AutoPrivado
REMOTE · AUTOPRIVADO.COM
Private car sales in Europe: search listings, price estimate from VIN, portals, contracts.
Available components
Last scanned (12 hours ago)
Scores higher than 54% of remote servers
Reachable. Last reached 5 Nov 2026.
Category E-commerce
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security74
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- No authorisation is required to call this server. Every tool declares its destructiveHint and none is destructive, so open access doesn't expose one. See how to fix → View diagnostics → Partial
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability56
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 1489 tokens (~212/item across 7 items; 7 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management17
- Stability observed for 5 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage86
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 59% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 7 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 8 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 5 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 13 to 17. That category is still filling its 30-day observation window: 4 days of observed history at the previous scan, 5 at this one. The score rises as the window fills, whether or not the server changes.
- 4 Nov 26 0
- Tool “estimate_price” rewrote its description, which is the text the model reads security
- “estimate_price” added an optional parameter “carClass” cosmetic
- “estimate_price” added an optional parameter “country” cosmetic
- “estimate_price” reworded the description of “newPrice” cosmetic
- 2 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.
- 1 Nov 26 0
- Stability: unverified → 0.03 ▲ functional
- 31 Oct 26 67
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Probed https://autoprivado.com/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=autoprivado.com | CN=WE1,O=Google Trust Services,C=US | 31 Oct 2026 | 29 Jan 2027 | ECDSA 256 | ECDSA-SHA256 | fe57b82005913b9113d25ec3a770352b |
| SANs: autoprivado.com | ||||||
| CN=WE1,O=Google Trust Services,C=US (CA) | CN=GTS Root R4,O=Google Trust Services LLC,C=US | 13 Dec 2023 | 20 Feb 2029 | ECDSA 256 | ECDSA-SHA384 | 7ff31977972c224a76155d13b6d685e3 |
| CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) | CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE | 15 Nov 2023 | 28 Jan 2028 | ECDSA 384 | SHA256-RSA | 7fe530bf331343bedd821610493d8a1b |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of autoprivado.com. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| com. | present | 19718 | 13 | Verified |
| autoprivado.com. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
| Header | Value |
|---|---|
| x-content-type-options | nosniff |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://autoprivado.com/mcp | Verified | 200 | |
| http (plaintext) | http://autoprivado.com/mcp | HTTPS enforced | 301 | https://autoprivado.com/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
create_listing Create a private car listing ~470
Create a car-for-sale listing for a PRIVATE seller on AutoPrivado, only on behalf of and with the consent of the car's owner. Decodes the VIN (NHTSA vPIC) or Dutch plate (RDW), gives a rule-based price estimate, writes the listing in EN/DE/IT/ES/FR/NL/PL and a missing-info checklist. The listing page goes live on autoprivado.com; returns its URL and a secret edit URL (give the edit URL only to the seller). AutoPrivado never posts to portals: the seller publishes on each portal himself with the posting kit (kitUrl). Limited per client and per day (free service).
| Name | Type | Req | Description |
|---|---|---|---|
| accidentFree | boolean | – | – |
| alsoIn | array | – | Optional: also sell in these other markets. Posting kits are written in each market's language and the car appears in searches there. |
| altPrice | integer | – | Optional second price for markets in the other currency (PLN for PL when the seller uses EUR, EUR when the seller is in PL). Never converted; without it those kits show no price. |
| city | string | – | – |
| colour | string | – | – |
| condition | string | – | – |
| contact | string | – | Public contact shown on the listing (optional; it is public) |
| country | string | yes | Country where the car is sold |
| gearbox | string | – | – |
| inspectionUntil | string | – | YYYY-MM-DD |
| km | integer | yes | Mileage in km |
| negotiable | boolean | – | – |
| newPrice | integer | – | Approximate list price when new (EUR), improves the estimate for VINs |
| notes | string | – | Seller's own words (kept in the original language) |
| owners | integer | – | – |
| plate | string | – | Dutch licence plate (NL only, RDW lookup) |
| price | integer | – | Asking price: EUR, or PLN (złoty) when country is PL. No conversion. |
| serviceHistory | boolean | – | – |
| showVin | boolean | – | Show VIN/plate publicly (seller consent) |
| vehicle | object | – | Overrides: make, model, year, fuel, powerKw, body … |
| vin | string | – | 17-character VIN |
No output schema declared.
No examples provided.
decode_vehicle Decode a VIN or Dutch plate ~109
Decode a 17-character VIN (NHTSA vPIC, works best for cars sold in the US and many EU makes) or a Dutch licence plate (RDW open data: make, model, first registration, fuel, power, APK date). Returns the vehicle data AutoPrivado would use. Nothing is stored.
| Name | Type | Req | Description |
|---|---|---|---|
| country | string | – | Plate country (NL only) |
| plate | string | – | Dutch plate, e.g. HLZ85B |
| vin | string | – | – |
No output schema declared.
No examples provided.
estimate_price Estimate a used-car price ~313
Rule-based price range (low/mid/high) for a used car from its VIN or Dutch plate (or make/model/year), mileage and condition – the same estimate as the website. Price when new, in this order: newPrice, the RDW list price of a Dutch plate, the typical new price of the make + model + year from RDW open data (about 500 listed models; vehicle.make and vehicle.model are matched by name), else a car class (small, compact, family, suv, premium). Not a valuation; it explains every step and the typical dealer gap. In EUR; with country PL the result is in PLN (EUR sources converted at the ECB reference rate, class bands in PLN). Nothing is stored.
| Name | Type | Req | Description |
|---|---|---|---|
| carClass | string | – | Optional car class when the model is not listed and the price when new is unknown: small, compact, family, suv or premium |
| condition | string | – | – |
| country | string | – | Optional market; PL gives the result in PLN |
| km | integer | – | – |
| lang | string | – | Language of the explanation |
| newPrice | integer | – | Approximate price when new in EUR (needed when the decoder has no list price, unless carClass is given) |
| plate | string | – | Dutch plate (RDW) |
| vehicle | object | – | Instead of VIN/plate or as overrides: make, model, year, firstRegistration (YYYY-MM-DD), listPrice |
| vin | string | – | – |
No output schema declared.
No examples provided.
get_listing Get an AutoPrivado listing ~95
Get one AutoPrivado listing by id: vehicle data, price and currency, texts in 7 languages, photo URLs, page URL per language, missing-info checklist. Expired or deleted listings return not_found.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Listing id, e.g. from search_listings or a URL https://autoprivado.com/l/<id> |
| lang | string | – | Optional: language of the returned page URL |
No output schema declared.
No examples provided.
get_sale_documents Sale contract and registration checklist ~115
Links and data for closing a private car sale in a country: printable sale-contract template (prefilled when a listing id is given), the change-of-ownership checklist with deadlines (computed from the sale date), documents to hand over, costs and official sources.
| Name | Type | Req | Description |
|---|---|---|---|
| country | string | yes | – |
| lang | string | – | Language of the checklist texts (default en) |
| listingId | string | – | Optional: prefill the contract with this listing |
| saleDate | string | – | YYYY-MM-DD, to compute deadlines |
No output schema declared.
No examples provided.
list_portals Car portals per country ~84
The car portals AutoPrivado prepares posting kits for, per country (IT, ES, DE, FR, NL, PL): recommended and optional portal, home page, the portal's own listing form, private-seller fee with its source, optional payment service, and whether a seller from abroad can use it.
| Name | Type | Req | Description |
|---|---|---|---|
| country | string | – | Optional: only this country |
No output schema declared.
No examples provided.
search_listings Search AutoPrivado listings ~196
Search active private-seller car listings on AutoPrivado. Filters: free text (make/model), make, model, market country, price range with currency, max km, min year, fuel. A country search also returns cars cross-listed into that market (crossListed, marketPrice, marketCurrency); price filters use that market's currency (PLN in PL, EUR elsewhere). Results may be up to a minute old.
| Name | Type | Req | Description |
|---|---|---|---|
| country | string | – | Market (country of sale) |
| currency | string | – | Only listings priced in this currency (in the searched market) |
| fuel | string | – | – |
| limit | integer | – | – |
| make | string | – | – |
| maxKm | integer | – | – |
| maxPrice | integer | – | – |
| minPrice | integer | – | – |
| minYear | integer | – | – |
| model | string | – | – |
| q | string | – | Make or model text |
No output schema declared.
No examples provided.
How do I install the AutoPrivado MCP server?
AutoPrivado is a hosted endpoint at https://autoprivado.com/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · autoprivado.com
claude mcp add --transport http com-autoprivado-autoprivado 'https://autoprivado.com/mcp'
What is the AutoPrivado MCP server?
AutoPrivado is an MCP server listed in the public MCP registry as com.autoprivado/autoprivado. Private car sales in Europe: search listings, price estimate from VIN, portals, contracts. This page covers its hosted endpoint (https://autoprivado.com/mcp).
Is the AutoPrivado MCP server safe to use?
AutoPrivado scores 69 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the AutoPrivado MCP server expose?
AutoPrivado exposes 7 tools: create_listing, get_listing, search_listings, decode_vehicle, estimate_price, and 2 more. Their descriptions and schemas cost roughly 1,382 tokens of context every time the server is loaded.
Does the AutoPrivado MCP server require authentication?
No. We connected to AutoPrivado without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the AutoPrivado MCP server still maintained?
AutoPrivado is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.