# Alter Onboarding (remote · mcp.alterauth.com)

Guide developers from setup through a verified, policy-aware, audited Alter API call.

- Trust score: 81/100 (high trust)
- Change this week: +4
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-09-22

## Components

- remote · `mcp.alterauth.com`: 81/100 (this document), [markdown](https://verifymcp.io/servers/alteraidev-alter-onboarding/mcp.md), [page](https://verifymcp.io/servers/alteraidev-alter-onboarding/mcp)

## Channel facts

- Endpoint: `https://mcp.alterauth.com/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `0.2.7`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-09-22.

- **Endpoint Security**: 60/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation not fully verified: no authorisation is required to call this server, and 14 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe.
  - HTTPS is enforced; there's no plaintext access path.
  - HSTS check failed: the Strict-Transport-Security header is absent.
  - DNSSEC is configured correctly; the domain's records validate against the full chain to the root.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 83/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (good).
  - Tool/resource definitions use about 1793 tokens (~105/item across 17 items; 14 tools + 3 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 97/100
  - Stability observed for 29 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
  - Structured output schemas are declared (7% of tools); any adoption earns full credit.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 14 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 15 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### How do I install the Alter Onboarding MCP server?

Alter Onboarding is a hosted endpoint at https://mcp.alterauth.com/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http alteraidev-alter-onboarding 'https://mcp.alterauth.com/mcp'
```

### Cursor

```json
{
  "mcpServers": {
    "alteraidev-alter-onboarding": {
      "url": "https://mcp.alterauth.com/mcp"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "alteraidev-alter-onboarding": {
      "type": "http",
      "url": "https://mcp.alterauth.com/mcp"
    }
  }
}
```

### Codex

```toml
[mcp_servers.alteraidev-alter-onboarding]
url = "https://mcp.alterauth.com/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "alteraidev-alter-onboarding": {
      "type": "remote",
      "url": "https://mcp.alterauth.com/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add alteraidev-alter-onboarding --url 'https://mcp.alterauth.com/mcp' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  alteraidev-alter-onboarding:
    url: "https://mcp.alterauth.com/mcp"
```

### Netclaw

```json
{
  "McpServers": {
    "alteraidev-alter-onboarding": {
      "Transport": "http",
      "Url": "https://mcp.alterauth.com/mcp"
    }
  }
}
```

### Vellum

```bash
assistant mcp add alteraidev-alter-onboarding -t streamable-http -u 'https://mcp.alterauth.com/mcp'
```

### Other

```json
{
  "mcpServers": {
    "alteraidev-alter-onboarding": {
      "type": "http",
      "url": "https://mcp.alterauth.com/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-09-22 (score 81, +1)

- [functional] Server version: 0.2.6 → 0.2.7

### 2026-09-21 (score 80, 0)

- [functional] Server version: 0.2.5 → 0.2.6

### 2026-09-20 (score 80, +1)

No change was recorded against any check on this day. Stability & Change Management went from 87 to 90. That category is still filling its 30-day observation window: 26 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-18 (score 79, +1)

- [security] Tool “fetch_doc” rewrote its description, which is the text the model reads
- [security] Tool “sdk_pattern” rewrote its description, which is the text the model reads
- [functional regression] Schema quality: 1618 → 1793
- [functional] Server version: 0.2.4 → 0.2.5
- [functional] New tool “search_docs”
- [cosmetic] “sdk_pattern” reworded the description of “pattern”

### 2026-09-17 (score 78, +1)

No change was recorded against any check on this day. Stability & Change Management went from 77 to 80. That category is still filling its 30-day observation window: 23 days of observed history at the previous scan, 24 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-16 (score 77, 0)

- [security] Tool “policy_language” rewrote its description, which is the text the model reads
- [functional] Server version: 0.2.3 → 0.2.4

### 2026-09-15 (score 77, +1)

No change was recorded against any check on this day. Stability & Change Management went from 70 to 73. That category is still filling its 30-day observation window: 21 days of observed history at the previous scan, 22 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-13 (score 76, +1)

No change was recorded against any check on this day. Stability & Change Management went from 63 to 67. That category is still filling its 30-day observation window: 19 days of observed history at the previous scan, 20 at this one. The score rises as the window fills, whether or not the server changes.

## MCP tools (14)

### `list_phases` (~27 tokens)

List the lifecycle phases this server serves (setup, modify) and what each is for.

### `list_skills` (~38 tokens)

List the guidance Skills available on this server, with the phase each serves. Read a skill via its resource (skill://alter/<name>).

### `get_started` (~122 tokens)

Begin or change an Alter integration. Without args: lists the phases. With `phase`: returns that phase's flows + a heuristic hint — classify the use case YOURSELF and call again with `goal` for the plan. If the use case spans multiple flows, run them sequentially.

Input parameters:

- `goal` (string): The flow id YOU classified. Returns that flow's full plan.
- `phase` (string): setup (integrate from scratch) or modify (change an existing integration).
- `use_case` (string): Plain-English description of what the developer wants.

### `next_step` (~112 tokens)

Return the next step for a flow. Pass the goal (flow id) and the id of the last completed step (omit `after` for the first step). Run each step's detect command FIRST and skip the run command when detection passes. The design step also returns that flow's complete starter ALTER_INTEGRATION.md.

Input parameters:

- `after` (string): Id of the last completed step (e.g. "2", "3a").
- `goal` (string, required): The flow id (setup goal or modify operation).

### `sdk_integration` (~65 tokens)

Return the Alter SDK wiring (install + client init + request) to write into the developer's codebase, for a language and setup goal.

Input parameters:

- `goal` (string, required): The setup goal (user-data | backend-secret | agent).
- `language` (string, required): Target language.

### `sdk_pattern` (~157 tokens)

Return a runnable Alter SDK call pattern for a language: `proxy-call` (zero-egress proxy_request + HITL), `resolve-grant-by-user` (call as an end user via their delegated grant), `delegate-managed-secret` (the operator-side delegation step), or `resolve-ambiguous-grant` (an identity-mode call matched several of one user's grants: choose deliberately, never the first, and persist it; ask the developer at design time whether users can hold several accounts per provider). Use AFTER `sdk_integration` has wired the client.

Input parameters:

- `language` (string, required): Target language.
- `pattern` (string, required): proxy-call | resolve-grant-by-user | delegate-managed-secret | resolve-ambiguous-grant.

### `troubleshoot` (~48 tokens)

Map a @alter-ai/cli exit code or error message to a remediation.

Input parameters:

- `error` (string): The stderr / error message.
- `exit_code` (integer): The CLI process exit code.

### `verify_integration` (~87 tokens)

Return a copy-pasteable recipe to VERIFY an integration works: `first-call` (code↔design, an audit row, correct attribution) or `per-user-isolation` (a multi-user/broker server runs two users under different credentials and rejects cross-user access). Guidance only — you run the commands.

Input parameters:

- `scenario` (string, required): first-call | per-user-isolation.

### `fetch_doc` (~130 tokens)

Fetch any page of the Alter documentation by slug (e.g. "quickstart"). The whole published docs site is bundled here, skill pages included, so every page a doc, a skill or a flow step links to can be read in-band. Accepts any spelling the docs use: a bare slug, a leading slash, a #section anchor, a full docs.alterauth.com URL, or an older path that now redirects. Omit the slug to list every page.

Input parameters:

- `slug` (string): Doc slug, e.g. "guides/call-apis-on-behalf-of-users".

### `search_docs` (~122 tokens)

Search every bundled page of the Alter documentation (docs and skill pages) by keywords: returns the best-matching pages with the section and a snippet that matched. Use it when a flow step or doc did not point you at the page you need, instead of guessing slugs or listing every page; then read one with fetch_doc and its slug.

Input parameters:

- `limit` (integer): Maximum results (default 8, at most 20).
- `query` (string, required): Keywords or a short phrase, e.g. "connect widget popup" or "PAT scopes login".

### `list_providers` (~74 tokens)

List every provider with an ingested API spec in Alter's provider-spec catalog, with each spec's source and freshness. Optionally filter by `kind`. Start here, then call list_operations for a provider's operations.

Input parameters:

- `kind` (string): Provider family: oauth (user-authorized) or managed (API-key).

### `list_operations` (~204 tokens)

List the API operations a provider exposes, live from Alter's provider-spec catalog (e.g. "what can I call on google?"). Returns operation ids + methods/paths, plus the spec's source and freshness. Omit `kind` to auto-detect the provider family; when the id exists in both oauth and managed you'll be asked to pass `kind`. Machine-readable rows ride in `structuredContent` (see this tool's outputSchema) — read those rather than parsing the prose.

Input parameters:

- `kind` (string): Provider family: oauth (user-authorized) or managed (API-key).
- `limit` (integer): Max operations to return (backend default 100, max 500).
- `offset` (integer): Zero-based offset for paging through large operation lists.
- `provider_id` (string, required): Provider id, e.g. "google" or "github".
- `search` (string): Case-insensitive filter over operation ids/paths/summaries.

Output parameters:

- `offset` (integer): Zero-based offset of the first row.
- `operations` (array): This page of operations, in the catalog's serving order.
- `provider_id` (string): Resolved provider id the rows belong to.
- `provider_kind` (string): Resolved provider family: oauth or managed.
- `spec_version` (integer): Alter's ingested spec version these rows came from.
- `total` (integer): Total operations matching the query (before limit/offset).

### `get_operation_schema` (~116 tokens)

Fetch one provider API operation's full contract — method, path, parameters, request/response schemas — live from Alter's provider-spec catalog, plus the spec's source and freshness. Get operation ids from list_operations first.

Input parameters:

- `kind` (string): Provider family: oauth (user-authorized) or managed (API-key).
- `operation_id` (string, required): Operation id from list_operations, e.g. "gmail.users.messages.list".
- `provider_id` (string, required): Provider id, e.g. "google" or "github".

### `policy_language` (~242 tokens)

The authoritative grammar of Alter's runtime-policy language, live from the deployed backend: every authorable rule type with its JSON body schema, caps, authorable levels, worked examples, and fail-closed semantics. Call with no arguments for the overview; pass `rule_type` (e.g. "content_match") for one type's full grammar. Use it before authoring rules with `alter policy rules create` — never guess a body shape. Vocabulary: the dashboard's "Runtime policies" surface, the docs' "policy", and `alter policy` are one feature, and the dashboard's "Human in the loop (HITL)" type is the `require_approval` rule type (its grant-editor block is the grant-level baseline of the same gate). Workflow prose: the `set-policy` modify flow (`get_started` with phase=modify), fetch_doc("guides/set-policies"), fetch_doc("guides/add-human-in-the-loop-approvals"), and fetch_doc("reference/cli/commands/policy").

Input parameters:

- `rule_type` (string): One rule type's full grammar, e.g. "content_match" or "quota".

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/alteraidev-alter-onboarding/mcp#diagnostics

## Score history

- 2026-09-22: 81
- 2026-09-21: 80
- 2026-09-20: 80
- 2026-09-19: 79
- 2026-09-18: 79
- 2026-09-17: 78
- 2026-09-16: 77
- 2026-09-15: 77
- 2026-09-14: 76
- 2026-09-13: 76
- 2026-09-12: 75
- 2026-09-11: 75
- 2026-09-10: 74
- 2026-09-09: 74
- 2026-09-08: 73
- 2026-09-07: 73
- 2026-09-06: 72
- 2026-09-05: 72
- 2026-09-04: 72
- 2026-09-03: 71
- 2026-09-02: 71
- 2026-09-01: 70
- 2026-08-31: 70
- 2026-08-30: 69
- 2026-08-29: 69
- 2026-08-28: 68
- 2026-08-27: 68
- 2026-08-26: 67
- 2026-08-25: 65
- 2026-08-24: 65

## Common questions

### What is the Alter Onboarding MCP server?

Alter Onboarding is an MCP server listed in the public MCP registry as io.github.AlterAIDev/alter-onboarding. Guide developers from setup through a verified, policy-aware, audited Alter API call. This page covers its hosted endpoint (https://mcp.alterauth.com/mcp).

### Is the Alter Onboarding MCP server safe to use?

Alter Onboarding scores 81 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Alter Onboarding MCP server expose?

Alter Onboarding exposes 14 tools: list_phases, list_skills, get_started, next_step, sdk_integration, and 9 more. Their descriptions and schemas cost roughly 1,544 tokens of context every time the server is loaded.

### Does the Alter Onboarding MCP server require authentication?

No. We connected to Alter Onboarding without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

### Is the Alter Onboarding MCP server still maintained?

Alter Onboarding is still listed as active in the MCP registry. We last reached this channel on 22 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

## Links

- Remote endpoint: https://mcp.alterauth.com/mcp
- Repository: https://github.com/AlterAIDev/Alter-Vault
- Website: https://docs.alterauth.com/mcp
- Changelog RSS feed: https://verifymcp.io/servers/alteraidev-alter-onboarding/mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/alteraidev-alter-onboarding/mcp.json
- HTML version of this page: https://verifymcp.io/servers/alteraidev-alter-onboarding/mcp