# Luala (remote · luala.app)

Photo shoots of you from your saved selfies: pick a pack, shoot, edit.

- Trust score: 72/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

## Components

- remote · `luala.app`: 72/100 (this document), [markdown](https://verifymcp.io/servers/app-luala-luala/luala.md), [page](https://verifymcp.io/servers/app-luala-luala/luala)

## Channel facts

- Endpoint: `https://luala.app/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `1.19.0`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Endpoint Security**: 80/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - No authorisation is required to call this server. Nothing on it is marked destructive, but we can't show that an anonymous caller can only read: full credit needs the server to list at least one tool and every tool to be verifiably read-only. We use a best-effort check of tool names and descriptions to tell read-only tools from tools that change things, so some genuinely read-only tools may not get full credit. Names that start with a read verb (get, list, read, search and similar) and accurate readOnlyHint annotations help. Meet that to earn full credit, or require authorisation.
  - HTTPS is enforced; there's no plaintext access path.
  - The HSTS (Strict-Transport-Security) header is present.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 74/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 3343 tokens (~151/item across 22 items; 21 tools + 1 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 7/100
  - Stability observed for 2 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 70/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 9% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - All 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.
  - An AI judge read all 23 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.
  - Supports UI / widget rendering.

## Install

### How do I install the Luala MCP server?

Luala is a hosted endpoint at https://luala.app/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http app-luala-luala 'https://luala.app/mcp'
```

### Cursor

```json
{
  "mcpServers": {
    "app-luala-luala": {
      "url": "https://luala.app/mcp"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "app-luala-luala": {
      "type": "http",
      "url": "https://luala.app/mcp"
    }
  }
}
```

### Codex

```toml
[mcp_servers.app-luala-luala]
url = "https://luala.app/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "app-luala-luala": {
      "type": "remote",
      "url": "https://luala.app/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add app-luala-luala --url 'https://luala.app/mcp' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  app-luala-luala:
    url: "https://luala.app/mcp"
```

### Netclaw

```json
{
  "McpServers": {
    "app-luala-luala": {
      "Transport": "http",
      "Url": "https://luala.app/mcp"
    }
  }
}
```

### Vellum

```bash
assistant mcp add app-luala-luala -t streamable-http -u 'https://luala.app/mcp'
```

### Other

```json
{
  "mcpServers": {
    "app-luala-luala": {
      "type": "http",
      "url": "https://luala.app/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-05 (score 72, +1)

- [security] Resource “photos” now points somewhere else: ui://luala/photos-d5f71627fb2e.html → ui://luala/photos-321acc39e4ea.html
- [functional regression] Schema quality: 2973 → 3343
- [functional] Server version: 1.20.0 → 1.22.0
- [functional] New tool “blur_faces”
- [functional] New tool “remove_objects”

### 2026-11-04 (score 71, 0)

- [security] Resource “photos” now points somewhere else: ui://luala/photos-f9a41e494519.html → ui://luala/photos-d5f71627fb2e.html
- [functional improvement] Stability: unverified → 0.03
- [functional] Server version: 1.19.0 → 1.20.0

### 2026-11-03 (score 71)

First indexed and scored.

## MCP tools (21)

### `list_packs` (~99 tokens)

List photo packs

Lists Luala's photo packs (a themed shoot of several photos of the user, made from their selfies) and mixes (one photo from each of several packs), with what all of a pack's photos cost and the price of one: a shoot can be any of a pack's shots, down to a single photo. Optionally only the packs for one use case.

Input parameters:

- `use_case` (string): Only the packs for this use case.

### `get_pack` (~89 tokens)

Get a pack's options

A pack's or mix's options (outfit, place, light, shots, shape and the attribute pickers), with ids, labels and defaults, and its price per photo. Each shot is one photo, and the user may pick any of them, from one to all (the default). start_shoot takes these ids.

Input parameters:

- `slug` (string, required): The pack's or mix's slug.

### `start_shoot` (~193 tokens)

Start a shoot

Starts a shoot of a pack from the user's saved selfies, paid from their credits: one photo per picked shot, at the price get_pack gives. Unless the user has said, offer them the whole pack or only the shots they want, even one. Tell the user the price first and pass it as max_credits; the shoot is refused if it costs more. A photo takes about 20 seconds: follow them with get_shoot. If a call to this tool got no answer, it may already have started: check list_photos before calling it again.

Input parameters:

- `max_credits` (integer, required): The most the user agreed to pay.
- `options` (object): Option ids from get_pack: outfit, place, light, ratio, shots (a list of shot ids) and any attribute key. Anything left out keeps its default.
- `pack` (string, required): The pack's or mix's slug.

### `get_shoot` (~108 tokens)

Get a shoot's photos

A shoot's photos: each one's id, whether it is ready, still working or failed (failed photos are refunded), each one's link in the Luala app (the link to give the user), and the shoot's page there; previews of the ready ones once none is working. While photos are working it waits up to 25 seconds for them before answering; call it again until none is working, telling the user how many are ready each time.

Input parameters:

- `shoot_id` (integer, required)

### `edit` (~231 tokens)

Edit a photo

Makes an edited copy of one of the user's photos, paid from their credits. type change keeps the pose and framing and changes any of: outfit and place (ids from get_pack of the photo's pack), light, the attributes, and text, up to 300 characters of what to change. type zoom_out steps back one step. Pass the price the user agreed to as max_credits: the photo's prices from get_shoot or list_photos name it. Fetch the result with list_photos. If a call to this tool got no answer, it may already have started: check list_photos before calling it again.

Input parameters:

- `beard` (string)
- `expression` (string)
- `glasses` (string)
- `hair_colour` (string)
- `hair_length` (string)
- `light` (string)
- `makeup` (string)
- `max_credits` (integer, required)
- `outfit` (string)
- `photo_id` (integer, required)
- `place` (string)
- `text` (string)
- `type` (string, required)

### `zoom_in` (~170 tokens)

Zoom in on a photo

Cuts a frame of the given shape out of one of the user's photos and upscales it to a full photo, paid from their credits. x, y and w are the frame's left edge, top edge and width as fractions of the photo (0 to 1); left out, the largest frame is centred. Pass the price the user agreed to as max_credits: the photo's prices from get_shoot or list_photos name it. If a call to this tool got no answer, it may already have started: check list_photos before calling it again.

Input parameters:

- `max_credits` (integer, required)
- `photo_id` (integer, required)
- `ratio` (string, required)
- `w` (number)
- `x` (number)
- `y` (number)

### `upscale` (~126 tokens)

Upscale a photo

Upscales one of the user's photos to 1K, 2K or 4K, paid from their credits. A photo is offered only the sizes larger than it and at most 4× its size; its prices from get_shoot or list_photos name them. Pass the price the user agreed to as max_credits. If a call to this tool got no answer, it may already have started: check list_photos before calling it again.

Input parameters:

- `max_credits` (integer, required)
- `photo_id` (integer, required)
- `size` (string, required)

### `reroll` (~97 tokens)

Re-roll a photo

Makes the same photo again, a new take of the same look, paid from the user's credits. Pass the price the user agreed to as max_credits: the photo's prices from get_shoot or list_photos name it. If a call to this tool got no answer, it may already have started: check list_photos before calling it again.

Input parameters:

- `max_credits` (integer, required)
- `photo_id` (integer, required)

### `remove_background` (~190 tokens)

Remove a photo's background

Cuts the person out of one of the user's photos, paid from their credits: on a clear (transparent) backdrop unless backdrop names a colour, #rrggbb (the app offers #ffffff, #e9e7e3, #3a3a3c, #000000, #1f2f4d, #bcd7ee, #f2e8d5, #b9c8b0). On a photo that is already a cutout it lays it on another backdrop. Pass the price the user agreed to as max_credits: the photo's prices from get_shoot or list_photos name it. If a call to this tool got no answer, it may already have started: check list_photos before calling it again.

Input parameters:

- `backdrop` (string)
- `max_credits` (integer, required)
- `photo_id` (integer, required)

### `remove_objects` (~197 tokens)

Remove things from a photo

Takes what description names out of one of the user's photos, paid from their credits, and fills where it was from what is around it; nothing else in the photo changes. Describe it as the user did, in any language (the people behind me, the bin on the left, the sign and the cables): Luala finds every match and removes the ones the words mean. 4 credits for one or two kinds of thing, 5 for three or four; when nothing matches, nothing is charged and the answer says so. Not on a cutout. Pass the price the user agreed to as max_credits: the photo's prices from get_shoot or list_photos name it. If a call to this tool got no answer, it may already have started: check list_photos before calling it again.

Input parameters:

- `description` (string, required)
- `max_credits` (integer, required)
- `photo_id` (integer, required)

### `replace_background` (~143 tokens)

Replace a photo's background

Puts the person in one of the user's photos somewhere else, keeping their pose and framing, paid from their credits: scene is one of the app's scenes, or text says the place in up to 300 characters; a scene wins when both come. Pass the price the user agreed to as max_credits: the photo's prices from get_shoot or list_photos name it. If a call to this tool got no answer, it may already have started: check list_photos before calling it again.

Input parameters:

- `max_credits` (integer, required)
- `photo_id` (integer, required)
- `scene` (string)
- `text` (string)

### `light_camera` (~214 tokens)

Relight a photo, or see it through another camera

Changes the light, the camera or the look of one of the user's photos, paid from their credits: at most one pick per group (light, lens, angle, focus, look), and/or text, up to 300 characters of what to change. What is not picked stays as it is. light and look keep the pose, framing and scene; a lens, angle or focus pick re-imagines the same moment through that camera, so the framing changes. Pass the price the user agreed to as max_credits: the photo's prices from get_shoot or list_photos name it. If a call to this tool got no answer, it may already have started: check list_photos before calling it again.

Input parameters:

- `angle` (string)
- `focus` (string)
- `lens` (string)
- `light` (string)
- `look` (string)
- `max_credits` (integer, required)
- `photo_id` (integer, required)
- `text` (string)

### `restore` (~176 tokens)

Restore an old photo

Repairs an old or damaged photo of the user's (a photographed print, most often one from list_photos with uploads), paid from their credits: repair fixes scratches, tears and stains, faces enhances them, colourise adds colour to a black and white one. size 1K is Standard, 2K High quality; the price is by size. Pass the price the user agreed to as max_credits: the photo's prices from get_shoot or list_photos name it. If a call to this tool got no answer, it may already have started: check list_photos before calling it again.

Input parameters:

- `colourise` (boolean)
- `faces` (boolean)
- `max_credits` (integer, required)
- `photo_id` (integer, required)
- `repair` (boolean)
- `size` (string, required)

### `blur_faces` (~173 tokens)

Blur the faces in a photo

Hides every face in one of the user's photos, as a new photo, paid from their credits: effect blur or pixelate, strength 0 (light) to 100 (strong). The faces are found by Luala; with none found nothing is started or charged. To keep some faces sharp or hide one it missed, the user opens the photo's link and uses Blur faces in the app. Pass the price the user agreed to as max_credits: the photo's prices from get_shoot or list_photos name it. If a call to this tool got no answer, it may already have started: check list_photos before calling it again.

Input parameters:

- `effect` (string)
- `max_credits` (integer, required)
- `photo_id` (integer, required)
- `strength` (integer)

### `combine` (~145 tokens)

Add to a photo from another photo

Adds the main subject of another of the user's photos (with_photo_id: an object or a person, a cutout works well) into one of their photos, keeping its scene, framing and light, paid from their credits. with_photo_id may not be a selfie, nor photo_id itself. Pass the price the user agreed to as max_credits: the photo's prices from get_shoot or list_photos name it. If a call to this tool got no answer, it may already have started: check list_photos before calling it again.

Input parameters:

- `max_credits` (integer, required)
- `photo_id` (integer, required)
- `with_photo_id` (integer, required)

### `try_on` (~148 tokens)

Try on clothes from another photo

Puts the clothes another of the user's photos shows (with_photo_id) on the person in one of their photos, paid from their credits; part top or bottom takes only that part of the outfit. with_photo_id may not be a selfie, nor photo_id itself. Pass the price the user agreed to as max_credits: the photo's prices from get_shoot or list_photos name it. If a call to this tool got no answer, it may already have started: check list_photos before calling it again.

Input parameters:

- `max_credits` (integer, required)
- `part` (string)
- `photo_id` (integer, required)
- `with_photo_id` (integer, required)

### `list_photos` (~153 tokens)

List the user's photos

With ids, those photos (up to 10), with a preview of each ready one once none is working: how to fetch an edit's result. While one is working it waits up to 25 seconds for it. Without, the user's latest shoots, newest first, five at a time; pass the answer's next as before for the five after. With uploads true, the photos the user added in the app (My photos) and those made from them, newest first, ten at a time, paged the same way: an old print to restore, clothes to try on, something to add.

Input parameters:

- `before` (integer)
- `ids` (array)
- `uploads` (boolean)

### `add_photo` (~236 tokens)

Add a photo

Adds one photo to the user's My photos in Luala, free, so it can be edited: an old print to restore, clothes to try on, a photo to change. The answer is the saved photo with its photo_id and edit prices: when the user asked for an edit of it, tell them that edit's price, and once they agree make it with Luala's tool for it on this photo_id, never with another image tool. Pass the file the user attached as photo. If you can't, but the file is in your sandbox, call with its content_type (image/jpeg, image/png or image/webp: convert a HEIC to JPEG first) and size in bytes, PUT the file to the answer's upload url with its headers, then call again with the answer's key. Called with none of these, it answers with the luala.app page where the user adds it. The user accepted the upload rules when connecting Luala.

Input parameters:

- `content_type` (string)
- `key` (string)
- `photo` (object): The file the user attached.
- `size` (integer)

### `add_selfie` (~181 tokens)

Add a selfie

Adds one selfie to the user's selfie set in Luala, which shoots are made from, free: one face, clearly visible, up to 15 selfies in the set. Pass the file the user attached as photo. If you can't, but the file is in your sandbox, call with its content_type (image/jpeg, image/png or image/webp: convert a HEIC to JPEG first) and size in bytes, PUT the file to the answer's upload url with its headers, then call again with the answer's key. Called with none of these, it answers with the luala.app page where the user adds it. The user accepted the upload rules when connecting Luala.

Input parameters:

- `content_type` (string)
- `key` (string)
- `photo` (object): The file the user attached.
- `size` (integer)

### `upload_status` (~49 tokens)

Whether an upload was saved

For Luala's widget: whether the file staged at key was saved by add_photo or add_selfie (tool). Read-only.

Input parameters:

- `key` (string, required)
- `tool` (string, required)

### `balance` (~25 tokens)

Credit balance

The user's credit balance, about how many photos it buys, and where to buy more.

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/app-luala-luala/luala#diagnostics

## Score history

- 2026-11-05: 72
- 2026-11-04: 71
- 2026-11-03: 71

## Common questions

### What is the Luala MCP server?

Luala is an MCP server listed in the public MCP registry as app.luala/luala. Photo shoots of you from your saved selfies: pick a pack, shoot, edit. This page covers its hosted endpoint (https://luala.app/mcp).

### Is the Luala MCP server safe to use?

Luala scores 72 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Luala MCP server expose?

Luala exposes 21 tools: list_packs, get_pack, start_shoot, get_shoot, edit, and 16 more. Their descriptions and schemas cost roughly 3,143 tokens of context every time the server is loaded.

### Does the Luala MCP server require authentication?

No. We connected to Luala without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

### Is the Luala MCP server still maintained?

Luala is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What did VerifyMCP test on the Luala MCP server?

VerifyMCP ran 14 checks on Luala, covering TLS certificate, Authorization, HTTPS, HSTS header and 10 more. Supply Chain Security and Provenance & Transparency do not apply to a hosted endpoint, so they were not tested. The score does not measure everything, and the scoring documentation lists what it leaves out.

## Links

- Remote endpoint: https://luala.app/mcp
- Website: https://luala.app/
- Changelog RSS feed: https://verifymcp.io/servers/app-luala-luala/luala.xml
- Changelog JSON feed: https://verifymcp.io/servers/app-luala-luala/luala/changelog.json
- Trust report (JSON): https://verifymcp.io/servers/app-luala-luala/luala.json
- HTML version of this page: https://verifymcp.io/servers/app-luala-luala/luala