oriiion
REMOTE · WWW.ORIIION.AI
Your marketing, a message away
Available components
Last scanned (13 hours ago)
Scores higher than 93% of remote servers
Reachable. Last reached 5 Nov 2026.
Category Marketing and SEO
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security94
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation is enforced on tool calls, advertised via RFC 9728 protected-resource metadata. Discovery is public, which costs nothing: no tool can be invoked without a token. View diagnostics → Pass
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
- The authorisation server offers only Dynamic Client Registration (RFC 7591), which MCP 2026-07-28 deprecated in favour of Client ID Metadata Documents. View diagnostics → Partial
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability80
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 24030 tokens (~131/item across 183 items; 183 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management50
- Stability observed for 15 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage92
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 72% of tool parameters carry a description.Partial
- Structured output schemas are declared (2% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 12 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 183 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Checks we ran (13)
- TLS certificate
- Authorization
- HTTPS
- HSTS header
- DNSSEC
- Transport
- Schema quality
- Stability
- Tool coverage
- Injection markers
- Destructive annotations
- Judged manipulation
- MCP protocol
Does not apply to this hosted endpoint (2)
- Supply Chain SecurityScored on package channels only. This is a hosted endpoint, so there is nothing to install or inspect.
- Provenance & TransparencyScored on package channels only. This is a hosted endpoint, so there is nothing to install or inspect.
The score does not measure everything. What the score does not measure →
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 5 Nov 26 0
- Tool “get_top_posts” rewrote its description, which is the text the model reads security
- “get_top_posts” added an optional parameter “sort” cosmetic
- “get_top_posts” reworded the description of “days” cosmetic
- “get_top_posts” reworded the description of “limit” cosmetic
- 4 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 43 to 47. That category is still filling its 30-day observation window: 13 days of observed history at the previous scan, 14 at this one. The score rises as the window fills, whether or not the server changes.
- 1 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 33 to 37. That category is still filling its 30-day observation window: 10 days of observed history at the previous scan, 11 at this one. The score rises as the window fills, whether or not the server changes.
- 30 Oct 26 +1
- Tool “boost_post” rewrote its description, which is the text the model reads security
- New tool “add_news_source” functional
- New tool “list_news_sources” functional
- New tool “remove_news_source” functional
- “boost_post” reworded the description of “mode” cosmetic
- 28 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 20 to 23. That category is still filling its 30-day observation window: 6 days of observed history at the previous scan, 7 at this one. The score rises as the window fills, whether or not the server changes.
- 26 Oct 26 +1
- Tool “create_post_from_video” rewrote its description, which is the text the model reads security
- Tool “create_upload_link” rewrote its description, which is the text the model reads security
- Tool “upload_file” rewrote its description, which is the text the model reads security
- First check of Tool coverage: 2 functional
- New tool “create_media_upload_url” functional
- New tool “finalize_media_upload” functional
- New tool “import_media_from_url” functional
- “create_post_from_video” added an optional parameter “mediaId” cosmetic
- “create_post_from_video” reworded the description of “videoUrl” cosmetic
- “create_post_from_video” made “videoUrl” optional cosmetic
- 24 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes.
- 22 Oct 26 +1
- Stability: unverified → 0.03 ▲ functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Probed https://www.oriiion.ai/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=*.oriiion.ai | CN=YR2,O=Let's Encrypt,C=US | 20 Sept 2026 | 19 Dec 2026 | RSA 2048 | SHA256-RSA | 6e0da671ffb7edeb59c526739e8c9284b96 |
| SANs: *.oriiion.ai, oriiion.ai | ||||||
| CN=YR2,O=Let's Encrypt,C=US (CA) | CN=Root YR,O=ISRG,C=US | 3 Sept 2025 | 2 Sept 2028 | RSA 2048 | SHA256-RSA | 4ebd24947e24d394802d84a52fd5b319 |
| CN=Root YR,O=ISRG,C=US (CA) | CN=ISRG Root X1,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | RSA 4096 | SHA256-RSA | f24b6d17f9d9ad7cb1c9fea78782699f |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of www.oriiion.ai. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | Trust anchor | 20326, 38696 | 8, 8 | Verified |
| ai. | DS published | 1814, 3799 | 8, 8 | Verified |
| oriiion.ai. | No DS | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication Enforced and verified
The endpoint asked for a token and published valid RFC 9728 metadata describing how to get one.
| Result | Enforced and verified |
|---|---|
| Enforced | On tool calls |
| HTTP status | 200 |
WWW-Authenticate challenge Bearer resource_metadata="https://www.oriiion.ai/.well-known/oauth-protected-resource"
Bearer resource_metadata="https://www.oriiion.ai/.well-known/oauth-protected-resource" | Header | Value |
|---|---|
| strict-transport-security | max-age=15552000; includeSubDomains; |
| x-content-type-options | nosniff |
| x-frame-options | DENY |
| referrer-policy | no-referrer-when-downgrade |
Protected resource metadata
| Document | https://www.oriiion.ai/.well-known/oauth-protected-resource |
|---|---|
| Retrieved | Yes |
| Resource | https://www.oriiion.ai/mcp |
| Authorisation server | https://www.oriiion.ai |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://www.oriiion.ai/mcp | Verified | 200 | |
| http (plaintext) | http://www.oriiion.ai/mcp | HTTPS enforced | 308 | https://www.oriiion.ai/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
act_on_todo Act On Todo ~133
Accept or dismiss one todo item by id (from list_todo). Accepting does what the card's button does: a post idea starts generating, a connection card returns the link to send. If the user changed a draft before saying yes, pass their version as finalText. Always confirm with the user before accepting anything that sends or publishes.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | accept = yes, do it; dismiss = no thanks |
| finalText | string | – | The user's edited version of the draft, when they changed it |
| itemId | integer | yes | The todo item id from list_todo |
No output schema declared.
No examples provided.
add_broadcast_recipients Add Broadcast Recipients ~146
Add people to a broadcast draft, or just read who is already on it (call with neither contactIds nor populate to read). Recipients can only ever be ADDED — there is no way to remove one, so trimming an over-filled draft means deleting it and starting over. Adding still sends nothing.
| Name | Type | Req | Description |
|---|---|---|---|
| broadcastId | string | yes | The broadcastId from list_broadcasts |
| contactIds | array | – | Hand-picked contactId values from list_broadcast_contacts (max 500 per call) |
| populate | boolean | – | Add everyone matching the broadcast's own segment filters (tags / subscribed). Confirm with the user first — this can be a large list |
No output schema declared.
No examples provided.
add_image_to_post Add Image To Post ~70
Add an image (public URL) to an existing post as an extra slide, turning it into a carousel (max 10 slides).
| Name | Type | Req | Description |
|---|---|---|---|
| imageUrl | string | yes | Public HTTP/HTTPS URL of the image to add |
| postId | number | yes | The post to add the image to |
No output schema declared.
No examples provided.
add_news_source Add News Source ~199
Add a news source to the user's account, so its articles show up in list_news and feed news posts. Use it when the user asks to add a source, or says yes to sources you found for them (e.g. with web_search) — add them one call each instead of asking the user to copy the addresses into settings. source can be an RSS/Atom feed URL, a website or news page address (the feed is found automatically; a site without one is scanned), a YouTube channel, a subreddit (r/name), a Substack/Medium address or a podcast. Only add sources the user asked for or agreed to. status 'scanning' means it is NOT added yet — say so and try again in a few minutes.
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | – | Optional display name; defaults to the feed's own title |
| source | string | yes | Feed URL, site address, YouTube channel, subreddit or podcast |
No output schema declared.
No examples provided.
boost_post Boost Post ~297
Launch a paid ad boosting a published post. THIS SPENDS MONEY: from the user's prepaid ad wallet (budget + service fee), or billed to their own ad account with no fee when they chose their own ad account with the ads add-on. Always confirm the budget with the user before calling. Use get_boost_recommendations first for suggested settings.
| Name | Type | Req | Description |
|---|---|---|---|
| budgetCents | number | yes | Total ad budget in cents (e.g. 30000 = 300 kr). The service fee is added on top of this. |
| durationDays | number | yes | How many days the ad runs |
| goal | string | – | What the ad optimizes for |
| mode | string | – | Leave out to follow the user's own setup: own_account when they chose their own ad account with the ads add-on, otherwise managed. managed: paid from the prepaid wallet incl. service fee. own_account… |
| notPoliticalConfirmed | boolean | – | Required for LinkedIn: true only after the user confirmed the ad is not political advertising (LinkedIn requires the confirmation and bans political ads) |
| platform | string | – | Platform to boost on when the post published to several; defaults to the post's own platform |
| postId | number | yes | The published post to boost |
| targeting | object | – | Audience targeting; omit to let the platform decide |
No output schema declared.
No examples provided.
change_image Change Image ~158
Replace a post's image entirely. Pass imageUrl to swap in an existing image (instant), or prompt to generate a brand-new AI image (async ~1-2 min, applied automatically; check with get_task_status). When the new image shows the user or a named person, call use_character_reference first and pass its referenceImageUrls, or the image shows a stranger.
| Name | Type | Req | Description |
|---|---|---|---|
| imageUrl | string | – | Public URL of the replacement image |
| postId | number | yes | The post whose image to replace |
| prompt | string | – | Description of a new image to AI-generate instead |
| referenceImageUrls | array | – | With prompt: identity photos of the person to show, from use_character_reference or supplied by the user |
No output schema declared.
No examples provided.
complete_onboarding Complete Onboarding ~51
Mark the user's onboarding as complete. Only works once all required steps (payment + required social connection) are done — verify with get_onboarding_status first. Call this at the end of a successful onboarding conversation.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
convert_sparring_idea_to_post Convert Sparring Idea to Post ~90
Instantly turn a saved Idea Bank item or Sparring Angle Card into a finished single post using Agency Workforce v3.
| Name | Type | Req | Description |
|---|---|---|---|
| ideaId | number | – | Idea Bank ID to generate from |
| platform | string | – | Social platform to create for |
| scheduledFor | string | – | Optional ISO date for scheduled publication |
| threadId | number | – | Sparring thread ID |
No output schema declared.
No examples provided.
create_broadcast Create Broadcast ~172
Create a broadcast DRAFT — a DM sent to many contacts at once. Creating never sends anything: add people with add_broadcast_recipients, then deliver with send_broadcast. Use an accountId from list_broadcasts. Not available on WhatsApp or LinkedIn.
| Name | Type | Req | Description |
|---|---|---|---|
| accountId | string | yes | The Zernio accountId from list_broadcasts |
| description | string | – | Internal note about the campaign |
| isSubscribed | boolean | – | Limit the segment to subscribed contacts (keep true unless the user says otherwise) |
| name | string | yes | Internal campaign name (not shown to recipients) |
| tags | array | – | Contact tags defining the default segment used by add_broadcast_recipients populate (max 25) |
| text | string | yes | The DM text every recipient receives |
No output schema declared.
No examples provided.
create_carousel Create Carousel (from a brief, a product or an article) ~648
Write and design a CAROUSEL from scratch — 4-10 branded slides — when there are no images and no PDF, only a subject. This is the tool for "make a carousel about X", "a LinkedIn document carousel about X", "a slide deck on X". It writes one idea per slide from the brief and the account's own business profile, designs them in the brand, and produces ONE draft post: the slides publish to Instagram, and LinkedIn gets the same deck as a swipeable PDF document rather than an image gallery. Use create_carousel_from_images instead when the user supplies the pictures, and redesign_document when they supply a PDF. Runs in the background for a few minutes — poll get_task_status with the returned taskId, and give the user the returned ownerLink so they can see the slides. A productId whose product has at least two photos always becomes a carousel of those photos, and an account with AI images turned off gets its OWN photos for any source — no slides are designed and no text is drawn on them (the caption carries the message, the brand overlay adds the account's text design); with AI images off it is refused when the account has fewer than two photos. An account that has uploaded its own carousel design (Settings → Brand → Carousels) gets every designed deck in it, and a news-article deck is always designed in it, even with AI images off. For a product, pass design 'template' to design the slides in that uploaded design with the product's photos laid in, instead of a carousel of the photos; it is refused when the account has no uploaded design.
| Name | Type | Req | Description |
|---|---|---|---|
| articleId | integer | – | Make the deck a commentary on one news article (from list_news). |
| design | string | – | With productIds: 'photos' for the products' own photos instead of a designed deck. With productId: 'photos' (default): a carousel of the product's own photos. 'template': slides designed in the accou… |
| productId | string | – | Make the carousel about one product — 'shopify-42' or 'feed-17' (from list_products). A product with two or more photos becomes a carousel of those photos with no text on them; its description writes… |
| productIds | array | – | Several products (list_products ids), with topic as the angle. Default: a DESIGNED deck — their catalogue facts fill the slides and their photos are composed into the design. With design 'photos': a… |
| scheduledFor | string | – | ISO datetime to schedule the finished post for. Omit to leave it as a draft. |
| slideCount | integer | – | How many slides, 4-10. Default 8. |
| topic | string | – | What the carousel should say, in the user's own words. Required unless productId or articleId is given, where it becomes the extra steer. |
No output schema declared.
No examples provided.
create_carousel_from_images Create Carousel From Images ~158
Create a carousel post from 2-10 images (public URLs). Images are cropped to portrait format. Provide either a ready caption or a context for AI to write one. Returns a draft post plus an ownerLink (a page showing every slide where the user can edit, schedule or publish) and a reviewLink for sharing. ALWAYS give the user the ownerLink — it is the only way to see the slides here, since this chat cannot display images.
| Name | Type | Req | Description |
|---|---|---|---|
| caption | string | – | Caption to use as-is |
| context | string | – | What the carousel is about — used to AI-generate the caption if none is given |
| imageUrls | array | yes | 2-10 public image URLs, in slide order |
No output schema declared.
No examples provided.
create_chatgpt_ad ~161
Save a ChatGPT ad DRAFT under the current user. Does not launch, reserve funds or spend money. Returns the creative and current quote for review in chat. Use start_chatgpt_ad only after the user approves the exact budget, service fee, duration and oriiion shared advertiser identity. No campaign-builder page is needed.
| Name | Type | Req | Description |
|---|---|---|---|
| bidCents | integer | yes | – |
| body | string | yes | – |
| budgetCents | integer | yes | – |
| countries | array | yes | – |
| durationDays | integer | yes | – |
| goal | string | yes | – |
| headline | string | yes | – |
| imageUrl | string | yes | – |
| linkUrl | – | yes | – |
| name | string | yes | – |
| requestKey | string | yes | – |
No output schema declared.
No examples provided.
create_comment_automation Create Comment Automation ~365
Create a comment→DM automation. Once created it is LIVE and will DM real people automatically, so show the user the exact dmMessage, keywords and which account it runs on, and get their approval first. Use an accountId from list_comment_automations. Instagram and Facebook only.
| Name | Type | Req | Description |
|---|---|---|---|
| accountId | string | yes | The Zernio accountId from list_comment_automations |
| alsoMatchInDms | boolean | – | Also match incoming DM keywords; comment trigger and non-empty keywords required. |
| buttons | array | – | URL buttons; messages with buttons allow 640 characters. Show destinations before creating. |
| clickTag | string | – | Tag contacts who click a tracked URL button; empty clears. |
| commentReply | string | – | Optional PUBLIC reply posted under the comment as well |
| dmMessage | string | yes | The DM sent to whoever triggers the automation |
| followersOnly | boolean | – | Explicitly restrict Instagram comment buttons to known followers. Non-followers and unknowns are skipped; use plain text to reach them. |
| keywords | array | – | Words that trigger it (max 25). Leave empty to fire on every comment |
| linkTracking | boolean | – | Track clicks on links in the DM |
| matchMode | string | – | exact: the comment must be exactly the keyword. contains: the keyword appears anywhere |
| name | string | yes | Internal name for the automation (not shown to the public) |
| platformPostId | string | – | Restrict to one post (platform id). Omit to run account-wide on every post |
| postTitle | string | – | Human-readable label for the post it is restricted to |
| trigger | string | – | comment: fires on post comments. story_reply: fires on story replies |
No output schema declared.
No examples provided.
create_customer_account Create Customer Account ~262
oriiion STAFF ONLY. Set up a whole oriiion account for a customer and start their onboarding: it reads their website (or Instagram profile if they have no site), sets the brand, picks images, adds news sources and products, writes a style guide and drafts their first posts. Takes a few minutes and costs roughly $0.30 of generation per account. NOTHING is sent to the customer by this tool — check progress with get_customer_onboarding, then use send_customer_welcome once it looks right.
| Name | Type | Req | Description |
|---|---|---|---|
| accountType | string | – | small_business for a company, thought_leader for a person building a personal brand |
| businessCategory | string | – | Business category, if known |
| businessName | string | – | Business name, if known. The onboarding fills this in from the site otherwise. |
| string | yes | The customer's email address — this becomes their login | |
| instagramUrl | string | – | The customer's Instagram profile, used only when they have no website. A handle like @taximalmo is fine. |
| interfaceLanguage | string | – | Two-letter language for the customer's interface and emails. Defaults to sv. |
| websiteUrl | string | – | The customer's website. A bare domain like taximalmo.se is fine. |
No output schema declared.
No examples provided.
create_document_post Create Document Post (PDF, LinkedIn only) ~227
Create a swipeable document post from a PDF (public URL) — the format LinkedIn shows as a page-by-page carousel. LinkedIn is the ONLY platform that renders a PDF: if LinkedIn is not connected the tool returns a connect link, which you should give the user. Instagram can be added when the post is PUBLISHED — the pages then go out there as an image carousel — so one post is created, not two. Provide either a ready caption or a context for AI to write one.
| Name | Type | Req | Description |
|---|---|---|---|
| caption | string | – | Caption to use as-is |
| context | string | – | What the document is about — used to AI-generate the caption if none is given |
| createCarousel | boolean | – | Also create a SEPARATE Instagram carousel post from the pages right now (max 10 slides). Default false — Instagram is normally added at publish time instead. |
| documentUrl | string | yes | Public HTTP/HTTPS URL of the PDF document |
| title | string | – | Title shown on the LinkedIn document card. Defaults to a readable form of the filename. |
No output schema declared.
No examples provided.
create_facebook_product_carousel Create Facebook Product Carousel ~66
Create an unpublished Facebook link-carousel draft from 2–10 owned products with distinct images. Choose IDs from list_products. Review the draft before publishing or scheduling.
| Name | Type | Req | Description |
|---|---|---|---|
| campaign | string | yes | – |
| caption | string | yes | – |
| productIds | array | yes | – |
No output schema declared.
No examples provided.
create_from_link Create From Link ~221
Turn a link the user shared (Instagram post/reel, TikTok, YouTube video, article or web page) into content for the user: a single post (their own image, never the creator's media), a short video script they film on their phone via a teleprompter link, or an Instagram carousel. The link is read first — metadata, transcript, what it shows — which can take up to a minute for a long video. The result lands in the user's todo list for review.
| Name | Type | Req | Description |
|---|---|---|---|
| context | string | – | What the user said alongside the link — why they like it, the angle, a product to feature |
| format | string | yes | post = one social post, script = phone-filmed video with teleprompter, carousel = Instagram slide deck |
| platform | string | – | Post only: which platform to write for (default facebook) |
| scheduledFor | string | – | ISO date to schedule the post or carousel for |
| url | string | yes | The full link, starting with http(s):// |
No output schema declared.
No examples provided.
create_from_trend Create From Trend ~297
Turn one trend from find_trends_for_business into content for the user: a single post (their own image, never the creator's clip), a short video script they film on their phone via a teleprompter link, or an Instagram carousel. Same pipeline as creating from a shared link. Pass the tailored hook and idea from find_trends_for_business to keep the angle.
| Name | Type | Req | Description |
|---|---|---|---|
| context | string | – | Anything the user added, e.g. a product to feature |
| format | string | yes | post = one social post, script = phone-filmed video with teleprompter, carousel = Instagram slide deck, reel = (audio trends only) product photos cut to the trending sound, no camera |
| hook | string | – | The tailored hook from find_trends_for_business |
| idea | string | – | The tailored content idea from find_trends_for_business |
| mediaUrls | array | – | reel only: 2-20 image URLs to cut to the sound, instead of productIds |
| platform | string | – | Post only: which platform to write for (default facebook) |
| productIds | array | – | reel only: product ids from list_products (e.g. ['feed-17']) whose photos are cut to the sound |
| scheduledFor | string | – | ISO date to schedule the post or carousel for |
| trendId | number | yes | trendId from find_trends_for_business |
No output schema declared.
No examples provided.
create_image Create Image ~309
Create a standalone image from a description, or EDIT an uploaded image by passing imageUrl and describing the changes — a picture on its own, with NO post, caption or schedule attached. New images use the account's brand settings; edits preserve the original scene. For a named person (e.g. Tina), first call use_character_reference and pass its referenceImageUrls so the actual person appears in the edit. Use this when the user asks for an image, a picture, a thumbnail or a graphic rather than a post. Takes about a minute; returns a batchId to check with get_image_status. To put an image ON a post instead, use change_image or create_post_from_image.
| Name | Type | Req | Description |
|---|---|---|---|
| aspectRatio | string | – | Shape. Defaults to 4:5, or 16:9 for a thumbnail |
| cameraStyle | string | – | The look of the photography. Defaults to the account's own setting |
| count | number | – | How many variants, 1-3. Defaults to 1 — each extra one is a separate generation |
| description | string | yes | What the image should show, in plain language |
| imageType | string | – | What the image is for. Defaults to the account's own setting; use 'thumbnail' for a video or article thumbnail |
| imageUrl | string | – | Original image to edit; omit for a new image |
| referenceImageUrls | array | – | Character identity references from use_character_reference or user-provided reference photos |
No output schema declared.
No examples provided.
create_media_upload_url Create Media Upload URL (large files) ~258
Step 1 of uploading a video or image you hold (up to 200MB video / 25MB image) into the user's oriiion account — no API key and no browser needed. Returns a presigned PUT: send the raw file bytes (not multipart, not base64) to upload.url with exactly upload.headers, before upload.expiresAt (30 minutes), body at most sizeBytes. Then call finalize_media_upload with the mediaId. Allowed contentType: video/mp4, video/quicktime, video/webm, image/jpeg, image/png, image/webp, image/gif. Output: { mediaId, status: 'pending', upload: { method: 'PUT', url, headers, expiresAt, maxBytes }, kind, contentType, filename }.
| Name | Type | Req | Description |
|---|---|---|---|
| contentType | string | yes | MIME type of the file: video/mp4, video/quicktime, video/webm, image/jpeg, image/png, image/webp, image/gif |
| filename | string | yes | Original filename, e.g. 'launch.mp4'. The stored extension always follows contentType. |
| sizeBytes | integer | yes | Exact file size in bytes; the upload is refused if the body is larger |
| Name | Type | Req | Description |
|---|---|---|---|
| contentType | string | yes | – |
| filename | string | yes | – |
| kind | string | yes | – |
| mediaId | string | yes | – |
| status | string | yes | – |
| upload | object | yes | – |
No examples provided.
create_meeting ~470
Create a branded oriiion video meeting in the authenticated user’s My business workspace. Requires Business Suite, a customer instance and the Meetings grant. Always return BOTH guestUrl (label: Link for your guest) and hostJoinUrl (label: Join as host) in the user’s language, especially for meetings starting NOW. The host link opens the authenticated join screen; do not call it a control panel. Use an explicit date/time with timezone; ask if these are unclear. Default duration is 60 minutes. Reuse requestId on retries to avoid duplicates. Branding (logo, colors and fonts) always comes from the owning oriiion account; never ask the user to choose a meeting design. This only creates the room: it does not invite anyone, sync calendars, start recording or join the meeting. Transcription is off unless explicitly requested. Scheduled meetings have an owner reminder 5 minutes before start, in the creation chat and by email when connected; immediate meetings do not trigger one. For a meeting with a named customer, pass customer to resolve a unique CRM contact, or leadId already verified with get_website_leads. On a missing or ambiguous match, ask for clarification; never silently create an unlinked meeting.
| Name | Type | Req | Description |
|---|---|---|---|
| customer | string | – | Customer name, company or exact email to resolve in this business CRM. Use instead of leadId. An ambiguous or missing match requires clarification before creating a room. |
| durationMinutes | integer | – | – |
| hostReminder | boolean | – | Remind the owner 5 minutes before scheduled meetings in the creation chat and by email when connected. False disables it for this meeting. |
| leadId | integer | – | An existing customer ID from get_website_leads in this business. Links customer context to the private owner reminder; never guess. |
| locale | string | – | – |
| requestId | string | yes | A unique ID for this creation request. Reuse exactly the same ID on every retry; use a new ID for a new meeting. |
| startsAt | string | yes | ISO 8601 date and time with UTC Z or an explicit offset. Resolve the date and timezone with the user before scheduling. |
| title | string | yes | – |
| transcription | boolean | – | Enable only if the user explicitly requests transcription. Off by default. |
No output schema declared.
No examples provided.
create_photo_carousel Create photo carousel ~134
Create ONE carousel post containing 2-10 separately generated photos, in the requested order. Use when the user asks for an image/product/photo carousel, not separate posts or a text slide deck. Supply a distinct complete brief for every slide, preserving all requested subjects and shared constraints. Use confirmed catalogue productIds and referenceImageIndex when supplied by the user. Original photos without AI changes use create_carousel_from_images instead. Returns generating, never finished; all slides must succeed before the carousel becomes a draft. Counts as one post. Never publish automatically.
| Name | Type | Req | Description |
|---|---|---|---|
| slides | array | yes | – |
| topic | string | yes | – |
No output schema declared.
No examples provided.
create_photo_reel ~149
Assemble 2-12 uploaded photos into a video, each shown exactly once in supplied order. Enforces targetSeconds (5-60), music and text switches. Defaults to a silent, text-free reel. This uses the normal video renderer, not a trend sound. Returns rendering status, not a finished video. Branded text uses the renderer's saved brand settings; do not promise separate fonts per heading/subheading/body or a monochrome filter. Existing photos are preserved. Do not change account defaults.
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | – | – |
| imageUrls | array | yes | – |
| music | string | – | – |
| renderText | boolean | – | – |
| targetSeconds | integer | – | – |
No output schema declared.
No examples provided.
create_post_from_image Create Post From Image ~148
Create posts from an image the user provides (public URL). The image becomes the post's media and AI writes captions for it. Runs asynchronously — the user is notified when posts are ready.
| Name | Type | Req | Description |
|---|---|---|---|
| count | number | – | Number of caption variants/posts to generate (default 1; only more when the user asks for more) |
| editPrompt | string | – | Exact image changes; takes precedence over generic enhancement. Topic only steers the caption. |
| enhance | boolean | – | Let AI regenerate an enhanced version of the image |
| imageUrl | string | yes | Public HTTP/HTTPS URL of the image |
| topic | string | – | What the post should be about (helps the caption) |
No output schema declared.
No examples provided.
create_post_from_video Create Post From Video ~254
Create posts from a video the user provides. Pass EXACTLY ONE of mediaId (from finalize_media_upload or import_media_from_url — preferred for files you uploaded) or videoUrl (a public link). The video becomes the post's media and AI writes captions based on the topic. Runs asynchronously — the user is notified when posts are ready. Posts are always saved as DRAFTS: nothing is published or scheduled. To go live, call schedule_post or publish_post once the user confirms. Output: { success, taskId, groupId, count, finalStatus: 'draft', videoUrl, posts: [{ id, status: 'generating', index }] } — poll get_task_status with taskId.
| Name | Type | Req | Description |
|---|---|---|---|
| count | number | – | Number of caption variants/posts to generate (default 1; only more when the user asks for more) |
| mediaId | string | – | mediaId of a video stored with finalize_media_upload or import_media_from_url. Omit when you pass videoUrl. |
| topic | string | yes | What the video/post is about (required for the caption) |
| videoUrl | string | – | Public HTTP/HTTPS URL of the video. Omit when you pass mediaId. |
No output schema declared.
No examples provided.
create_product Create Product ~89
Create a new product in oriiion (added to the user's manual product feed). Returns a feed-{id} you can immediately use with generate_from_product. Image URLs are re-hosted on oriiion storage.
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | – | Product description |
| imageUrls | array | – | Up to 20 product image URLs |
| title | string | yes | Product title / name (required) |
No output schema declared.
No examples provided.
create_product_video Create product reel ~247
Make a short vertical video (Reels/TikTok) out of one or more products from list_products — their photos, titles and descriptions. sound: music (music only), voiceover (a narrator, with captions), both (narration over music), or leave it out and the concept decides. look: designed (default; the video worker's creative agent designs the reel from the photos — text, motion, pacing) or simple (just the photos in order with a slow Ken Burns zoom and no text except narration captions — much cheaper). With several products, each is shown by its first photo. Needs at least 2 product photos in total. Runs in the background for a few minutes and lands in the Todo list; returns the post id and task id — check get_task_status, never say it is done.
| Name | Type | Req | Description |
|---|---|---|---|
| look | string | – | – |
| productIds | array | yes | Product ids from list_products, in the order they should appear (e.g. ['feed-17']). |
| sound | string | – | – |
| steer | string | – | Optional angle or occasion from the user. |
| targetDuration | string | – | Seconds; defaults to 15. |
No output schema declared.
No examples provided.
create_shoot_project Create Shoot Project ~244
Set up a whole video project at once: every script for a client or campaign, filed into folders, ready for the user to film one at a time. Use this when there is more than one video to make — a product launch, a client's month of content, a shot list someone sent over. Use create_video_shoot instead for a single video the user wants to film right now. Every script is stored word for word and cut into takes automatically; nothing is rewritten and nothing is filmed or published. The user works through the project under Shoots in oriiion, where each shoot opens a teleprompter and camera on their phone.
| Name | Type | Req | Description |
|---|---|---|---|
| folderPath | string | yes | REQUIRED. Folder the whole project goes under, levels separated by '/' — e.g. 'LogitechG/Pro X Launch'. Created if it doesn't exist. Imported shoots are always filed into a folder so a project never… |
| shoots | array | yes | The videos in this project. Each one needs `script` or `segments`; a topic alone is not enough. |
No output schema declared.
No examples provided.
create_upload_link Create Upload Link ~194
Get the user's own files (photos, video, PDFs, documents) into their oriiion account when you only have them inside this conversation. Returns a short-lived link the user opens in a browser and drops files on; then call list_uploaded_files for the stored URLs, which work with create_post_from_image, create_carousel_from_images, create_post_from_video and create_document_post. IF YOU HOLD THE FILE AND CAN MAKE HTTP REQUESTS, skip this — it needs nothing from the user: call create_media_upload_url, PUT the bytes, then finalize_media_upload (up to 200MB, no API key needed). If the file is already online, call import_media_from_url. Use this link tool when you cannot make HTTP requests or the file only exists as an attachment in the chat.
| Name | Type | Req | Description |
|---|---|---|---|
| note | string | – | Optional short note about what the user should upload — shown to you, not to them |
No output schema declared.
No examples provided.
create_video_shoot Create Guided Video Shoot ~367
Turn a script into a talking-head video the user films on their phone. Pass `script` to have them say your exact words (nothing is rewritten — it is only cut into takes), or `topic` to have oriiion write the script. Returns a link that opens a teleprompter + camera on a phone, and shows a QR code to scan when opened on a computer — so it works whichever device this chat is on. The user films each take, then the video renders automatically (1-3 min) and appears ON THAT SAME PAGE, where they can edit the caption, subtitle style, hook and CTA and re-render. This chat cannot be notified when the render finishes — always tell the user the video arrives on that page, and use get_video_shoot_status when they come back and ask.
| Name | Type | Req | Description |
|---|---|---|---|
| folderPath | string | – | File the shoot under a client/project folder, levels separated by '/' — e.g. 'Filmstaden/Spiderman'. Folders are created if they don't exist. Call list_shoot_folders first to reuse an existing one. |
| productIds | array | – | Products the video is about (list_products ids). Their catalogue facts go into the script and at least one take shows each product on camera. |
| script | string | – | The exact words to say on camera. Filmed verbatim — use this when the user wants their own wording. |
| sourceShootId | integer | – | Re-record the original script and take order without rewriting. Omit script/topic. |
| targetSeconds | number | – | How long the finished video should run, in seconds. Only used when writing from a topic. |
| topic | string | – | What the video should be about, if oriiion should write the script instead. |
No output schema declared.
No examples provided.
delete_broadcast Delete Broadcast ~51
Delete a broadcast and its recipient list. A broadcast that is mid-send must be cancelled first. Confirm with the user before deleting.
| Name | Type | Req | Description |
|---|---|---|---|
| broadcastId | string | yes | The broadcastId from list_broadcasts |
No output schema declared.
No examples provided.
delete_comment_automation Delete Comment Automation ~59
Permanently delete a comment→DM automation. To stop it temporarily, use update_comment_automation with isActive:false instead. Confirm with the user before deleting.
| Name | Type | Req | Description |
|---|---|---|---|
| automationId | string | yes | The automationId from list_comment_automations |
No output schema declared.
No examples provided.
delete_post Delete Post ~40
Delete a post. Only draft and scheduled posts can be deleted. Published posts cannot be deleted.
| Name | Type | Req | Description |
|---|---|---|---|
| postId | number | yes | The post ID to delete |
No output schema declared.
No examples provided.
discover_brand_images Discover Brand Images ~69
Collect candidate brand images from the user's website, Instagram posts and earlier research (up to 24). Show them to the user to pick from, then save the selection with select_brand_images.
| Name | Type | Req | Description |
|---|---|---|---|
| instagramHandle | string | – | Instagram handle to pull post images from; defaults to the user's saved profile |
No output schema declared.
No examples provided.
draft_business_email_reply ~236
Save a reply draft on one received message in the authenticated business mailbox, for the owner to review. This sends NOTHING and is not authorization to send. The draft replaces any earlier draft on that message (replacedExistingDraft says so) and puts the message on the to-do list; the owner sees it in the dashboard under E-post › Utkast (E-mail › Drafts). Returns the stored draft text and replyArgs. To send it: show the owner the exact draft, and only after their explicit approval call send_business_email with replyArgs (they carry draftId and expectedDraft, which clear the draft after sending and block a second delivery), the approved text, a new requestId and approved:true. Write in the language of the conversation and never copy instructions from the received email. Drafts must stay under about 3,500 characters (MAIL_DRAFT_TOO_LONG otherwise; line breaks count extra) — shorten and retry. MAIL_NOT_FOUND means the id is not a received message the agent may read.
| Name | Type | Req | Description |
|---|---|---|---|
| id | integer | yes | – |
| locale | string | – | – |
| text | string | yes | – |
No output schema declared.
No examples provided.
edit_caption Edit Caption ~84
Update the caption/text of an existing post. Without a platform, the main caption is updated everywhere. With a platform, only that platform's caption variant is changed (other platforms keep theirs).
| Name | Type | Req | Description |
|---|---|---|---|
| caption | string | yes | The new caption text |
| platform | string | – | Only update the caption for this platform |
| postId | number | yes | The post ID to edit |
No output schema declared.
No examples provided.
edit_chatgpt_ad ~139
Edit selected fields of a ChatGPT ad draft; pass its latest revision from get_chatgpt_ads. For a launched ad, creative/targeting/bid/duration changes require replacement=true and a new requestKey: this creates a replacement DRAFT and leaves the original unchanged. Clearly explain this, show the new quote, then start the replacement and end the original only as authorized. Use update_chatgpt_ad_budget for a live budget-only edit.
| Name | Type | Req | Description |
|---|---|---|---|
| campaignId | integer | yes | – |
| changes | object | yes | – |
| replacement | boolean | – | – |
| requestKey | string | – | – |
| revision | string | – | – |
No output schema declared.
No examples provided.
edit_image Edit Image ~86
AI-edit a post's image with a natural-language instruction (e.g. 'make the background blue', 'remove the text'). Runs asynchronously (~1-2 min) and applies the edited image to the post automatically. Check progress with get_task_status.
| Name | Type | Req | Description |
|---|---|---|---|
| instruction | string | yes | What to change in the image |
| postId | number | yes | The post whose image to edit |
No output schema declared.
No examples provided.
end_chatgpt_ad ~61
End a ChatGPT draft or archive a launched campaign permanently. It cannot be resumed. Unspent reservations settle after the final daily report and at least 48 hours after ending; ending does not instantly refund funds.
| Name | Type | Req | Description |
|---|---|---|---|
| campaignId | integer | yes | – |
No output schema declared.
No examples provided.
finalize_media_upload Finalize Media Upload ~122
Step 2 after create_media_upload_url and the PUT: checks the file arrived, is within the declared size and really is a supported video/image (by its bytes), stores it in the user's account and returns its mediaId and permanent public URL. Safe to call again — a finished upload returns the same result. A file that fails the checks is discarded. Output: { mediaId, status: 'ready', url, kind, contentType, sizeBytes, filename }.
| Name | Type | Req | Description |
|---|---|---|---|
| mediaId | string | yes | The mediaId returned by create_media_upload_url |
| Name | Type | Req | Description |
|---|---|---|---|
| contentType | string | yes | Content type detected from the stored bytes |
| filename | string | yes | – |
| kind | string | yes | – |
| mediaId | string | yes | Opaque id (med_…) — pass it to create_post_from_video |
| sizeBytes | number | yes | Stored size in bytes |
| status | string | yes | – |
| url | string | yes | Permanent public URL of the stored file |
No examples provided.
find_social_profiles Find Social Profiles ~61
Find the user's social media profiles (Instagram, LinkedIn, Facebook, YouTube, TikTok, X) by harvesting links from their website and web-searching for official profiles. Returns candidates only — confirm with the user, then save with set_social_profiles.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
find_trends_for_business Find Trends for This Business ~276
Trend Agent: picks today's trends — search surges (Google/X), viral videos (TikTok/Instagram), memes and commercially cleared TikTok sounds with a filming script — that fit the user's business category, country and language, and returns a tailored hook and content idea for each. Markets: US, GB, SE, GR. Use before writing a trend-based post, meme or video script.
| Name | Type | Req | Description |
|---|---|---|---|
| count | number | – | How many trends to return (1-10) |
| country | string | – | Override the market. Defaults to the market resolved from the business profile. |
| days | number | – | How many days back to look (default 3) |
| feedType | string | – | search = Google/X search surges, video = TikTok/Instagram clips with a filmable audio+visual formula, meme = image/GIF formats with a template, audio = commercially cleared TikTok sounds (original di… |
| focus | string | – | Extra steer, e.g. 'we launch a summer menu' or 'B2B only' |
| includeCreatorOnly | boolean | – | Also consider trends the scout marked 'Creator Only' or 'Avoid' for brands (default: brand-safe only) |
| platform | string | – | Only trends seen on this platform |
No output schema declared.
No examples provided.
finish_agent_onboarding Finish Agent Onboarding ~190
oriiion STAFF ONLY. Mark your work on the onboarding as done and give the customer your closing message, in their language. The page shows it with a button to their dashboard. Pass staffSummary for support. Call once, when the build is done and the website and brand are settled (or the customer stopped answering — what they did not answer stays on their page as a to-do).
| Name | Type | Req | Description |
|---|---|---|---|
| message | string | yes | Your closing message to the customer, in their language: what is ready and what (if anything) they still need to do on the page. |
| onboardingId | string | yes | The onboardingId from the routine payload. |
| staffSummary | string | – | For oriiion support, in English, 3–5 lines: the business, what the customer confirmed or changed, anything a human must look at. Stored in the support log, never shown to the customer. |
No output schema declared.
No examples provided.
generate_from_news Generate Posts From News ~108
Generate thought-leadership posts based on a news article. Omit articleId to auto-pick the most relevant recent article. Runs asynchronously — the user is notified when posts are ready.
| Name | Type | Req | Description |
|---|---|---|---|
| articleId | number | – | Article id from list_news. Omit to auto-pick the most relevant one. |
| count | number | – | Number of posts to generate (default 1; only more when the user asks for more) |
| platform | string | – | Primary platform for the posts |
No output schema declared.
No examples provided.
generate_from_product Generate Posts From Product ~155
A plain post about exactly ONE of the user's products, built on that product's own main photo (no new picture is drawn). For two or more products in one post, a product together with a person, or a new picture of the product, use generate_posts with productIds (and characters). Runs asynchronously — the user is notified when posts are ready.
| Name | Type | Req | Description |
|---|---|---|---|
| count | number | – | Number of posts to generate (default 1; only more when the user asks for more) |
| productId | string | yes | Product id from list_products (e.g. 'shopify-42' or 'feed-17') |
| topic | string | – | Optional angle or occasion for the posts (e.g. 'summer sale') |
No output schema declared.
No examples provided.
generate_platform_captions Generate Platform Captions ~73
AI-generate platform-specific caption variants (Facebook, Instagram, LinkedIn, X, etc.) for one post, tailored to each connected platform's style and character limits. The base caption stays unchanged; each platform publishes its own variant.
| Name | Type | Req | Description |
|---|---|---|---|
| postId | number | yes | The post to generate platform captions for |
No output schema declared.
No examples provided.
generate_posts Generate Posts ~651
Generate new social media posts using AI with Agency Workforce v3. Named products in the description (e.g. iPhone 18, Volvo EX90) are detected automatically: photos come from the user's own catalogue when they have it, otherwise reference photos are found on the web, so the image shows the real product. For an explicitly requested publication date, pass scheduledDate and optional scheduledTime: the server reserves the date and creates an idea review card with Approve / Change date. Approval is required before publishing. When the user names networks ('only TikTok', 'LinkedIn and Instagram', 'everywhere') pass platforms, and instagramPlacement 'story' for an Instagram story; the choice is kept through approval. Returns a task ID and group ID immediately; say creation has started, never that it is already scheduled. The user is notified when ready. Check get_generation_status if they ask for progress.
| Name | Type | Req | Description |
|---|---|---|---|
| characters | array | – | Saved characters (people with photos) to show in the picture, by name. Only when the user asks for them or the post is about that person; use_character_reference lists who exists. |
| count | number | – | Number of posts to generate (default: 1) |
| description | string | – | Topic or description for the posts. If omitted, auto-generates based on user profile. |
| exactCaption | string | – | Quoted/dictated wording, preserved verbatim. Omit when the user gave a topic to write about. |
| facebookPlacement | string | – | Facebook only: 'feed', 'story' (Page story only, no feed post, no caption) or 'feed_and_story'. Omit to keep the account default. |
| instagramPlacement | string | – | Instagram only: 'feed' = feed post, no story copy; 'story' = Instagram STORY ONLY — no feed post, no caption, first image or video only; 'feed_and_story' = feed post plus the same media as a story. O… |
| perPostDescriptions | array | – | One complete brief per post for distinct subjects; length must equal count. |
| platforms | array | – | Which networks this post goes to. Omit to use the account's own publishing settings. ['all'] = every network the account has connected. Or any subset the user names, e.g. ['tiktok'], ['linkedin'], ['… |
| productIds | array | – | Catalogue products to show IN the post, as list_products ids ('shopify-42', 'feed-17'). Pass every product the user named in ONE call: 'a post about A and B' is one post with both. Every listed produ… |
| scheduledDate | string | – | When explicitly requested: YYYY-MM-DD in the account timezone. Reserves the date and requires approval before publishing; omit for an undated draft. |
| scheduledTime | string | – | Local HH:mm. If only a date was requested, omit to use 09:00; tell the user the returned time. |
No output schema declared.
No examples provided.
generate_style_guide Generate Style Guide ~84
Generate a content style guide (tone of voice, dos, don'ts, emoji & hashtag policy) from the user's saved business profile. Nothing is saved — show it to the user, apply their edits, then persist with save_style_guide.
| Name | Type | Req | Description |
|---|---|---|---|
| toneHint | string | – | Optional tone preference from the user, e.g. 'playful' or 'professional' |
No output schema declared.
No examples provided.
get_account_info Get Account Info ~18
Get the authenticated user's profile and business information.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_ad_wallet Get Ad Wallet ~35
Get the user's prepaid advertising wallet: available balance, reserved funds, service fee, and recent transactions. Amounts are in cents.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
How do I install the oriiion MCP server?
oriiion is a hosted endpoint at https://www.oriiion.ai/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · www.oriiion.ai
claude mcp add --transport http ai-oriiion-oriiion 'https://www.oriiion.ai/mcp'
What is the oriiion MCP server?
oriiion is an MCP server listed in the public MCP registry as ai.oriiion/oriiion. Your marketing, a message away. This page covers its hosted endpoint (https://www.oriiion.ai/mcp).
Is the oriiion MCP server safe to use?
oriiion scores 86 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the oriiion MCP server expose?
oriiion exposes 183 tools: get_chatgpt_ads, create_chatgpt_ad, edit_chatgpt_ad, start_chatgpt_ad, pause_chatgpt_ad, and 178 more. Their descriptions and schemas cost roughly 24,030 tokens of context every time the server is loaded.
Does the oriiion MCP server require authentication?
Yes. oriiion asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.
Is the oriiion MCP server still maintained?
oriiion is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What did VerifyMCP test on the oriiion MCP server?
VerifyMCP ran 13 checks on oriiion, covering TLS certificate, Authorization, HTTPS, HSTS header and 9 more. Supply Chain Security and Provenance & Transparency do not apply to a hosted endpoint, so they were not tested. The score does not measure everything, and the scoring documentation lists what it leaves out.