-policy | camera=(), microphone=(), geolocation=() |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://api.daystruct.ai/mcp | Verified | 200 | |
| http (plaintext) | http://api.daystruct.ai/mcp | HTTPS enforced | 301 | https://api.daystruct.ai/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
answer_software_questions Answer software questions ~75
Deprecated: this evidence tool is no longer refreshed and will be removed on or after 2026-12-31. For building, use discover_daystruct_capabilities and compat_check. Resolve up to four package/API questions and an optional runtime compatibility check.
| Name | Type | Req | Description |
|---|---|---|---|
| claims | array | yes | – |
| compatibility | object | – | – |
No output schema declared.
No examples provided.
check_release_support Check whether a release is still supported ~116
Deprecated: this evidence tool is no longer refreshed and will be removed on or after 2026-12-31. For building, use discover_daystruct_capabilities and compat_check. Given a product and version, return whether that release line is supported, in security-fix-only maintenance, or past end of life, with the dates behind the answer and the cycles you could upgrade into. A line with no published end-of-life returns undetermined rather than supported.
| Name | Type | Req | Description |
|---|---|---|---|
| product | string | yes | – |
| version | string | yes | – |
No output schema declared.
No examples provided.
check_security_exposure Check security exposure for a version ~122
Deprecated: this evidence tool is no longer refreshed and will be removed on or after 2026-12-31. For building, use discover_daystruct_capabilities and compat_check. Given a package and the version you are running, return the known vulnerabilities that affect it, worst first, each with the version that fixes it. Advisories whose affected range could not be parsed are returned under undetermined; treat undetermined as unanswered, never as safe.
| Name | Type | Req | Description |
|---|---|---|---|
| ecosystem | string | – | – |
| package | string | yes | – |
| version | string | yes | – |
No output schema declared.
No examples provided.
close_task_session ~50
Close a task with its reported outcome and compact summary.
| Name | Type | Req | Description |
|---|---|---|---|
| outcome | string | yes | – |
| request_id | string | yes | – |
| session_id | string | yes | – |
| summary | string | – | – |
No output schema declared.
No examples provided.
compat_check Check that Daystruct capabilities fit together and fit your project ~282
Resolve Daystruct capabilities to exact versions that fit each other, or get the exact constraint that broke with suggested alternatives. Send the project manifest by default: project.runtime (the node or python version the project runs), project.platform, and the project's package-lock.json (or an installed name->version map) plus the dependency sections of package.json. That makes the answer project-checked rather than bundle-only. Never send source code or other files; only those fields are read and nothing is stored. The result's scope says what it covers (bundle-only, project-checked, project-verified). Its state is compatible, except when you pass bundle (for example security-scanners@latest-verified) instead of capabilities: then it is verified, because that exact set passed its integration suite, and the result names the run and the environment it ran in. Affected versions are refused and listed under advisoriesAvoided; a deprecated version is chosen only when nothing else fits and is named in notes. To reach project-verified, fetch the verify kit for the resolved members, show the user the report the script prints, send it only with the user's agreement (--send), and pass the returned report id as verifyReportId.
| Name | Type | Req | Description |
|---|---|---|---|
| bundle | string | – | – |
| capabilities | array | – | – |
| project | object | – | – |
| verifyReportId | string | – | – |
No output schema declared.
No examples provided.
create_task_session ~65
Start compact task context with optional capability steps and dependencies. Requires read and requests:write. No conversation or reasoning trace is stored.
| Name | Type | Req | Description |
|---|---|---|---|
| current_stage | string | – | – |
| intent | string | yes | – |
| request_id | string | yes | – |
| steps | array | – | – |
No output schema declared.
No examples provided.
daystruct_status Daystruct status and capabilities ~27
Read the public Daystruct manifest: how capabilities are discovered, checked for compatibility and delivered.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
discover_daystruct_capabilities ~213
Find available Daystruct capabilities using a task sentence or tool name. Query searches return up to eight ranked compact descriptors, matched terms, requirements, limitations, prices and profile links; meta.matched and fullResults expose truncation. Inspect a selected capability by reference for its full contract before requesting help. Provider availability is not proof a task will succeed. Licensing filters narrow the list to source packages whose licensing evidence matches; entries with no licensing evidence are excluded rather than assumed to pass, and a filtered list returns summary licensing only. Read a capability's profile for its full receipt. Licensing findings are evidence against a configured policy, not legal advice.
| Name | Type | Req | Description |
|---|---|---|---|
| bundleMembers | string | – | – |
| licenseEvidence | array | – | – |
| licensePolicyState | array | – | – |
| licenseReciprocal | string | – | – |
| licenseSpdx | array | – | – |
| licenseStatus | array | – | – |
| licenseUnresolved | string | – | – |
| query | string | – | – |
| reference | string | – | – |
No output schema declared.
No examples provided.
get_compat_verify_kit Get the local verify script for a resolved set ~113
Return the files of the local verify step for exact source members from compat_check: a script, its plan, and the interface conformance suites. Write them to a scratch directory and run `node daystruct-verify.mjs` from the user's project; it runs the members' own tests and conformance suites and prints a report of counts and versions only. It sends nothing unless run with --send, which needs the user's agreement. Native members cannot be verified locally.
| Name | Type | Req | Description |
|---|---|---|---|
| members | array | yes | – |
No output schema declared.
No examples provided.
get_context_contract Get a Daystruct context-packet contract ~71
Deprecated: this evidence tool is no longer refreshed and will be removed on or after 2026-12-31. For building, use discover_daystruct_capabilities and compat_check. Read a databank's identity, temporal, dimension, and context-packet contract.
| Name | Type | Req | Description |
|---|---|---|---|
| databank | string | yes | – |
No output schema declared.
No examples provided.
get_daystruct_validated_guidance ~70
Retrieve reviewed Frontier guidance scoped to an exact databank, task family and tested model. Returns only live, unexpired promotions and their evidence limits; never private test fixtures.
| Name | Type | Req | Description |
|---|---|---|---|
| databank | string | yes | – |
| model | string | yes | – |
| taskFamily | string | yes | – |
No output schema declared.
No examples provided.
get_entity_evidence Get entity evidence ~69
Deprecated: this evidence tool is no longer refreshed and will be removed on or after 2026-12-31. For building, use discover_daystruct_capabilities and compat_check. Read canonical facts, aliases, history, and provenance for an entity.
| Name | Type | Req | Description |
|---|---|---|---|
| entityId | string | yes | – |
No output schema declared.
No examples provided.
get_task_session ~43
Read compact task context or preview the next ready capabilities without consuming them or extending the session TTL.
| Name | Type | Req | Description |
|---|---|---|---|
| next | boolean | – | – |
| session_id | string | yes | – |
No output schema declared.
No examples provided.
list_daystruct_guidance_scopes ~42
Find task families and exact tested models with live Frontier guidance for a databank, before requesting that guidance.
| Name | Type | Req | Description |
|---|---|---|---|
| databank | string | yes | – |
No output schema declared.
No examples provided.
lookup_vulnerability Look up a vulnerability by its identifier ~244
Deprecated: this evidence tool is no longer refreshed and will be removed on or after 2026-12-31. For building, use discover_daystruct_capabilities and compat_check. Given a vulnerability identifier such as a CVE, return what is held about it: the affected package and version range, the version that fixes it, severity, and whether it is recorded as known-exploited. Use this when you have an identifier rather than a package you are running. Fields come back as claims carrying their own authority. status 'known' with authority 'exclusive' means Daystruct has evidence for the value; if you hold a different value, treat it as a conflict to resolve. status 'unknown' with authority 'non_exclusive' means Daystruct has no evidence either way -- an absence of evidence, which does not contradict or supersede anything you already know: keep what you independently know, and stay uncertain if you do not. A field returned as null means Daystruct looked and holds nothing for it; no other Daystruct tool will have it either. Exploitation status is never reported false from a partial catalog.
| Name | Type | Req | Description |
|---|---|---|---|
| cve | string | yes | – |
No output schema declared.
No examples provided.
prepare_daystruct_capabilities ~69
Group up to six discovered capability IDs into a plan with each profile and delivery instructions. Missing entries remain explicit. Does not acquire, execute, check combined compatibility or charge credits. Your agent can combine these pieces with Daystruct knowledge and verify the resulting task.
| Name | Type | Req | Description |
|---|---|---|---|
| references | array | yes | – |
No output schema declared.
No examples provided.
read_recent_evidence_changes Read recent evidence changes ~62
Deprecated: this evidence tool is no longer refreshed and will be removed on or after 2026-12-31. For building, use discover_daystruct_capabilities and compat_check. Read the bounded canonical change feed.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | – |
No output schema declared.
No examples provided.
record_task_event ~99
Report viewed, called, succeeded, failed or skipped capability status, or task stage. Usage and outcomes remain client-reported.
| Name | Type | Req | Description |
|---|---|---|---|
| capability | string | – | – |
| current_stage | string | – | – |
| reported_cost_usd | number | – | – |
| reported_tool_turns | integer | – | – |
| request_id | string | yes | – |
| session_id | string | yes | – |
| summary | string | – | – |
| type | string | yes | – |
No output schema declared.
No examples provided.
resolve_daystruct_bundle ~52
Read a saved, owned or public bundle with pinned source versions and current member availability. Returns a composition plan, not an execution or purchase. Each capability retains its usage terms.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | – |
No output schema declared.
No examples provided.
resolve_task_capabilities ~97
Select relevant capabilities progressively, or request full delivery. Optional task session remembers prior delivery and reported results; selection never executes or acquires a capability.
| Name | Type | Req | Description |
|---|---|---|---|
| bundle_id | – | – | – |
| capabilities | array | – | – |
| delivery | string | – | – |
| include_repeat | boolean | – | – |
| intent | string | – | – |
| limit | integer | – | – |
| request_id | string | – | – |
| session_id | string | – | – |
No output schema declared.
No examples provided.
search_daystruct_library ~66
Search this account's saved or owned capabilities and bundles. Returns a small shortlist; saving does not acquire, execute or grant access to source. Inspect a selected profile before use.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | – |
| query | string | yes | – |
| scope | string | – | – |
No output schema declared.
No examples provided.
search_entities Search Daystruct entities ~119
Deprecated: this evidence tool is no longer refreshed and will be removed on or after 2026-12-31. For building, use discover_daystruct_capabilities and compat_check. Search normalized entities by databank, type, provider, or capability.
| Name | Type | Req | Description |
|---|---|---|---|
| capability | string | – | – |
| databank | string | – | – |
| lane | string | – | – |
| limit | integer | – | – |
| minContextWindow | integer | – | – |
| modelType | string | – | – |
| provider | string | – | – |
| type | string | – | – |
No output schema declared.
No examples provided.
select_model Select a model that meets stated constraints ~189
Deprecated: this evidence tool is no longer refreshed and will be removed on or after 2026-12-31. For building, use discover_daystruct_capabilities and compat_check. Given a need -- minimum context window, required capabilities, a price ceiling -- return the models that satisfy it, cheapest input price first, with the corroboration behind each record so you can judge how well-sourced it is. Prices are per million tokens. A model with no published price is returned under undetermined rather than excluded, so an unpriced model never reads as a disqualified one. This returns candidates and their evidence, not a recommendation.
| Name | Type | Req | Description |
|---|---|---|---|
| capabilities | array | – | – |
| limit | integer | – | – |
| maxInputPricePerMillionTokens | number | – | – |
| maxOutputPricePerMillionTokens | number | – | – |
| minContextWindow | integer | – | – |
| provider | string | – | – |
No output schema declared.
No examples provided.
What is the Daystruct MCP server?
Daystruct is an MCP server listed in the public MCP registry as ai.daystruct.api/daystruct. Find source-package workflows, inspect live prices and evidence, and connect with a scoped key. This page covers its hosted endpoint (https://api.daystruct.ai/mcp).
Is the Daystruct MCP server safe to use?
Daystruct scores 78 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Daystruct MCP server expose?
Daystruct exposes 23 tools: daystruct_status, search_entities, get_entity_evidence, get_context_contract, answer_software_questions, and 18 more. Their descriptions and schemas cost roughly 2,355 tokens of context every time the server is loaded.
Does the Daystruct MCP server require authentication?
No. We connected to Daystruct without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the Daystruct MCP server still maintained?
Daystruct is still listed as active in the MCP registry. We last reached this channel on 4 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.