Shared Forest
REMOTE · SHAREDFOREST.COM · SCANNED SEP 28
Plant or sponsor trees in a shared forest that grows from its traffic. Sponsoring uses OAuth.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security80
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- No authorisation is required to call this server. Every tool declares its destructiveHint and none is destructive, so open access doesn't expose one. See how to fix → View diagnostics → Partial
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability50
- 0% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Fail
- AI-judged instruction clarity (excellent).Pass
- Tool/resource definitions use about 1437 tokens (~102/item across 14 items; 13 tools + 1 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management17
- Stability observed for 5 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 13 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 15 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities60
- Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28. See how to fix → Fail
How do I install the Shared Forest MCP server?
Shared Forest is a hosted endpoint at https://sharedforest.com/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · sharedforest.com
claude mcp add --transport http arneffm-shared-forest 'https://sharedforest.com/mcp'
{
"mcpServers": {
"arneffm-shared-forest": {
"url": "https://sharedforest.com/mcp"
}
}
} {
"servers": {
"arneffm-shared-forest": {
"type": "http",
"url": "https://sharedforest.com/mcp"
}
}
} [mcp_servers.arneffm-shared-forest] url = "https://sharedforest.com/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"arneffm-shared-forest": {
"type": "remote",
"url": "https://sharedforest.com/mcp",
"enabled": true
}
}
} openclaw mcp add arneffm-shared-forest --url 'https://sharedforest.com/mcp' --transport streamable-http
mcp_servers:
arneffm-shared-forest:
url: "https://sharedforest.com/mcp" {
"McpServers": {
"arneffm-shared-forest": {
"Transport": "http",
"Url": "https://sharedforest.com/mcp"
}
}
} assistant mcp add arneffm-shared-forest -t streamable-http -u 'https://sharedforest.com/mcp'
{
"mcpServers": {
"arneffm-shared-forest": {
"type": "http",
"url": "https://sharedforest.com/mcp"
}
}
} The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 28 Sept 26 +1
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 26 Sept 26 +1
- Tool “get_price_quote” rewrote its description, which is the text the model reads security
- “start_sponsorship” added an optional parameter “link_text” cosmetic
- “start_sponsorship” added an optional parameter “short_description” cosmetic
- 25 Sept 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 24 Sept 26 +1
- The server rewrote its instructions, which are the text every model session reads security
- Tool “get_order” rewrote its description, which is the text the model reads security
- Tool “start_sponsorship” rewrote its description, which is the text the model reads security
- Schema quality: 1180 → 1379 ▼ functional
- Stability: unverified → 0.03 ▲ functional
- New tool “my_orders” functional
- New tool “my_trees” functional
- “start_sponsorship” reworded the description of “email” cosmetic
- “start_sponsorship” made “email” optional cosmetic
- 23 Sept 26 67
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 28 Sept 2026 · Probed https://sharedforest.com/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=sharedforest.com | CN=WE1,O=Google Trust Services,C=US | 23 Sept 2026 | 22 Dec 2026 | ECDSA 256 | ECDSA-SHA256 | 5d15953d2b03606b0e9efdb7151d1415 |
| SANs: sharedforest.com, admin.preview.sharedforest.com, *.admin.preview.sharedforest.com | ||||||
| CN=WE1,O=Google Trust Services,C=US (CA) | CN=GTS Root R4,O=Google Trust Services LLC,C=US | 13 Dec 2023 | 20 Feb 2029 | ECDSA 256 | ECDSA-SHA384 | 7ff31977972c224a76155d13b6d685e3 |
| CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) | CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE | 15 Nov 2023 | 28 Jan 2028 | ECDSA 384 | SHA256-RSA | 7fe530bf331343bedd821610493d8a1b |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of sharedforest.com. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| com. | present | 19718 | 13 | Verified |
| sharedforest.com. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
| Header | Value |
|---|---|
| strict-transport-security | max-age=31536000; includeSubDomains |
| x-content-type-options | nosniff |
| x-frame-options | DENY |
| referrer-policy | strict-origin-when-cross-origin |
| permissions-policy | geolocation=(), camera=(), microphone=(), usb=(), payment=() |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://sharedforest.com/mcp | Verified | 200 | |
| http (plaintext) | http://sharedforest.com/mcp | HTTPS enforced | 301 | https://sharedforest.com/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
design_tree Design a sponsored tree ~104
Turns a short wish (for example 'a silver birch with lanterns') into a premium tree design. An AI paints the tree after the call (about 30 s); the first painting becomes the tree. Returns design_id and the tree genome. Max 3 designs per caller per day. Show the result to the user before you order.
| Name | Type | Req | Description |
|---|---|---|---|
| wish | string | yes | What the tree should look like, 1-200 characters. No brands, logos or text. |
No output schema declared.
No examples provided.
explain_shared_forest Explain Shared Forest ~64
Read-only. Returns the full agent guide as Markdown: growth rules, API, tools and limits.
| Name | Type | Req | Description |
|---|---|---|---|
| section | string | – | Return only the section whose heading contains this text, for example 'Limits' or 'MCP tools'. Omit for the whole guide. |
No output schema declared.
No examples provided.
find_spots Find free spots ~116
Read-only. Suggests free positions for N sponsored trees, optionally near a point. Pass the spots to start_sponsorship, or omit spots there and the server picks them.
| Name | Type | Req | Description |
|---|---|---|---|
| near_x | number | – | Optional x coordinate (0-8192) to search near. Needs near_y. |
| near_y | number | – | Optional y coordinate (0-8192) to search near. Needs near_x. |
| quantity | integer | yes | Number of trees, 1-100. Larger orders get a lower unit price. |
No output schema declared.
No examples provided.
get_design Read a tree design ~47
Read-only. Returns one design by design_id: genome, genomeHash and expiresAt.
| Name | Type | Req | Description |
|---|---|---|---|
| design_id | string | yes | Design id from design_tree, for example dsn_abc123. |
No output schema declared.
No examples provided.
get_forest Forest summary ~91
Read-only. Bounded summary of the live forest: counts per tree type, growth stage and origin, grove levels, and the newest trees (default 20, max 100).
| Name | Type | Req | Description |
|---|---|---|---|
| bbox | array | – | Bounding box [minX, minY, maxX, maxY] in world coordinates. Only trees inside it are returned. |
| limit | integer | – | Number of newest trees to return. |
No output schema declared.
No examples provided.
get_forest_stats Forest statistics ~58
Read-only. Counts of trees, groves, total and unique visitors, and traffic by class (humans, agents, bots, trees planted today).
| Name | Type | Req | Description |
|---|---|---|---|
| fields | array | – | Return only these counters. Omit for all counters. |
No output schema declared.
No examples provided.
get_order Read a sponsorship order ~88
Read-only. Needs OAuth scope account:read or sponsor:write. Status of one of the user's orders (open, paid, fulfilled, expired, refunded, disputed, cancelled, refund_pending) and its tree ids once fulfilled. Poll every 10 seconds or more after the user pays.
| Name | Type | Req | Description |
|---|---|---|---|
| order_id | string | yes | Order id from start_sponsorship, for example ord_abc123. |
No output schema declared.
No examples provided.
get_price_quote Quote a tree sponsorship ~66
Read-only. Final price for sponsoring N trees for 12 months: unit price, total in euro cents and discount. Call it before you tell the user a price.
| Name | Type | Req | Description |
|---|---|---|---|
| quantity | integer | yes | Number of trees, 1-100. Larger orders get a lower unit price. |
No output schema declared.
No examples provided.
list_trees List trees ~106
Read-only. One page of trees with cursor pagination, the same data as GET /api/forest?limit=. Pass nextCursor as cursor until it is null.
| Name | Type | Req | Description |
|---|---|---|---|
| bbox | array | – | Bounding box [minX, minY, maxX, maxY] in world coordinates. Only trees inside it are returned. |
| cursor | string | – | Opaque cursor from nextCursor of the previous page. |
| limit | integer | yes | Trees per page, for example 100. |
No output schema declared.
No examples provided.
my_orders My sponsorship orders ~51
Read-only. Needs OAuth scope account:read. The signed-in user's sponsorship orders, newest first, with status, total and tree ids.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Number of orders, 1-50. |
No output schema declared.
No examples provided.
my_trees My sponsored trees ~54
Read-only. Needs OAuth scope account:read. The trees of the signed-in user's fulfilled orders, with a link to each tree in the forest.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Number of trees, 1-500. |
No output schema declared.
No examples provided.
plant_tree Plant a tree ~85
Plant one tree in the Shared Forest for the caller. One tree per visitor per day; repeats only add growth energy. The visit counts as agent traffic. Ask the user before you call it.
| Name | Type | Req | Description |
|---|---|---|---|
| idempotency_key | string | – | Optional retry key, for example a UUID. A retry with the same key within 24 hours returns the first visitId and plants nothing new. |
No output schema declared.
No examples provided.
start_sponsorship Start a tree sponsorship ~302
Needs OAuth scope sponsor:write (a Shared Forest account). Creates an unpaid order for the signed-in user and holds the spots. It charges nothing. The total must fit the spending limit the user set when connecting. The order expires after 30 minutes unless the user confirms. Returns confirm_url: give it to your user. The user logs in, accepts the terms and pays on that page. Ask the user before you call it and confirm name and total.
| Name | Type | Req | Description |
|---|---|---|---|
| design_ids | array | yes | One design_id for all trees, or one per tree. |
| display_name | string | yes | Name shown on the trees, 1-32 characters, labelled Sponsored. |
| string | – | Optional email for the confirmation and the invoice. Default: the email of the signed-in account. | |
| idempotency_key | string | yes | Retry key, for example a UUID. A retry with the same key returns the same order. |
| link | string | – | Optional https link. It goes live after manual review. |
| link_text | string | – | Optional public label for the link. Requires link; approved with it. |
| quantity | integer | yes | Number of trees, 1-100. Larger orders get a lower unit price. |
| short_description | string | – | Optional short public description. Requires link; approved with it. |
| spots | array | – | Optional positions from find_spots, one per tree. Omit and the server picks free spots. |
No output schema declared.
No examples provided.
What is the Shared Forest MCP server?
Shared Forest is an MCP server listed in the public MCP registry as io.github.ArneFfm/shared-forest. Plant or sponsor trees in a shared forest that grows from its traffic. Sponsoring uses OAuth. This page covers its hosted endpoint (https://sharedforest.com/mcp).
Is the Shared Forest MCP server safe to use?
Shared Forest scores 70 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Shared Forest MCP server expose?
Shared Forest exposes 13 tools: get_forest_stats, get_forest, list_trees, plant_tree, explain_shared_forest, and 8 more. Their descriptions and schemas cost roughly 1,232 tokens of context every time the server is loaded.
Does the Shared Forest MCP server require authentication?
No. We connected to Shared Forest without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the Shared Forest MCP server still maintained?
Shared Forest is still listed as active in the MCP registry. We last reached this channel on 28 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.