Spala Public MCP

REMOTE · MCP.SPALA.AI · SCANNED AUG 3

Discovery, OAuth, project operations, and exact project MCP handoff for Spala backend projects.

Available components

+8 this week 64 64 Trust /100

Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score →

Endpoint Security57

The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
Authorisation check failed: no authorisation is required to call this server, and it exposes a tool marked destructive (account_setup). See how to fix → View diagnostics → Fail
HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail

Transport & Reachability100

Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass

Schema Quality & AI Usability60

AI-judged instruction clarity (good).Pass
Context-footprint check failed: tool/resource definitions use about 2119 tokens (~132/item across 16 items; 16 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
Usage-examples check failed: none of the tools include examples. See how to fix → Fail

Stability & Change Management27

Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial

Tool Coverage100

100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
100% of tool parameters carry a description.Pass
Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass

Capabilities100

Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass

Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

remote · mcp.spala.ai

Claude Codex opencode OpenClaw Hermes Other

# add to Claude Code

claude mcp add --transport http ai-spala-public-mcp https://mcp.spala.ai/mcp

# ~/.codex/config.toml

[mcp_servers.ai-spala-public-mcp]
url = "https://mcp.spala.ai/mcp"

// opencode.json

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "ai-spala-public-mcp": {
      "type": "remote",
      "url": "https://mcp.spala.ai/mcp",
      "enabled": true
    }
  }
}

# add to OpenClaw

openclaw mcp add ai-spala-public-mcp --url https://mcp.spala.ai/mcp --transport streamable-http

# ~/.hermes/config.yaml

mcp_servers:
  ai-spala-public-mcp:
    url: "https://mcp.spala.ai/mcp"

// mcp.json

{
  "mcpServers": {
    "ai-spala-public-mcp": {
      "type": "http",
      "url": "https://mcp.spala.ai/mcp"
    }
  }
}

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

3 Aug 26 +1

No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.
1 Aug 26 +1

No change was recorded against any check on this day. Stability & Change Management went from 17 to 20. That category is still filling its 30-day observation window: 5 days of observed history at the previous scan, 6 at this one. The score rises as the window fills, whether or not the server changes.
31 Jul 26 +1
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
30 Jul 26 +1

No change was recorded against any check on this day. Stability & Change Management went from 10 to 13. That category is still filling its 30-day observation window: 3 days of observed history at the previous scan, 4 at this one. The score rises as the window fills, whether or not the server changes.
29 Jul 26 +4

No change was recorded against any check on this day. Schema Quality & AI Usability went from 43 to 55. Other categories moved too: Stability & Change Management rose 7.
27 Jul 26 +1
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
26 Jul 26 55

First indexed and scored.

Show 6 earlier entries Hide earlier entries

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 3 Aug 2026 · Probed https://mcp.spala.ai/mcp

TLS valid

Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .

Subject	Issuer	Valid from	Valid until	Key	Signature	Serial
CN=spala.ai	CN=WE1,O=Google Trust Services,C=US	7 Jul 2026	5 Oct 2026	ECDSA 256	ECDSA-SHA256	efcfb2dd7e3dd641302a1b4abcee0b1
SANs: spala.ai, .spala.ai, mcp.spala.ai, .mcp.spala.ai
CN=WE1,O=Google Trust Services,C=US (CA)	CN=GTS Root R4,O=Google Trust Services LLC,C=US	13 Dec 2023	20 Feb 2029	ECDSA 256	ECDSA-SHA384	7ff31977972c224a76155d13b6d685e3
CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA)	CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE	15 Nov 2023	28 Jan 2028	ECDSA 384	SHA256-RSA	7fe530bf331343bedd821610493d8a1b

DNSSEC insecure

Validation of mcp.spala.ai. — Not signed

Zone	DS	Keys	Algorithms	Outcome
.	trust_anchor	20326, 38696	8, 8	Verified
ai.	present	3799	8	Verified
spala.ai.	absent			Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation

Authentication No authorisation required

The endpoint answered without asking for a token. Anyone who knows the URL can reach it.

Result	No authorisation required
HTTP status	200

Transports 2 probes

Transport	URL	Outcome	Status	Location
streamable-http	https://mcp.spala.ai/mcp	Verified	200
http (plaintext)	http://mcp.spala.ai/mcp	HTTPS enforced	301	https://mcp.spala.ai/mcp

MCP tools — 16 exposed · ~1,523 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens

account_setup Complete Spala Account Setup ~121

AUTH REQUIRED; WRITES MISSING ACCOUNT DATA TO THE SPALA CONTROL PLANE. Fills missing first and last name fields and creates the first company or workspace organization when none exists. Invoke only with real account and organization values supplied by the user.

Input Output Examples

Name	Type	Req	Description
companyName	string	—	Company or workspace name. Required when account_status reports companyName missing.
firstName	string	—	Account holder first name. Required when account_status reports firstName missing.
lastName	string	—	Account holder last name. Required when account_status reports lastName missing.

Name	Type	Req	Description
accountSetup	string	yes	—
nextAction	object	yes	—
organization	object	yes	—
organizationCreated	boolean	yes	—
profileUpdated	boolean	yes	—
user	object	yes	—

No examples provided.

account_status Check Spala Account ~47

AUTH REQUIRED; READ-ONLY. Verifies the current public MCP OAuth identity and account readiness. Returns the authenticated identity, available organizations, and exact missing account fields without exposing OAuth or dashboard credentials.

Input Output Examples

Input schema present but exposes no named parameters.

Name	Type	Req	Description
accountSetup	object	yes	—
authenticated	boolean	yes	—
next	string	—	—
oauthResource	string	yes	—
organizations	array	yes	—
subject	string	yes	—
tokenStatus	string	yes	—
user	object	yes	—

No examples provided.

addon_list List Spala Addons ~95

Lists public Spala addons and integrations matching an optional query. Invoke to discover capabilities such as webhooks, outbound HTTP API calls, transactional email, media uploads, and realtime messaging. Returns addon ids, names, descriptions, and tags.

Input Output Examples

Name	Type	Req	Description
limit	integer	—	Maximum number of catalog entries to return.
query	string	—	Optional filter phrase for matching public Spala templates or addons by name, tag, or use case.

Name	Type	Req	Description
addons	array	yes	—
query	string	yes	—

No examples provided.

docs_search Search Spala Documentation ~111

Searches the public Spala agent-facing documentation index by query. Invoke for setup, OAuth, installer, public-versus-project MCP, pricing, limits, security, templates, addons, or project handoff questions. Returns ranked docs entries with URLs and summaries.

Input Output Examples

Name	Type	Req	Description
limit	integer	—	Maximum number of ranked documentation results to return.
query	string	—	Optional search phrase. Use words such as auth, OAuth, MCP, templates, addons, pricing, limits, frontend handoff, or project handoff.

Name	Type	Req	Description
query	string	yes	—
results	array	yes	—

No examples provided.

organization_create Create Spala Organization ~51

AUTH REQUIRED; WRITES A NEW SPALA ORGANIZATION FOR THE SIGNED-IN ACCOUNT. Creates an additional company or workspace organization using the supplied name.

Input Output Examples

Name	Type	Req	Description
name	string	yes	Human-readable company or workspace name.

Name	Type	Req	Description
created	boolean	yes	—
nextAction	object	yes	—
organization	object	yes	—

No examples provided.

project_connect Connect Spala Project ~177

AUTH REQUIRED; IDEMPOTENT PROJECT CONNECTION WRITE. Prepares one accessible Spala project for agent access. Accepts one installer client (codex, roo, claude-code, cursor, a2a); when omitted, returns a client-selection response without executable arguments. Returns a protected one-time bootstrap capability and a workspace-scoped project binding plan without exposing bearer credentials.

Input Output Examples

Name	Type	Req	Description
client	string	—	Target MCP client for @spala-ai/mcp-install. Omit to receive client_selection_required without an executable mutation plan.
organizationId	string	—	Optional organization ID returned for the signed-in account.
projectId	string	—	Exact Spala project ID. Mutually exclusive with subdomain.
subdomain	string	—	Exact project subdomain returned by the Spala projects API. Mutually exclusive with projectId.

Name	Type	Req	Description
bootstrap	object	yes	—
bootstrapPreparedByProjectBackend	boolean	—	—
handoff	object	yes	—
installPlan	object	yes	—
intentBoundary	object	—	—
mcpUrl	string	yes	—
nextSteps	array	—	—
preparedByProjectBackend	boolean	—	—
project	object	yes	—
rule	string	—	—
serverName	string	yes	—
transport	string	yes	—
workspaceOnly	boolean	—	—

No examples provided.

project_create Create Spala Project ~103

AUTH REQUIRED; WRITES TO THE SPALA CONTROL PLANE. Creates a real Spala project with the supplied project name in an accessible organization. Accepts an organization id when multiple organizations are available and automatically scopes a sole organization. This operation is not idempotent.

Input Output Examples

Name	Type	Req	Description
name	string	yes	Human-readable name for the new Spala project.
organizationId	string	—	Organization ID returned for the signed-in account. Optional only when exactly one organization is available.

Name	Type	Req	Description
created	boolean	yes	—
mcpUrlResolved	boolean	yes	—
next	string	yes	—
organization	object	yes	—
project	object	yes	—
provisioning	object	yes	—

No examples provided.

project_get_mcp_manifest Get Project MCP Manifest ~178

AUTH REQUIRED; IDEMPOTENT PROJECT CONNECTION WRITE. Prepares one accessible project and returns its exact platform-provided project MCP manifest URL, MCP URL, protected bootstrap capability, and workspace binding plan. Accepts one installer client (codex, roo, claude-code, cursor, a2a); when omitted, returns a client-selection response without executable arguments.

Input Output Examples

Name	Type	Req	Description
client	string	—	Target MCP client for @spala-ai/mcp-install. Omit to receive client_selection_required without an executable mutation plan.
organizationId	string	—	Optional organization ID returned for the signed-in account.
projectId	string	—	Exact Spala project ID. Mutually exclusive with subdomain.
subdomain	string	—	Exact project subdomain returned by the Spala projects API. Mutually exclusive with projectId.

Name	Type	Req	Description
auth	string	—	—
bootstrap	object	yes	—
handoff	object	yes	—
installPlan	object	yes	—
intentBoundary	object	—	—
manifestUrl	string	yes	—
mcpUrl	string	yes	—
name	string	yes	—
nextSteps	array	—	—
project	object	yes	—
rule	string	—	—
schemaVersion	integer	yes	—
serverName	string	yes	—
transport	string	yes	—

No examples provided.

project_get_public_context Get Project Public Context ~107

AUTH REQUIRED; READ-ONLY. Returns documented MCP handoff fields for one accessible project without exposing tokens, private source code, unrelated customer data, or executable installer arguments.

Input Output Examples

Name	Type	Req	Description
organizationId	string	—	Optional organization ID returned for the signed-in account.
projectId	string	—	Exact Spala project ID. Mutually exclusive with subdomain.
subdomain	string	—	Exact project subdomain returned by the Spala projects API. Mutually exclusive with projectId.

Name	Type	Req	Description
handoff	object	yes	—
intentBoundary	object	yes	—
project	object	yes	—

No examples provided.

project_list List Spala Projects ~70

AUTH REQUIRED; READ-ONLY. Lists projects accessible to the authenticated Spala user in one organization. Accepts an organization id when multiple organizations are available and automatically scopes a sole organization.

Input Output Examples

Name	Type	Req	Description
organizationId	string	—	Organization ID returned for the signed-in account. Optional only when exactly one organization is available.

Name	Type	Req	Description
organization	object	yes	—
projects	array	yes	—

No examples provided.

project_select Select Spala Project ~139

AUTH REQUIRED; IDEMPOTENT PROJECT CONNECTION WRITE. Compatibility alias for project_connect. Prepares one accessible project and returns its protected one-time bootstrap capability and workspace-scoped binding plan.

Input Output Examples

Name	Type	Req	Description
client	string	—	Target MCP client for @spala-ai/mcp-install. Omit to receive client_selection_required without an executable mutation plan.
organizationId	string	—	Optional organization ID returned for the signed-in account.
projectId	string	—	Exact Spala project ID. Mutually exclusive with subdomain.
subdomain	string	—	Exact project subdomain returned by the Spala projects API. Mutually exclusive with projectId.

Name	Type	Req	Description
bootstrap	object	yes	—
bootstrapPreparedByProjectBackend	boolean	—	—
handoff	object	yes	—
installPlan	object	yes	—
intentBoundary	object	—	—
mcpUrl	string	yes	—
nextSteps	array	—	—
preparedByProjectBackend	boolean	—	—
project	object	yes	—
rule	string	—	—
serverName	string	yes	—
transport	string	yes	—
workspaceOnly	boolean	—	—

No examples provided.

spala_get_onboarding Get Spala Onboarding ~47

Returns machine-readable Spala onboarding information for MCP clients. Includes product scope, OAuth metadata, supported installer client identifiers, authenticated project-handoff status, workflow stages, and canonical links.

Input Output Examples

Input schema present but exposes no named parameters.

Name	Type	Req	Description
handoffExample	object	—	—
intentBoundary	object	—	—
product	string	yes	—
projectMcpRole	string	yes	—
publicMcpRole	string	yes	—
supportedInstallerClients	array	—	—
urls	object	yes	—
workflow	array	yes	—

No examples provided.

spala_get_tool_map Get Spala Tool Map ~49

Returns a machine-readable routing map for Spala MCP clients. Identifies public and authenticated tools, supported installer clients, OAuth endpoints, project handoff rules, and project-MCP entry points.

Input Output Examples

Input schema present but exposes no named parameters.

Name	Type	Req	Description
projectMcp	object	yes	—
publicMcp	object	yes	—

No examples provided.

spala_help Learn About Spala ~62

Returns a human-readable overview of Spala, canonical start URLs, and the boundary between public discovery and project-scoped backend MCPs. Invoke for product, setup, or integration orientation. This read-only tool requires no authentication and does not access or modify project data.

Input Output Examples

Input schema present but exposes no named parameters.

Name	Type	Req	Description
markdown	string	yes	—

No examples provided.

spala_start Start Spala ~74

AUTH REQUIRED; READ-ONLY STARTUP. Invoke after OAuth to begin Spala account or project setup. Returns a versioned startup phase with account readiness, organizations, safely scoped project discovery, and one explicit next action. Reports missing account fields, automatically scopes a sole organization, and returns all accessible choices when multiple organizations exist.

Input Output Examples

Input schema present but exposes no named parameters.

Name	Type	Req	Description
accountSetup	object	yes	—
authenticated	boolean	yes	—
backendProvider	string	yes	—
nextAction	object	yes	—
organizations	array	yes	—
phase	string	yes	—
projects	array	yes	—
schemaVersion	integer	yes	—
selectedOrganizationId	string	—	—
user	object	yes	—

No examples provided.

template_list List Spala Templates ~92

Lists public Spala backend templates matching an optional query. Invoke to discover available backend starting points such as marketplace, dashboard API, reservation, inventory, or document management. Returns template ids, names, descriptions, and tags.

Input Output Examples

Name	Type	Req	Description
limit	integer	—	Maximum number of catalog entries to return.
query	string	—	Optional filter phrase for matching public Spala templates or addons by name, tag, or use case.

Name	Type	Req	Description
query	string	yes	—
templates	array	yes	—

No examples provided.

On this page

Handy links

Scoring key

80+ high trust
60–79 medium
below 60 low

How we score

Score history · last 30 days

26 Jul 3 Aug

Day	Score
26 Jul	55
27 Jul	56
29 Jul	60
30 Jul	61
31 Jul	62
1 Aug	63
2 Aug	63
3 Aug	64