Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

Heista

REMOTE · WWW.HEISTA.CO · SCANNED SEP 27

Decode video ads, load brand intelligence, generate ad scripts.

Available components

+60 this week 93 Trust /100
Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →

Endpoint Security94
Transport & Reachability100
Schema Quality & AI Usability77
  • 97% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Partial
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 30622 tokens (~257/item across 119 items; 118 tools + 1 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
  • No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 99% of tool parameters carry a description.Partial
  • Structured output schemas are declared (1% of tools); any adoption earns full credit.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • All 4 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
  • An AI judge read all 120 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
  • Supports UI / widget rendering.Pass
Install

How do I install the Heista MCP server?

Heista is a hosted endpoint at https://www.heista.co/api/mcp/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

remote · www.heista.co

# add to Claude Code
claude mcp add --transport http co-heista-api 'https://www.heista.co/api/mcp/mcp'
// .cursor/mcp.json
{
  "mcpServers": {
    "co-heista-api": {
      "url": "https://www.heista.co/api/mcp/mcp"
    }
  }
}
// .vscode/mcp.json
{
  "servers": {
    "co-heista-api": {
      "type": "http",
      "url": "https://www.heista.co/api/mcp/mcp"
    }
  }
}
# ~/.codex/config.toml
[mcp_servers.co-heista-api]
url = "https://www.heista.co/api/mcp/mcp"
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "co-heista-api": {
      "type": "remote",
      "url": "https://www.heista.co/api/mcp/mcp",
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add co-heista-api --url 'https://www.heista.co/api/mcp/mcp' --transport streamable-http
# ~/.hermes/config.yaml
mcp_servers:
  co-heista-api:
    url: "https://www.heista.co/api/mcp/mcp"
// ~/.netclaw/config/netclaw.json
{
  "McpServers": {
    "co-heista-api": {
      "Transport": "http",
      "Url": "https://www.heista.co/api/mcp/mcp"
    }
  }
}
# add to Vellum
assistant mcp add co-heista-api -t streamable-http -u 'https://www.heista.co/api/mcp/mcp'
// mcp.json
{
  "mcpServers": {
    "co-heista-api": {
      "type": "http",
      "url": "https://www.heista.co/api/mcp/mcp"
    }
  }
}

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 26 Sept 26 +60
    • Transport: unverified → pass ▲ security
    • Injection markers: unverified → pass ▲ security
    • Stability: unverified → pass ▲ security
    • HSTS header: fail → pass ▲ security
    • Authorization: fail → pass ▲ security
    • The server rewrote its instructions, which are the text every model session reads security
    • Endpoint reachability: behind authorisation → reachable ▲ functional
    • MCP protocol: unverified → pass ▲ functional
    • Schema quality: unverified → 97 ▲ functional
    • Tool coverage: unverified → 100 ▲ functional
    • “fleet_crawler_hits” reworded the description of “path_contains” cosmetic
    • “fleet_site_pages” reworded the description of “path_contains” cosmetic
  • 25 Sept 26 0
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 15 Sept 26 −60
    • Endpoint reachability: reachable → behind authorisation ▼ security
    • Stability: pass → unverified ▼ security
    • Tool safety: pass → unverified ▼ security
    • Transport: pass → unverified ▼ security
    • Authorization: pass → fail ▼ security
    • HSTS header: pass → fail ▼ security
    • Schema quality: 97 → unverified ▼ functional
    • Capabilities: pass → unverified ▼ functional
    • Tool coverage: 100 → unverified ▼ functional
  • 26 Aug 26 0
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 25 Aug 26 0
    • Stability: 0.97 → pass security
    • New tool “creative_delete_draft”, which the server declares destructive security
    • New tool “creative_update_slug”, which the server declares destructive security
    • Tool “fleet_analytics_overview” rewrote its description, which is the text the model reads security
    • New tool “creative_get_shelf” functional
    • New tool “fleet_create_issue” functional
    • New tool “fleet_product_funnel_counts” functional
    • “fleet_crawler_hits” added an optional parameter “path_prefix” cosmetic
    • “fleet_site_pages” added an optional parameter “path_prefix” cosmetic
    • “fleet_crawler_hits” reworded the description of “path_contains” cosmetic
    • “fleet_site_pages” reworded the description of “path_contains” cosmetic
  • 21 Aug 26 0
    • Tool “read_brand_document” rewrote its description, which is the text the model reads security
  • 12 Aug 26 0
    • First check of Tool coverage: 1 functional
    • New tool “search_skills” functional
  • 11 Aug 26 0
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 27 Sept 2026 · Probed https://www.heista.co/api/mcp/mcp

TLS valid

Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .

Subject Issuer Valid from Valid until Key Signature Serial
CN=www.heista.co CN=YR1,O=Let's Encrypt,C=US 4 Aug 2026 2 Nov 2026 RSA 2048 SHA256-RSA 68784c91387913c57c390ff2a467dc63bc5
SANs: www.heista.co
CN=YR1,O=Let's Encrypt,C=US (CA) CN=Root YR,O=ISRG,C=US 3 Sept 2025 2 Sept 2028 RSA 2048 SHA256-RSA a20253f15f2691c05dc1ce13b9bcca4e
CN=Root YR,O=ISRG,C=US (CA) CN=ISRG Root X1,O=Internet Security Research Group,C=US 13 May 2026 2 Sept 2032 RSA 4096 SHA256-RSA f24b6d17f9d9ad7cb1c9fea78782699f

Background: What to check on a remote MCP endpoint →

DNSSEC insecure

Validation of www.heista.co. — Not signed

Zone DS Keys Algorithms Outcome
. trust_anchor 20326, 38696 8, 8 Verified
co. present 7786 8 Verified
heista.co. absent Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation
Authentication Enforced and verified

The endpoint asked for a token and published valid RFC 9728 metadata describing how to get one.

Result Enforced and verified
Enforced On tool calls
HTTP status 200

WWW-Authenticate challenge Bearer realm="mcp", resource_metadata="https://www.heista.co/.well-known/oauth-protected-resource/mcp"

Bearer realm="mcp", resource_metadata="https://www.heista.co/.well-known/oauth-protected-resource/mcp"
Header Value
strict-transport-security max-age=63072000; includeSubDomains; preload
x-content-type-options nosniff
x-frame-options DENY
referrer-policy strict-origin-when-cross-origin
permissions-policy camera=(), geolocation=(), microphone=(self)

Protected resource metadata

Document https://www.heista.co/.well-known/oauth-protected-resource/mcp
Retrieved Yes
Resource https://www.heista.co/api/mcp/mcp
Authorisation server https://www.heista.co

Background: How OAuth 2.1 works in the 2026 MCP spec →

Transports 2 probes
Transport URL Outcome Status Location
streamable-http https://www.heista.co/api/mcp/mcp Verified 200
http (plaintext) http://www.heista.co/api/mcp/mcp HTTPS enforced 308 https://www.heista.co/api/mcp/mcp
MCP tools · 118 exposed · ~27,003 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
fleet_gsc_top_queries ~129

Top Google search queries by clicks or impressions from first-party Search Console data, optionally filtered to pages containing a path (e.g. "/decode"). The core tool for briefing programmatic SEO. Hard cap 50 rows, max window 28 days. Read-only.

NameTypeReqDescription
daysinteger–Window in days (max 28). Default 28.
limitinteger–Max rows (default 25, hard cap 50).
order_bystring–Sort key. Default clicks.
page_prefixstring–Only include pages whose URL contains this path.

No output schema declared.

No examples provided.

fleet_intel_stats ~88

Canonical Ad Intelligence corpus counts — the single source of truth that kills number drift across marketing surfaces. Returns decoded ads published (THE number to quote publicly), total corpus size, live brand/category/weekly report counts, live categories and verticals, and the last publish timestamp. Use this BEFORE citing any corpus number in content, outreach, or briefs. Free, read-only, no parameters.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

fleet_list_brand_reports ~103

List live brand-level Ad Intelligence reports (the public /decode/brand pages). Optional brand-name filter, paginated, hard cap 50 rows. Returns identifiers + ad counts + public URLs; use fleet_get_brand_report for a full report. Read-only.

NameTypeReqDescription
limitinteger–Max rows (default 10, hard cap 50).
offsetinteger–Pagination offset.
querystring–Filter by brand name (partial match).

No output schema declared.

No examples provided.

fleet_list_intelligence_articles ~118

List live intelligence articles — the weekly and per-vertical category report system behind the public intelligence surfaces. Filter by kind (weekly/category) or vertical. Note: individual static deep-dive articles are not DB rows and are not listed here. Hard cap 50 rows. Read-only.

NameTypeReqDescription
kindstring–Filter by article kind.
limitinteger–Max rows (default 10, hard cap 50).
offsetinteger–Pagination offset.
verticalstring–Filter category articles by vertical.

No output schema declared.

No examples provided.

fleet_list_issues ~223

List issues on the Heista Linear board (team HEI) — the read-only window into what the dev agents are working on, what's broken, and what's shipped. Filter by workflow state ("Backlog"/"Todo"/"In Progress"/"In Review"/"Done"), label ("Bug"/"Security"/"SEO"/"In-App Feedback"/…), or a title search. Returns identifier + state + priority + assignee + labels; use fleet_get_issue for the full description + comments. Hard cap 100 rows. Read-only — the fleet cannot create, edit, or close tickets.

NameTypeReqDescription
labelstring–Filter by label name (e.g. "Bug", "Security", "SEO", "In-App Feedback").
limitinteger–Max rows (default 30, hard cap 100).
querystring–Text search over issue titles (case-insensitive).
statestring–Filter by workflow state name: "Backlog", "Todo", "In Progress", "In Review", or "Done".

No output schema declared.

No examples provided.

fleet_product_funnel_counts ~160

The signup -> trial -> paid funnel as COUNTS ONLY, with no customer PII scope required: signups, trials active, trials expired unconverted, converted to paid, onboarding completed, plus the conversion rate. Aggregated in the database — no identifiers are read or returned. Definitions mirror fleet_product_funnel_summary exactly so the two never disagree. Cohorts below 5 signups have their breakdown SUPPRESSED, because at that size a conversion count identifies an individual; widen the window instead. This is the product funnel (signup onward) — the marketing funnel before it (views, engaged, CTA) is fleet_analytics_overview.

NameTypeReqDescription
daysinteger–Signup cohort window in days (default 30, max 90).

No output schema declared.

No examples provided.

fleet_product_funnel_summary ~119

Aggregate conversion/drop-off stats for a signup cohort (last N days, max 90): trial active vs expired-unconverted vs converted-to-paid, conversion rate, never-spent-a-credit rate, onboarding completion rate, and the most-installed Heists. Answers "where is the funnel leaking" in one call instead of aggregating individual summaries. Requires mcp:fleet:customer_pii. Every call is audit-logged. Read-only.

NameTypeReqDescription
daysinteger–Signup cohort window in days (max 90). Default 30.

No output schema declared.

No examples provided.

fleet_product_signups_recent ~123

List recent signups (last N days, hard cap 50 rows) with the same product-backend shape as fleet_product_user_summary — trial/credits/plan/onboarding/Heists per user. Use to see the newest cohort at a glance before drilling into individuals. Requires mcp:fleet:customer_pii. Every call is audit-logged. Read-only.

NameTypeReqDescription
daysinteger–Signup window in days (max 90). Default 7.
limitinteger–Max rows (default 20, hard cap 50).

No output schema declared.

No examples provided.

fleet_product_user_summary ~138

Look up ONE customer's product-backend state by email: trial status, credit balance, workspace plan, installed Heists, onboarding completion, plus PostHog attribution/engagement signals (source, 30d activity, page journey). This is the data PostHog structurally cannot see — whether they actually have active credits, are on a paid plan, or installed anything. Requires mcp:fleet:customer_pii (a separate, PII-adjacent scope — see Docs/systems/fleet-access.md). Every call is audit-logged. Read-only.

NameTypeReqDescription
emailstringyesThe user email to look up.

No output schema declared.

No examples provided.

fleet_search_decoded_ads ~196

Search the published Ad Intelligence corpus (the public decode gallery). Filter by free-text (name/tagline/brand), brand, category, vertical, or platform. Returns list rows with public URLs — never the full structural payload (use fleet_get_decoded_ad for that). Hard cap 50 rows per call; paginate with offset. Read-only.

NameTypeReqDescription
brandstring–Filter by brand name (partial match).
categorystring–Filter by gallery category (exact match — values from fleet_intel_stats / prior searches).
limitinteger–Max rows (default 10, hard cap 50).
offsetinteger–Pagination offset.
platformstring–Filter by platform (e.g. facebook, tiktok).
querystring–Free-text match against ad name, tagline, and brand name.
verticalstring–Filter by vertical classification (exact match).

No output schema declared.

No examples provided.

fleet_seo_recovery ~185

One-row verification scorecard for the indexing-recovery plan (internal-linking-spec-v2): site-wide + /decode-specific orphan counts (200 but zero internal inlinks) from the latest crawl, Googlebot vs other-bot crawl activity over a window (default 7 days, max 180), and Google Search Console impressions/clicks/avg-position over the trailing 28 days — each figure compared against the pre-fix baseline (1,521 orphans, 7 Googlebot pages/wk, 2 GSC impressions). Use this to confirm PR-A/B/C landed and is moving the needle, not just that the code shipped. Read-only.

NameTypeReqDescription
daysinteger–Crawler-hit window in days (default 7, max 180 — retention limit). GSC + orphan figures are always current-snapshot / trailing-28d.

No output schema declared.

No examples provided.

fleet_site_audit_summary ~78

One-row health scoreboard from the weekly full-site crawl: total pages, OK/redirect/error counts, ORPHAN pages (200 but zero internal inlinks — the primary indexing-recovery target), thin pages, missing meta/titles, total internal links, last crawl time. Start here before drilling into fleet_site_pages. Read-only.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

fleet_site_links ~138

Internal links for one page: direction "in" = who links TO it (zero inlinks = orphan), "out" = what it links to. Link data comes from the first render of sitemap-listed pages (pagination-only links are not observed — which mirrors crawler discovery). Hard cap 200 rows. Read-only.

NameTypeReqDescription
directionstring–"in" = pages linking TO this path (default); "out" = pages this path links to.
limitinteger–Max rows (default 50, hard cap 200).
pathstringyesPage path (e.g. "/decode/some-slug").

No output schema declared.

No examples provided.

fleet_site_pages ~304

Filterable inventory of every sitemap-listed page with SEO facts (title, meta description, canonical, h1, word count, JSON-LD) and internal inlink/outlink counts from the weekly crawl. Filters: path_contains, orphans_only (zero inlinks), max_word_count (thin content), status, missing_meta. Sorted fewest-inlinks first — the pages Google cannot discover float to the top. Hard cap 100 rows. Read-only.

NameTypeReqDescription
limitinteger–Max rows (default 25, hard cap 100).
max_word_countinteger–Only pages at or below this visible word count (thin-content filter, e.g. 150).
missing_metaboolean–Only pages missing a meta description.
offsetinteger–Pagination offset.
orphans_onlyboolean–Only pages with ZERO internal inlinks — the pages Google has no path to discover.
path_containsstring–Filter: path contains this anywhere. Over-matches — "/creative" also returns /creative-playbooks and /creative-development. Use path_prefix unless a substring is genuinely wanted.
path_prefixstring–Filter: path STARTS WITH this (e.g. "/creative/library"). Anchored — prefer this. Filtering /creative by substring returns 77 pages; by prefix, 9.
statusinteger–Filter by HTTP status (e.g. 200, 308, 404).

No output schema declared.

No examples provided.

generate_adscript ~825

Generate direct-response video ad scripts by fusing a proven structural source (decoded ad or formula) with a brand's PowerSource. Output is feed-native ad copy for paid social (Meta, TikTok, Reels) in the brand's voice — hook, beat-by-beat body, CTA close, plus visual direction per beat. Takes source_id (from adformula_intelligence, decoder_intelligence, or decode_ad), source_type ("formula" or "decode"), powersource_id (from any create_powersource_*), and tunable params: count (1-5 variants, tensions and selling points auto-rotated across variants), script_mode ("blueprint" preserves source structure exactly, "remix" preserves psychology but writes original copy), duration (target seconds), audience, tension override, selling_points override, voice_mode ("creator" for UGC default, "brand" for owned channels), and idempotency_key. Use this when the user says "write me a script", "I need a TikTok script", "write an ad based on this", or wants shell-faithful replication of a proven winner in their own brand voice. REQUIRES both a structural source AND a powersource — guide the user through creating either if missing. Metered pricing — typically 2-5 credits per script (~2 credits for 15s, ~5 credits for 60s). Pre-flight reserves a 17-credit ceiling and refunds the difference after measurement. Do NOT use to discover sources — use decoder_intelligence or adformula_intelligence first. Do NOT use to extract brand intel — use create_powersource_url first.

NameTypeReqDescription
audiencestring–Audience segment from the PowerSource. "buyer_profile" (default) uses the composite buyer. "audience_0", "audience_1", etc. target specific segments.
countinteger–Number of scripts to generate (1-5, default 1). Each script uses a different tension and selling point combination for variety.
durationinteger–Target duration in seconds (remix mode only, 10-120). Blueprint mode locks to the source duration.
idempotency_keystring–Optional unique key to make this call safely retryable. If the same key + org repeats, the original result is returned without re-charging.
powersource_idstringyesIdentifier for the brand PowerSource that supplies voice, selling points, tensions, and audience. Accepts either a job_id from create_powersource_* or a brief_id from get_powersource — both work.
script_modestring–Script mode. "blueprint" (default) follows the source formula exactly — same beat structure, same timing. "remix" uses the psychological architecture but writes original copy.
selling_pointsarray–Lock to specific selling points from the PowerSource (max 5). Omit to let the system select the best match for each beat.
source_idstringyesThe ID of the structural source to write from. For source_type="decode": either a job_id from your own decode_ad call OR an id from decoder_intelligence (corpus ad). For source_type="formula": a form…
source_typestringyesType of structural source. "decode" = a single decoded ad (your own or from the corpus). "formula" = a clustered blueprint built from multiple winning ads.
tensionstring–Lock to a specific behavioral tension from the PowerSource (e.g., "Frustration → Relief"). Omit to let the system select the best match.
voice_modestring–Voice register for the script. "creator" (default) = authentic creator voice for UGC, PowerSource locks facts/tensions/selling points but NOT voice register. "brand" = full PowerSource brand voice fo…

No output schema declared.

No examples provided.

get_ad_formula_preset ~72

Get one ad formulas preset by id, including its full body payload (framework, agent config, etc.). Call the matching list tool first to discover ids. Free, read-only.

NameTypeReqDescription
idstringyesPreset id. Discover ids by calling the matching list_<type>_presets first.

No output schema declared.

No examples provided.

get_brand ~91

Get a brand's full canonical record — name, domain, voice (tone_of_voice), story, visual identity (logo, primary color, visual assets), and counts. Use to inspect what a brand carries before deciding which Heist context to run, or to read the brand voice directly when writing copy. Free, read-only.

NameTypeReqDescription
brand_idstringyesBrand to inspect. Get from list_brands.

No output schema declared.

No examples provided.

get_cd_card_bookmark_preset ~74

Get one saved cards preset by id, including its full body payload (framework, agent config, etc.). Call the matching list tool first to discover ids. Free, read-only.

NameTypeReqDescription
idstringyesPreset id. Discover ids by calling the matching list_<type>_presets first.

No output schema declared.

No examples provided.

get_creative_agent_preset ~73

Get one creative agents preset by id, including its full body payload (framework, agent config, etc.). Call the matching list tool first to discover ids. Free, read-only.

NameTypeReqDescription
idstringyesPreset id. Discover ids by calling the matching list_<type>_presets first.

No output schema declared.

No examples provided.

get_creative_agent_skill_preset ~75

Get one creative agent skills preset by id, including its full body payload (framework, agent config, etc.). Call the matching list tool first to discover ids. Free, read-only.

NameTypeReqDescription
idstringyesPreset id. Discover ids by calling the matching list_<type>_presets first.

No output schema declared.

No examples provided.

get_creative_director_playbook_preset ~78

Get one creative director playbooks preset by id, including its full body payload (framework, agent config, etc.). Call the matching list tool first to discover ids. Free, read-only.

NameTypeReqDescription
idstringyesPreset id. Discover ids by calling the matching list_<type>_presets first.

No output schema declared.

No examples provided.

get_decode ~232

Retrieve the full decode bundle for a previously-submitted ad, or poll the status of a running decode job. Takes a single job_id (UUID returned by decode_ad). Returns either status="processing" (call again in 15s) or the completed payload — exact transcripts per beat, director's read, per-cut visual data (shot_breakdown), visual psychology, behaviour biases, beat structure, hook classification, and runtime fields (active days on Meta Ad Library when the source supports it). Use this immediately after decode_ad and every 15 seconds until the job completes. Also use this to re-fetch a decode any time you need the full bundle for script writing (Path B) or as the source_id for generate_adscript (source_type="decode"). Free — billing happens at decode_ad submit time, not on retrieval. Do NOT use to discover or list decodes — use decoder_intelligence for browsing. Do NOT use to start a new decode — call decode_ad first.

NameTypeReqDescription
job_idstringyesJob ID returned by decode_ad. Call this tool to poll status or retrieve completed results.

No output schema declared.

No examples provided.

get_decoded_ad_preset ~73

Get one decoded ads preset by id, including its full body payload (framework, agent config, etc.). Call the matching list tool first to discover ids. Free, read-only.

NameTypeReqDescription
idstringyesPreset id. Discover ids by calling the matching list_<type>_presets first.

No output schema declared.

No examples provided.

get_dispatch_result ~158

Get the current status of a specialist dispatch job started via dispatch_<specialist>_async. Returns { status: queued|running|completed|failed, result_text?, error_text?, error_class?, retry_count, elapsed_seconds, wait_ms_hint }. Call this repeatedly after a dispatch_*_async returns a job_id. Sleep wait_ms_hint milliseconds between calls. When status === "completed", read result_text as the specialist's full synthesis. When status === "failed", error_class tells you whether to retry (transient/scope/routing) or give up and synthesize around (permanent) per the fleet resilience pattern.

NameTypeReqDescription
job_idstringyesThe job_id returned by a previous dispatch_<specialist>_async call.

No output schema declared.

No examples provided.

get_fleet_cost ~207

Read-only walk of a fleet session tree. Given any session_id in the tree (root, Head, Mastermind, or specialist sub-node) returns the full breakdown: every session row with depth + parent + agent_kind + node_label, the cost_events recorded against each, per-node self_cost_cents, total raw compute, tier markup estimate, and (after close_session_tree has run) the authoritative credits_charged + credits_refunded. Org-scoped: only sessions belonging to your org return data. Free — no compute cost. Use to render cost breakdown UIs, audit fleet spend, or verify a session's tree topology.

NameTypeReqDescription
root_session_idstringyesA session_id from anywhere in the fleet tree — root, Head, Mastermind, or specialist sub-node. The handler resolves to the actual root and walks the full subtree, so you do not need to know the root…

No output schema declared.

No examples provided.

get_hook_intelligence ~446

Browse proven hook patterns from Heista's corpus of decoded winning Meta/TikTok ads. Takes optional filters: vertical (e.g. BEAUTY_SKINCARE, SUPPLEMENTS, APPAREL), hook_type (e.g. CURIOSITY_SPIKE, CONTRADICTION, CALLOUT), and marketing_angle. Returns hook examples (the real opener lines from successful ads), pattern templates, the psychological mechanism behind why each one stops the scroll within the first 1.5 seconds, and runtime performance data (active days on Meta when available). Free, read-only, idempotent — no credits consumed. Use this when the user asks "what hooks stop the scroll", "give me hook ideas", "how should I open this ad", "show me hooks for [vertical]", or needs scroll-stopping openers grounded in proven patterns rather than guessed copy. Useful before writing a script — pair with adformula_intelligence or decoder_intelligence for the full beat structure. Do NOT use to decode a specific ad URL — use decode_ad. Do NOT use to generate finished scripts — use generate_adscript. Hooks here are pattern intelligence, not finished copy.

NameTypeReqDescription
hook_typestring–Specific hook type to retrieve patterns for. Examples: CURIOSITY_SPIKE, OPEN_LOOP_STATEMENT, HIDDEN_TRUTH_REVEAL, IDENTITY_HOOK, CONTRADICTION_HOOK, PROVOCATION, STORY_START, DIRECT_QUESTION_HOOK, CH…
marketing_anglestring–Marketing angle to filter by. Examples: PROBLEM_SOLUTION, SOCIAL_PROOF_RESULTS, HOW_TO_TUTORIAL, OFFER_URGENCY, ASPIRATIONAL_IDENTITY, VALUE_STACK. Omit for all angles.
verticalstring–Industry vertical to filter corpus patterns. Examples: BEAUTY_SKINCARE, HEALTH_SUPPLEMENTS, FITNESS, FOOD_BEVERAGE, FASHION_APPAREL, SAAS_SOFTWARE, FINANCE_FINTECH, INFO_PRODUCTS, TECH_GADGETS. Omit…

No output schema declared.

No examples provided.

get_image_ad_scan_preset ~73

Get one static ads preset by id, including its full body payload (framework, agent config, etc.). Call the matching list tool first to discover ids. Free, read-only.

NameTypeReqDescription
idstringyesPreset id. Discover ids by calling the matching list_<type>_presets first.

No output schema declared.

No examples provided.

get_outfit_preset ~71

Get one outfits preset by id, including its full body payload (framework, agent config, etc.). Call the matching list tool first to discover ids. Free, read-only.

NameTypeReqDescription
idstringyesPreset id. Discover ids by calling the matching list_<type>_presets first.

No output schema declared.

No examples provided.

get_powersource ~306

Retrieve the full creative intelligence profile for a previously-submitted PowerSource scan, or poll the status of a running scan. Takes a job_id (UUID returned by any create_powersource_* tool) plus an optional include_raw flag (admin-only). Returns either status="processing" with partial progress or the completed bundle: brand identity, offer, 12 selling points, brand voice rules, buyer profile, 12 buyer tensions, angles, emotional arcs, ctas, proof, narrative. Use this immediately after any create_powersource_* call and every 3-5 seconds until status is "completed". During synthesis, partial intelligence appears progressively (buyer archetype first, then tensions, then angles) — inspect each poll response, useful signal arrives early. Also use this to re-fetch a finished PowerSource any time you need the brand layer for downstream work. Free — billing happens at submit time. Do NOT use to start a new scan — call create_powersource_url, _docs, or _full first. Do NOT use to retrieve a video decode — use get_decode.

NameTypeReqDescription
include_rawboolean–Internal-only. When true and the caller holds mcp:internal_admin, returns the un-merged brief bundle alongside the merged response. Silently ignored for non-admin callers — no error is raised.
job_idstringyesJob ID returned by any create_powersource_* call. Use this to poll status or retrieve completed results.

No output schema declared.

No examples provided.

get_saved_asset ~83

Fetch one saved asset by id. Returns the full row including category, format, tags, body_text/html, signed media_url (if private storage), metadata, creator, brand, and timestamps. Use AFTER list_saved_assets to load the full record when the list projection is too sparse.

NameTypeReqDescription
asset_idstringyesAsset to fetch. Get from list_saved_assets.

No output schema declared.

No examples provided.

get_saved_assets_batch ~134

Fetch up to 50 saved assets by id in one round-trip. Use when an agent needs to pull a pre-selected set — e.g. resolving a saved_asset_picker context input on a Heist that requires N pinned assets. Missing or cross-workspace ids are silently dropped; compare returned items vs requested ids to detect drops.

NameTypeReqDescription
asset_idsarrayyesUp to 50 asset ids to fetch in one round-trip. Use when an agent needs to pull a pre-selected set of saves (e.g. resolving a saved_asset_picker declaration in a Heist). Missing/cross-workspace ids ar…

No output schema declared.

No examples provided.

get_saved_visual_idea_preset ~75

Get one saved visual ideas preset by id, including its full body payload (framework, agent config, etc.). Call the matching list tool first to discover ids. Free, read-only.

NameTypeReqDescription
idstringyesPreset id. Discover ids by calling the matching list_<type>_presets first.

No output schema declared.

No examples provided.

get_strategy ~270

Read a creative strategy in full by its powersource_id. Returns the same brand-merged bundle shape as get_powersource(data) — buyer profile, 12 behavioral tensions, angles, narrative direction, tone of voice, selling points, CTAs, proof, brand story, homepage data, offering — projected through the public PowerSource API serializer. Use this when you already have a powersource_id (from list_strategies) and want the full strategy payload in one call, without the job_id round-trip that get_powersource needs. Archived strategies are excluded by default (parity with list_strategies). Pass include_archived=true to read archived strategies. Read-only, free, account-scoped.

NameTypeReqDescription
include_archivedboolean–Include archived strategies. Default false (archived strategies are excluded from agent reads — same default as list_strategies).
powersource_idstringyesStrategy (PowerSource / brief) id. Get from list_strategies. Returns the full brand-merged bundle — buyer profile, 12 behavioral tensions, angles, narrative, tone of voice, selling points, CTAs, proo…

No output schema declared.

No examples provided.

get_talent_model_preset ~72

Get one models preset by id, including its full body payload (framework, agent config, etc.). Call the matching list tool first to discover ids. Free, read-only.

NameTypeReqDescription
idstringyesPreset id. Discover ids by calling the matching list_<type>_presets first.

No output schema declared.

No examples provided.

get_visual_preset_preset ~72

Get one visuals preset by id, including its full body payload (framework, agent config, etc.). Call the matching list tool first to discover ids. Free, read-only.

NameTypeReqDescription
idstringyesPreset id. Discover ids by calling the matching list_<type>_presets first.

No output schema declared.

No examples provided.

get_visual_style_preset ~72

Get one visual styles preset by id, including its full body payload (framework, agent config, etc.). Call the matching list tool first to discover ids. Free, read-only.

NameTypeReqDescription
idstringyesPreset id. Discover ids by calling the matching list_<type>_presets first.

No output schema declared.

No examples provided.

list_ad_formula_presets ~208

Cluster-level structural formulas derived from decoded ads. Heista-curated; served as a generation parameter. Read-only, free. Filter scope with only_workspace / only_official (mutually exclusive — same toggle as the in-app library lens). Page with limit + offset.

NameTypeReqDescription
brand_idstring–Optional brand_id to scope workspace presets to. Get from list_brands. Official presets are not brand-scoped and are unaffected by this filter.
limitinteger–Page size. Default 24, max 100.
offsetinteger–Offset for paging through results. Default 0.
only_officialboolean–When true, hide workspace (user-created) presets and only return Heista-curated (official) presets. Mutually exclusive with only_workspace.
only_workspaceboolean–When true, hide Heista-curated (official) presets and only return workspace (user-created) presets. Mutually exclusive with only_official.

No output schema declared.

No examples provided.

list_brand_assets ~287

List images for a brand. Filter by PowerSource (this scan only, via powersource_id), by on-pack product_name (the vision tagger's read), by type (logo, product, product_cutout, hero, lifestyle, ingredient, packaging, certification, before_after, infographic, screenshot, video, general), or by is_primary_product. Use this BEFORE generating any image-based output so you pick from the brand's real assets, not generic stock. Returns asset_id, signed url, type, detected_product_name, is_primary_product, sources. Free, read-only. Paginated via cursor.

NameTypeReqDescription
brand_idstringyesBrand to list assets for. Get from list_brands.
cursorstring–Pagination cursor returned as next_cursor on the previous page.
is_primary_productboolean–Filter to only the scanned product's images (or its absence with false).
limitinteger–Page size. Default 50, max 200.
powersource_idstring–Filter to assets discovered during this PowerSource scan.
product_namestring–Filter to assets the vision tagger read as this on-pack product name.
typestring–Filter by image type: logo, product, product_cutout, hero, lifestyle, ingredient, packaging, certification, before_after, infographic, screenshot, video, general.

No output schema declared.

No examples provided.

list_brand_documents ~306

List indexed brand documents for a brand. Each row carries the indexed signals (doc_type, summary, key_topics, classification_confidence, indexing_status) plus mime_type and size_bytes from the underlying file. Filter by doc_type (one of 19 values incl. voice_tone_doc, brand_guidelines, strategy_memo, customer_interview, pitch_deck, general_reference) or by indexing_status (pending, running, indexed, error). Use BEFORE read_brand_document to discover what context exists for a brand without paying the read cost. Free, read-only. Paginated via cursor.

NameTypeReqDescription
brand_idstringyesBrand to list documents for. Get from list_brands.
cursorstring–Pagination cursor returned as next_cursor on the previous page (created_at ISO timestamp).
doc_typestring–Filter by classified document type. One of 19 values: voice_tone_doc, brand_guidelines, strategy_memo, brand_brief, pitch_deck, research_report, campaign_brief, tone_of_voice_synthesis, customer_inte…
indexing_statusstring–Filter by indexing pipeline state. Use "indexed" to only see fully-processed docs ready to read.
limitinteger–Page size. Default 20, max 100.

No output schema declared.

No examples provided.

list_brands ~205

List every brand in this workspace. Use this BEFORE creating a PowerSource to avoid creating duplicate brand records (pass the matching brand_id to create_powersource_*), and to discover brands the user can pivot a Heist to. Each row carries the brand_id (persistent identity), name, domain, asset_count, strategy_count, and brand status. Use this when the user asks "what brands do I have", "show me my brands", or before any image-led work where you need to know which brand owns assets. Free, read-only. Distinguish Brand (persistent, brand_id) from PowerSource (a scan, powersource_id). A brand has many PowerSources; pick the brand first, then narrow to a strategy with list_strategies.

NameTypeReqDescription
include_allboolean–When true, returns transient (status="creating") and signal-less draft brands too. Default false matches the picker dropdown — only confirmed/draft brands with real data.

No output schema declared.

No examples provided.

list_cd_card_bookmark_presets ~262

Cards the user bookmarked from Creative Director chat — directions, concepts, executions, brand platforms, art directions, visual sets. Surfaces in /library + the chat-side tray. Saves happen through the dedicated /api/creative-director/bookmarks route (NOT through /api/library), so is_savable is false here — the library surface is read-only. Read-only, free. Filter scope with only_workspace / only_official (mutually exclusive — same toggle as the in-app library lens). Page with limit + offset.

NameTypeReqDescription
brand_idstring–Optional brand_id to scope workspace presets to. Get from list_brands. Official presets are not brand-scoped and are unaffected by this filter.
limitinteger–Page size. Default 24, max 100.
offsetinteger–Offset for paging through results. Default 0.
only_officialboolean–When true, hide workspace (user-created) presets and only return Heista-curated (official) presets. Mutually exclusive with only_workspace.
only_workspaceboolean–When true, hide Heista-curated (official) presets and only return workspace (user-created) presets. Mutually exclusive with only_official.

No output schema declared.

No examples provided.

list_creative_agent_presets ~235

Reusable creative agents the Heist can pick as a handoff target — picked from the UI, callable as an MCP tool from Managed Agents. Workspace = private agents in the org. Official = public_template agents in any org. Read-only, free. Filter scope with only_workspace / only_official (mutually exclusive — same toggle as the in-app library lens). Page with limit + offset.

NameTypeReqDescription
brand_idstring–Optional brand_id to scope workspace presets to. Get from list_brands. Official presets are not brand-scoped and are unaffected by this filter.
limitinteger–Page size. Default 24, max 100.
offsetinteger–Offset for paging through results. Default 0.
only_officialboolean–When true, hide workspace (user-created) presets and only return Heista-curated (official) presets. Mutually exclusive with only_workspace.
only_workspaceboolean–When true, hide Heista-curated (official) presets and only return workspace (user-created) presets. Mutually exclusive with only_official.

No output schema declared.

No examples provided.

list_creative_agent_skill_presets ~267

Portable craft skills (frameworks + method + worked examples) a Creative Agent loads ON TOP of its worldview — additive and stackable, never substitutive (unlike a creative_director_playbook, which replaces the agent for a session). Pinned per character on creative_agent_versions.skill_ids. Workspace = org-authored private skills; official = the Heista-curated starter library. Read-only, free. Filter scope with only_workspace / only_official (mutually exclusive — same toggle as the in-app library lens). Page with limit + offset.

NameTypeReqDescription
brand_idstring–Optional brand_id to scope workspace presets to. Get from list_brands. Official presets are not brand-scoped and are unaffected by this filter.
limitinteger–Page size. Default 24, max 100.
offsetinteger–Offset for paging through results. Default 0.
only_officialboolean–When true, hide workspace (user-created) presets and only return Heista-curated (official) presets. Mutually exclusive with only_workspace.
only_workspaceboolean–When true, hide Heista-curated (official) presets and only return workspace (user-created) presets. Mutually exclusive with only_official.

No output schema declared.

No examples provided.

list_creative_director_playbook_presets ~255

Seven-section creative-mechanism lenses the Creative Director chat picks at session start. The picked playbook substitutes Layers 3 + 4 of the system prompt — voice + foundation — for the session (the lens IS who the agent is). Workspace = private playbooks; official = the Heista-curated catalog. Read-only, free. Filter scope with only_workspace / only_official (mutually exclusive — same toggle as the in-app library lens). Page with limit + offset.

NameTypeReqDescription
brand_idstring–Optional brand_id to scope workspace presets to. Get from list_brands. Official presets are not brand-scoped and are unaffected by this filter.
limitinteger–Page size. Default 24, max 100.
offsetinteger–Offset for paging through results. Default 0.
only_officialboolean–When true, hide workspace (user-created) presets and only return Heista-curated (official) presets. Mutually exclusive with only_workspace.
only_workspaceboolean–When true, hide Heista-curated (official) presets and only return workspace (user-created) presets. Mutually exclusive with only_official.

No output schema declared.

No examples provided.

list_decoded_ad_presets ~226

Structural references for script-led Heists. Workspace decodes (your video_sources scans joined with their video_scan_frameworks) + Heista-curated decoded ads from official_ad_heists. Read-only, free. Filter scope with only_workspace / only_official (mutually exclusive — same toggle as the in-app library lens). Page with limit + offset.

NameTypeReqDescription
brand_idstring–Optional brand_id to scope workspace presets to. Get from list_brands. Official presets are not brand-scoped and are unaffected by this filter.
limitinteger–Page size. Default 24, max 100.
offsetinteger–Offset for paging through results. Default 0.
only_officialboolean–When true, hide workspace (user-created) presets and only return Heista-curated (official) presets. Mutually exclusive with only_workspace.
only_workspaceboolean–When true, hide Heista-curated (official) presets and only return workspace (user-created) presets. Mutually exclusive with only_official.

No output schema declared.

No examples provided.

list_image_ad_scan_presets ~211

Static-ad references for image-led Heists. Workspace static scans + Heista-curated image ad heists. Read-only, free. Filter scope with only_workspace / only_official (mutually exclusive — same toggle as the in-app library lens). Page with limit + offset.

NameTypeReqDescription
brand_idstring–Optional brand_id to scope workspace presets to. Get from list_brands. Official presets are not brand-scoped and are unaffected by this filter.
limitinteger–Page size. Default 24, max 100.
offsetinteger–Offset for paging through results. Default 0.
only_officialboolean–When true, hide workspace (user-created) presets and only return Heista-curated (official) presets. Mutually exclusive with only_workspace.
only_workspaceboolean–When true, hide Heista-curated (official) presets and only return workspace (user-created) presets. Mutually exclusive with only_official.

No output schema declared.

No examples provided.

list_outfit_presets ~289

Styled outfits — a talent dressed in a full look, saved as one composite sheet (turnaround + wardrobe detail crops) with structured refs to the product images that built it. The Outfits Heist saves them on click; future image/video Heists pick one to lock model + wardrobe in a single pick. Workspace = your saved outfits. Official = Heista-curated drops across casual, streetwear, activewear, business, evening, swim & resort, loungewear, and outerwear. Read-only, free. Filter scope with only_workspace / only_official (mutually exclusive — same toggle as the in-app library lens). Page with limit + offset.

NameTypeReqDescription
brand_idstring–Optional brand_id to scope workspace presets to. Get from list_brands. Official presets are not brand-scoped and are unaffected by this filter.
limitinteger–Page size. Default 24, max 100.
offsetinteger–Offset for paging through results. Default 0.
only_officialboolean–When true, hide workspace (user-created) presets and only return Heista-curated (official) presets. Mutually exclusive with only_workspace.
only_workspaceboolean–When true, hide Heista-curated (official) presets and only return workspace (user-created) presets. Mutually exclusive with only_official.

No output schema declared.

No examples provided.

list_projects ~118

List all projects (campaign folders) for a brand. A project groups strategies, documents, client assets, and outputs under one campaign. Returns project_id (pass as project_id to list_strategies / list_brand_documents / list_brand_assets to scope those reads to this project), name, status, start_date, target_date, and per-type counts. Free, read-only.

NameTypeReqDescription
brand_idstringyesBrand to list projects for. Get from list_brands.
include_archivedboolean–Include archived projects. Default false.

No output schema declared.

No examples provided.

list_saved_assets ~463

List saved assets in the workspace. Filter by category (STRATEGY, IDEAS, COPY, VISUALS, MOTION, BRIEFS), by one or more formats inside the category (e.g. COPY + formats=["ad-script","hook"]), by tags (any/all), by brand_id, by brief_id (PowerSource), by created_by ("me" resolves to caller via OAuth), or favorites_only. Returns the unified view that backs the /assets page — BRIEFS rows come from creator_briefs with share URLs; other categories come from saved_assets. Use BEFORE asking the user what to pull into a Heist. Free, read-only, paginated.

NameTypeReqDescription
brand_idstring–Limit to one brand.
brief_idstring–Limit to one PowerSource (brief).
categorystring–Tab filter. STRATEGY (positioning, brand platform), IDEAS (hooks, concepts, territories), COPY (ad scripts, hooks, campaign copy), VISUALS (static ads, product, lifestyle imagery), MOTION (talking he…
created_bystring–User id or the literal "me". When called via OAuth, "me" resolves to the caller. API-key callers MUST pass an explicit user id (no caller identity).
cursorstring–Pagination cursor returned as next_cursor on the previous page.
favorites_onlyboolean–Restrict to favorited assets only.
formatsarray–Multi-select format pills within a category. e.g. for COPY: ["ad-script","hook"]. See save_asset description for the full per-category enum.
limitinteger–Page size. Default 50, max 200.
searchstring–Full-text search on title + body + tags.
tagsarray–Tag filter. Default mode is `any` (OR). Switch to `all` with tags_mode.
tags_modestring–How to combine tags. Default `any` (overlap). `all` requires every tag.

No output schema declared.

No examples provided.

list_saved_visual_idea_presets ~201

Visual ideas you saved from prior generations. Workspace-only. Read-only, free. Filter scope with only_workspace / only_official (mutually exclusive — same toggle as the in-app library lens). Page with limit + offset.

NameTypeReqDescription
brand_idstring–Optional brand_id to scope workspace presets to. Get from list_brands. Official presets are not brand-scoped and are unaffected by this filter.
limitinteger–Page size. Default 24, max 100.
offsetinteger–Offset for paging through results. Default 0.
only_officialboolean–When true, hide workspace (user-created) presets and only return Heista-curated (official) presets. Mutually exclusive with only_workspace.
only_workspaceboolean–When true, hide Heista-curated (official) presets and only return workspace (user-created) presets. Mutually exclusive with only_official.

No output schema declared.

No examples provided.

Common questions

What is the Heista MCP server?

Heista is an MCP server listed in the public MCP registry as co.heista/api. Decode video ads, load brand intelligence, generate ad scripts. This page covers its hosted endpoint (https://www.heista.co/api/mcp/mcp).

Is the Heista MCP server safe to use?

Heista scores 93 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the Heista MCP server expose?

Heista exposes 118 tools: decode_ad, get_decode, create_powersource_url, get_powersource, create_powersource_docs, and 113 more. Their descriptions and schemas cost roughly 27,003 tokens of context every time the server is loaded.

Does the Heista MCP server require authentication?

Yes. Heista asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.

Is the Heista MCP server still maintained?

Heista is still listed as active in the MCP registry. We last reached this channel on 27 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.