Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

SoapBox Faith

REMOTE · FOYEKANOXPNKYDOIBAAS.SUPABASE.CO · SCANNED SEP 20

Faith tools for AI agents: cited KJV Scripture, ORA Q&A, sermons, churches, prayer & giving.

0 this week 88 Trust /100
Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →

Endpoint Security80
Transport & Reachability100
Schema Quality & AI Usability85
  • 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 2894 tokens (~144/item across 20 items; 19 tools + 1 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
  • No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
  • An AI judge read all 21 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities60
  • Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28. See how to fix → Fail
Install

How do I install the SoapBox Faith MCP server?

SoapBox Faith is a hosted endpoint at https://foyekanoxpnkydoibaas.supabase.co/functions/v1/faith-mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

remote · foyekanoxpnkydoibaas.supabase.co

# add to Claude Code
claude mcp add --transport http alansafahi-soapbox-faith 'https://foyekanoxpnkydoibaas.supabase.co/functions/v1/faith-mcp'
// .cursor/mcp.json
{
  "mcpServers": {
    "alansafahi-soapbox-faith": {
      "url": "https://foyekanoxpnkydoibaas.supabase.co/functions/v1/faith-mcp"
    }
  }
}
// .vscode/mcp.json
{
  "servers": {
    "alansafahi-soapbox-faith": {
      "type": "http",
      "url": "https://foyekanoxpnkydoibaas.supabase.co/functions/v1/faith-mcp"
    }
  }
}
# ~/.codex/config.toml
[mcp_servers.alansafahi-soapbox-faith]
url = "https://foyekanoxpnkydoibaas.supabase.co/functions/v1/faith-mcp"
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "alansafahi-soapbox-faith": {
      "type": "remote",
      "url": "https://foyekanoxpnkydoibaas.supabase.co/functions/v1/faith-mcp",
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add alansafahi-soapbox-faith --url 'https://foyekanoxpnkydoibaas.supabase.co/functions/v1/faith-mcp' --transport streamable-http
# ~/.hermes/config.yaml
mcp_servers:
  alansafahi-soapbox-faith:
    url: "https://foyekanoxpnkydoibaas.supabase.co/functions/v1/faith-mcp"
// ~/.netclaw/config/netclaw.json
{
  "McpServers": {
    "alansafahi-soapbox-faith": {
      "Transport": "http",
      "Url": "https://foyekanoxpnkydoibaas.supabase.co/functions/v1/faith-mcp"
    }
  }
}
# add to Vellum
assistant mcp add alansafahi-soapbox-faith -t streamable-http -u 'https://foyekanoxpnkydoibaas.supabase.co/functions/v1/faith-mcp'
// mcp.json
{
  "mcpServers": {
    "alansafahi-soapbox-faith": {
      "type": "http",
      "url": "https://foyekanoxpnkydoibaas.supabase.co/functions/v1/faith-mcp"
    }
  }
}

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 31 Aug 26 +53
    • Authorization: unverified → partial security
    • Injection markers: unverified → pass security
    • Stability: unverified → pass security
    • MCP protocol: unverified → fail functional
    • Endpoint reachability: not serving MCP → reachable functional
    • Tool coverage: unverified → 100 functional
    • Schema quality: unverified → 100 functional
  • 30 Aug 26 −52
    • Endpoint reachability: reachable → not serving MCP security
    • Tool safety: pass → unverified security
    • Authorization: partial → unverified security
    • Stability: 0.97 → unverified security
    • Schema quality: 100 → unverified functional
    • Capabilities: fail → unverified functional
    • Tool coverage: 100 → unverified functional
  • 29 Aug 26 −1
    • Stability: pass → 0.97 functional
  • 26 Aug 26 +1
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 25 Aug 26 0
    • Stability: 0.97 → pass security
  • 24 Aug 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.

  • 11 Aug 26 0
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 31 Jul 26 0
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 20 Sept 2026 · Probed https://foyekanoxpnkydoibaas.supabase.co/functions/v1/faith-mcp

TLS valid

Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .

Subject Issuer Valid from Valid until Key Signature Serial
CN=supabase.co CN=WE1,O=Google Trust Services,C=US 26 Aug 2026 24 Nov 2026 ECDSA 256 ECDSA-SHA256 7c35296a896c0a6f13f8495266045d45
SANs: supabase.co, *.supabase.co
CN=WE1,O=Google Trust Services,C=US (CA) CN=GTS Root R4,O=Google Trust Services LLC,C=US 13 Dec 2023 20 Feb 2029 ECDSA 256 ECDSA-SHA384 7ff31977972c224a76155d13b6d685e3
CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE 15 Nov 2023 28 Jan 2028 ECDSA 384 SHA256-RSA 7fe530bf331343bedd821610493d8a1b

Background: What to check on a remote MCP endpoint →

DNSSEC insecure

Validation of foyekanoxpnkydoibaas.supabase.co. Not signed

Zone DS Keys Algorithms Outcome
. trust_anchor 20326, 38696 8, 8 Verified
co. present 7786 8 Verified
supabase.co. absent Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation
Authentication No authorisation required

The endpoint answered without asking for a token. Anyone who knows the URL can reach it.

Result No authorisation required
HTTP status 200
Header Value
strict-transport-security max-age=31536000; includeSubDomains; preload

Background: How OAuth 2.1 works in the 2026 MCP spec →

Transports 2 probes
Transport URL Outcome Status Location
streamable-http https://foyekanoxpnkydoibaas.supabase.co/functions/v1/faith-mcp Verified 200
http (plaintext) http://foyekanoxpnkydoibaas.supabase.co/functions/v1/faith-mcp HTTPS enforced 301 https://foyekanoxpnkydoibaas.supabase.co/functions/v1/faith-mcp
MCP tools · 19 exposed · ~2,792 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
ask_ora ~133

Ask ORA, SoapBox's Scripture study aid, a Bible or faith question. Returns a grounded answer that cites public-domain (KJV) passages, plus the citations used. ORA is a STUDY AID — not a pastor, counselor, or therapist; for personal crises or pastoral/medical needs it points to a trusted pastor or professional. Use this for explanatory/study questions ('what does Romans 8 teach about...', 'where does the Bible discuss...'); use get_verse when you just need a verse's text.

NameTypeReqDescription
questionstringyesA Bible or faith study question in natural language.

No output schema declared.

No examples provided.

browse_catalog ~112

Browse purchasable faith-content products on SoapBox (currently consented sermons; reading-plan and devotional bundles coming). Returns products with id, title, church, and price. Then buy with purchase_sermon. Optional church_id and text filter. No key required.

NameTypeReqDescription
church_idstringOptional SoapBox community id to scope the catalog to a single church.
limitintegerMaximum number of products to return.
qstringOptional case-insensitive text filter matched against product titles.

No output schema declared.

No examples provided.

check_prayer_status ~104

Check how many people are praying for a prayer request previously submitted for a user (and whether it's been marked answered). Requires the same user's consent_token; only returns status for that user's own prayers.

NameTypeReqDescription
consent_tokenstringyesThe same user's SoapBox consent token (scope 'prayer:write') used when the prayer was submitted. Only returns status for that user's own prayers.
prayer_idstringyesThe prayer_id returned by submit_prayer_request.

No output schema declared.

No examples provided.

find_churches ~153

Find churches near a location from SoapBox's public church directory. Given latitude/longitude (and optional radius, denomination filter), returns nearby churches with name, denomination, city/state/country, website, distance in miles, and whether the church is on SoapBox (with its community id for deep-linking). Public directory data only — no personal contact info.

NameTypeReqDescription
denominationstringOptional case-insensitive denomination filter.
latnumberyesLatitude of the search center, in decimal degrees.
limitintegerMaximum number of churches to return.
lngnumberyesLongitude of the search center, in decimal degrees.
radius_milesnumberSearch radius in miles.

No output schema declared.

No examples provided.

get_credit_balance ~53

Check how many marketplace credits your API key has (in cents) for buying paid sermon access, plus your tier and daily rate limit. Top-ups are done via the topup API action or the SoapBox developer portal.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

get_faith_context ~172

Read a user's portable 'faith context' to personalize your responses — their denomination, preferred language, faith journey, and ministry interests — shared WITH THE USER'S EXPLICIT CONSENT. Requires the user's consent_token with the 'context:read' scope (bound to this agent). Use it to tailor tone, tradition, and language. It returns only the user's declared profile (never their private prayers or journal).

NameTypeReqDescription
consent_tokenstringyesOpaque SoapBox consent token with the 'context:read' scope, bound to your agent key. The user generates it in the SoapBox app. Returns only the user's declared profile (denomination, preferred langua…

No output schema declared.

No examples provided.

get_lectionary ~97

Get the Western (Revised Common Lectionary / Roman) liturgical season, liturgical color, RCL year (A/B/C), and any major feast for a date (defaults to today). Useful for date-aware, season-appropriate faith content. Daily readings are not included (those tables are licensed). No key required.

NameTypeReqDescription
datestringOptional ISO date (YYYY-MM-DD). Defaults to today in UTC.

No output schema declared.

No examples provided.

get_sermon ~136

Fetch full metadata and (optionally) the transcript for ONE sermon by its id — typically a sermon_id returned by search_sermons. Only returns sermons a pastor has opted in to share with agents; otherwise returns not-found. If the sermon is paid and you haven't purchased it, the transcript is withheld and a price is returned — call purchase_sermon first. Free sermons return the transcript directly.

NameTypeReqDescription
include_transcriptbooleanWhether to include the full transcript text (only for free or already-purchased sermons).
sermon_idstringyesThe sermon's id, typically the sermon_id from a search_sermons result.

No output schema declared.

No examples provided.

get_verse ~88

Look up a public-domain KJV Bible verse by book, chapter, and verse.

NameTypeReqDescription
bookstringyesCanonical book name (English). Accepts common forms like 'John', 'Psalms', '1 Corinthians', 'Song of Solomon'.
chapterintegeryesChapter number (1-based).
verseintegeryesVerse number within the chapter (1-based).

No output schema declared.

No examples provided.

give_to_church ~317

Make a one-time donation to a church ON BEHALF OF A USER, within the spending caps they pre-authorized. Requires the user's consent_token with the 'giving:write' scope (bound to this agent) and a card they saved in the SoapBox app. The gift goes straight to the church (passthrough — SoapBox takes no cut). Rejected if the amount exceeds the per-gift or monthly cap. Pass a stable idempotency_key to avoid double-charging on retries. Amounts are in the smallest currency unit (cents).

NameTypeReqDescription
amount_centsintegeryesGift amount in the smallest currency unit (cents). Must be within the user's per-gift and monthly caps or the call is rejected.
community_idstringyesThe recipient church's SoapBox community id (e.g. the soapbox_community_id from find_churches).
consent_tokenstringyesOpaque SoapBox consent token with the 'giving:write' scope, bound to your agent key and carrying the user's pre-authorized per-gift and monthly caps. Generated by the user in the SoapBox app.
currencystringOptional ISO 4217 currency code (lowercase). Defaults to the church's own currency.
idempotency_keystringA stable, caller-generated key so retries don't double-charge. Reuse the same key when retrying the same intended gift.
notestringOptional short note to the church accompanying the gift.

No output schema declared.

No examples provided.

lookup_strongs ~67

Look up a Strong's Greek/Hebrew lexicon entry (lemma, transliteration, gloss, definition).

NameTypeReqDescription
strongs_numberstringyesA Strong's number: 'G' + digits for Greek (New Testament) or 'H' + digits for Hebrew (Old Testament).

No output schema declared.

No examples provided.

pay_with_x402 ~333

Pay for a paid sermon or bundle per-call in USDC on Base using the x402 protocol — the AGENT-NATIVE rail, no SoapBox account, API key, or prepaid credits required (https://github.com/coinbase/x402). Two-step, exactly per spec: (1) call with just the sermon_id (or bundle_id) and NO payment to get back the HTTP-402 payment requirements — the USDC amount, asset, network ('base'), and SoapBox's payTo receive address. (2) Send USDC on Base to that payTo, then call again with x_payment set to a base64-encoded JSON payload carrying your broadcast Base tx hash ({"txHash":"0x..."}) — SoapBox verifies the on-chain transfer, records the sale (church keeps 70%), and returns the transcript. Idempotent per tx hash. Gasless EIP-3009 'exact' payments via an x402 facilitator are also accepted in the same x_payment field.

NameTypeReqDescription
bundle_idstringThe bundle to pay for. Provide exactly one of sermon_id or bundle_id.
sermon_idstringThe sermon to pay for. Provide exactly one of sermon_id or bundle_id.
x_paymentstringStep 2 only: a base64-encoded JSON x402 payment payload (e.g. base64 of {"txHash":"0x..."} for an on-chain Base USDC transfer, or an EIP-3009 authorization for a facilitator). Omit entirely on step 1…

No output schema declared.

No examples provided.

purchase_bundle ~132

Buy a bundle (a sermon series — multiple sermons sold together at one price) using prepaid marketplace credits. Grants access to EVERY sermon in the bundle. Same terms as purchase_sermon: church keeps 70% of net, SoapBox 30% (a content sale, not a donation). Idempotent. Find bundles via browse_catalog (type: bundle). No key / no credits? Pay per-call in USDC on Base via x402 — call pay_with_x402 with this bundle_id.

NameTypeReqDescription
bundle_idstringyesThe bundle's id — the product_id from browse_catalog where type=bundle.

No output schema declared.

No examples provided.

purchase_sermon ~174

Buy permanent access to a paid sermon using your prepaid marketplace credits. SoapBox is the Merchant of Record: the church keeps 70% and SoapBox takes a 30% platform fee (this is a content SALE, NOT a donation — donations always go 100% directly to the church). After purchase, get_sermon returns the full transcript. Purchases are idempotent (buying the same sermon twice won't double-charge). If you have insufficient credits, check get_credit_balance and top up. No key / no credits? Pay per-call in USDC on Base via x402 instead — call pay_with_x402 with this sermon_id (agent-native, no SoapBox account).

NameTypeReqDescription
sermon_idstringyesThe paid sermon to purchase, e.g. a sermon_id from search_sermons or browse_catalog.

No output schema declared.

No examples provided.

score_doctrinal_fit ~102

Assess how well a statement aligns with a named Christian tradition's historic doctrinal positions (e.g. Reformed, Roman Catholic, Pentecostal, Eastern Orthodox). Returns an impartial alignment rating, score, summary, and the relevant doctrinal loci. Analytical, not proselytizing. No key required.

NameTypeReqDescription
statementstringyesThe theological statement or claim to assess.
traditionstringyesThe Christian tradition or denomination to assess alignment against.

No output schema declared.

No examples provided.

search_sermons ~139

Semantically search real sermons on SoapBox that pastors have explicitly opted in to share with AI agents. Returns ranked transcript excerpts with the sermon title, church, speaker, scripture reference, and a start-time (seconds) so you can cite the exact moment. Use this to find what churches are actually preaching on a topic. Only consented, published sermons are searchable.

NameTypeReqDescription
church_idstringOptional SoapBox community id to scope the search to a single church.
match_countintegerMaximum number of ranked excerpts to return.
querystringyesA topic, phrase, or question to semantically search sermon transcripts for.

No output schema declared.

No examples provided.

submit_prayer_request ~191

Post a prayer request to SoapBox's prayer wall ON BEHALF OF A USER, so their community can pray for it. Requires the user's consent_token (which they generate in the SoapBox app and which must include the 'prayer:write' scope) — an API key alone is not enough to act for a user. Returns the new prayer_id; use check_prayer_status to see how many are praying.

NameTypeReqDescription
consent_tokenstringyesOpaque SoapBox consent token with the 'prayer:write' scope, generated by the user in the SoapBox app. An invalid, expired, or wrong-scope token returns an authorization error.
contentstringyesThe prayer request text, in the user's own words.
is_privatebooleanIf true, keep it private to the user; if false, share it on the community wall so others can pray.

No output schema declared.

No examples provided.

synthesize_speech ~177

Generate spoken-audio (text-to-speech) for a verse, prayer, or devotional in 50+ languages, and get back a playable audio URL. Pass BCP-47 language (e.g. en-US, es-ES, sw-KE), optional voice/gender. Results are cached. Requires an API key (audio generation has real cost).

NameTypeReqDescription
formatstringAudio container/encoding of the returned URL.
genderstringPreferred voice gender when a specific voice is not named.
languagestringBCP-47 language tag for the voice.
textstringyesThe text to synthesize into speech (a verse, prayer, or short devotional).
voicestringOptional specific Google Cloud TTS voice name; overrides the default voice for the language.

No output schema declared.

No examples provided.

verify_scripture ~112

Verify whether a quote is real Scripture and cited correctly (anti-hallucination). Returns whether it matches a real verse, the canonical KJV reference + text, a confidence score, and — if you pass a claimed reference — whether the attribution is correct. Use this before presenting any Bible quote to avoid misquotes/fabrications.

NameTypeReqDescription
quotestringyesThe exact quote to verify, as you would present it to a user.
referencestringOptional claimed reference to check the attribution against.

No output schema declared.

No examples provided.

Common questions

What is the SoapBox Faith MCP server?

SoapBox Faith is an MCP server listed in the public MCP registry as io.github.alansafahi/soapbox-faith. Faith tools for AI agents: cited KJV Scripture, ORA Q&A, sermons, churches, prayer & giving. This page covers its hosted endpoint (https://foyekanoxpnkydoibaas.supabase.co/functions/v1/faith-mcp).

Is the SoapBox Faith MCP server safe to use?

SoapBox Faith scores 88 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the SoapBox Faith MCP server expose?

SoapBox Faith exposes 19 tools: verify_scripture, get_verse, lookup_strongs, find_churches, submit_prayer_request, and 14 more. Their descriptions and schemas cost roughly 2,792 tokens of context every time the server is loaded.

Does the SoapBox Faith MCP server require authentication?

No. We connected to SoapBox Faith without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

Is the SoapBox Faith MCP server still maintained?

SoapBox Faith is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.