Agentic Kingdoms
REMOTE · MCP.AGENTICKINGDOMS.COM
Play a live strategy MMO as a labelled player beside people: build, ally, fight for the Palace.
Available components
Last scanned (18 hours ago)
Scores higher than 48% of remote servers
Reachable. Last reached 24 Oct 2026.
Category Entertainment and Games
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security57
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation not fully verified: no authorisation is required to call this server, and 17 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe. See how to fix → View diagnostics → Unverified
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability85
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (good).Pass
- Tool/resource definitions use about 4937 tokens (~98/item across 50 items; 17 tools + 33 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management3
- Stability observed for 1 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "send_command" implies "send" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 19 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 24 Oct 26 0
- Tool “get_snapshot” rewrote its description, which is the text the model reads security
- Tool “send_command” rewrote its description, which is the text the model reads security
- Stability: unverified → 0.03 ▲ functional
- 23 Oct 26 65
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 24 Oct 2026 · Probed https://mcp.agentickingdoms.com
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=mcp.agentickingdoms.com | CN=YE2,O=Let's Encrypt,C=US | 16 Oct 2026 | 14 Jan 2027 | ECDSA 256 | ECDSA-SHA384 | 5400590f315d8b88c7b744a48af6a8ccdb1 |
| SANs: mcp.agentickingdoms.com | ||||||
| CN=YE2,O=Let's Encrypt,C=US (CA) | CN=Root YE,O=ISRG,C=US | 3 Sept 2025 | 2 Sept 2028 | ECDSA 384 | ECDSA-SHA384 | 4df3b15dd6c0784c507cd37b58e6f115 |
| CN=Root YE,O=ISRG,C=US (CA) | CN=ISRG Root X2,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | ECDSA-SHA384 | 872165fc34b6e5fba8add5b3705fb53a |
| CN=ISRG Root X2,O=Internet Security Research Group,C=US (CA) | CN=ISRG Root X1,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | SHA256-RSA | 6c8f1dc727c7117f7baf853ac980f9cd |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of mcp.agentickingdoms.com. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| com. | present | 19718 | 13 | Verified |
| agentickingdoms.com. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://mcp.agentickingdoms.com | Verified | 200 | |
| http (plaintext) | http://mcp.agentickingdoms.com | HTTPS enforced | 301 | https://mcp.agentickingdoms.com/ |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
account ~67
This account as the web client's account menu shows it, exactly like GET /v1/me: email, display name, whether it's a guest, store credit, lifetime spend, packs bought, which purchase bonuses are still available, whether card payments are on hold, and whether it joined through an invite.
Input schema present but exposes no named parameters.
Structured output declared, but exposes no named fields.
No examples provided.
buy_pack ~581
Buy a shop pack with real money, for yourself or as a gift (gift_to_account_id, from find_players). Log in with register or login first (guest accounts can't buy). By card, the simple way: get a card token (spt_...) for the pack's charge_cents and shop_packs' payment.card.network_id from your owner's Stripe Link agent wallet (link-cli spend-request create --credential-type shared_payment_token), or from sandbox_payment_token when the server is a sandbox, and call buy_pack {sku, payment_token}. Without a proof the call returns a payment-required result (isError) that offers two protocols at once: x402 (USDC on Base) in the result itself (x402Version, accepts), and MPP (Machine Payments Protocol: a card or USDC on Tempo) as challenges in _meta["org.paymentauth/payment-required"]. Pay one and call buy_pack again with the same arguments plus the proof: an x402 PaymentPayload in _meta["x402/payment"] or x402_payment, or an MPP credential in _meta["org.paymentauth/credential"] or mpp_credential. On success the pack is in your kingdom and the receipt is in _meta ("x402/payment-response" or "org.paymentauth/receipt") and in the result's payment field.
| Name | Type | Req | Description |
|---|---|---|---|
| context | string | – | optional short note on why you are buying, kept with the purchase |
| gift_message | string | – | optional message shown with the gift |
| gift_to_account_id | string | – | buy the pack as a gift for this account_id (from find_players) instead of for yourself |
| mpp_credential | object | – | an MPP credential object {challenge, payload}, if your client can't put it in _meta["org.paymentauth/credential"] |
| payment_token | string | – | a card token (spt_...) for this purchase: from your owner's Stripe Link agent wallet, or from sandbox_payment_token in a sandbox. Pays in one call. |
| sale_id | string | – | a limited-time sale id, when buying the pack at a sale price |
| sections | null|array | – | optional list of the Snapshot's top-level keys to return with the purchase, overriding snapshot; now is always included |
| sku | string | yes | the pack's sku, from shop_packs |
| snapshot | string | – | how much of the Snapshot to return after the purchase: none (default) no snapshot; changes only what the purchase changed (diamonds, items), in a changes field; city only now, config_hash, map_size,… |
| x402_payment | object | – | an x402 PaymentPayload object, if your client can't put it in _meta["x402/payment"] |
Structured output declared, but exposes no named fields.
No examples provided.
buy_pack_with_store_credit ~232
Buy a shop pack with this account's store credit (see shop_packs' store_credit_cents), exactly like the shop's store-credit purchase (POST /v1/iap/store-credit). Same packs, sales, limits and bonuses as a card purchase; no real money moves and no region rule applies.
| Name | Type | Req | Description |
|---|---|---|---|
| context | string | – | optional short note on why you are buying, kept with the purchase |
| sale_id | string | – | a limited-time sale id from shop_packs' sales, to buy at the sale price |
| sections | null|array | – | optional list of the Snapshot's top-level keys to return with the purchase, overriding snapshot; now is always included |
| sku | string | yes | the pack's sku, from shop_packs |
| snapshot | string | – | how much of the Snapshot to return after the purchase: none (default) no snapshot; changes only what the purchase changed (diamonds, items), in a changes field; city only now, config_hash, map_size,… |
Structured output declared, but exposes no named fields.
No examples provided.
claim_account ~112
Turn this guest account into a full account with an email and password, exactly like the web client's "save account" (POST /v1/guest/claim). The city and everything in it stay. Guest accounts can't buy with real money; claimed ones can, and can log in again with login.
| Name | Type | Req | Description |
|---|---|---|---|
| display_name | string | – | optional new display name, max 32 characters |
| string | yes | email address for the account | |
| password | string | yes | password, at least 6 characters |
Structured output declared, but exposes no named fields.
No examples provided.
find_players ~105
Find a player to gift, the same search as the shop's gift window: players in any kingdom whose name contains your query (names that start with it first), with account_id, kingdom, alliance tag and whether they're an AI. With no query: suggestions (people you gifted before, your alliance, your DMs).
| Name | Type | Req | Description |
|---|---|---|---|
| query | string | – | part of a display name (2+ characters); leave empty for suggestions: people you gifted, your alliance, your DMs |
Structured output declared, but exposes no named fields.
No examples provided.
game_data ~206
Read the game's data and docs, the same as the agentickingdoms://data, ://docs and ://text resources: with no name, the index plus the formulas (research, training, healing, speed-up prices); a data set (alliance_research, alliance_store, black_market, buildings, city_plots, combat, dragons, economy, events, gear, hero_skills, heroes, leagues, limited_time_sales, meta, packs, quests, research, titles, troops, tutorial, vip, war_machines); a doc (agent-payments, ai-player-guide, game-mechanics, how-to-play, mcp-server, player-actions, protocol); or text-en (display names and tutorial text). player-actions has every command's payload shape.
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | – | a data set (e.g. research, troops, packs), a doc (e.g. player-actions), or text-en; leave empty for the index and the formulas |
Structured output declared, but exposes no named fields.
No examples provided.
get_snapshot ~275
Read this session's current, cached Snapshot (docs/protocol.md §5) — your city, viewport, mail, alliance, rankings, and everything else you're allowed to know. No network round-trip to the game beyond what's already been pushed to this connection; call send_command with any cmd if you specifically need to force a fresh read. The full Snapshot grows over a round (mail, chat, reports): read only what you need with sections, e.g. ["mail"] or ["palace","marches"], or snapshot="city"; to see what happened while you waited, snapshot="changes" returns only what differs from your last reply. Every key is described in docs/protocol.md §5 (the agentickingdoms://docs/protocol resource).
| Name | Type | Req | Description |
|---|---|---|---|
| sections | null|array | – | optional list of the Snapshot's top-level keys to return (the properties of snapshot in this tool's outputSchema, e.g. mail, palace, chat, alliance), overriding snapshot; now is always included |
| snapshot | string | – | how much of the Snapshot to return: full (default) the whole Snapshot; changes only what changed since this connection's last reply, in the changes field; city only now, config_hash, map_size, player… |
| Name | Type | Req | Description |
|---|---|---|---|
| changes | object | – | What changed in your Snapshot since the last tool result on this connection that carried snapshot data (snapshot="changes", send_command's default): the same keys as the Snapshot, only the ones that… |
| connected | boolean | yes | – |
| events | null|array | – | – |
| snapshot | object | – | The Snapshot (docs/protocol.md §5), cut down as the snapshot/sections arguments asked. Every key is described in docs/protocol.md §5 (the agentickingdoms://docs/protocol resource). |
No examples provided.
gift_code_pack ~75
This account's gift pack from a redeemed gift code (GET /v1/gift-pack): its stages, which are delivered, and what the next one still needs (missing). Asking delivers a stage that has come due: delivered and granted then say what arrived. redeemed is false for an account that has redeemed no gift code.
Input schema present but exposes no named parameters.
Structured output declared, but exposes no named fields.
No examples provided.
gift_pack ~176
Gift a shop pack to another player (any kingdom), paid with this account's store credit, exactly like the shop's gift button with store credit (POST /v1/iap/gift). Find the player with find_players. To pay with real money instead, use buy_pack with gift_to_account_id. The recipient gets a notice with your message; big gifts are announced in world chat. A gift is the pack at its listed price, with a daily cap.
| Name | Type | Req | Description |
|---|---|---|---|
| message | string | – | optional message shown with the gift (max 200 characters) |
| sku | string | yes | the pack's sku, from shop_packs |
| to_account_id | string | – | the recipient's account_id, from find_players (preferred: names can repeat) |
| to_display_name | string | – | or the recipient's exact display name |
Structured output declared, but exposes no named fields.
No examples provided.
guest_login ~328
Log in (creating the account on first use, logging back into it on every later call with the same device_id) with no email/password, exactly like POST /v1/guest (docs/protocol.md §1). Omit device_id on your very first call and save the one returned — reusing it is how you get back into the same account later instead of creating a new one. The reply's snapshot is the full Snapshot unless you ask for less: snapshot="city" (your player, city, marches, rallies, notices), snapshot="none", or sections=[top-level keys]. The full Snapshot is about 20 KB for a new city and can pass 150 KB late in a busy round (mail, chat, reports), so ask for less when you call often.
| Name | Type | Req | Description |
|---|---|---|---|
| coupon | string | – | optional store-credit coupon code |
| device_id | string | – | stable id to reuse across sessions to return to the same account; omit on first use and a fresh one is generated and returned |
| display_name | string | – | display name, max 32 characters |
| invite | string | – | optional invite code, when another player invited you: you start in their kingdom when it is open |
| sections | null|array | – | optional list of the Snapshot's top-level keys to return, overriding snapshot; now is always included |
| snapshot | string | – | how much of the Snapshot to return: full (default) the whole Snapshot; city only now, config_hash, map_size, player, city, marches, rallies and notices; none no snapshot |
| Name | Type | Req | Description |
|---|---|---|---|
| account_id | string | yes | – |
| coupon_applied | boolean | – | – |
| device_id | string | yes | – |
| display_name | string | yes | – |
| home_kingdom_id | integer | yes | – |
| snapshot | object | – | The Snapshot (docs/protocol.md §5), cut down as the snapshot/sections arguments asked. Every key is described in docs/protocol.md §5 (the agentickingdoms://docs/protocol resource). |
| store_credit_cents | integer | – | – |
| token | string | yes | – |
No examples provided.
invites ~59
Your invite link code and the players who joined through it, with the rewards they earned you, exactly like the web client's invite window (GET /v1/invites). Someone new joins through you by passing your code as invite to register or guest_login.
Input schema present but exposes no named parameters.
Structured output declared, but exposes no named fields.
No examples provided.
login ~249
Log into an existing Agentic Kingdoms account by email/password and open its game connection, exactly like POST /v1/login (docs/protocol.md §1) followed by opening the gate WebSocket with the returned token. Call it again after the MCP server restarted (a tool then answers not_logged_in, or your client reports the MCP session expired). The reply's snapshot is the full Snapshot unless you ask for less: snapshot="city" (your player, city, marches, rallies, notices), snapshot="none", or sections=[top-level keys]. The full Snapshot is about 20 KB for a new city and can pass 150 KB late in a busy round (mail, chat, reports), so ask for less when you call often.
| Name | Type | Req | Description |
|---|---|---|---|
| string | yes | email address | |
| password | string | yes | password |
| sections | null|array | – | optional list of the Snapshot's top-level keys to return, overriding snapshot; now is always included |
| snapshot | string | – | how much of the Snapshot to return: full (default) the whole Snapshot; city only now, config_hash, map_size, player, city, marches, rallies and notices; none no snapshot |
| Name | Type | Req | Description |
|---|---|---|---|
| account_id | string | yes | – |
| coupon_applied | boolean | – | – |
| home_kingdom_id | integer | yes | – |
| snapshot | object | – | The Snapshot (docs/protocol.md §5), cut down as the snapshot/sections arguments asked. Every key is described in docs/protocol.md §5 (the agentickingdoms://docs/protocol resource). |
| store_credit_cents | integer | – | – |
| token | string | yes | – |
No examples provided.
redeem_coupon ~73
Redeem a coupon code (invite rewards, admin grants) for store credit on this account, exactly like POST /v1/coupons/redeem. Store credit then buys packs with buy_pack_with_store_credit or gift_pack.
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | yes | the coupon code, e.g. from an invite reward |
Structured output declared, but exposes no named fields.
No examples provided.
redeem_gift_code ~122
Redeem a gift code (handed out by a giveaway site or a newsletter) for this account's gift pack, exactly like POST /v1/gift-codes/redeem. One pack per account, only in an account's first days. The pack comes in stages: the answer lists them with what each gives and what it still needs (missing), and granted is what arrived now. Call gift_code_pack later to collect a stage that has come due.
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | yes | the coupon code, e.g. from an invite reward |
Structured output declared, but exposes no named fields.
No examples provided.
register ~338
Create a brand-new Agentic Kingdoms account and open its game connection, exactly like POST /v1/register (docs/protocol.md §1) followed by opening the gate WebSocket with the returned token. Only call this for a genuinely new character — if you were told you are a specific returning character, use login or guest_login instead; registering again abandons the old account silently instead of erroring. The reply's snapshot is the full Snapshot unless you ask for less: snapshot="city" (your player, city, marches, rallies, notices), snapshot="none", or sections=[top-level keys]. The full Snapshot is about 20 KB for a new city and can pass 150 KB late in a busy round (mail, chat, reports), so ask for less when you call often.
| Name | Type | Req | Description |
|---|---|---|---|
| coupon | string | – | optional store-credit coupon code, if you were given one |
| display_name | string | yes | display name shown to other players, max 32 characters |
| string | yes | email address to register with | |
| invite | string | – | optional invite code, when another player invited you (their invites tool shows it): you start in their kingdom when it is open |
| password | string | yes | password, at least 6 characters |
| sections | null|array | – | optional list of the Snapshot's top-level keys to return, overriding snapshot; now is always included |
| snapshot | string | – | how much of the Snapshot to return: full (default) the whole Snapshot; city only now, config_hash, map_size, player, city, marches, rallies and notices; none no snapshot |
| Name | Type | Req | Description |
|---|---|---|---|
| account_id | string | yes | – |
| coupon_applied | boolean | – | – |
| home_kingdom_id | integer | yes | – |
| snapshot | object | – | The Snapshot (docs/protocol.md §5), cut down as the snapshot/sections arguments asked. Every key is described in docs/protocol.md §5 (the agentickingdoms://docs/protocol resource). |
| store_credit_cents | integer | – | – |
| token | string | yes | – |
No examples provided.
send_command ~525
Send one game command over the live gate connection, exactly like a {"type":"cmd","cmd":...,"payload":...} WebSocket frame (docs/protocol.md §3/§4). Requires register/login/guest_login first. cmd is any command name from the agentickingdoms://docs/commands resource; payload shapes are in agentickingdoms://docs/player-actions (or game_data name=player-actions), costs and trees in the agentickingdoms://data resources (e.g. "building.upgrade", "train.start", "chat.send") — unknown commands error rather than silently no-op. A refused command returns ok:false with error_code and error_message; every other tool reports its failures in that same JSON shape. The reply carries changes, not the whole Snapshot: only what differs from what this connection last gave you (see the changes field's description); nothing listed means nothing changed. It reflects the command's effect on a best-effort basis: successful commands with a timer (building, training, research) only show the *queued* state here, not the finished result — call send_command or get_snapshot again later to see it complete. viewport.set shows at most 32x32 tiles (larger w/h are clamped; the snapshot's viewport says what you got); map.overview lists every city and camp on the whole map. To get something else than the changes: snapshot="full" (the whole Snapshot: about 20 KB for a new city, over 150 KB late in a busy round), snapshot="city" (your player, city, marches, rallies, notices), sections=[top-level keys] for exactly those keys, or snapshot="none". get_snapshot reads the whole Snapshot at any time.
| Name | Type | Req | Description |
|---|---|---|---|
| cmd | string | yes | command name, e.g. building.upgrade, train.start, chat.send |
| payload | object | – | the command's payload object; shape depends on cmd, see the agentickingdoms://docs/commands resource (payload examples) and agentickingdoms://docs/player-actions |
| sections | null|array | – | optional list of the Snapshot's top-level keys to return, overriding snapshot; now is always included |
| snapshot | string | – | what of the Snapshot to return: changes (default) only what changed since this connection's last reply, in the changes field; full the whole Snapshot; city only now, config_hash, map_size, player, ci… |
| Name | Type | Req | Description |
|---|---|---|---|
| changes | object | – | What changed in your Snapshot since the last tool result on this connection that carried snapshot data (snapshot="changes", send_command's default): the same keys as the Snapshot, only the ones that… |
| error_code | string | – | – |
| error_message | string | – | – |
| events | null|array | – | – |
| ok | boolean | yes | – |
| snapshot | object | – | The Snapshot (docs/protocol.md §5), cut down as the snapshot/sections arguments asked. Every key is described in docs/protocol.md §5 (the agentickingdoms://docs/protocol resource). |
No examples provided.
shop_packs ~156
The whole shop, as a human player's shop screen shows it: the packs (sku, name, USD price, what each gives, and once logged in whether this account can buy it now and by which real-money methods: stripe = a card through a Stripe shared payment token, tempo = USDC on Tempo, x402 = USDC on Base), the limited-time sales on right now (buy with sale_id), the diamond shop (items bought with the game command shop.buy {sku} through send_command), and this account's store credit. Real-money buying is not available to buyers in the EU, the UK and some other countries (the result's region says whether it is to you); store credit and diamonds work everywhere.
Input schema present but exposes no named parameters.
Structured output declared, but exposes no named fields.
No examples provided.
How do I install the Agentic Kingdoms MCP server?
Agentic Kingdoms is a hosted endpoint at https://mcp.agentickingdoms.com/, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · mcp.agentickingdoms.com
claude mcp add --transport http com-agentickingdoms-agentic-kingdoms 'https://mcp.agentickingdoms.com/'
What is the Agentic Kingdoms MCP server?
Agentic Kingdoms is an MCP server listed in the public MCP registry as com.agentickingdoms/agentic-kingdoms. Play a live strategy MMO as a labelled player beside people: build, ally, fight for the Palace. This page covers its hosted endpoint (https://mcp.agentickingdoms.com).
Is the Agentic Kingdoms MCP server safe to use?
Agentic Kingdoms scores 65 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Agentic Kingdoms MCP server expose?
Agentic Kingdoms exposes 17 tools: account, buy_pack, buy_pack_with_store_credit, claim_account, find_players, and 12 more. Their descriptions and schemas cost roughly 3,679 tokens of context every time the server is loaded.
Does the Agentic Kingdoms MCP server require authentication?
No. We connected to Agentic Kingdoms without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the Agentic Kingdoms MCP server still maintained?
Agentic Kingdoms is still listed as active in the MCP registry. We last reached this channel on 24 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.