Luala
REMOTE · LUALA.APP
Photo shoots of you from your saved selfies: pick a pack, shoot, edit.
Available components
Last scanned (4 hours ago)
Scores higher than 58% of remote servers
Reachable. Last reached 5 Nov 2026.
Category Design and Media
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security80
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- No authorisation is required to call this server. Every tool declares its destructiveHint and none is destructive, so open access doesn't expose one. See how to fix → View diagnostics → Partial
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability74
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 3343 tokens (~151/item across 22 items; 21 tools + 1 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management7
- Stability observed for 2 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage70
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 9% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 23 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
- Supports UI / widget rendering.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 5 Nov 26 +1
- Resource “photos” now points somewhere else: ui://luala/photos-d5f71627fb2e.html → ui://luala/photos-321acc39e4ea.html security
- Schema quality: 2973 → 3343 ▼ functional
- Server version: 1.20.0 → 1.22.0 functional
- New tool “blur_faces” functional
- New tool “remove_objects” functional
- 4 Nov 26 0
- Resource “photos” now points somewhere else: ui://luala/photos-f9a41e494519.html → ui://luala/photos-d5f71627fb2e.html security
- Stability: unverified → 0.03 ▲ functional
- Server version: 1.19.0 → 1.20.0 functional
- 3 Nov 26 71
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Probed https://luala.app/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=luala.app | CN=YE1,O=Let's Encrypt,C=US | 28 Oct 2026 | 26 Jan 2027 | ECDSA 256 | ECDSA-SHA384 | 57ad1e7cc3efeb1f4856976ee9a0a51befc |
| SANs: luala.app | ||||||
| CN=YE1,O=Let's Encrypt,C=US (CA) | CN=Root YE,O=ISRG,C=US | 3 Sept 2025 | 2 Sept 2028 | ECDSA 384 | ECDSA-SHA384 | 5ddd70dd31f801c85c186a7a04b80afe |
| CN=Root YE,O=ISRG,C=US (CA) | CN=ISRG Root X2,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | ECDSA-SHA384 | 872165fc34b6e5fba8add5b3705fb53a |
| CN=ISRG Root X2,O=Internet Security Research Group,C=US (CA) | CN=ISRG Root X1,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | SHA256-RSA | 6c8f1dc727c7117f7baf853ac980f9cd |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of luala.app. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| app. | present | 23684 | 8 | Verified |
| luala.app. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
| Header | Value |
|---|---|
| strict-transport-security | max-age=31536000 |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://luala.app/mcp | Verified | 200 | |
| http (plaintext) | http://luala.app/mcp | HTTPS enforced | 301 | https://luala.app/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
add_photo Add a photo ~236
Adds one photo to the user's My photos in Luala, free, so it can be edited: an old print to restore, clothes to try on, a photo to change. The answer is the saved photo with its photo_id and edit prices: when the user asked for an edit of it, tell them that edit's price, and once they agree make it with Luala's tool for it on this photo_id, never with another image tool. Pass the file the user attached as photo. If you can't, but the file is in your sandbox, call with its content_type (image/jpeg, image/png or image/webp: convert a HEIC to JPEG first) and size in bytes, PUT the file to the answer's upload url with its headers, then call again with the answer's key. Called with none of these, it answers with the luala.app page where the user adds it. The user accepted the upload rules when connecting Luala.
| Name | Type | Req | Description |
|---|---|---|---|
| content_type | string | – | – |
| key | string | – | – |
| photo | object | – | The file the user attached. |
| size | integer | – | – |
No output schema declared.
No examples provided.
add_selfie Add a selfie ~181
Adds one selfie to the user's selfie set in Luala, which shoots are made from, free: one face, clearly visible, up to 15 selfies in the set. Pass the file the user attached as photo. If you can't, but the file is in your sandbox, call with its content_type (image/jpeg, image/png or image/webp: convert a HEIC to JPEG first) and size in bytes, PUT the file to the answer's upload url with its headers, then call again with the answer's key. Called with none of these, it answers with the luala.app page where the user adds it. The user accepted the upload rules when connecting Luala.
| Name | Type | Req | Description |
|---|---|---|---|
| content_type | string | – | – |
| key | string | – | – |
| photo | object | – | The file the user attached. |
| size | integer | – | – |
No output schema declared.
No examples provided.
balance Credit balance ~25
The user's credit balance, about how many photos it buys, and where to buy more.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
blur_faces Blur the faces in a photo ~173
Hides every face in one of the user's photos, as a new photo, paid from their credits: effect blur or pixelate, strength 0 (light) to 100 (strong). The faces are found by Luala; with none found nothing is started or charged. To keep some faces sharp or hide one it missed, the user opens the photo's link and uses Blur faces in the app. Pass the price the user agreed to as max_credits: the photo's prices from get_shoot or list_photos name it. If a call to this tool got no answer, it may already have started: check list_photos before calling it again.
| Name | Type | Req | Description |
|---|---|---|---|
| effect | string | – | – |
| max_credits | integer | yes | – |
| photo_id | integer | yes | – |
| strength | integer | – | – |
No output schema declared.
No examples provided.
combine Add to a photo from another photo ~145
Adds the main subject of another of the user's photos (with_photo_id: an object or a person, a cutout works well) into one of their photos, keeping its scene, framing and light, paid from their credits. with_photo_id may not be a selfie, nor photo_id itself. Pass the price the user agreed to as max_credits: the photo's prices from get_shoot or list_photos name it. If a call to this tool got no answer, it may already have started: check list_photos before calling it again.
| Name | Type | Req | Description |
|---|---|---|---|
| max_credits | integer | yes | – |
| photo_id | integer | yes | – |
| with_photo_id | integer | yes | – |
No output schema declared.
No examples provided.
edit Edit a photo ~231
Makes an edited copy of one of the user's photos, paid from their credits. type change keeps the pose and framing and changes any of: outfit and place (ids from get_pack of the photo's pack), light, the attributes, and text, up to 300 characters of what to change. type zoom_out steps back one step. Pass the price the user agreed to as max_credits: the photo's prices from get_shoot or list_photos name it. Fetch the result with list_photos. If a call to this tool got no answer, it may already have started: check list_photos before calling it again.
| Name | Type | Req | Description |
|---|---|---|---|
| beard | string | – | – |
| expression | string | – | – |
| glasses | string | – | – |
| hair_colour | string | – | – |
| hair_length | string | – | – |
| light | string | – | – |
| makeup | string | – | – |
| max_credits | integer | yes | – |
| outfit | string | – | – |
| photo_id | integer | yes | – |
| place | string | – | – |
| text | string | – | – |
| type | string | yes | – |
No output schema declared.
No examples provided.
get_pack Get a pack's options ~89
A pack's or mix's options (outfit, place, light, shots, shape and the attribute pickers), with ids, labels and defaults, and its price per photo. Each shot is one photo, and the user may pick any of them, from one to all (the default). start_shoot takes these ids.
| Name | Type | Req | Description |
|---|---|---|---|
| slug | string | yes | The pack's or mix's slug. |
No output schema declared.
No examples provided.
get_shoot Get a shoot's photos ~108
A shoot's photos: each one's id, whether it is ready, still working or failed (failed photos are refunded), each one's link in the Luala app (the link to give the user), and the shoot's page there; previews of the ready ones once none is working. While photos are working it waits up to 25 seconds for them before answering; call it again until none is working, telling the user how many are ready each time.
| Name | Type | Req | Description |
|---|---|---|---|
| shoot_id | integer | yes | – |
No output schema declared.
No examples provided.
light_camera Relight a photo, or see it through another camera ~214
Changes the light, the camera or the look of one of the user's photos, paid from their credits: at most one pick per group (light, lens, angle, focus, look), and/or text, up to 300 characters of what to change. What is not picked stays as it is. light and look keep the pose, framing and scene; a lens, angle or focus pick re-imagines the same moment through that camera, so the framing changes. Pass the price the user agreed to as max_credits: the photo's prices from get_shoot or list_photos name it. If a call to this tool got no answer, it may already have started: check list_photos before calling it again.
| Name | Type | Req | Description |
|---|---|---|---|
| angle | string | – | – |
| focus | string | – | – |
| lens | string | – | – |
| light | string | – | – |
| look | string | – | – |
| max_credits | integer | yes | – |
| photo_id | integer | yes | – |
| text | string | – | – |
No output schema declared.
No examples provided.
list_packs List photo packs ~99
Lists Luala's photo packs (a themed shoot of several photos of the user, made from their selfies) and mixes (one photo from each of several packs), with what all of a pack's photos cost and the price of one: a shoot can be any of a pack's shots, down to a single photo. Optionally only the packs for one use case.
| Name | Type | Req | Description |
|---|---|---|---|
| use_case | string | – | Only the packs for this use case. |
No output schema declared.
No examples provided.
list_photos List the user's photos ~153
With ids, those photos (up to 10), with a preview of each ready one once none is working: how to fetch an edit's result. While one is working it waits up to 25 seconds for it. Without, the user's latest shoots, newest first, five at a time; pass the answer's next as before for the five after. With uploads true, the photos the user added in the app (My photos) and those made from them, newest first, ten at a time, paged the same way: an old print to restore, clothes to try on, something to add.
| Name | Type | Req | Description |
|---|---|---|---|
| before | integer | – | – |
| ids | array | – | – |
| uploads | boolean | – | – |
No output schema declared.
No examples provided.
remove_background Remove a photo's background ~190
Cuts the person out of one of the user's photos, paid from their credits: on a clear (transparent) backdrop unless backdrop names a colour, #rrggbb (the app offers #ffffff, #e9e7e3, #3a3a3c, #000000, #1f2f4d, #bcd7ee, #f2e8d5, #b9c8b0). On a photo that is already a cutout it lays it on another backdrop. Pass the price the user agreed to as max_credits: the photo's prices from get_shoot or list_photos name it. If a call to this tool got no answer, it may already have started: check list_photos before calling it again.
| Name | Type | Req | Description |
|---|---|---|---|
| backdrop | string | – | – |
| max_credits | integer | yes | – |
| photo_id | integer | yes | – |
No output schema declared.
No examples provided.
remove_objects Remove things from a photo ~197
Takes what description names out of one of the user's photos, paid from their credits, and fills where it was from what is around it; nothing else in the photo changes. Describe it as the user did, in any language (the people behind me, the bin on the left, the sign and the cables): Luala finds every match and removes the ones the words mean. 4 credits for one or two kinds of thing, 5 for three or four; when nothing matches, nothing is charged and the answer says so. Not on a cutout. Pass the price the user agreed to as max_credits: the photo's prices from get_shoot or list_photos name it. If a call to this tool got no answer, it may already have started: check list_photos before calling it again.
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | yes | – |
| max_credits | integer | yes | – |
| photo_id | integer | yes | – |
No output schema declared.
No examples provided.
replace_background Replace a photo's background ~143
Puts the person in one of the user's photos somewhere else, keeping their pose and framing, paid from their credits: scene is one of the app's scenes, or text says the place in up to 300 characters; a scene wins when both come. Pass the price the user agreed to as max_credits: the photo's prices from get_shoot or list_photos name it. If a call to this tool got no answer, it may already have started: check list_photos before calling it again.
| Name | Type | Req | Description |
|---|---|---|---|
| max_credits | integer | yes | – |
| photo_id | integer | yes | – |
| scene | string | – | – |
| text | string | – | – |
No output schema declared.
No examples provided.
reroll Re-roll a photo ~97
Makes the same photo again, a new take of the same look, paid from the user's credits. Pass the price the user agreed to as max_credits: the photo's prices from get_shoot or list_photos name it. If a call to this tool got no answer, it may already have started: check list_photos before calling it again.
| Name | Type | Req | Description |
|---|---|---|---|
| max_credits | integer | yes | – |
| photo_id | integer | yes | – |
No output schema declared.
No examples provided.
restore Restore an old photo ~176
Repairs an old or damaged photo of the user's (a photographed print, most often one from list_photos with uploads), paid from their credits: repair fixes scratches, tears and stains, faces enhances them, colourise adds colour to a black and white one. size 1K is Standard, 2K High quality; the price is by size. Pass the price the user agreed to as max_credits: the photo's prices from get_shoot or list_photos name it. If a call to this tool got no answer, it may already have started: check list_photos before calling it again.
| Name | Type | Req | Description |
|---|---|---|---|
| colourise | boolean | – | – |
| faces | boolean | – | – |
| max_credits | integer | yes | – |
| photo_id | integer | yes | – |
| repair | boolean | – | – |
| size | string | yes | – |
No output schema declared.
No examples provided.
start_shoot Start a shoot ~193
Starts a shoot of a pack from the user's saved selfies, paid from their credits: one photo per picked shot, at the price get_pack gives. Unless the user has said, offer them the whole pack or only the shots they want, even one. Tell the user the price first and pass it as max_credits; the shoot is refused if it costs more. A photo takes about 20 seconds: follow them with get_shoot. If a call to this tool got no answer, it may already have started: check list_photos before calling it again.
| Name | Type | Req | Description |
|---|---|---|---|
| max_credits | integer | yes | The most the user agreed to pay. |
| options | object | – | Option ids from get_pack: outfit, place, light, ratio, shots (a list of shot ids) and any attribute key. Anything left out keeps its default. |
| pack | string | yes | The pack's or mix's slug. |
No output schema declared.
No examples provided.
try_on Try on clothes from another photo ~148
Puts the clothes another of the user's photos shows (with_photo_id) on the person in one of their photos, paid from their credits; part top or bottom takes only that part of the outfit. with_photo_id may not be a selfie, nor photo_id itself. Pass the price the user agreed to as max_credits: the photo's prices from get_shoot or list_photos name it. If a call to this tool got no answer, it may already have started: check list_photos before calling it again.
| Name | Type | Req | Description |
|---|---|---|---|
| max_credits | integer | yes | – |
| part | string | – | – |
| photo_id | integer | yes | – |
| with_photo_id | integer | yes | – |
No output schema declared.
No examples provided.
upload_status Whether an upload was saved ~49
For Luala's widget: whether the file staged at key was saved by add_photo or add_selfie (tool). Read-only.
| Name | Type | Req | Description |
|---|---|---|---|
| key | string | yes | – |
| tool | string | yes | – |
No output schema declared.
No examples provided.
upscale Upscale a photo ~126
Upscales one of the user's photos to 1K, 2K or 4K, paid from their credits. A photo is offered only the sizes larger than it and at most 4× its size; its prices from get_shoot or list_photos name them. Pass the price the user agreed to as max_credits. If a call to this tool got no answer, it may already have started: check list_photos before calling it again.
| Name | Type | Req | Description |
|---|---|---|---|
| max_credits | integer | yes | – |
| photo_id | integer | yes | – |
| size | string | yes | – |
No output schema declared.
No examples provided.
zoom_in Zoom in on a photo ~170
Cuts a frame of the given shape out of one of the user's photos and upscales it to a full photo, paid from their credits. x, y and w are the frame's left edge, top edge and width as fractions of the photo (0 to 1); left out, the largest frame is centred. Pass the price the user agreed to as max_credits: the photo's prices from get_shoot or list_photos name it. If a call to this tool got no answer, it may already have started: check list_photos before calling it again.
| Name | Type | Req | Description |
|---|---|---|---|
| max_credits | integer | yes | – |
| photo_id | integer | yes | – |
| ratio | string | yes | – |
| w | number | – | – |
| x | number | – | – |
| y | number | – | – |
No output schema declared.
No examples provided.
How do I install the Luala MCP server?
Luala is a hosted endpoint at https://luala.app/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · luala.app
claude mcp add --transport http app-luala-luala 'https://luala.app/mcp'
What is the Luala MCP server?
Luala is an MCP server listed in the public MCP registry as app.luala/luala. Photo shoots of you from your saved selfies: pick a pack, shoot, edit. This page covers its hosted endpoint (https://luala.app/mcp).
Is the Luala MCP server safe to use?
Luala scores 72 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Luala MCP server expose?
Luala exposes 21 tools: list_packs, get_pack, start_shoot, get_shoot, edit, and 16 more. Their descriptions and schemas cost roughly 3,143 tokens of context every time the server is loaded.
Does the Luala MCP server require authentication?
No. We connected to Luala without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the Luala MCP server still maintained?
Luala is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.