Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

Mono eSIM — Travel Connectivity for AI Agents

REMOTE · WWW.MONOESIM.APP

Search travel eSIM plans, check devices, and create secure customer-paid checkout links.

Available components

60 Trust /100

Last scanned (14 hours ago)

Scores higher than 43% of remote servers

Reachable. Last reached 5 Nov 2026.

Category E-commerce

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →

Endpoint Security63
Transport & Reachability100
Schema Quality & AI Usability46
  • 0% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Fail
  • AI-judged instruction clarity (good).Pass
  • Context-footprint check failed: tool/resource definitions use about 2733 tokens (~118/item across 23 items; 21 tools + 2 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management10
  • Stability observed for 3 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage84
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 53% of tool parameters carry a description.Partial
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • All 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
  • An AI judge read all 23 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities60
  • Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28. See how to fix → Fail
What we tested

Checks we ran (13)

  • TLS certificate
  • Authorization
  • HTTPS
  • HSTS header
  • DNSSEC
  • Transport
  • Schema quality
  • Stability
  • Tool coverage
  • Injection markers
  • Destructive annotations
  • Judged manipulation
  • MCP protocol

Does not apply to this hosted endpoint (2)

  • Supply Chain SecurityScored on package channels only. This is a hosted endpoint, so there is nothing to install or inspect.
  • Provenance & TransparencyScored on package channels only. This is a hosted endpoint, so there is nothing to install or inspect.

The score does not measure everything. What the score does not measure →

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 4 Nov 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.

  • 3 Nov 26 0
    • The server changed its declared name: monoesim → app.monoesim/esim security
    • Stability: unverified → 0.03 ▲ functional
  • 2 Nov 26 59

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 5 Nov 2026 · Probed https://www.monoesim.app/mcp

TLS valid

Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .

Subject Issuer Valid from Valid until Key Signature Serial
CN=www.monoesim.app CN=YR2,O=Let's Encrypt,C=US 28 Oct 2026 26 Jan 2027 RSA 2048 SHA256-RSA 6adab4fbc55724b8e8d275402058c3ee70c
SANs: www.monoesim.app
CN=YR2,O=Let's Encrypt,C=US (CA) CN=Root YR,O=ISRG,C=US 3 Sept 2025 2 Sept 2028 RSA 2048 SHA256-RSA 4ebd24947e24d394802d84a52fd5b319
CN=Root YR,O=ISRG,C=US (CA) CN=ISRG Root X1,O=Internet Security Research Group,C=US 13 May 2026 2 Sept 2032 RSA 4096 SHA256-RSA f24b6d17f9d9ad7cb1c9fea78782699f

Background: What to check on a remote MCP endpoint →

DNSSEC insecure

Validation of www.monoesim.app. — Not signed

Zone DS Keys Algorithms Outcome
. Trust anchor 20326, 38696 8, 8 Verified
app. DS published 23684 8 Verified
monoesim.app. No DS Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation
Authentication No authorisation required

The endpoint answered without asking for a token. Anyone who knows the URL can reach it.

Result No authorisation required
HTTP status 200
Header Value
strict-transport-security max-age=63072000; includeSubDomains; preload
content-security-policy default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; font-src 'self' data:; connect-src 'self'; media-src 'self' data: blob:; worker-src 'self' blob:; manifest-src 'self'; frame-src 'none'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'; upgrade-insecure-requests; report-uri /api/csp-report; report-to csp
x-content-type-options nosniff
x-frame-options SAMEORIGIN
referrer-policy strict-origin-when-cross-origin
permissions-policy camera=(), microphone=(), geolocation=(), payment=(self "https://checkout.stripe.com")

Background: How OAuth 2.1 works in the 2026 MCP spec →

Transports 2 probes
Transport URL Outcome Status Location
streamable-http https://www.monoesim.app/mcp Verified 200
http (plaintext) http://www.monoesim.app/mcp HTTPS enforced 308 https://www.monoesim.app/mcp
MCP tools · 21 exposed · ~2,404 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
card_payment_terms ~46

Read the currently required consent version and conditions before create_card_authorization. Use this to explain future off-session card charges and spending authority; it never creates a card setup or charges money.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

check_device ~119

Look up a phone model's probable eSIM compatibility by model name (for example 'iPhone 12 mini' or 'Galaxy S21'), using a device list and optional supplier check. Returns supported=true/false/null, close model matches and caveats; null means unknown, not incompatible. Always advise users to confirm an EID and carrier unlock status, especially for regional variants; this is not a purchase approval.

NameTypeReqDescription
modelstringyesFull commercial phone model such as iPhone 13 or Galaxy S23; include region variant when known.

No output schema declared.

No examples provided.

compare_plans ~127

Compare 2–10 existing eSIM plan IDs returned by search_plans or get_plan. Returns each matching plan plus the IDs of the cheapest plan, lowest EUR price per GB where calculable, and longest validity; an unknown plan ID is flagged not_found rather than silently replaced. Use for an explicit shortlist, not as the initial destination search; this makes no reservation or purchase.

NameTypeReqDescription
langstring–Language for names and texts (default en).
plan_idsarrayyesTwo to ten exact plan IDs from search_plans; unknown IDs are reported as not_found.

No output schema declared.

No examples provided.

create_card_authorization ~137

Create an offline-sandbox Stripe SetupIntent tied to this authenticated machine after explicit saved-card consent. Call card_payment_terms first, then complete the returned client_secret with Stripe.js and call sync_card_authorization; this call stores consent and limits but does not charge the card. Reuse idempotency_key on retries and never send PAN/CVC to this tool.

NameTypeReqDescription
consent_versionstringyes–
idempotency_keystring––
payment_authorizedbooleanyes–
per_day_centsintegeryes–
per_purchase_centsintegeryes–
valid_daysinteger––

No output schema declared.

No examples provided.

create_checkout ~215

Create a pending customer-paid Stripe Checkout from a quote_id returned by prepare_order, only after the customer explicitly approved the displayed plan and price and accepted the terms. Requires the customer's email and customer_confirmed=true, terms_accepted=true; returns a checkout URL, NOT a paid eSIM, and fulfilment starts only after verified payment. Reuse one idempotency_key per intended purchase, including retries, to avoid duplicate orders; use purchase for other supported payment methods.

NameTypeReqDescription
customer_confirmedbooleanyestrue only if the customer explicitly confirmed this purchase.
emailstringyesCustomer email; the eSIM and receipt are sent there.
idempotency_keystring–Unique per purchase (MCP). REST: send the Idempotency-Key header instead.
langstring–Language for names and texts (default en).
quote_idstringyesFrom prepare_order.
terms_acceptedbooleanyestrue only if the customer accepted immediate delivery and the loss of the withdrawal right.

No output schema declared.

No examples provided.

fund_wallet ~94

Create or retrieve an offline-sandbox Stripe TEST Checkout session for funding this authenticated machine's test wallet. amount_cents is integer EUR cents (100 = EUR 1.00); the balance changes only after verified test payment, not after opening the checkout link. Reuse idempotency_key for retries; no real money is accepted.

NameTypeReqDescription
amount_centsintegeryes–
idempotency_keystring––

No output schema declared.

No examples provided.

get_order ~106

Retrieve payment/fulfilment status for exactly one order using its order_id AND private order_token returned during checkout or purchase. After confirmed delivery, the response may include activation code (LPA), QR/install links and available usage data; treat the token and activation information as secrets. This is read-only and never confirms payment by itself; do not share the output publicly.

NameTypeReqDescription
include_usageboolean––
order_idstringyes–
order_tokenstringyes–

No output schema declared.

No examples provided.

get_plan ~138

Retrieve one current eSIM plan by plan_id (from search_plans), including EUR price, coverage destination, data allowance, validity, availability, and purchase terms. Use this to confirm an offer before prepare_order; optional destination must be the exact destination slug to narrow lookup, not a free-text city. A missing or withdrawn plan returns not_found; search_plans again instead of relying on cached prices.

NameTypeReqDescription
destinationstring–Optional destination slug (faster).
langstring–Language for names and texts (default en).
plan_idstringyesExact current plan ID from search_plans, not a plan name.

No output schema declared.

No examples provided.

get_terms ~83

Retrieve the latest displayed eSIM purchase terms and legal links in the requested language (en/de/ru/uk), including delivery, validity, refund/withdrawal conditions and payment. Show these to the customer before confirmation and checkout. This is read-only; it neither records agreement nor grants payment authorization.

NameTypeReqDescription
langstring–Language for names and texts (default en).

No output schema declared.

No examples provided.

get_wallet ~98

Read the authenticated sandbox machine's own EUR-cent balance, spending limits, and latest ledger entries. Returns at most 100 ledger entries per call; pass offset=100, 200, ... to paginate when next_offset is present. Use fund_wallet to create a test funding checkout and set_wallet_limits to change limits; this read does neither.

NameTypeReqDescription
offsetinteger–Zero-based ledger offset; use next_offset to fetch the next 100 entries.

No output schema declared.

No examples provided.

list_destinations ~103

List currently offered travel eSIM destinations (countries and multi-country regions) with their localized names, identifiers and starting EUR prices. Use when the travel destination is unknown or to discover valid destinations before search_plans; filter type=country or type=region, or omit it for both. Results are informational only and do not reserve inventory or prices.

NameTypeReqDescription
langstring–Language for names and texts (default en).
typestring–Filter by type.

No output schema declared.

No examples provided.

payment_capabilities ~79

Read the payment-method capability matrix BEFORE invoking purchase. Each method reports enabled versus planned status, environment (live/sandbox/offline_sandbox), required customer interaction, supported buyer modes, and any unavailable reason. This is discovery only: listing a planned method does not mean it can charge, and autonomous payments must not fall back silently to human Stripe Checkout.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

prepare_order ~109

Prepare a time-limited signed quote for a plan_id selected using search_plans or get_plan. Returns quote_id, current price and customer-confirmation requirements; the quoted price is locked for 30 minutes, but no order, payment, or eSIM is created. Next call create_checkout for customer-paid Stripe Checkout or purchase for an enabled alternate method.

NameTypeReqDescription
destinationstring––
langstring–Language for names and texts (default en).
plan_idstringyes–

No output schema declared.

No examples provided.

purchase ~200

Attempt a purchase for a quote_id from prepare_order using an explicitly selected buyer_mode and payment_method supported by payment_capabilities. stripe_checkout requires human/delegated confirmation, accepted terms, customer email and a customer-paid Stripe link; agent_wallet and stripe_off_session are available only when their offline-sandbox capabilities are enabled and the machine has the necessary authority or balance. This can create an order or start a payment; reuse the SAME idempotency_key on retries and never infer success before verified payment.

NameTypeReqDescription
authorization_idstring–Required for stripe_off_session; from create_card_authorization.
buyer_modestringyes–
customer_confirmedboolean––
emailstring––
idempotency_keystring––
langstring–Language for names and texts (default en).
payment_methodstringyes–
quote_idstringyes–
terms_acceptedboolean––

No output schema declared.

No examples provided.

register_machine ~97

Create a NEW offline-sandbox machine identity with a zero-EUR test wallet and one-time API key; no email or human account is required. Use before get_wallet, fund_wallet, set_wallet_limits, or sandbox purchases; securely store the returned mak_test_ key, which cannot be retrieved again. This does not create a live payment account.

NameTypeReqDescription
namestringyesNon-secret machine label used for audit trails (1–80 characters).

No output schema declared.

No examples provided.

revoke_card_authorization ~68

Revoke an authenticated machine's own saved-card spending permission by authorization_id. This blocks NEW purchases against that permission, but already reserved or in-flight payments may still settle and need reconciliation. This action does not delete the Stripe customer or refund prior charges.

NameTypeReqDescription
authorization_idstringyes–

No output schema declared.

No examples provided.

revoke_machine ~68

Permanently disable the authenticated sandbox machine's current API key, preventing subsequent wallet and purchase requests with that key. The transaction and ledger history remain; this does not cash out, refund, or transfer wallet funds. Use only when decommissioning or securing the machine, not when merely changing spending limits.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

search_plans ~217

Find available travel data eSIM plans for a country, city, region, or ISO-2 destination such as 'Japan', 'Tokyo', 'Europe', or 'TR'. Filter by minimum validity (days), minimum data (data_gb), unlimited-only, maximum EUR budget and sort order; returns matching plans, price/validity details and a cheapest-match recommendation, without reserving stock. Use get_plan to validate a selected plan before prepare_order and list_destinations if a location is not recognized.

NameTypeReqDescription
data_gbnumber–Minimum data in GB.
daysinteger–Minimum validity in days (trip length).
destinationstringyesCountry, city, region or ISO-2 code.
langstring–Language for names and texts (default en).
limitinteger––
max_price_eurnumber–Maximum price in EUR.
sortstring––
unlimitedboolean–Only unlimited (true) or only fixed-data (false) plans.

No output schema declared.

No examples provided.

set_wallet_limits ~84

Change this authenticated sandbox machine's gross spending limits in integer EUR cents per purchase and per UTC day. Zero blocks future spending; refunds do not restore the consumed daily limit. Use get_wallet to inspect current limits first; this does not authorize another person's card or make a purchase.

NameTypeReqDescription
per_day_centsintegeryes–
per_purchase_centsintegeryes–

No output schema declared.

No examples provided.

sync_card_authorization ~104

After completing a Stripe SetupIntent with Stripe.js, reconcile the authenticated machine's saved-card authorization with Stripe. Use the authorization_id returned by create_card_authorization; this may activate the permission only after successful setup and ownership checks, and never charges a card. Do not use it to initiate setup (create_card_authorization) or reconcile an order payment (sync_card_payment).

NameTypeReqDescription
authorization_idstringyesSaved-card permission ID from create_card_authorization for this machine.

No output schema declared.

No examples provided.

sync_card_payment ~112

Reconcile a saved-card purchase by the order_id returned from purchase with payment_method=stripe_off_session. For this machine's order, check Stripe PaymentIntent ownership and status; the operation can resume an idempotent pending charge, complete verified fulfilment, or return a required Stripe.js/3-D Secure action. Do not retry with a new order or bypass bank authentication; use get_order to read ordinary delivery status.

NameTypeReqDescription
order_idstringyesOrder ID returned by the machine's stripe_off_session purchase.

No output schema declared.

No examples provided.

Install

How do I install the Mono eSIM — Travel Connectivity for AI Agents MCP server?

Mono eSIM — Travel Connectivity for AI Agents is a hosted endpoint at https://www.monoesim.app/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

remote · www.monoesim.app

# add to Claude Code
claude mcp add --transport http andrii-tiurin-mono-esim 'https://www.monoesim.app/mcp'
Common questions

What is the Mono eSIM — Travel Connectivity for AI Agents MCP server?

Mono eSIM — Travel Connectivity for AI Agents is an MCP server listed in the public MCP registry as io.github.Andrii-Tiurin/mono-esim. Search travel eSIM plans, check devices, and create secure customer-paid checkout links. This page covers its hosted endpoint (https://www.monoesim.app/mcp).

Is the Mono eSIM — Travel Connectivity for AI Agents MCP server safe to use?

Mono eSIM — Travel Connectivity for AI Agents scores 60 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the Mono eSIM — Travel Connectivity for AI Agents MCP server expose?

Mono eSIM — Travel Connectivity for AI Agents exposes 21 tools: card_payment_terms, create_card_authorization, sync_card_authorization, revoke_card_authorization, sync_card_payment, and 16 more. Their descriptions and schemas cost roughly 2,404 tokens of context every time the server is loaded.

Does the Mono eSIM — Travel Connectivity for AI Agents MCP server require authentication?

No. We connected to Mono eSIM — Travel Connectivity for AI Agents without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

Is the Mono eSIM — Travel Connectivity for AI Agents MCP server still maintained?

Mono eSIM — Travel Connectivity for AI Agents is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What did VerifyMCP test on the Mono eSIM — Travel Connectivity for AI Agents MCP server?

VerifyMCP ran 13 checks on Mono eSIM — Travel Connectivity for AI Agents, covering TLS certificate, Authorization, HTTPS, HSTS header and 9 more. Supply Chain Security and Provenance & Transparency do not apply to a hosted endpoint, so they were not tested. The score does not measure everything, and the scoring documentation lists what it leaves out.