Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

Toolaby

NPM · TOOLABY

Paid plans, licences, subscriptions and the paywall for Chrome extensions, on your own Stripe.

Available components

63 Trust /100

Last scanned (15 hours ago)

Scores higher than 37% of npm servers

Category Finance and Payments

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security100
  • No malware found by supply-chain analysis.Pass
  • No known CVEs affecting this package version or its production dependencies.Pass
  • No install/post-install scripts declared.Pass
  • No production dependencies, so there is no dependency health to assess. View diagnostics → Pass
Provenance & Transparency19
Schema Quality & AI Usability64
  • 67% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Partial
  • AI-judged instruction clarity (good).Pass
  • Context-footprint check failed: tool/resource definitions use about 4569 tokens (~142/item across 32 items; 30 tools + 2 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management0
  • Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage91
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 69% of tool parameters carry a description.Partial
  • Structured output schemas are declared (97% of tools); any adoption earns full credit.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • All 4 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
  • An AI judge read all 32 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass

Unverified: 1 category

A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 15 Oct 26 +29
    • Injection markers: unverified → pass ▲ security
    • First check of Judged manipulation: pass security
    • Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window). security
    • Tool coverage: unverified → 100 ▲ functional
    • Schema quality: unverified → 67 ▲ functional
    • MCP protocol: unverified → pass ▲ functional
    • First check of Schema quality: fail functional
    • First check of Tool coverage: 97 functional
    • First check of Schema quality: fail functional
    • First check of Destructive annotations: 100 functional
    • First check of Tool coverage: 69 functional
    • First check of Schema quality: good functional
  • 14 Oct 26 34

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 17 Oct 2026 · Analysed npm/toolaby@1.15.1

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem npm

Background: How many MCP packages publish verified provenance →

Dependencies 0 packages
Packages resolved 0
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 30 exposed · ~4,328 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
toolaby_add_plan ~332

A plan buyers can buy: a Price on the workspace's Stripe account (on Test, its test account). "one_time" is a lifetime licence (by default on the tool's devices, sold per seat); "subscription" bills monthly or yearly (any devices, one person). Answers the plan's id (the first is "default") — what openPaymentPage(id) and data-toolaby-plan take — then say what it unlocks with toolaby_set_features. Two plans with one name are one tier. The answer says when the tool key changed: then `npx -y toolaby@latest upgrade <id>`.

NameTypeReqDescription
amountnumberyesIn the currency's main unit, like 9.99.
billingstringyes–
currencystringyesThree letters, like "usd" or "eur".
devicesinteger–Optional: devices one buyer may use at once.
intervalstring–Subscriptions only. Default: month.
namestring–Optional: the plan's name, its tier, like "Pro". Buyers read it before the billing ("Pro · Monthly"), so never the billing word itself.
perSeatboolean–Optional: sold per seat, to teams. Default: yes for one_time, no for a subscription.
toolstringyesThe tool id, as toolaby_list_tools gives it (like "acme--word-counter"); the short one ("word-counter") works when it names one tool.
trialDaysinteger–Subscriptions only: a free trial.
NameTypeReqDescription
keyChangedboolean––
messagestring––
nextstring––
okboolean––
planobject––

No examples provided.

toolaby_add_webhook ~222

Registers the developer's server to receive Toolaby's events on Test, and writes its signing secret into an env file as TOOLABY_WEBHOOK_SECRET, never shown. A server that mirrors buyers gets no event until its endpoint is registered: on Test, this is yours to do as part of the job, not a step to leave to the person; toolaby_remove_webhook undoes it. The url is the server's public address and the handler's path (a tunnel's while developing, like https://…trycloudflare.com/webhooks/toolaby).

NameTypeReqDescription
descriptionstring––
envFilestringyesThe env file the server reads, like ".env", for TOOLABY_WEBHOOK_SECRET.
eventsarray–Optional: only these events (toolaby_list_webhook_events); all of them when left out.
urlstringyesThe public https address of the handler.
workspacestring–The workspace slug, when you have more than one (toolaby_whoami lists them).
NameTypeReqDescription
envFilestring––
gitignoredboolean––
idstring––
messagestring––
okboolean––
urlstring––
variablestring––
workspacestring––

No examples provided.

toolaby_cancel_subscription ~137

Ends a buyer's subscription: at the end of the period they paid for (they keep access until then), or now. Nothing is refunded. By the buyer's address (when they have one running) or a subscription id from toolaby_get_customer.

NameTypeReqDescription
emailstring–The buyer's email address.
nowboolean–End it now, not at the period's end.
subscriptionstring––
toolstringyesThe tool id, as toolaby_list_tools gives it (like "acme--word-counter"); the short one ("word-counter") works when it names one tool.
NameTypeReqDescription
messagestring––
okboolean––
subscriptionstring––

No examples provided.

toolaby_check ~207

Checks an extension folder's Toolaby wiring and answers findings with stable codes ({ code, level, message, file, line, fix, docs }); ok is false when any is an error. Run it before saying the work is done. `built`: a build folder (like ".output/chrome-mv3" or "dist") to check as the build. `browser`: also load the extension in Chromium and ask its background (downloads Playwright and Chromium once, about 180 MB). `as`: with browser, enter the test licence `toolaby_test_unlock` made for this plan and confirm its features unlock.

NameTypeReqDescription
asstring–A plan id, as toolaby_get_tool lists them (the first plan is "default").
browserboolean––
builtstring–Optional: a build folder to check as the build.
folderstring–The extension's folder, absolute or relative to where the server started. Default: there.
NameTypeReqDescription
findingsarray––
okboolean––
sidestring––

No examples provided.

toolaby_copy_to_live ~198

Copies a tool from Test to Live — its Free plan, features, plans (as prices on the Live Stripe account), extension identity and versions — and answers the Live tool key. Done again later, it updates what changed. Needs the command line signed in on both sides (`npx -y toolaby@latest login` and `login --live`) as the same person, and Stripe taking payments on Live for the plans: copied before, the plans stay on Test until it is copied again. The answer's dashboard is the tool's page on Live, which lists what is left. Then `npx -y toolaby@latest upgrade <id> --live` writes the Live key into the extension before the store build.

NameTypeReqDescription
toolstringyesThe tool id, as toolaby_list_tools gives it (like "acme--word-counter"); the short one ("word-counter") works when it names one tool.
NameTypeReqDescription
keptinteger––
keystring––
madeinteger––
messagestring––
nextstring––
okboolean––

No examples provided.

toolaby_create_api_key ~173

A secret API key for the developer's own server (Toolaby's REST API, Test), written into an env file as TOOLABY_API_KEY, with the API's base for this side as TOOLABY_API_URL, and never shown: the answer says where it went, not what it is. The file is created if missing; a TOOLABY_API_KEY line already there is replaced. Make sure the file is in .gitignore.

NameTypeReqDescription
envFilestringyesThe env file, like ".env" (relative to where the server started) or an absolute path.
namestring–Optional: what the key is for, like "Server".
workspacestring–The workspace slug, when you have more than one (toolaby_whoami lists them).
NameTypeReqDescription
apiUrlstring|null––
envFilestring––
gitignoredboolean––
messagestring––
okboolean––
variablestring––
workspacestring––

No examples provided.

toolaby_create_coupon ~213

A coupon code buyers type on the checkout page, on the workspace's Stripe account (Test). The Chrome Web Store reviewer's way in: percentOff 100, maxRedemptions 1, a few days, and the code in the item's test instructions. percentOff or amountOff (with currency); once, for some months ("repeating" + months), or for ever on a subscription.

NameTypeReqDescription
amountOffnumber––
codestring–Optional: the code. Default: REVIEW-xxxxxx.
currencystring––
durationstring––
expiresDaysinteger––
firstTimeOnlyboolean––
maxRedemptionsinteger––
monthsinteger––
percentOffnumber––
toolstringyesThe tool id, as toolaby_list_tools gives it (like "acme--word-counter"); the short one ("word-counter") works when it names one tool.
NameTypeReqDescription
couponobject––
messagestring––
okboolean––

No examples provided.

toolaby_create_tool ~159

A new tool on Toolaby (Test): one more thing the workspace sells. Its Free plan holds everything until access is set. Then wire an extension to it: `npx -y toolaby@latest wire <id>` in an existing extension's folder, `npx -y toolaby@latest create <id>` for a new one.

NameTypeReqDescription
idstring–Optional: the id within the workspace. Default: from the name.
namestringyesWhat buyers see, like "Word Counter".
taglinestring–Optional: one line under the name on the checkout page.
workspacestring–The workspace slug, when you have more than one (toolaby_whoami lists them).
NameTypeReqDescription
idstring––
messagestring––
namestring––
okboolean––
workspacestring––

No examples provided.

toolaby_docs ~59

Toolaby's docs as Markdown. Without a page: the index, every page with what it covers. With a page (like "gating", "pricing", "agents", "reference/client"): that page.

NameTypeReqDescription
pagestring––

No output schema declared.

No examples provided.

toolaby_get_customer ~138

One buyer of the tool on Toolaby (Test): whether they hold it now and how (entitledVia, plan, features), their licences, subscriptions (status, renews, endsAt, trialEnd) and grants, each with the id refund, cancel and revoke take, and how many devices they use. Answers 404 when the address holds nothing of the tool.

NameTypeReqDescription
emailstringyesThe buyer's email address.
toolstringyesThe tool id, as toolaby_list_tools gives it (like "acme--word-counter"); the short one ("word-counter") works when it names one tool.
NameTypeReqDescription
emailstring––
entitledViastring|null––
grantsarray––
licencesarray––
planstring|null––
subscriptionsarray––

No examples provided.

toolaby_get_tool ~215

One tool on Toolaby (Test). Read it before changing it. freePlan says what the Free plan holds (freePlan.holds, in a sentence); features are the keys gate({ feature }) takes; plans say what each unlocks (plans[].features), with the id openPaymentPage(id) and data-toolaby-plan take; toolKey is what toolaby.config.js must hold (else `npx -y toolaby@latest upgrade <id>`); extension.checkedInAt says whether a copy has checked in; sale says whether anything can be bought, as the dashboard says it (label, and fix: stripe or price); pages.buyer is the checkout page, pages.webScript the <script src> of toolaby-web.js for a website, pages.api the REST API's base on this side.

NameTypeReqDescription
toolstringyesThe tool id, as toolaby_list_tools gives it (like "acme--word-counter"); the short one ("word-counter") works when it names one tool.
NameTypeReqDescription
extensionobject––
featuresarray––
freePlanobject––
idstring––
namestring––
pagesobject––
plansarray––
stripeConnectedboolean––
toolKeystring––

No examples provided.

toolaby_grant ~185

Access to the tool's paid features without paying, for an address: a friend, a beta tester, a refund made good. It applies once that person signs in to the extension with that address (a sign-in link by email). For a store reviewer, who cannot receive a sign-in link, make a coupon instead (toolaby_create_coupon). For a number of days, or until revoked; answers the grant id toolaby_revoke_grant takes. On Hobby a workspace holds 100 grants and other passes live at once.

NameTypeReqDescription
daysinteger–Optional: how long. Default: until revoked.
emailstringyesThe buyer's email address.
toolstringyesThe tool id, as toolaby_list_tools gives it (like "acme--word-counter"); the short one ("word-counter") works when it names one tool.
NameTypeReqDescription
grantobject––
messagestring––
okboolean––

No examples provided.

toolaby_list_customers ~133

The tool's customers on Toolaby (Test): everyone who holds or held it, with how (licence, subscription, trial, grant) and whether they are entitled now. `query` filters by an address or a name, in part.

NameTypeReqDescription
limitinteger–Optional: how many, 50 by default.
querystring–Optional: part of an address or a name.
toolstringyesThe tool id, as toolaby_list_tools gives it (like "acme--word-counter"); the short one ("word-counter") works when it names one tool.
NameTypeReqDescription
customersarray––
toolstring––
totalinteger––

No examples provided.

toolaby_list_tools ~32

Every tool in the developer's workspaces on Toolaby (Test), with the id the other tools take.

Input schema present but exposes no named parameters.

NameTypeReqDescription
toolsarray––

No examples provided.

toolaby_list_webhook_events ~51

The events Toolaby sends a registered endpoint — purchases, subscriptions started and cancelled, refunds, disputes — each with a description and an example of what it carries, for the handler that reads them.

Input schema present but exposes no named parameters.

NameTypeReqDescription
eventsarray––

No examples provided.

toolaby_list_webhooks ~58

The endpoints registered on Test: id, address, the events each listens for, and whether it is paused.

NameTypeReqDescription
workspacestring–The workspace slug, when you have more than one (toolaby_whoami lists them).
NameTypeReqDescription
endpointsarray––
workspacestring––

No examples provided.

toolaby_refund ~159

Refunds a buyer's lifetime licence in full on their card and revokes it at once; Stripe keeps its fee and Toolaby keeps its own. By the buyer's address (when they have one paid licence) or a licence id from toolaby_get_customer. A subscription's payment is refunded in the Stripe Dashboard; end the subscription with toolaby_cancel_subscription.

NameTypeReqDescription
emailstring–The buyer's email address.
licencestring–Optional: the licence id, when they have several.
reasonstring––
toolstringyesThe tool id, as toolaby_list_tools gives it (like "acme--word-counter"); the short one ("word-counter") works when it names one tool.
NameTypeReqDescription
licencestring––
messagestring––
okboolean––

No examples provided.

toolaby_remove_webhook ~66

Removes an endpoint: deliveries to it stop at once.

NameTypeReqDescription
idstringyesThe endpoint id, as toolaby_list_webhooks gives it.
workspacestring–The workspace slug, when you have more than one (toolaby_whoami lists them).
NameTypeReqDescription
removedstring––
workspacestring––

No examples provided.

toolaby_retire_plan ~104

Takes a plan off sale: its Stripe price is archived and nobody can buy it any more. Everyone who bought it keeps what they bought.

NameTypeReqDescription
planstringyesA plan id, as toolaby_get_tool lists them (the first plan is "default").
toolstringyesThe tool id, as toolaby_list_tools gives it (like "acme--word-counter"); the short one ("word-counter") works when it names one tool.
NameTypeReqDescription
messagestring––
okboolean––

No examples provided.

toolaby_revoke_grant ~91

Takes back access given without paying: the person loses it at their next check. The id comes from toolaby_grant's answer or toolaby_get_customer.

NameTypeReqDescription
idstringyes–
toolstringyesThe tool id, as toolaby_list_tools gives it (like "acme--word-counter"); the short one ("word-counter") works when it names one tool.
NameTypeReqDescription
messagestring––
okboolean––

No examples provided.

toolaby_search_docs ~61

Searches Toolaby's docs. Call this before writing Toolaby code or answering how something works, even when you think you know: it gives the pages and sections that match, with the page name toolaby_docs reads.

NameTypeReqDescription
querystringyes–
NameTypeReqDescription
resultsarray––

No examples provided.

toolaby_send_test_event ~99

Sends an event's example to every endpoint registered on Test that listens for it, as a real, signed delivery: the way to see a handler answer 2xx. 100 a day per workspace.

NameTypeReqDescription
typestringyesAn event, like "purchase.completed" (toolaby_list_webhook_events).
workspacestring–The workspace slug, when you have more than one (toolaby_whoami lists them).
NameTypeReqDescription
idstring––
sentstring––
workspacestring––

No examples provided.

toolaby_set_access ~374

What a buyer gets before paying, on Test: "open" (the tool's use, unlimited), "free_uses" (a number of uses per device, or per account with signInRequired, counted by gate() without a feature: for good, or each day, week or month with freeUsesPer, counted by Toolaby in UTC), or "paid" (nothing before a plan). Whichever it is, a feature a plan sells (not marked free) is refused until bought. signInRequired asks for an account first. Takes effect on every device at its next check, with no release — so moving from "free_uses" to "open" would let copies already installed that gate with a bare gate() run everything free until they update: while copies are installed it is refused. Keep "free_uses": opening it is the person's step, once the build that gates by feature is live on the store — tell them, with the command the refusal names. The answer says when the tool key changed: then `npx -y toolaby@latest upgrade <id>`.

NameTypeReqDescription
accessstringyes–
freeUsesinteger–With "free_uses": how many per device, or per account with signInRequired (at most 200 a day).
freeUsesPerstring–With "free_uses": how often they start again — "ever" (never, the default), or each UTC day, week (from Monday) or month. A daily allowance is this, not code.
signInRequiredboolean––
toolstringyesThe tool id, as toolaby_list_tools gives it (like "acme--word-counter"); the short one ("word-counter") works when it names one tool.
NameTypeReqDescription
keyChangedboolean––
messagestring––
nextstring––
okboolean––
warningstring––

No examples provided.

toolaby_set_features ~223

The tool's whole feature list — send the features it keeps too: one left out is archived, never deleted (off the checkout, still held by the plans that held it, still answered for code that asks; sent again, it is listed again) — and which plans unlock which. Add the plans first (toolaby_add_plan), then this. A feature's key is what the extension passes to gate({ feature }) and has(). A feature marked free is on the Free plan too; one not free that no plan unlocks is refused to everyone. Naming one plan of a tier (plans that share a name, like "Pro" monthly and yearly) sets the whole tier. The answer lists what each plan unlocks now.

NameTypeReqDescription
featuresarrayyes–
plansarray–For each plan id, the feature keys it unlocks.
toolstringyesThe tool id, as toolaby_list_tools gives it (like "acme--word-counter"); the short one ("word-counter") works when it names one tool.
NameTypeReqDescription
messagestring––
okboolean––
plansarray––

No examples provided.

toolaby_sign_in ~66

Signs the command line and this server in to Toolaby (Test). Answers a link and a code for the person to approve in their browser — show them both — and keeps waiting in the background: once they approve, every other tool works. Already signed in: says who.

Input schema present but exposes no named parameters.

NameTypeReqDescription
codestring––
emailstring––
expiresIninteger––
messagestring––
signedInboolean––
urlstring––

No examples provided.

toolaby_stripe_status ~87

Whether a workspace sells through Stripe yet on Test, and where a person connects it. Connecting is Stripe's own onboarding (identity, bank, terms): only a person can do it, in a browser. On Test every workspace has a test account already.

NameTypeReqDescription
workspacestring–The workspace slug, when you have more than one (toolaby_whoami lists them).
NameTypeReqDescription
connectUrlstring––
connectedboolean––
messagestring––
workspacestring––

No examples provided.

toolaby_test_unlock ~153

Test only. A licence for one of the tool's plans, for the developer's own +toolaby-test address, with no payment: then toolaby_check with browser and as: <plan> enters it in the loaded extension and confirms the plan's features unlock. Proves the paid path with no person and no card. Each call makes a new one (a pass on Hobby).

NameTypeReqDescription
planstring–A plan id, as toolaby_get_tool lists them (the first plan is "default").
toolstringyesThe tool id, as toolaby_list_tools gives it (like "acme--word-counter"); the short one ("word-counter") works when it names one tool.
NameTypeReqDescription
licenceobject––
messagestring––
okboolean––

No examples provided.

toolaby_update_plan ~158

A plan's name (its tier), free trial, devices or per seat. Only what is sent changes. The price never changes: a new price is a new plan (toolaby_add_plan), and the old one is retired (toolaby_retire_plan).

NameTypeReqDescription
devicesinteger––
namestring––
perSeatboolean––
planstringyesA plan id, as toolaby_get_tool lists them (the first plan is "default").
toolstringyesThe tool id, as toolaby_list_tools gives it (like "acme--word-counter"); the short one ("word-counter") works when it names one tool.
trialDaysinteger––
NameTypeReqDescription
keyChangedboolean––
messagestring––
nextstring––
okboolean––

No examples provided.

toolaby_update_tool ~138

The tool's name, its line, its description, or its Chrome Web Store listing (the store link or the 32-letter id), on Test. Only what is sent changes. The store listing makes the store's copy one the tool key opens for: set it once the item exists.

NameTypeReqDescription
descriptionstring––
namestring––
storeUrlstring––
taglinestring––
toolstringyesThe tool id, as toolaby_list_tools gives it (like "acme--word-counter"); the short one ("word-counter") works when it names one tool.
NameTypeReqDescription
messagestring––
okboolean––

No examples provided.

toolaby_whoami ~37

The developer signed in to Toolaby (Test) and their workspaces, each with its role and the address its buyers use.

Input schema present but exposes no named parameters.

NameTypeReqDescription
emailstring––
workspacesarray––

No examples provided.

Install

How do I install the Toolaby MCP server?

Toolaby runs locally as an npm package, launched with npx -y toolaby. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · toolaby

# add to Claude Code
claude mcp add app-toolaby-toolaby -- npx -y toolaby
Common questions

What is the Toolaby MCP server?

Toolaby is an MCP server listed in the public MCP registry as app.toolaby/toolaby. Paid plans, licences, subscriptions and the paywall for Chrome extensions, on your own Stripe. This page covers its npm package (toolaby).

Is the Toolaby MCP server safe to use?

Toolaby scores 63 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 17 October 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the Toolaby MCP server expose?

Toolaby exposes 30 tools: toolaby_whoami, toolaby_list_tools, toolaby_get_tool, toolaby_list_customers, toolaby_get_customer, and 25 more. Their descriptions and schemas cost roughly 4,328 tokens of context every time the server is loaded.

Is the Toolaby MCP server still maintained?

Toolaby is still listed as active in the MCP registry. We last reached this channel on 17 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the Toolaby MCP server under?

Toolaby declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.