SoapBox Faith
REMOTE · FOYEKANOXPNKYDOIBAAS.SUPABASE.CO · SCANNED SEP 20
Faith tools for AI agents: cited KJV Scripture, ORA Q&A, sermons, churches, prayer & giving.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security80
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- No authorisation is required to call this server. Every tool declares its destructiveHint and none is destructive, so open access doesn't expose one. See how to fix → View diagnostics → Partial
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability85
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 2894 tokens (~144/item across 20 items; 19 tools + 1 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 21 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities60
- Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28. See how to fix → Fail
How do I install the SoapBox Faith MCP server?
SoapBox Faith is a hosted endpoint at https://foyekanoxpnkydoibaas.supabase.co/functions/v1/faith-mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · foyekanoxpnkydoibaas.supabase.co
claude mcp add --transport http alansafahi-soapbox-faith 'https://foyekanoxpnkydoibaas.supabase.co/functions/v1/faith-mcp'
{
"mcpServers": {
"alansafahi-soapbox-faith": {
"url": "https://foyekanoxpnkydoibaas.supabase.co/functions/v1/faith-mcp"
}
}
} {
"servers": {
"alansafahi-soapbox-faith": {
"type": "http",
"url": "https://foyekanoxpnkydoibaas.supabase.co/functions/v1/faith-mcp"
}
}
} [mcp_servers.alansafahi-soapbox-faith] url = "https://foyekanoxpnkydoibaas.supabase.co/functions/v1/faith-mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"alansafahi-soapbox-faith": {
"type": "remote",
"url": "https://foyekanoxpnkydoibaas.supabase.co/functions/v1/faith-mcp",
"enabled": true
}
}
} openclaw mcp add alansafahi-soapbox-faith --url 'https://foyekanoxpnkydoibaas.supabase.co/functions/v1/faith-mcp' --transport streamable-http
mcp_servers:
alansafahi-soapbox-faith:
url: "https://foyekanoxpnkydoibaas.supabase.co/functions/v1/faith-mcp" {
"McpServers": {
"alansafahi-soapbox-faith": {
"Transport": "http",
"Url": "https://foyekanoxpnkydoibaas.supabase.co/functions/v1/faith-mcp"
}
}
} assistant mcp add alansafahi-soapbox-faith -t streamable-http -u 'https://foyekanoxpnkydoibaas.supabase.co/functions/v1/faith-mcp'
{
"mcpServers": {
"alansafahi-soapbox-faith": {
"type": "http",
"url": "https://foyekanoxpnkydoibaas.supabase.co/functions/v1/faith-mcp"
}
}
} The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 31 Aug 26 +53
- Authorization: unverified → partial ▲ security
- Injection markers: unverified → pass ▲ security
- Stability: unverified → pass ▲ security
- MCP protocol: unverified → fail ▼ functional
- Endpoint reachability: not serving MCP → reachable ▲ functional
- Tool coverage: unverified → 100 ▲ functional
- Schema quality: unverified → 100 ▲ functional
- 30 Aug 26 −52
- Endpoint reachability: reachable → not serving MCP ▼ security
- Tool safety: pass → unverified ▼ security
- Authorization: partial → unverified ▼ security
- Stability: 0.97 → unverified ▼ security
- Schema quality: 100 → unverified ▼ functional
- Capabilities: fail → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- 29 Aug 26 −1
- Stability: pass → 0.97 functional
- 26 Aug 26 +1
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 25 Aug 26 0
- Stability: 0.97 → pass security
- 24 Aug 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
- 11 Aug 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 31 Jul 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Probed https://foyekanoxpnkydoibaas.supabase.co/functions/v1/faith-mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=supabase.co | CN=WE1,O=Google Trust Services,C=US | 26 Aug 2026 | 24 Nov 2026 | ECDSA 256 | ECDSA-SHA256 | 7c35296a896c0a6f13f8495266045d45 |
| SANs: supabase.co, *.supabase.co | ||||||
| CN=WE1,O=Google Trust Services,C=US (CA) | CN=GTS Root R4,O=Google Trust Services LLC,C=US | 13 Dec 2023 | 20 Feb 2029 | ECDSA 256 | ECDSA-SHA384 | 7ff31977972c224a76155d13b6d685e3 |
| CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) | CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE | 15 Nov 2023 | 28 Jan 2028 | ECDSA 384 | SHA256-RSA | 7fe530bf331343bedd821610493d8a1b |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of foyekanoxpnkydoibaas.supabase.co. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| co. | present | 7786 | 8 | Verified |
| supabase.co. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
| Header | Value |
|---|---|
| strict-transport-security | max-age=31536000; includeSubDomains; preload |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://foyekanoxpnkydoibaas.supabase.co/functions/v1/faith-mcp | Verified | 200 | |
| http (plaintext) | http://foyekanoxpnkydoibaas.supabase.co/functions/v1/faith-mcp | HTTPS enforced | 301 | https://foyekanoxpnkydoibaas.supabase.co/functions/v1/faith-mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
ask_ora ~133
Ask ORA, SoapBox's Scripture study aid, a Bible or faith question. Returns a grounded answer that cites public-domain (KJV) passages, plus the citations used. ORA is a STUDY AID — not a pastor, counselor, or therapist; for personal crises or pastoral/medical needs it points to a trusted pastor or professional. Use this for explanatory/study questions ('what does Romans 8 teach about...', 'where does the Bible discuss...'); use get_verse when you just need a verse's text.
| Name | Type | Req | Description |
|---|---|---|---|
| question | string | yes | A Bible or faith study question in natural language. |
No output schema declared.
No examples provided.
browse_catalog ~112
Browse purchasable faith-content products on SoapBox (currently consented sermons; reading-plan and devotional bundles coming). Returns products with id, title, church, and price. Then buy with purchase_sermon. Optional church_id and text filter. No key required.
| Name | Type | Req | Description |
|---|---|---|---|
| church_id | string | – | Optional SoapBox community id to scope the catalog to a single church. |
| limit | integer | – | Maximum number of products to return. |
| q | string | – | Optional case-insensitive text filter matched against product titles. |
No output schema declared.
No examples provided.
check_prayer_status ~104
Check how many people are praying for a prayer request previously submitted for a user (and whether it's been marked answered). Requires the same user's consent_token; only returns status for that user's own prayers.
| Name | Type | Req | Description |
|---|---|---|---|
| consent_token | string | yes | The same user's SoapBox consent token (scope 'prayer:write') used when the prayer was submitted. Only returns status for that user's own prayers. |
| prayer_id | string | yes | The prayer_id returned by submit_prayer_request. |
No output schema declared.
No examples provided.
find_churches ~153
Find churches near a location from SoapBox's public church directory. Given latitude/longitude (and optional radius, denomination filter), returns nearby churches with name, denomination, city/state/country, website, distance in miles, and whether the church is on SoapBox (with its community id for deep-linking). Public directory data only — no personal contact info.
| Name | Type | Req | Description |
|---|---|---|---|
| denomination | string | – | Optional case-insensitive denomination filter. |
| lat | number | yes | Latitude of the search center, in decimal degrees. |
| limit | integer | – | Maximum number of churches to return. |
| lng | number | yes | Longitude of the search center, in decimal degrees. |
| radius_miles | number | – | Search radius in miles. |
No output schema declared.
No examples provided.
get_credit_balance ~53
Check how many marketplace credits your API key has (in cents) for buying paid sermon access, plus your tier and daily rate limit. Top-ups are done via the topup API action or the SoapBox developer portal.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_faith_context ~172
Read a user's portable 'faith context' to personalize your responses — their denomination, preferred language, faith journey, and ministry interests — shared WITH THE USER'S EXPLICIT CONSENT. Requires the user's consent_token with the 'context:read' scope (bound to this agent). Use it to tailor tone, tradition, and language. It returns only the user's declared profile (never their private prayers or journal).
| Name | Type | Req | Description |
|---|---|---|---|
| consent_token | string | yes | Opaque SoapBox consent token with the 'context:read' scope, bound to your agent key. The user generates it in the SoapBox app. Returns only the user's declared profile (denomination, preferred langua… |
No output schema declared.
No examples provided.
get_lectionary ~97
Get the Western (Revised Common Lectionary / Roman) liturgical season, liturgical color, RCL year (A/B/C), and any major feast for a date (defaults to today). Useful for date-aware, season-appropriate faith content. Daily readings are not included (those tables are licensed). No key required.
| Name | Type | Req | Description |
|---|---|---|---|
| date | string | – | Optional ISO date (YYYY-MM-DD). Defaults to today in UTC. |
No output schema declared.
No examples provided.
get_sermon ~136
Fetch full metadata and (optionally) the transcript for ONE sermon by its id — typically a sermon_id returned by search_sermons. Only returns sermons a pastor has opted in to share with agents; otherwise returns not-found. If the sermon is paid and you haven't purchased it, the transcript is withheld and a price is returned — call purchase_sermon first. Free sermons return the transcript directly.
| Name | Type | Req | Description |
|---|---|---|---|
| include_transcript | boolean | – | Whether to include the full transcript text (only for free or already-purchased sermons). |
| sermon_id | string | yes | The sermon's id, typically the sermon_id from a search_sermons result. |
No output schema declared.
No examples provided.
get_verse ~88
Look up a public-domain KJV Bible verse by book, chapter, and verse.
| Name | Type | Req | Description |
|---|---|---|---|
| book | string | yes | Canonical book name (English). Accepts common forms like 'John', 'Psalms', '1 Corinthians', 'Song of Solomon'. |
| chapter | integer | yes | Chapter number (1-based). |
| verse | integer | yes | Verse number within the chapter (1-based). |
No output schema declared.
No examples provided.
give_to_church ~317
Make a one-time donation to a church ON BEHALF OF A USER, within the spending caps they pre-authorized. Requires the user's consent_token with the 'giving:write' scope (bound to this agent) and a card they saved in the SoapBox app. The gift goes straight to the church (passthrough — SoapBox takes no cut). Rejected if the amount exceeds the per-gift or monthly cap. Pass a stable idempotency_key to avoid double-charging on retries. Amounts are in the smallest currency unit (cents).
| Name | Type | Req | Description |
|---|---|---|---|
| amount_cents | integer | yes | Gift amount in the smallest currency unit (cents). Must be within the user's per-gift and monthly caps or the call is rejected. |
| community_id | string | yes | The recipient church's SoapBox community id (e.g. the soapbox_community_id from find_churches). |
| consent_token | string | yes | Opaque SoapBox consent token with the 'giving:write' scope, bound to your agent key and carrying the user's pre-authorized per-gift and monthly caps. Generated by the user in the SoapBox app. |
| currency | string | – | Optional ISO 4217 currency code (lowercase). Defaults to the church's own currency. |
| idempotency_key | string | – | A stable, caller-generated key so retries don't double-charge. Reuse the same key when retrying the same intended gift. |
| note | string | – | Optional short note to the church accompanying the gift. |
No output schema declared.
No examples provided.
lookup_strongs ~67
Look up a Strong's Greek/Hebrew lexicon entry (lemma, transliteration, gloss, definition).
| Name | Type | Req | Description |
|---|---|---|---|
| strongs_number | string | yes | A Strong's number: 'G' + digits for Greek (New Testament) or 'H' + digits for Hebrew (Old Testament). |
No output schema declared.
No examples provided.
pay_with_x402 ~333
Pay for a paid sermon or bundle per-call in USDC on Base using the x402 protocol — the AGENT-NATIVE rail, no SoapBox account, API key, or prepaid credits required (https://github.com/coinbase/x402). Two-step, exactly per spec: (1) call with just the sermon_id (or bundle_id) and NO payment to get back the HTTP-402 payment requirements — the USDC amount, asset, network ('base'), and SoapBox's payTo receive address. (2) Send USDC on Base to that payTo, then call again with x_payment set to a base64-encoded JSON payload carrying your broadcast Base tx hash ({"txHash":"0x..."}) — SoapBox verifies the on-chain transfer, records the sale (church keeps 70%), and returns the transcript. Idempotent per tx hash. Gasless EIP-3009 'exact' payments via an x402 facilitator are also accepted in the same x_payment field.
| Name | Type | Req | Description |
|---|---|---|---|
| bundle_id | string | – | The bundle to pay for. Provide exactly one of sermon_id or bundle_id. |
| sermon_id | string | – | The sermon to pay for. Provide exactly one of sermon_id or bundle_id. |
| x_payment | string | – | Step 2 only: a base64-encoded JSON x402 payment payload (e.g. base64 of {"txHash":"0x..."} for an on-chain Base USDC transfer, or an EIP-3009 authorization for a facilitator). Omit entirely on step 1… |
No output schema declared.
No examples provided.
purchase_bundle ~132
Buy a bundle (a sermon series — multiple sermons sold together at one price) using prepaid marketplace credits. Grants access to EVERY sermon in the bundle. Same terms as purchase_sermon: church keeps 70% of net, SoapBox 30% (a content sale, not a donation). Idempotent. Find bundles via browse_catalog (type: bundle). No key / no credits? Pay per-call in USDC on Base via x402 — call pay_with_x402 with this bundle_id.
| Name | Type | Req | Description |
|---|---|---|---|
| bundle_id | string | yes | The bundle's id — the product_id from browse_catalog where type=bundle. |
No output schema declared.
No examples provided.
purchase_sermon ~174
Buy permanent access to a paid sermon using your prepaid marketplace credits. SoapBox is the Merchant of Record: the church keeps 70% and SoapBox takes a 30% platform fee (this is a content SALE, NOT a donation — donations always go 100% directly to the church). After purchase, get_sermon returns the full transcript. Purchases are idempotent (buying the same sermon twice won't double-charge). If you have insufficient credits, check get_credit_balance and top up. No key / no credits? Pay per-call in USDC on Base via x402 instead — call pay_with_x402 with this sermon_id (agent-native, no SoapBox account).
| Name | Type | Req | Description |
|---|---|---|---|
| sermon_id | string | yes | The paid sermon to purchase, e.g. a sermon_id from search_sermons or browse_catalog. |
No output schema declared.
No examples provided.
score_doctrinal_fit ~102
Assess how well a statement aligns with a named Christian tradition's historic doctrinal positions (e.g. Reformed, Roman Catholic, Pentecostal, Eastern Orthodox). Returns an impartial alignment rating, score, summary, and the relevant doctrinal loci. Analytical, not proselytizing. No key required.
| Name | Type | Req | Description |
|---|---|---|---|
| statement | string | yes | The theological statement or claim to assess. |
| tradition | string | yes | The Christian tradition or denomination to assess alignment against. |
No output schema declared.
No examples provided.
search_sermons ~139
Semantically search real sermons on SoapBox that pastors have explicitly opted in to share with AI agents. Returns ranked transcript excerpts with the sermon title, church, speaker, scripture reference, and a start-time (seconds) so you can cite the exact moment. Use this to find what churches are actually preaching on a topic. Only consented, published sermons are searchable.
| Name | Type | Req | Description |
|---|---|---|---|
| church_id | string | – | Optional SoapBox community id to scope the search to a single church. |
| match_count | integer | – | Maximum number of ranked excerpts to return. |
| query | string | yes | A topic, phrase, or question to semantically search sermon transcripts for. |
No output schema declared.
No examples provided.
submit_prayer_request ~191
Post a prayer request to SoapBox's prayer wall ON BEHALF OF A USER, so their community can pray for it. Requires the user's consent_token (which they generate in the SoapBox app and which must include the 'prayer:write' scope) — an API key alone is not enough to act for a user. Returns the new prayer_id; use check_prayer_status to see how many are praying.
| Name | Type | Req | Description |
|---|---|---|---|
| consent_token | string | yes | Opaque SoapBox consent token with the 'prayer:write' scope, generated by the user in the SoapBox app. An invalid, expired, or wrong-scope token returns an authorization error. |
| content | string | yes | The prayer request text, in the user's own words. |
| is_private | boolean | – | If true, keep it private to the user; if false, share it on the community wall so others can pray. |
No output schema declared.
No examples provided.
synthesize_speech ~177
Generate spoken-audio (text-to-speech) for a verse, prayer, or devotional in 50+ languages, and get back a playable audio URL. Pass BCP-47 language (e.g. en-US, es-ES, sw-KE), optional voice/gender. Results are cached. Requires an API key (audio generation has real cost).
| Name | Type | Req | Description |
|---|---|---|---|
| format | string | – | Audio container/encoding of the returned URL. |
| gender | string | – | Preferred voice gender when a specific voice is not named. |
| language | string | – | BCP-47 language tag for the voice. |
| text | string | yes | The text to synthesize into speech (a verse, prayer, or short devotional). |
| voice | string | – | Optional specific Google Cloud TTS voice name; overrides the default voice for the language. |
No output schema declared.
No examples provided.
verify_scripture ~112
Verify whether a quote is real Scripture and cited correctly (anti-hallucination). Returns whether it matches a real verse, the canonical KJV reference + text, a confidence score, and — if you pass a claimed reference — whether the attribution is correct. Use this before presenting any Bible quote to avoid misquotes/fabrications.
| Name | Type | Req | Description |
|---|---|---|---|
| quote | string | yes | The exact quote to verify, as you would present it to a user. |
| reference | string | – | Optional claimed reference to check the attribution against. |
No output schema declared.
No examples provided.
What is the SoapBox Faith MCP server?
SoapBox Faith is an MCP server listed in the public MCP registry as io.github.alansafahi/soapbox-faith. Faith tools for AI agents: cited KJV Scripture, ORA Q&A, sermons, churches, prayer & giving. This page covers its hosted endpoint (https://foyekanoxpnkydoibaas.supabase.co/functions/v1/faith-mcp).
Is the SoapBox Faith MCP server safe to use?
SoapBox Faith scores 88 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the SoapBox Faith MCP server expose?
SoapBox Faith exposes 19 tools: verify_scripture, get_verse, lookup_strongs, find_churches, submit_prayer_request, and 14 more. Their descriptions and schemas cost roughly 2,792 tokens of context every time the server is loaded.
Does the SoapBox Faith MCP server require authentication?
No. We connected to SoapBox Faith without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the SoapBox Faith MCP server still maintained?
SoapBox Faith is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.