# Toolaby (npm · toolaby)

Paid plans, licences, subscriptions and the paywall for Chrome extensions, on your own Stripe.

- Trust score: 63/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-10-17

## Components

- npm · `toolaby`: 63/100 (this document), [markdown](https://verifymcp.io/servers/app-toolaby-toolaby/toolaby.md), [page](https://verifymcp.io/servers/app-toolaby-toolaby/toolaby)

## Channel facts

- Registry: `npm`
- Package: `toolaby`
- Version: `1.15.1`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-10-17.

- **Supply Chain Security**: 100/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - No install/post-install scripts declared.
  - No production dependencies, so there is no dependency health to assess.
- **Provenance & Transparency**: 19/100
  - Repository check failed: no source repository is declared.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 0 days ago).
  - Security-disclosure policy not yet verified: we couldn't inspect the source repository.
- **Schema Quality & AI Usability**: 64/100
  - 67% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 4569 tokens (~142/item across 32 items; 30 tools + 2 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 91/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 69% of tool parameters carry a description.
  - Structured output schemas are declared (97% of tools); any adoption earns full credit.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - All 4 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.
  - An AI judge read all 32 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### How do I install the Toolaby MCP server?

Toolaby runs locally as an npm package, launched with npx -y toolaby. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add app-toolaby-toolaby -- npx -y toolaby
```

### Cursor

```json
{
  "mcpServers": {
    "app-toolaby-toolaby": {
      "command": "npx",
      "args": [
        "-y",
        "toolaby"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "app-toolaby-toolaby": {
      "command": "npx",
      "args": [
        "-y",
        "toolaby"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add app-toolaby-toolaby -- npx -y toolaby
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "app-toolaby-toolaby": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "toolaby"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add app-toolaby-toolaby --command npx --arg -y --arg toolaby
```

### Hermes

```yaml
mcp_servers:
  app-toolaby-toolaby:
    command: "npx"
    args: ["-y", "toolaby"]
```

### Netclaw

```json
{
  "McpServers": {
    "app-toolaby-toolaby": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "toolaby"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add app-toolaby-toolaby -t stdio -c npx -a -y toolaby
```

### Other

```json
{
  "mcpServers": {
    "app-toolaby-toolaby": {
      "command": "npx",
      "args": [
        "-y",
        "toolaby"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-10-15 (score 63, +29)

- [security improvement] Injection markers: unverified → pass
- [security] First check of Judged manipulation: pass
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] Tool coverage: unverified → 100
- [functional improvement] Schema quality: unverified → 67
- [functional improvement] MCP protocol: unverified → pass
- [functional] First check of Schema quality: fail
- [functional] First check of Tool coverage: 97
- [functional] First check of Schema quality: fail
- [functional] First check of Destructive annotations: 100
- [functional] First check of Tool coverage: 69
- [functional] First check of Schema quality: good

### 2026-10-14 (score 34)

First indexed and scored.

## MCP tools (30)

### `toolaby_whoami` (~37 tokens)

Who is signed in

The developer signed in to Toolaby (Test) and their workspaces, each with its role and the address its buyers use.

Output parameters:

- `email` (string)
- `workspaces` (array)

### `toolaby_list_tools` (~32 tokens)

List tools

Every tool in the developer's workspaces on Toolaby (Test), with the id the other tools take.

Output parameters:

- `tools` (array)

### `toolaby_get_tool` (~215 tokens)

Read a tool

One tool on Toolaby (Test). Read it before changing it. freePlan says what the Free plan holds (freePlan.holds, in a sentence); features are the keys gate({ feature }) takes; plans say what each unlocks (plans[].features), with the id openPaymentPage(id) and data-toolaby-plan take; toolKey is what toolaby.config.js must hold (else `npx -y toolaby@latest upgrade <id>`); extension.checkedInAt says whether a copy has checked in; sale says whether anything can be bought, as the dashboard says it (label, and fix: stripe or price); pages.buyer is the checkout page, pages.webScript the <script src> of toolaby-web.js for a website, pages.api the REST API's base on this side.

Input parameters:

- `tool` (string, required): The tool id, as toolaby_list_tools gives it (like "acme--word-counter"); the short one ("word-counter") works when it names one tool.

Output parameters:

- `extension` (object)
- `features` (array)
- `freePlan` (object)
- `id` (string)
- `name` (string)
- `pages` (object)
- `plans` (array)
- `stripeConnected` (boolean)
- `toolKey` (string)

### `toolaby_list_customers` (~133 tokens)

List customers

The tool's customers on Toolaby (Test): everyone who holds or held it, with how (licence, subscription, trial, grant) and whether they are entitled now. `query` filters by an address or a name, in part.

Input parameters:

- `limit` (integer): Optional: how many, 50 by default.
- `query` (string): Optional: part of an address or a name.
- `tool` (string, required): The tool id, as toolaby_list_tools gives it (like "acme--word-counter"); the short one ("word-counter") works when it names one tool.

Output parameters:

- `customers` (array)
- `tool` (string)
- `total` (integer)

### `toolaby_get_customer` (~138 tokens)

Read a customer

One buyer of the tool on Toolaby (Test): whether they hold it now and how (entitledVia, plan, features), their licences, subscriptions (status, renews, endsAt, trialEnd) and grants, each with the id refund, cancel and revoke take, and how many devices they use. Answers 404 when the address holds nothing of the tool.

Input parameters:

- `email` (string, required): The buyer's email address.
- `tool` (string, required): The tool id, as toolaby_list_tools gives it (like "acme--word-counter"); the short one ("word-counter") works when it names one tool.

Output parameters:

- `email` (string)
- `entitledVia` (string|null)
- `grants` (array)
- `licences` (array)
- `plan` (string|null)
- `subscriptions` (array)

### `toolaby_search_docs` (~61 tokens)

Search the docs

Searches Toolaby's docs. Call this before writing Toolaby code or answering how something works, even when you think you know: it gives the pages and sections that match, with the page name toolaby_docs reads.

Input parameters:

- `query` (string, required)

Output parameters:

- `results` (array)

### `toolaby_docs` (~59 tokens)

Read the docs

Toolaby's docs as Markdown. Without a page: the index, every page with what it covers. With a page (like "gating", "pricing", "agents", "reference/client"): that page.

Input parameters:

- `page` (string)

### `toolaby_check` (~207 tokens)

Check an extension's wiring

Checks an extension folder's Toolaby wiring and answers findings with stable codes ({ code, level, message, file, line, fix, docs }); ok is false when any is an error. Run it before saying the work is done. `built`: a build folder (like ".output/chrome-mv3" or "dist") to check as the build. `browser`: also load the extension in Chromium and ask its background (downloads Playwright and Chromium once, about 180 MB). `as`: with browser, enter the test licence `toolaby_test_unlock` made for this plan and confirm its features unlock.

Input parameters:

- `as` (string): A plan id, as toolaby_get_tool lists them (the first plan is "default").
- `browser` (boolean)
- `built` (string): Optional: a build folder to check as the build.
- `folder` (string): The extension's folder, absolute or relative to where the server started. Default: there.

Output parameters:

- `findings` (array)
- `ok` (boolean)
- `side` (string)

### `toolaby_stripe_status` (~87 tokens)

Is Stripe connected

Whether a workspace sells through Stripe yet on Test, and where a person connects it. Connecting is Stripe's own onboarding (identity, bank, terms): only a person can do it, in a browser. On Test every workspace has a test account already.

Input parameters:

- `workspace` (string): The workspace slug, when you have more than one (toolaby_whoami lists them).

Output parameters:

- `connectUrl` (string)
- `connected` (boolean)
- `message` (string)
- `workspace` (string)

### `toolaby_sign_in` (~66 tokens)

Sign in

Signs the command line and this server in to Toolaby (Test). Answers a link and a code for the person to approve in their browser — show them both — and keeps waiting in the background: once they approve, every other tool works. Already signed in: says who.

Output parameters:

- `code` (string)
- `email` (string)
- `expiresIn` (integer)
- `message` (string)
- `signedIn` (boolean)
- `url` (string)

### `toolaby_create_tool` (~159 tokens)

Create a tool

A new tool on Toolaby (Test): one more thing the workspace sells. Its Free plan holds everything until access is set. Then wire an extension to it: `npx -y toolaby@latest wire <id>` in an existing extension's folder, `npx -y toolaby@latest create <id>` for a new one.

Input parameters:

- `id` (string): Optional: the id within the workspace. Default: from the name.
- `name` (string, required): What buyers see, like "Word Counter".
- `tagline` (string): Optional: one line under the name on the checkout page.
- `workspace` (string): The workspace slug, when you have more than one (toolaby_whoami lists them).

Output parameters:

- `id` (string)
- `message` (string)
- `name` (string)
- `ok` (boolean)
- `workspace` (string)

### `toolaby_update_tool` (~138 tokens)

Change a tool's words or store listing

The tool's name, its line, its description, or its Chrome Web Store listing (the store link or the 32-letter id), on Test. Only what is sent changes. The store listing makes the store's copy one the tool key opens for: set it once the item exists.

Input parameters:

- `description` (string)
- `name` (string)
- `storeUrl` (string)
- `tagline` (string)
- `tool` (string, required): The tool id, as toolaby_list_tools gives it (like "acme--word-counter"); the short one ("word-counter") works when it names one tool.

Output parameters:

- `message` (string)
- `ok` (boolean)

### `toolaby_set_access` (~374 tokens)

Set what the Free plan holds

What a buyer gets before paying, on Test: "open" (the tool's use, unlimited), "free_uses" (a number of uses per device, or per account with signInRequired, counted by gate() without a feature: for good, or each day, week or month with freeUsesPer, counted by Toolaby in UTC), or "paid" (nothing before a plan). Whichever it is, a feature a plan sells (not marked free) is refused until bought. signInRequired asks for an account first. Takes effect on every device at its next check, with no release — so moving from "free_uses" to "open" would let copies already installed that gate with a bare gate() run everything free until they update: while copies are installed it is refused. Keep "free_uses": opening it is the person's step, once the build that gates by feature is live on the store — tell them, with the command the refusal names. The answer says when the tool key changed: then `npx -y toolaby@latest upgrade <id>`.

Input parameters:

- `access` (string, required)
- `freeUses` (integer): With "free_uses": how many per device, or per account with signInRequired (at most 200 a day).
- `freeUsesPer` (string): With "free_uses": how often they start again — "ever" (never, the default), or each UTC day, week (from Monday) or month. A daily allowance is this, not code.
- `signInRequired` (boolean)
- `tool` (string, required): The tool id, as toolaby_list_tools gives it (like "acme--word-counter"); the short one ("word-counter") works when it names one tool.

Output parameters:

- `keyChanged` (boolean)
- `message` (string)
- `next` (string)
- `ok` (boolean)
- `warning` (string)

### `toolaby_set_features` (~223 tokens)

Set features, and the plans that unlock them

The tool's whole feature list — send the features it keeps too: one left out is archived, never deleted (off the checkout, still held by the plans that held it, still answered for code that asks; sent again, it is listed again) — and which plans unlock which. Add the plans first (toolaby_add_plan), then this. A feature's key is what the extension passes to gate({ feature }) and has(). A feature marked free is on the Free plan too; one not free that no plan unlocks is refused to everyone. Naming one plan of a tier (plans that share a name, like "Pro" monthly and yearly) sets the whole tier. The answer lists what each plan unlocks now.

Input parameters:

- `features` (array, required)
- `plans` (array): For each plan id, the feature keys it unlocks.
- `tool` (string, required): The tool id, as toolaby_list_tools gives it (like "acme--word-counter"); the short one ("word-counter") works when it names one tool.

Output parameters:

- `message` (string)
- `ok` (boolean)
- `plans` (array)

### `toolaby_add_plan` (~332 tokens)

Add a plan

A plan buyers can buy: a Price on the workspace's Stripe account (on Test, its test account). "one_time" is a lifetime licence (by default on the tool's devices, sold per seat); "subscription" bills monthly or yearly (any devices, one person). Answers the plan's id (the first is "default") — what openPaymentPage(id) and data-toolaby-plan take — then say what it unlocks with toolaby_set_features. Two plans with one name are one tier. The answer says when the tool key changed: then `npx -y toolaby@latest upgrade <id>`.

Input parameters:

- `amount` (number, required): In the currency's main unit, like 9.99.
- `billing` (string, required)
- `currency` (string, required): Three letters, like "usd" or "eur".
- `devices` (integer): Optional: devices one buyer may use at once.
- `interval` (string): Subscriptions only. Default: month.
- `name` (string): Optional: the plan's name, its tier, like "Pro". Buyers read it before the billing ("Pro · Monthly"), so never the billing word itself.
- `perSeat` (boolean): Optional: sold per seat, to teams. Default: yes for one_time, no for a subscription.
- `tool` (string, required): The tool id, as toolaby_list_tools gives it (like "acme--word-counter"); the short one ("word-counter") works when it names one tool.
- `trialDays` (integer): Subscriptions only: a free trial.

Output parameters:

- `keyChanged` (boolean)
- `message` (string)
- `next` (string)
- `ok` (boolean)
- `plan` (object)

### `toolaby_update_plan` (~158 tokens)

Change a plan's terms

A plan's name (its tier), free trial, devices or per seat. Only what is sent changes. The price never changes: a new price is a new plan (toolaby_add_plan), and the old one is retired (toolaby_retire_plan).

Input parameters:

- `devices` (integer)
- `name` (string)
- `perSeat` (boolean)
- `plan` (string, required): A plan id, as toolaby_get_tool lists them (the first plan is "default").
- `tool` (string, required): The tool id, as toolaby_list_tools gives it (like "acme--word-counter"); the short one ("word-counter") works when it names one tool.
- `trialDays` (integer)

Output parameters:

- `keyChanged` (boolean)
- `message` (string)
- `next` (string)
- `ok` (boolean)

### `toolaby_retire_plan` (~104 tokens)

Retire a plan

Takes a plan off sale: its Stripe price is archived and nobody can buy it any more. Everyone who bought it keeps what they bought.

Input parameters:

- `plan` (string, required): A plan id, as toolaby_get_tool lists them (the first plan is "default").
- `tool` (string, required): The tool id, as toolaby_list_tools gives it (like "acme--word-counter"); the short one ("word-counter") works when it names one tool.

Output parameters:

- `message` (string)
- `ok` (boolean)

### `toolaby_grant` (~185 tokens)

Give access without paying

Access to the tool's paid features without paying, for an address: a friend, a beta tester, a refund made good. It applies once that person signs in to the extension with that address (a sign-in link by email). For a store reviewer, who cannot receive a sign-in link, make a coupon instead (toolaby_create_coupon). For a number of days, or until revoked; answers the grant id toolaby_revoke_grant takes. On Hobby a workspace holds 100 grants and other passes live at once.

Input parameters:

- `days` (integer): Optional: how long. Default: until revoked.
- `email` (string, required): The buyer's email address.
- `tool` (string, required): The tool id, as toolaby_list_tools gives it (like "acme--word-counter"); the short one ("word-counter") works when it names one tool.

Output parameters:

- `grant` (object)
- `message` (string)
- `ok` (boolean)

### `toolaby_revoke_grant` (~91 tokens)

Take a grant back

Takes back access given without paying: the person loses it at their next check. The id comes from toolaby_grant's answer or toolaby_get_customer.

Input parameters:

- `id` (string, required)
- `tool` (string, required): The tool id, as toolaby_list_tools gives it (like "acme--word-counter"); the short one ("word-counter") works when it names one tool.

Output parameters:

- `message` (string)
- `ok` (boolean)

### `toolaby_create_coupon` (~213 tokens)

Make a coupon code

A coupon code buyers type on the checkout page, on the workspace's Stripe account (Test). The Chrome Web Store reviewer's way in: percentOff 100, maxRedemptions 1, a few days, and the code in the item's test instructions. percentOff or amountOff (with currency); once, for some months ("repeating" + months), or for ever on a subscription.

Input parameters:

- `amountOff` (number)
- `code` (string): Optional: the code. Default: REVIEW-xxxxxx.
- `currency` (string)
- `duration` (string)
- `expiresDays` (integer)
- `firstTimeOnly` (boolean)
- `maxRedemptions` (integer)
- `months` (integer)
- `percentOff` (number)
- `tool` (string, required): The tool id, as toolaby_list_tools gives it (like "acme--word-counter"); the short one ("word-counter") works when it names one tool.

Output parameters:

- `coupon` (object)
- `message` (string)
- `ok` (boolean)

### `toolaby_refund` (~159 tokens)

Refund a licence

Refunds a buyer's lifetime licence in full on their card and revokes it at once; Stripe keeps its fee and Toolaby keeps its own. By the buyer's address (when they have one paid licence) or a licence id from toolaby_get_customer. A subscription's payment is refunded in the Stripe Dashboard; end the subscription with toolaby_cancel_subscription.

Input parameters:

- `email` (string): The buyer's email address.
- `licence` (string): Optional: the licence id, when they have several.
- `reason` (string)
- `tool` (string, required): The tool id, as toolaby_list_tools gives it (like "acme--word-counter"); the short one ("word-counter") works when it names one tool.

Output parameters:

- `licence` (string)
- `message` (string)
- `ok` (boolean)

### `toolaby_cancel_subscription` (~137 tokens)

Cancel a subscription

Ends a buyer's subscription: at the end of the period they paid for (they keep access until then), or now. Nothing is refunded. By the buyer's address (when they have one running) or a subscription id from toolaby_get_customer.

Input parameters:

- `email` (string): The buyer's email address.
- `now` (boolean): End it now, not at the period's end.
- `subscription` (string)
- `tool` (string, required): The tool id, as toolaby_list_tools gives it (like "acme--word-counter"); the short one ("word-counter") works when it names one tool.

Output parameters:

- `message` (string)
- `ok` (boolean)
- `subscription` (string)

### `toolaby_test_unlock` (~153 tokens)

Make a test licence (Test only)

Test only. A licence for one of the tool's plans, for the developer's own +toolaby-test address, with no payment: then toolaby_check with browser and as: <plan> enters it in the loaded extension and confirms the plan's features unlock. Proves the paid path with no person and no card. Each call makes a new one (a pass on Hobby).

Input parameters:

- `plan` (string): A plan id, as toolaby_get_tool lists them (the first plan is "default").
- `tool` (string, required): The tool id, as toolaby_list_tools gives it (like "acme--word-counter"); the short one ("word-counter") works when it names one tool.

Output parameters:

- `licence` (object)
- `message` (string)
- `ok` (boolean)

### `toolaby_copy_to_live` (~198 tokens)

Copy a tool to Live

Copies a tool from Test to Live — its Free plan, features, plans (as prices on the Live Stripe account), extension identity and versions — and answers the Live tool key. Done again later, it updates what changed. Needs the command line signed in on both sides (`npx -y toolaby@latest login` and `login --live`) as the same person, and Stripe taking payments on Live for the plans: copied before, the plans stay on Test until it is copied again. The answer's dashboard is the tool's page on Live, which lists what is left. Then `npx -y toolaby@latest upgrade <id> --live` writes the Live key into the extension before the store build.

Input parameters:

- `tool` (string, required): The tool id, as toolaby_list_tools gives it (like "acme--word-counter"); the short one ("word-counter") works when it names one tool.

Output parameters:

- `kept` (integer)
- `key` (string)
- `made` (integer)
- `message` (string)
- `next` (string)
- `ok` (boolean)

### `toolaby_create_api_key` (~173 tokens)

Make a server API key

A secret API key for the developer's own server (Toolaby's REST API, Test), written into an env file as TOOLABY_API_KEY, with the API's base for this side as TOOLABY_API_URL, and never shown: the answer says where it went, not what it is. The file is created if missing; a TOOLABY_API_KEY line already there is replaced. Make sure the file is in .gitignore.

Input parameters:

- `envFile` (string, required): The env file, like ".env" (relative to where the server started) or an absolute path.
- `name` (string): Optional: what the key is for, like "Server".
- `workspace` (string): The workspace slug, when you have more than one (toolaby_whoami lists them).

Output parameters:

- `apiUrl` (string|null)
- `envFile` (string)
- `gitignored` (boolean)
- `message` (string)
- `ok` (boolean)
- `variable` (string)
- `workspace` (string)

### `toolaby_list_webhook_events` (~51 tokens)

List the webhook events

The events Toolaby sends a registered endpoint — purchases, subscriptions started and cancelled, refunds, disputes — each with a description and an example of what it carries, for the handler that reads them.

Output parameters:

- `events` (array)

### `toolaby_list_webhooks` (~58 tokens)

List webhook endpoints

The endpoints registered on Test: id, address, the events each listens for, and whether it is paused.

Input parameters:

- `workspace` (string): The workspace slug, when you have more than one (toolaby_whoami lists them).

Output parameters:

- `endpoints` (array)
- `workspace` (string)

### `toolaby_add_webhook` (~222 tokens)

Register a webhook endpoint

Registers the developer's server to receive Toolaby's events on Test, and writes its signing secret into an env file as TOOLABY_WEBHOOK_SECRET, never shown. A server that mirrors buyers gets no event until its endpoint is registered: on Test, this is yours to do as part of the job, not a step to leave to the person; toolaby_remove_webhook undoes it. The url is the server's public address and the handler's path (a tunnel's while developing, like https://…trycloudflare.com/webhooks/toolaby).

Input parameters:

- `description` (string)
- `envFile` (string, required): The env file the server reads, like ".env", for TOOLABY_WEBHOOK_SECRET.
- `events` (array): Optional: only these events (toolaby_list_webhook_events); all of them when left out.
- `url` (string, required): The public https address of the handler.
- `workspace` (string): The workspace slug, when you have more than one (toolaby_whoami lists them).

Output parameters:

- `envFile` (string)
- `gitignored` (boolean)
- `id` (string)
- `message` (string)
- `ok` (boolean)
- `url` (string)
- `variable` (string)
- `workspace` (string)

### `toolaby_send_test_event` (~99 tokens)

Send a test event

Sends an event's example to every endpoint registered on Test that listens for it, as a real, signed delivery: the way to see a handler answer 2xx. 100 a day per workspace.

Input parameters:

- `type` (string, required): An event, like "purchase.completed" (toolaby_list_webhook_events).
- `workspace` (string): The workspace slug, when you have more than one (toolaby_whoami lists them).

Output parameters:

- `id` (string)
- `sent` (string)
- `workspace` (string)

### `toolaby_remove_webhook` (~66 tokens)

Remove a webhook endpoint

Removes an endpoint: deliveries to it stop at once.

Input parameters:

- `id` (string, required): The endpoint id, as toolaby_list_webhooks gives it.
- `workspace` (string): The workspace slug, when you have more than one (toolaby_whoami lists them).

Output parameters:

- `removed` (string)
- `workspace` (string)

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/app-toolaby-toolaby/toolaby#diagnostics

## Score history

- 2026-10-17: 63
- 2026-10-16: 63
- 2026-10-15: 63
- 2026-10-14: 34

## Common questions

### What is the Toolaby MCP server?

Toolaby is an MCP server listed in the public MCP registry as app.toolaby/toolaby. Paid plans, licences, subscriptions and the paywall for Chrome extensions, on your own Stripe. This page covers its npm package (toolaby).

### Is the Toolaby MCP server safe to use?

Toolaby scores 63 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 17 October 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Toolaby MCP server expose?

Toolaby exposes 30 tools: toolaby_whoami, toolaby_list_tools, toolaby_get_tool, toolaby_list_customers, toolaby_get_customer, and 25 more. Their descriptions and schemas cost roughly 4,328 tokens of context every time the server is loaded.

### Is the Toolaby MCP server still maintained?

Toolaby is still listed as active in the MCP registry. We last reached this channel on 17 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the Toolaby MCP server under?

Toolaby declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- npm package: https://www.npmjs.com/package/toolaby
- Socket report: https://socket.dev/npm/package/toolaby
- Website: https://toolaby.app/docs/agents
- Changelog RSS feed: https://verifymcp.io/servers/app-toolaby-toolaby/toolaby.xml
- Changelog JSON feed: https://verifymcp.io/servers/app-toolaby-toolaby/toolaby.json
- HTML version of this page: https://verifymcp.io/servers/app-toolaby-toolaby/toolaby