ChatStack - App Cost Estimator
REMOTE · MCP.CHATSTACK.APP
Estimate development costs and hours, scope an MVP, and write a PRD with user stories and specs.
Available components
Last scanned (5 hours ago)
Scores higher than 53% of remote servers
Reachable. Last reached 5 Nov 2026.
Category Developer Tools
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security57
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation check failed: no authorisation is required to call this server, and it exposes a tool marked destructive (submit_prd). See how to fix → View diagnostics → Fail
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability73
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 3630 tokens (~605/item across 6 items; 5 tools + 1 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management23
- Stability observed for 7 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage99
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 95% of tool parameters carry a description.Partial
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 7 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 4 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 17 to 20. That category is still filling its 30-day observation window: 5 days of observed history at the previous scan, 6 at this one. The score rises as the window fills, whether or not the server changes.
- 3 Nov 26 0
- The server rewrote its instructions, which are the text every model session reads security
- Server version: 0.9.4 → 0.9.6 functional
- 2 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 10 to 13. That category is still filling its 30-day observation window: 3 days of observed history at the previous scan, 4 at this one. The score rises as the window fills, whether or not the server changes.
- 31 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.
- 30 Oct 26 0
- Stability: unverified → 0.03 ▲ functional
- 29 Oct 26 64
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Probed https://mcp.chatstack.app/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=mcp.chatstack.app | CN=WR3,O=Google Trust Services,C=US | 21 Oct 2026 | 19 Jan 2027 | RSA 2048 | SHA256-RSA | 6eaea3018fdbf3960a3542a9d5071c0d |
| SANs: mcp.chatstack.app, mcp-staging.chatstack.app, portal-mcp.chatstack.app, portal-mcp-staging.chatstack.app | ||||||
| CN=WR3,O=Google Trust Services,C=US (CA) | CN=GTS Root R1,O=Google Trust Services LLC,C=US | 13 Dec 2023 | 20 Feb 2029 | RSA 2048 | SHA256-RSA | 7ff005a91568d63abc22861684aa4b5a |
| CN=GTS Root R1,O=Google Trust Services LLC,C=US (CA) | CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE | 19 Jun 2020 | 28 Jan 2028 | RSA 4096 | SHA256-RSA | 77bd0d6cdb36f91aea210fc4f058d30d |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of mcp.chatstack.app. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| app. | present | 23684 | 8 | Verified |
| chatstack.app. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://mcp.chatstack.app/mcp | Verified | 200 | |
| http (plaintext) | http://mcp.chatstack.app/mcp | HTTPS enforced | 301 | https://mcp.chatstack.app:443/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
get_estimate_status Get app estimate progress ~138
Read the current app cost estimate without advancing it. Returns flow_stage, pending_gate, and pending_gate_payload. After submission it also returns post_submit_notice and post_submit_links: relay the notice verbatim, keep every URL, and do not add an email-delivery caveat. Pass the thread_id and interview_handle from the Session section. Do not call start_session to recover a session, and do not use this tool to approve, edit, or submit.
| Name | Type | Req | Description |
|---|---|---|---|
| interview_handle | string | yes | Opaque interview handle from start_session. Pass it on every later tool. |
| thread_id | string | yes | Interview thread id from start_session. |
| Name | Type | Req | Description |
|---|---|---|---|
| result | object | – | – |
No examples provided.
send_action Submit the pending choice ~431
Submit the user's pending choice. Set action_type to a value from pending_gate_payload.allowed_actions. In Review each step, action_type is required; confirmed_by_user=true is preferred and is not a substitute for it. In Run it for me, omit action_type and payload to advance one milestone, and do not ask the user to choose – show the user that milestone's Auto-complete decision receipt and pipe-table. Do not ask them to approve it. Call send_action once per result, and only again on the next result while next_tool is send_action. When next_tool is submit_prd, stop and offer submission. An approve moves one phase: stories to requirements, requirements to the technical spec, then the tech spec to the estimate. In Review each step, stories_reject, requirements_reject, and techspec_reject show the current table again and wait. When the user describes the change, call send_turn with their exact words and show the regenerated table that comes back. mode_select_a, mode_select_b, and mode_select_c are only the How much time pick: Normal, Quick estimate, or Detailed. Do not use them for Review each step or Run it for me. That choice is send_turn with interaction_mode. For clarifying_questions_submit, set payload.answers by question id with the letter only, such as {"q1":"A","q2":"B"}, not "1A". A plain reply such as "1B, 2A, 3C", or any wording that combines options, goes through send_turn. Do not split one question into several letters.
| Name | Type | Req | Description |
|---|---|---|---|
| action_type | string | – | Widget action type from allowed_actions. Optional in auto_complete; defaults fill the pending gate. |
| confirmed_by_user | boolean | – | Preferred when the user explicitly chose. Not required when action_type is already set to an allowed_actions value with a complete payload. |
| interview_handle | string | yes | Opaque interview handle from start_session. Pass it on every later tool. |
| payload | object | – | – |
| thread_id | string | yes | Interview thread id from start_session. |
| Name | Type | Req | Description |
|---|---|---|---|
| result | object | – | – |
No examples provided.
send_turn Continue app estimate or revise scope ~339
Continue an app cost estimate by sending the user's answers or requested changes to the MVP scope, user stories, requirements, or technical specification. Pass their exact words in input_as_text, even when next_tool is send_action. Compact replies such as "1A, 2B" are valid. Preserve the user's selections; in interaction mode Review each step do not choose answers for them. In interaction mode Review each step, relay the pipe-table and wait for approval. In Run it for me, relay the table and the decision receipt, then continue. After the user picks Review each step or Run it for me, set interaction_mode to clarify_first or auto_complete on this call. Include input_as_text when their reply also contains an idea or an answer. Omit input_as_text only when the reply is just the mode. Do not use send_action or mode_select_* for that choice. If no mode is set yet and the user continues without choosing, omit interaction_mode and the server accepts clarify_first. Phrases like "Run it for me" or "auto-complete" in input_as_text switch the thread to auto_complete.
| Name | Type | Req | Description |
|---|---|---|---|
| input_as_text | string | – | User message text; omit for a style-only interaction_mode switch. |
| interaction_mode | string | – | Interview style: clarify_first (Review each step) or auto_complete (Run it for me). Required for a style-only switch; when omitted with input_as_text, clarify_first is accepted by default. |
| interview_handle | string | yes | Opaque interview handle from start_session. Pass it on every later tool. |
| thread_id | string | yes | Interview thread id from start_session. |
| Name | Type | Req | Description |
|---|---|---|---|
| result | object | – | – |
No examples provided.
start_session Start an app cost estimate ~207
Start a guided session to estimate app development cost, scope an MVP, and generate a software PRD. No portal account or personal access token is required. Call it with no arguments unless the user already named Review each step (clarify_first) or Run it for me (auto_complete). Do not choose an interaction mode on the user's behalf — wanting an estimate or a fast answer is not auto_complete. If interaction_mode_question is returned, show both Review each step and Run it for me, with Review each step as the default, and wait for the user's pick before send_turn. The text result has a Session section with thread_id and interview_handle. Copy those into every later tool. Preserve an explicitly selected mode without asking the user to choose again.
| Name | Type | Req | Description |
|---|---|---|---|
| interaction_mode | string | – | Omit this. Set it only when the user explicitly named a mode (e.g. "use auto-complete"): clarify_first reviews every gate, auto_complete advances on its own and reports each decision. |
| Name | Type | Req | Description |
|---|---|---|---|
| result | object | – | – |
No examples provided.
submit_prd Submit PRD and app estimate ~485
Submit the completed software PRD and app development estimate for email delivery and portal project creation. Call it only after user stories, requirements, tech specs, and the estimate exist. (flow_stage estimate). Run it for me stops at this tool. Offer submission and wait for the user. Do not submit it the way an empty send_action advances a milestone. Before calling, tell the user it emails the pack and creates a portal project. Propose first_name, last_name, email, country, and project_name already provided by the user, or a project name suggested by the tool. Show those values for confirmation and ask only for missing fields; if none are known, ask for all five. Set confirmed_by_user=true only after they confirm. Offer optional feedback and omit it if they skip. Never invent a contact field. If they decline, do not call this tool. Omit contact arguments the thread already collected. Pass the thread_id and interview_handle from the Session section. Success is only a ### PRD submitted receipt that includes project_id and version_id. Relay post_submit_notice verbatim, including every URL, and do not add an email-delivery caveat. A missing next_tool, a timeout, or an error is not success. If the result is unclear, call get_estimate_status. Do not call submit_prd again while that check is still unclear. Do not call submit_prd again after a receipt with both ids.
| Name | Type | Req | Description |
|---|---|---|---|
| confirmed_by_user | boolean | – | Set true only after the user confirms the contact details (or corrects them). |
| country | string | – | Suggested or confirmed home country from user context. |
| string | – | Suggested or confirmed email from user context. | |
| feedback | string | – | Optional notes from the user (scope, questions, extra context). Ask, but omit if they skip. Never invent this. |
| first_name | string | – | Suggested or confirmed first name from user context. |
| interview_handle | string | yes | Opaque interview handle from start_session. Pass it on every later tool. |
| interview_summary | string | – | Optional override; normally loaded from the thread |
| last_name | string | – | Suggested or confirmed surname from user context. |
| project_name | string | – | Suggested or confirmed project name. Prefer values the user stated. |
| thread_id | string | yes | Interview thread id from start_session. |
| Name | Type | Req | Description |
|---|---|---|---|
| result | object | – | – |
No examples provided.
How do I install the ChatStack - App Cost Estimator MCP server?
ChatStack - App Cost Estimator is a hosted endpoint at https://mcp.chatstack.app/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · mcp.chatstack.app
claude mcp add --transport http app-chatstack-app-cost-estimator 'https://mcp.chatstack.app/mcp'
What is the ChatStack - App Cost Estimator MCP server?
ChatStack - App Cost Estimator is an MCP server listed in the public MCP registry as app.chatstack/app-cost-estimator. Estimate development costs and hours, scope an MVP, and write a PRD with user stories and specs. This page covers its hosted endpoint (https://mcp.chatstack.app/mcp).
Is the ChatStack - App Cost Estimator MCP server safe to use?
ChatStack - App Cost Estimator scores 67 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the ChatStack - App Cost Estimator MCP server expose?
ChatStack - App Cost Estimator exposes 5 tools: start_session, send_turn, send_action, get_estimate_status, submit_prd. Their descriptions and schemas cost roughly 1,600 tokens of context every time the server is loaded.
Does the ChatStack - App Cost Estimator MCP server require authentication?
No. We connected to ChatStack - App Cost Estimator without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the ChatStack - App Cost Estimator MCP server still maintained?
ChatStack - App Cost Estimator is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.