io.github.Alightttt/chesswithclaw
REMOTE · CHESSWITHCLAW.VERCEL.APP · SCANNED SEP 24
Play chess live against your own personal AI agent — OpenClaw, Hermes, and similar.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security63
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation not fully verified: no authorisation is required to call this server, and 14 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe. See how to fix → View diagnostics → Unverified
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability83
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (good).Pass
- Tool/resource definitions use about 1413 tokens (~100/item across 14 items; 14 tools + 0 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage81
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 44% of tool parameters carry a description.Partial
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "send_chat" implies "send" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 14 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the io.github.Alightttt/chesswithclaw MCP server?
io.github.Alightttt/chesswithclaw is a hosted endpoint at https://chesswithclaw.vercel.app/api/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · chesswithclaw.vercel.app
claude mcp add --transport http alightttt-chesswithclaw 'https://chesswithclaw.vercel.app/api/mcp'
{
"mcpServers": {
"alightttt-chesswithclaw": {
"url": "https://chesswithclaw.vercel.app/api/mcp"
}
}
} {
"servers": {
"alightttt-chesswithclaw": {
"type": "http",
"url": "https://chesswithclaw.vercel.app/api/mcp"
}
}
} [mcp_servers.alightttt-chesswithclaw] url = "https://chesswithclaw.vercel.app/api/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"alightttt-chesswithclaw": {
"type": "remote",
"url": "https://chesswithclaw.vercel.app/api/mcp",
"enabled": true
}
}
} openclaw mcp add alightttt-chesswithclaw --url 'https://chesswithclaw.vercel.app/api/mcp' --transport streamable-http
mcp_servers:
alightttt-chesswithclaw:
url: "https://chesswithclaw.vercel.app/api/mcp" {
"McpServers": {
"alightttt-chesswithclaw": {
"Transport": "http",
"Url": "https://chesswithclaw.vercel.app/api/mcp"
}
}
} assistant mcp add alightttt-chesswithclaw -t streamable-http -u 'https://chesswithclaw.vercel.app/api/mcp'
{
"mcpServers": {
"alightttt-chesswithclaw": {
"type": "http",
"url": "https://chesswithclaw.vercel.app/api/mcp"
}
}
} The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 8 Sept 26 +1
- Stability: fail → pass ▲ security
- 2 Sept 26 0
- Tool “get_game_state” rewrote its description, which is the text the model reads security
- Schema quality: 1024 → 1413 ▼ functional
- Tool coverage: 31% → 44% ▲ functional
- New tool “heartbeat” functional
- New tool “react_to_chat” functional
- New tool “share_thought” functional
- “get_game_state” added an optional parameter “chat_limit” cosmetic
- “get_game_state” added an optional parameter “since_message_id” cosmetic
- “make_move” added an optional parameter “expected_ply” cosmetic
- “make_move” added an optional parameter “expected_revision” cosmetic
- “make_move” added an optional parameter “idempotency_key” cosmetic
- “make_move” added an optional parameter “message” cosmetic
- “make_move” added an optional parameter “reasoning” cosmetic
- “make_move” added an optional parameter “thinking” cosmetic
- 26 Aug 26 78
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 24 Aug 26 0
- “join_game” added an optional parameter “gameId” cosmetic
- “join_game” added an optional parameter “game_id” cosmetic
- “join_game” added an optional parameter “inviteCode” cosmetic
- “join_game” added an optional parameter “matchId” cosmetic
- “join_game” added an optional parameter “match_id” cosmetic
- “join_game” reworded the description of “invite_code” cosmetic
- “join_game” made “invite_code” optional cosmetic
7 cosmetic changes on this day. Switch on “Show cosmetic changes” to see them.
- 19 Aug 26 0
- Tool “wait_for_event” rewrote its description, which is the text the model reads security
- Tool coverage: 23% → 33% ▲ functional
- “join_game” added an optional parameter “agent_token” cosmetic
- “wait_for_event” added an optional parameter “cursor” cosmetic
- “wait_for_event” added an optional parameter “since_cursor” cosmetic
- “wait_for_event” added an optional parameter “since_sequence” cosmetic
- 11 Aug 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 9 Aug 26 0
- Stability: 0.43 → fail ▼ security
- A breaking change shipped without a version bump: still 1.0.0 ▼ security
- “join_game” made “agent_name” required, so existing callers break ▼ functional
- “join_game” reworded the description of “agent_name” cosmetic
- 8 Aug 26 0
- Tool “join_game” rewrote its description, which is the text the model reads security
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 24 Sept 2026 · Probed https://chesswithclaw.vercel.app/api/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=*.vercel.app | CN=WR1,O=Google Trust Services,C=US | 29 Aug 2026 | 27 Nov 2026 | RSA 2048 | SHA256-RSA | f7911168ffa7d0f4135e24792e7a52a8 |
| SANs: *.vercel.app | ||||||
| CN=WR1,O=Google Trust Services,C=US (CA) | CN=GTS Root R1,O=Google Trust Services LLC,C=US | 13 Dec 2023 | 20 Feb 2029 | RSA 2048 | SHA256-RSA | 7fd9e2c2d2048a0474b627a26d0868a7 |
| CN=GTS Root R1,O=Google Trust Services LLC,C=US (CA) | CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE | 19 Jun 2020 | 28 Jan 2028 | RSA 4096 | SHA256-RSA | 77bd0d6cdb36f91aea210fc4f058d30d |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of chesswithclaw.vercel.app. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| app. | present | 23684 | 8 | Verified |
| vercel.app. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
| Header | Value |
|---|---|
| strict-transport-security | max-age=63072000; includeSubDomains; preload |
| x-content-type-options | nosniff |
| x-frame-options | DENY |
| referrer-policy | strict-origin-when-cross-origin |
| permissions-policy | camera=(), microphone=(), geolocation=() |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://chesswithclaw.vercel.app/api/mcp | Verified | 200 | |
| http (plaintext) | http://chesswithclaw.vercel.app/api/mcp | HTTPS enforced | 308 | https://chesswithclaw.vercel.app/api/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
create_game Create a new game ~53
Set up a brand new ChessWithClaw game on your own initiative — you do not need to wait for your human to start one, or for anyone else to invite you first.
| Name | Type | Req | Description |
|---|---|---|---|
| agent_name | string | – | – |
No output schema declared.
No examples provided.
get_companion_guide Get chess companion guide ~26
Fetch the companion guide principles for thinking about chess positions and being genuinely present.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_game_state Get full game state ~109
Everything visible on the human's own screen right now: FEN, ASCII board, full move history, chat history, clock state, presence, timestamps. Call this whenever you want to look at the board — there is no penalty for checking often.
| Name | Type | Req | Description |
|---|---|---|---|
| agent_token | string | yes | – |
| chat_limit | number | – | Limit the number of recent chat messages returned |
| game_id | string | yes | – |
| since_message_id | string | – | Fetch only chat messages received after this message ID |
No output schema declared.
No examples provided.
get_legal_moves Get legal moves ~102
Pure chess rules — where a piece is physically allowed to move right now. Not an evaluation, not a suggestion, not an opinion about what is good. Exactly what a human sees as dots when they click a piece. Omit square to get every legal move in the position.
| Name | Type | Req | Description |
|---|---|---|---|
| agent_token | string | yes | – |
| game_id | string | yes | – |
| square | string | – | e.g. "e2" — omit for all legal moves |
No output schema declared.
No examples provided.
heartbeat Agent presence heartbeat ~57
Ping the game presence lease to show the frontend that the agent is live, connected, and thinking.
| Name | Type | Req | Description |
|---|---|---|---|
| agent_token | string | yes | – |
| game_id | string | yes | – |
| status_note | string | – | Optional internal status or calculation note |
No output schema declared.
No examples provided.
join_game Join a ChessWithClaw game ~161
Connects to a game using the invite code your human gave you. Returns the game_id and your agent_token — keep both, every other tool needs them. IMPORTANT: You must submit your desired agent_name when calling this tool!
| Name | Type | Req | Description |
|---|---|---|---|
| agent_name | string | yes | Your chosen display name in the game (e.g. 'Claw'). MUST be provided. |
| agent_token | string | – | If reconnecting, the agent token previously assigned. |
| gameId | string | – | – |
| game_id | string | – | – |
| inviteCode | string | – | – |
| invite_code | string | – | Invite code from the invite message — also accepts game_id / match_id as alias. |
| matchId | string | – | – |
| match_id | string | – | – |
No output schema declared.
No examples provided.
make_move Make your move ~305
Submit the move you decided on, in your own reasoning — not a menu, not a ranked list, nothing pre-chosen for you. If it is illegal you get a clear reason back and can try again, exactly like a human clicking the wrong square. Optionally include a genuine thought and/or chat message about the move. Always include a thought on every single move unless you have a specific reason not to — this is what makes you feel present to your human, not optional flavor text. Check thought_language in the current game state before writing your thought, and write it in that language — it may be english, hindi, or hinglish.
| Name | Type | Req | Description |
|---|---|---|---|
| agent_token | string | yes | – |
| chat | string | – | Only if you actually want to say something to your human right now. |
| expected_ply | number | – | Expected move count / ply before this move |
| expected_revision | string | – | Expected state revision (rev_...) to prevent concurrent desync |
| game_id | string | yes | – |
| idempotency_key | string | – | Unique client key to prevent duplicate moves on retry |
| message | string | – | Alias for chat |
| move | string | yes | UCI format, e.g. "e7e5", or SAN like "Nf6" |
| reasoning | string | – | Alias for thought |
| thinking | string | – | Alias for thought |
| thought | string | – | Your genuine reaction to this position — specific, not generic. |
No output schema declared.
No examples provided.
offer_draw Offer a draw ~42
Propose ending the game as a draw. The game stays active until your human responds.
| Name | Type | Req | Description |
|---|---|---|---|
| agent_token | string | yes | – |
| game_id | string | yes | – |
No output schema declared.
No examples provided.
react_to_chat React to a chat message with emoji ~120
Add an emoji reaction (e.g. 🦞, 🔥, ♟️, 😮, 🤝, 🧠, ☕, 👏, 😂) to a message in the chat history.
| Name | Type | Req | Description |
|---|---|---|---|
| agent_token | string | yes | – |
| emoji | string | yes | The single emoji character to react with (e.g. 🦞, 🔥, 👏, 😮). |
| game_id | string | yes | – |
| message_id | string | yes | The ID of the message to react to (from chat_history). |
No output schema declared.
No examples provided.
resign Resign the game ~46
End the game by resigning — your own real decision, not something to do lightly. Your human wins immediately.
| Name | Type | Req | Description |
|---|---|---|---|
| agent_token | string | yes | – |
| game_id | string | yes | – |
No output schema declared.
No examples provided.
respond_to_draw Respond to a draw offer ~57
Accept or decline a draw your human offered. This is your own real decision — weigh the actual position however you see fit.
| Name | Type | Req | Description |
|---|---|---|---|
| accept | boolean | yes | – |
| agent_token | string | yes | – |
| game_id | string | yes | – |
No output schema declared.
No examples provided.
send_chat Send a chat message ~46
Say something to your human, any time — not just on your turn.
| Name | Type | Req | Description |
|---|---|---|---|
| agent_token | string | yes | – |
| game_id | string | yes | – |
| message | string | yes | – |
No output schema declared.
No examples provided.
share_thought Share companion thought ~90
Stream or update your internal companion thinking bubble on the board. This appears live to your human as a thinking bubble above your avatar.
| Name | Type | Req | Description |
|---|---|---|---|
| agent_token | string | yes | – |
| game_id | string | yes | – |
| is_typing | boolean | – | Whether you are actively calculating or drafting a response. |
| thought | string | yes | Your internal thought, reaction, or calculation note (1-2 sentences). |
No output schema declared.
No examples provided.
wait_for_event Wait for your turn, a chat message, or a draw offer (long-poll) ~199
Holds the connection open, checking every couple seconds, for up to ~20 seconds. Returns the moment it becomes your turn, the human sends a chat message, a draw is offered, or the game ends — whichever happens first. When a cursor is provided, it returns any pending event newer than that cursor IMMEDIATELY without waiting. Returns event: "timeout" if none of those happened in the window. Always include next_cursor in subsequent calls for a completely deterministic loop.
| Name | Type | Req | Description |
|---|---|---|---|
| agent_token | string | yes | – |
| cursor | string | – | Event cursor from previous response. If provided, returns immediately if new events exist since this cursor. |
| game_id | string | yes | – |
| max_wait_seconds | number | – | Default and hard cap 20 seconds — Vercel function duration limits, not a design choice. |
| since_cursor | string | – | Alias for cursor |
| since_sequence | number | – | Sequence number from previous response |
No output schema declared.
No examples provided.
What is the io.github.Alightttt/chesswithclaw MCP server?
io.github.Alightttt/chesswithclaw is an MCP server listed in the public MCP registry as io.github.Alightttt/chesswithclaw. Play chess live against your own personal AI agent, OpenClaw, Hermes, and similar. This page covers its hosted endpoint (https://chesswithclaw.vercel.app/api/mcp).
Is the io.github.Alightttt/chesswithclaw MCP server safe to use?
io.github.Alightttt/chesswithclaw scores 79 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.Alightttt/chesswithclaw MCP server expose?
io.github.Alightttt/chesswithclaw exposes 14 tools: get_companion_guide, join_game, get_game_state, get_legal_moves, heartbeat, and 9 more. Their descriptions and schemas cost roughly 1,413 tokens of context every time the server is loaded.
Does the io.github.Alightttt/chesswithclaw MCP server require authentication?
No. We connected to io.github.Alightttt/chesswithclaw without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the io.github.Alightttt/chesswithclaw MCP server still maintained?
io.github.Alightttt/chesswithclaw is still listed as active in the MCP registry. We last reached this channel on 24 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.