Spala Public MCP
REMOTE · MCP.SPALA.AI · SCANNED SEP 24
Discovery, OAuth, project operations, and exact project MCP handoff for Spala backend projects.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security57
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation check failed: no authorisation is required to call this server, and it exposes a tool marked destructive (account_setup). See how to fix → View diagnostics → Fail
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability71
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 2511 tokens (~156/item across 16 items; 16 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 16 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 17 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the Spala Public MCP server?
Spala Public MCP is a hosted endpoint at https://mcp.spala.ai/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · mcp.spala.ai
claude mcp add --transport http ai-spala-public-mcp 'https://mcp.spala.ai/mcp'
{
"mcpServers": {
"ai-spala-public-mcp": {
"url": "https://mcp.spala.ai/mcp"
}
}
} {
"servers": {
"ai-spala-public-mcp": {
"type": "http",
"url": "https://mcp.spala.ai/mcp"
}
}
} [mcp_servers.ai-spala-public-mcp] url = "https://mcp.spala.ai/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"ai-spala-public-mcp": {
"type": "remote",
"url": "https://mcp.spala.ai/mcp",
"enabled": true
}
}
} openclaw mcp add ai-spala-public-mcp --url 'https://mcp.spala.ai/mcp' --transport streamable-http
mcp_servers:
ai-spala-public-mcp:
url: "https://mcp.spala.ai/mcp" {
"McpServers": {
"ai-spala-public-mcp": {
"Transport": "http",
"Url": "https://mcp.spala.ai/mcp"
}
}
} assistant mcp add ai-spala-public-mcp -t streamable-http -u 'https://mcp.spala.ai/mcp'
{
"mcpServers": {
"ai-spala-public-mcp": {
"type": "http",
"url": "https://mcp.spala.ai/mcp"
}
}
} The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 24 Sept 26 0
- “project_connect” dropped the optional parameter “profile” cosmetic
- “project_get_mcp_manifest” dropped the optional parameter “profile” cosmetic
- “project_select” dropped the optional parameter “profile” cosmetic
3 cosmetic changes on this day. Switch on “Show cosmetic changes” to see them.
- 4 Sept 26 0
- “project_connect” added an optional parameter “profile” cosmetic
- “project_get_mcp_manifest” added an optional parameter “profile” cosmetic
- “project_select” added an optional parameter “profile” cosmetic
3 cosmetic changes on this day. Switch on “Show cosmetic changes” to see them.
- 26 Aug 26 78
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 25 Aug 26 0
- Stability: 0.97 → pass security
- 24 Aug 26 0
- The server rewrote its instructions, which are the text every model session reads security
- 23 Aug 26 0
- The server rewrote its instructions, which are the text every model session reads security
- 18 Aug 26 0
- The server rewrote its instructions, which are the text every model session reads security
- 11 Aug 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 24 Sept 2026 · Probed https://mcp.spala.ai/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=spala.ai | CN=WE1,O=Google Trust Services,C=US | 4 Sept 2026 | 3 Dec 2026 | ECDSA 256 | ECDSA-SHA256 | aafa634f4288119213b77f51ed78e89c |
| SANs: spala.ai, *.spala.ai, mcp.spala.ai, *.mcp.spala.ai | ||||||
| CN=WE1,O=Google Trust Services,C=US (CA) | CN=GTS Root R4,O=Google Trust Services LLC,C=US | 13 Dec 2023 | 20 Feb 2029 | ECDSA 256 | ECDSA-SHA384 | 7ff31977972c224a76155d13b6d685e3 |
| CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) | CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE | 15 Nov 2023 | 28 Jan 2028 | ECDSA 384 | SHA256-RSA | 7fe530bf331343bedd821610493d8a1b |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of mcp.spala.ai. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| ai. | present | 3799 | 8 | Verified |
| spala.ai. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://mcp.spala.ai/mcp | Verified | 200 | |
| http (plaintext) | http://mcp.spala.ai/mcp | HTTPS enforced | 301 | https://mcp.spala.ai/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
account_setup Complete Spala Account Setup ~121
AUTH REQUIRED; WRITES MISSING ACCOUNT DATA TO THE SPALA CONTROL PLANE. Fills missing first and last name fields and creates the first company or workspace organization when none exists. Invoke only with real account and organization values supplied by the user.
| Name | Type | Req | Description |
|---|---|---|---|
| companyName | string | – | Company or workspace name. Required when account_status reports companyName missing. |
| firstName | string | – | Account holder first name. Required when account_status reports firstName missing. |
| lastName | string | – | Account holder last name. Required when account_status reports lastName missing. |
| Name | Type | Req | Description |
|---|---|---|---|
| accountSetup | string | yes | – |
| nextAction | object | yes | – |
| organization | object | yes | – |
| organizationCreated | boolean | yes | – |
| profileUpdated | boolean | yes | – |
| user | object | yes | – |
No examples provided.
account_status Check Spala Account ~47
AUTH REQUIRED; READ-ONLY. Verifies the current public MCP OAuth identity and account readiness. Returns the authenticated identity, available organizations, and exact missing account fields without exposing OAuth or dashboard credentials.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| accountSetup | object | yes | – |
| authenticated | boolean | yes | – |
| next | string | – | – |
| oauthResource | string | yes | – |
| organizations | array | yes | – |
| subject | string | yes | – |
| tokenStatus | string | yes | – |
| user | object | yes | – |
No examples provided.
addon_list List Spala Addons ~95
Lists public Spala addons and integrations matching an optional query. Invoke to discover capabilities such as webhooks, outbound HTTP API calls, transactional email, media uploads, and realtime messaging. Returns addon ids, names, descriptions, and tags.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Maximum number of catalog entries to return. |
| query | string | – | Optional filter phrase for matching public Spala templates or addons by name, tag, or use case. |
| Name | Type | Req | Description |
|---|---|---|---|
| addons | array | yes | – |
| query | string | yes | – |
No examples provided.
docs_search Search Spala Documentation ~111
Searches the public Spala agent-facing documentation index by query. Invoke for setup, OAuth, installer, public-versus-project MCP, pricing, limits, security, templates, addons, or project handoff questions. Returns ranked docs entries with URLs and summaries.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Maximum number of ranked documentation results to return. |
| query | string | – | Optional search phrase. Use words such as auth, OAuth, MCP, templates, addons, pricing, limits, frontend handoff, or project handoff. |
| Name | Type | Req | Description |
|---|---|---|---|
| query | string | yes | – |
| results | array | yes | – |
No examples provided.
organization_create Create Spala Organization ~51
AUTH REQUIRED; WRITES A NEW SPALA ORGANIZATION FOR THE SIGNED-IN ACCOUNT. Creates an additional company or workspace organization using the supplied name.
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | yes | Human-readable company or workspace name. |
| Name | Type | Req | Description |
|---|---|---|---|
| created | boolean | yes | – |
| nextAction | object | yes | – |
| organization | object | yes | – |
No examples provided.
project_connect Connect Spala Project ~233
AUTH REQUIRED; IDEMPOTENT PROJECT CONNECTION WRITE. Prepares one accessible Spala project for agent access. Accepts one installer client (codex, roo, claude-code, cursor, a2a); when omitted, returns a client-selection response without executable arguments. Returns a client-specific workspace binding plan: protected one-time bootstrap for Codex, Roo, and Cursor; verifier-bound delegated bootstrap for Claude Code.
| Name | Type | Req | Description |
|---|---|---|---|
| bootstrapChallenge | string | – | S256 challenge returned by project prepare. The verifier remains only in the local credential store. |
| bootstrapRequestId | string | – | Non-secret local request ID returned by project prepare. Claude Code only. |
| client | string | – | Target MCP client for @spala-ai/mcp-install. Omit to receive client_selection_required without an executable mutation plan. |
| organizationId | string | – | Optional organization ID returned for the signed-in account. |
| projectId | string | – | Exact Spala project ID. Mutually exclusive with subdomain. |
| subdomain | string | – | Exact project subdomain returned by the Spala projects API. Mutually exclusive with projectId. |
| Name | Type | Req | Description |
|---|---|---|---|
| bootstrap | object | yes | – |
| bootstrapPreparedByProjectBackend | boolean | – | – |
| handoff | object | yes | – |
| installPlan | object | yes | – |
| intentBoundary | object | – | – |
| mcpUrl | string | yes | – |
| nextSteps | array | – | – |
| preparedByProjectBackend | boolean | – | – |
| project | object | yes | – |
| rule | string | – | – |
| serverName | string | yes | – |
| transport | string | yes | – |
| workspaceOnly | boolean | – | – |
No examples provided.
project_create Create Spala Project ~103
AUTH REQUIRED; WRITES TO THE SPALA CONTROL PLANE. Creates a real Spala project with the supplied project name in an accessible organization. Accepts an organization id when multiple organizations are available and automatically scopes a sole organization. This operation is not idempotent.
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | yes | Human-readable name for the new Spala project. |
| organizationId | string | – | Organization ID returned for the signed-in account. Optional only when exactly one organization is available. |
| Name | Type | Req | Description |
|---|---|---|---|
| created | boolean | yes | – |
| mcpUrlResolved | boolean | yes | – |
| next | string | yes | – |
| organization | object | yes | – |
| project | object | yes | – |
| provisioning | object | yes | – |
No examples provided.
project_get_mcp_manifest Get Project MCP Manifest ~223
AUTH REQUIRED; IDEMPOTENT PROJECT CONNECTION WRITE. Prepares one accessible project and returns its exact platform-provided project MCP manifest URL, MCP URL, and client-specific workspace binding plan. Accepts one installer client (codex, roo, claude-code, cursor, a2a); when omitted, returns a client-selection response without executable arguments.
| Name | Type | Req | Description |
|---|---|---|---|
| bootstrapChallenge | string | – | S256 challenge returned by project prepare. The verifier remains only in the local credential store. |
| bootstrapRequestId | string | – | Non-secret local request ID returned by project prepare. Claude Code only. |
| client | string | – | Target MCP client for @spala-ai/mcp-install. Omit to receive client_selection_required without an executable mutation plan. |
| organizationId | string | – | Optional organization ID returned for the signed-in account. |
| projectId | string | – | Exact Spala project ID. Mutually exclusive with subdomain. |
| subdomain | string | – | Exact project subdomain returned by the Spala projects API. Mutually exclusive with projectId. |
| Name | Type | Req | Description |
|---|---|---|---|
| auth | string | – | – |
| bootstrap | object | yes | – |
| handoff | object | yes | – |
| installPlan | object | yes | – |
| intentBoundary | object | – | – |
| manifestUrl | string | yes | – |
| mcpUrl | string | yes | – |
| name | string | yes | – |
| nextSteps | array | – | – |
| project | object | yes | – |
| rule | string | – | – |
| schemaVersion | integer | yes | – |
| serverName | string | yes | – |
| transport | string | yes | – |
No examples provided.
project_get_public_context Get Project Public Context ~107
AUTH REQUIRED; READ-ONLY. Returns documented MCP handoff fields for one accessible project without exposing tokens, private source code, unrelated customer data, or executable installer arguments.
| Name | Type | Req | Description |
|---|---|---|---|
| organizationId | string | – | Optional organization ID returned for the signed-in account. |
| projectId | string | – | Exact Spala project ID. Mutually exclusive with subdomain. |
| subdomain | string | – | Exact project subdomain returned by the Spala projects API. Mutually exclusive with projectId. |
| Name | Type | Req | Description |
|---|---|---|---|
| handoff | object | yes | – |
| intentBoundary | object | yes | – |
| project | object | yes | – |
No examples provided.
project_list List Spala Projects ~70
AUTH REQUIRED; READ-ONLY. Lists projects accessible to the authenticated Spala user in one organization. Accepts an organization id when multiple organizations are available and automatically scopes a sole organization.
| Name | Type | Req | Description |
|---|---|---|---|
| organizationId | string | – | Organization ID returned for the signed-in account. Optional only when exactly one organization is available. |
| Name | Type | Req | Description |
|---|---|---|---|
| organization | object | yes | – |
| projects | array | yes | – |
No examples provided.
project_select Select Spala Project ~184
AUTH REQUIRED; IDEMPOTENT PROJECT CONNECTION WRITE. Compatibility alias for project_connect. Prepares one accessible project and returns the same client-specific workspace binding contract as project_connect.
| Name | Type | Req | Description |
|---|---|---|---|
| bootstrapChallenge | string | – | S256 challenge returned by project prepare. The verifier remains only in the local credential store. |
| bootstrapRequestId | string | – | Non-secret local request ID returned by project prepare. Claude Code only. |
| client | string | – | Target MCP client for @spala-ai/mcp-install. Omit to receive client_selection_required without an executable mutation plan. |
| organizationId | string | – | Optional organization ID returned for the signed-in account. |
| projectId | string | – | Exact Spala project ID. Mutually exclusive with subdomain. |
| subdomain | string | – | Exact project subdomain returned by the Spala projects API. Mutually exclusive with projectId. |
| Name | Type | Req | Description |
|---|---|---|---|
| bootstrap | object | yes | – |
| bootstrapPreparedByProjectBackend | boolean | – | – |
| handoff | object | yes | – |
| installPlan | object | yes | – |
| intentBoundary | object | – | – |
| mcpUrl | string | yes | – |
| nextSteps | array | – | – |
| preparedByProjectBackend | boolean | – | – |
| project | object | yes | – |
| rule | string | – | – |
| serverName | string | yes | – |
| transport | string | yes | – |
| workspaceOnly | boolean | – | – |
No examples provided.
spala_get_onboarding Get Spala Onboarding ~47
Returns machine-readable Spala onboarding information for MCP clients. Includes product scope, OAuth metadata, supported installer client identifiers, authenticated project-handoff status, workflow stages, and canonical links.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| handoffExample | object | – | – |
| intentBoundary | object | – | – |
| product | string | yes | – |
| projectMcpRole | string | yes | – |
| publicMcpRole | string | yes | – |
| supportedInstallerClients | array | – | – |
| urls | object | yes | – |
| workflow | array | yes | – |
No examples provided.
spala_get_tool_map Get Spala Tool Map ~49
Returns a machine-readable routing map for Spala MCP clients. Identifies public and authenticated tools, supported installer clients, OAuth endpoints, project handoff rules, and project-MCP entry points.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| projectMcp | object | yes | – |
| publicMcp | object | yes | – |
No examples provided.
spala_help Learn About Spala ~62
Returns a human-readable overview of Spala, canonical start URLs, and the boundary between public discovery and project-scoped backend MCPs. Invoke for product, setup, or integration orientation. This read-only tool requires no authentication and does not access or modify project data.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| markdown | string | yes | – |
No examples provided.
spala_start Start Spala ~74
AUTH REQUIRED; READ-ONLY STARTUP. Invoke after OAuth to begin Spala account or project setup. Returns a versioned startup phase with account readiness, organizations, safely scoped project discovery, and one explicit next action. Reports missing account fields, automatically scopes a sole organization, and returns all accessible choices when multiple organizations exist.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| accountSetup | object | yes | – |
| authenticated | boolean | yes | – |
| backendProvider | string | yes | – |
| installerMaintenance | object | yes | – |
| nextAction | object | yes | – |
| organizations | array | yes | – |
| phase | string | yes | – |
| projects | array | yes | – |
| schemaVersion | integer | yes | – |
| selectedOrganizationId | string | – | – |
| user | object | yes | – |
No examples provided.
template_list List Spala Templates ~92
Lists public Spala backend templates matching an optional query. Invoke to discover available backend starting points such as marketplace, dashboard API, reservation, inventory, or document management. Returns template ids, names, descriptions, and tags.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Maximum number of catalog entries to return. |
| query | string | – | Optional filter phrase for matching public Spala templates or addons by name, tag, or use case. |
| Name | Type | Req | Description |
|---|---|---|---|
| query | string | yes | – |
| templates | array | yes | – |
No examples provided.
What is the Spala Public MCP server?
Spala Public MCP is listed in the public MCP registry as ai.spala/public-mcp. Discovery, OAuth, project operations, and exact project MCP handoff for Spala backend projects. This page covers its hosted endpoint (https://mcp.spala.ai/mcp).
Is the Spala Public MCP server safe to use?
Spala Public MCP scores 78 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Spala Public MCP server expose?
Spala Public MCP exposes 16 tools: spala_help, spala_get_onboarding, spala_get_tool_map, docs_search, template_list, and 11 more. Their descriptions and schemas cost roughly 1,669 tokens of context every time the server is loaded.
Does the Spala Public MCP server require authentication?
No. We connected to Spala Public MCP without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the Spala Public MCP server still maintained?
Spala Public MCP is still listed as active in the MCP registry. We last reached this channel on 24 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.