Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

Cobalt Capture

REMOTE · COBALTCAPTURE.COM · SCANNED SEP 24

Annotated-screenshot reviews and ready-made product studies your AI agent can read, run, and share.

+3 this week 78 Trust /100

Recent critical change

Authorization (23 Sept 2026). See the changelog before you install this server.

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →

Endpoint Security63
Transport & Reachability100
Schema Quality & AI Usability76
  • 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 6192 tokens (~516/item across 12 items; 12 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management80
  • Stability observed for 24 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
  • An AI judge read all 13 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Install

How do I install the Cobalt Capture MCP server?

Cobalt Capture is a hosted endpoint at https://cobaltcapture.com/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

remote · cobaltcapture.com

# add to Claude Code
claude mcp add --transport http com-cobaltcapture-cobalt 'https://cobaltcapture.com/mcp'
// .cursor/mcp.json
{
  "mcpServers": {
    "com-cobaltcapture-cobalt": {
      "url": "https://cobaltcapture.com/mcp"
    }
  }
}
// .vscode/mcp.json
{
  "servers": {
    "com-cobaltcapture-cobalt": {
      "type": "http",
      "url": "https://cobaltcapture.com/mcp"
    }
  }
}
# ~/.codex/config.toml
[mcp_servers.com-cobaltcapture-cobalt]
url = "https://cobaltcapture.com/mcp"
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "com-cobaltcapture-cobalt": {
      "type": "remote",
      "url": "https://cobaltcapture.com/mcp",
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add com-cobaltcapture-cobalt --url 'https://cobaltcapture.com/mcp' --transport streamable-http
# ~/.hermes/config.yaml
mcp_servers:
  com-cobaltcapture-cobalt:
    url: "https://cobaltcapture.com/mcp"
// ~/.netclaw/config/netclaw.json
{
  "McpServers": {
    "com-cobaltcapture-cobalt": {
      "Transport": "http",
      "Url": "https://cobaltcapture.com/mcp"
    }
  }
}
# add to Vellum
assistant mcp add com-cobaltcapture-cobalt -t streamable-http -u 'https://cobaltcapture.com/mcp'
// mcp.json
{
  "mcpServers": {
    "com-cobaltcapture-cobalt": {
      "type": "http",
      "url": "https://cobaltcapture.com/mcp"
    }
  }
}

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 24 Sept 26 0
    • The server rewrote its instructions, which are the text every model session reads security
    • Tool “get_playbook” rewrote its description, which is the text the model reads security
    • New prompt “website_teardown” functional
    • Server version: 1.21.0 → 1.22.0 functional
  • 23 Sept 26 +1
    • Authorization: unverified → fail critical
    • The server rewrote its instructions, which are the text every model session reads security
    • New tool “replace_screenshot”, which the server declares destructive security
    • Tool “add_screenshot” rewrote its description, which is the text the model reads security
    • Tool “update_review” is now declared destructive security
    • Schema quality: 5431 → 6117 functional
    • Destructive annotations: pass → 100 functional
    • Server version: 1.20.0 → 1.21.0 functional
    • “add_screenshot” dropped the optional parameter “replace_item” cosmetic
  • 21 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 67 to 70. That category is still filling its 30-day observation window: 20 days of observed history at the previous scan, 21 at this one. The score rises as the window fills, whether or not the server changes.

  • 19 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 60 to 63. That category is still filling its 30-day observation window: 18 days of observed history at the previous scan, 19 at this one. The score rises as the window fills, whether or not the server changes.

  • 17 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 53 to 57. That category is still filling its 30-day observation window: 16 days of observed history at the previous scan, 17 at this one. The score rises as the window fills, whether or not the server changes.

  • 16 Sept 26 0
    • The server rewrote its instructions, which are the text every model session reads security
    • Schema quality: 573 → 493 functional
    • Server version: 1.19.0 → 1.20.0 functional
    • New tool “fetch” functional
    • New tool “search” functional
  • 15 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 47 to 50. That category is still filling its 30-day observation window: 14 days of observed history at the previous scan, 15 at this one. The score rises as the window fills, whether or not the server changes.

  • 13 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 40 to 43. That category is still filling its 30-day observation window: 12 days of observed history at the previous scan, 13 at this one. The score rises as the window fills, whether or not the server changes.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 24 Sept 2026 · Probed https://cobaltcapture.com/mcp

TLS valid

Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .

Subject Issuer Valid from Valid until Key Signature Serial
CN=cobaltcapture.com CN=YE2,O=Let's Encrypt,C=US 6 Sept 2026 5 Dec 2026 ECDSA 256 ECDSA-SHA384 631da6310eb1f1d62153b0d3f3125bcd33d
SANs: *.cobaltcapture.com, cobaltcapture.com
CN=YE2,O=Let's Encrypt,C=US (CA) CN=Root YE,O=ISRG,C=US 3 Sept 2025 2 Sept 2028 ECDSA 384 ECDSA-SHA384 4df3b15dd6c0784c507cd37b58e6f115
CN=Root YE,O=ISRG,C=US (CA) CN=ISRG Root X2,O=Internet Security Research Group,C=US 13 May 2026 2 Sept 2032 ECDSA 384 ECDSA-SHA384 872165fc34b6e5fba8add5b3705fb53a
CN=ISRG Root X2,O=Internet Security Research Group,C=US (CA) CN=ISRG Root X1,O=Internet Security Research Group,C=US 13 May 2026 2 Sept 2032 ECDSA 384 SHA256-RSA 6c8f1dc727c7117f7baf853ac980f9cd

Background: What to check on a remote MCP endpoint →

DNSSEC insecure

Validation of cobaltcapture.com. Not signed

Zone DS Keys Algorithms Outcome
. trust_anchor 20326, 38696 8, 8 Verified
com. present 19718 13 Verified
cobaltcapture.com. absent Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation
Authentication No authorisation required

The endpoint answered without asking for a token. Anyone who knows the URL can reach it.

Result No authorisation required
HTTP status 200
Header Value
strict-transport-security max-age=15552000; includeSubDomains; preload
content-security-policy default-src 'self'; script-src 'self' 'unsafe-inline' https://acornreply.com https://challenges.cloudflare.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; font-src 'self'; connect-src 'self' https://analytics.ahrefs.com https://*.supabase.co wss://*.supabase.co https://*.ingest.sentry.io https://*.ingest.us.sentry.io https://challenges.cloudflare.com https://acornreply.com; frame-src https://challenges.cloudflare.com https://www.youtube-nocookie.com https://acornreply.com; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; object-src 'none'; upgrade-insecure-requests
x-content-type-options nosniff
x-frame-options DENY
referrer-policy strict-origin-when-cross-origin

Background: How OAuth 2.1 works in the 2026 MCP spec →

Transports 2 probes
Transport URL Outcome Status Location
streamable-http https://cobaltcapture.com/mcp Verified 200
http (plaintext) http://cobaltcapture.com/mcp HTTPS enforced 301 https://cobaltcapture.com/mcp
MCP tools · 12 exposed · ~3,592 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
add_note ~128

Append a free-standing text note (not tied to a screenshot) to a review created by create_review. Use for context, steps taken, or a summary of findings between screenshots.

NameTypeReqDescription
claim_tokenstringyesThe claim_token from create_review (authorizes the write). For a review the human has SAVED to their account, pass the agent token they generated on the review page (Export & more → Hand to your agen…
reviewstringyesThe review slug or URL from create_review.
textstringyesThe note text (plain text or markdown).

No output schema declared.

No examples provided.

add_screenshot ~965

Append a screenshot (with an optional note) to a review created by create_review. The image is stored durably in Cobalt — this is the way to persist screenshots that would otherwise be lost when they only pass through a browser tool. Call once per screen as you go. NO BROWSER? Pass `page_url` and Cobalt renders the page for you (Cloudflare headless Chrome): `viewport` 'desktop' (1280px) or 'mobile' (390px phone, 2x), `full_page` true for the whole scroll. Use it for every screen you would otherwise only describe in text — a review without screenshots is a reduced deliverable, and the mobile viewport is how you test the phone fold without a device. The result includes the rendered image: LOOK AT IT before moving on. Cookie walls and modal veils are stripped automatically, but if what came back is still not the shot (an overlay, a blank, the wrong page), retake it in place with replace_screenshot(item=<that item's number>), adding `hide_selectors` for anything you can name — never leave a useless capture in the review and never append a second copy after it. This tool only ever appends; it never changes an existing item. Otherwise the input is `image_url`: POST the image to https://cobaltcapture.com/api/upload (multipart field `file`, no auth, returns {url, key}) and pass back the url. If a browser-automation script took the screenshot, do that POST inside the same script (Python `requests.post(...)`, or Playwright's request context) rather than shelling out to curl afterwards — same result, one less permission prompt. The `image` base64 parameter exists for small images only: tool-call arguments are model-generated text, so a real screenshot means emitting tens of thousands of base64 tokens perfectly, and an image you received as an image cannot be transcribed at all.

NameTypeReqDescription
claim_tokenstringyesThe claim_token from create_review (authorizes the write). For a review the human has SAVED to their account, pass the agent token they generated on the review page (Export & more → Hand to your agen…
commentstringOptional note describing what this screen shows or what's wrong with it.
full_pagebooleanWith page_url: capture the entire scrollable page instead of the first viewport. Default false. Prefer the fold first; use full_page for one overview shot. Sites that scroll inside an inner container…
hide_selectorsarrayWith page_url: extra CSS selectors to hide before the shot (e.g. ['#newsletter-modal', '.chat-widget']) when the returned image shows something still covering the page. Common cookie/consent banners…
imagestringFor SMALL images only (< ~100 KB) that you already hold as base64 text: a base64-encoded PNG/JPEG/WebP (data: URL prefix accepted). Not the path for screenshots — emitting one as tool-call text is sl…
image_urlstringThe image URL returned by Cobalt's own upload: POST the file as multipart field `file` to https://cobaltcapture.com/api/upload (returns {url, key}) — ideally from inside the script that captured it —…
page_urlstringA public http(s) page for Cobalt to render and screenshot server-side — the path when you have no browser or screenshot tool of your own (chat clients, text-only agents). Public pages only: nothing b…
reviewstringyesThe review slug or URL from create_review.
source_urlstringOptional URL of the page the screenshot was taken on.
titlestringOptional short caption for the screenshot.
viewportstringWith page_url: 'desktop' (1280x800, default) or 'mobile' (390x844 phone, 2x, touch) — the way to test the phone fold.

No output schema declared.

No examples provided.

check_inbox ~224

Read mail delivered to an inbox from create_inbox — e.g. to pull a verification code or confirmation link out of a signup email. Returns newest-first. Mail usually lands within seconds; if the response is empty, wait a few seconds and call again (there is no blocking wait). Extract the code or link yourself and continue the flow in the browser. Pass format="html" when you are AUDITING the email rather than reading a code out of it: the default text view flattens away the layout, typography and branding, which is exactly what an email audit is judging.

NameTypeReqDescription
addressstringyesThe inbox address from create_inbox.
formatstring"text" (default) flattens each message to readable text — right for pulling a code or link. "html" returns the raw HTML part instead, for auditing the email as a rendered artifact: write it to a file…
inbox_tokenstringyesThe inbox_token from create_inbox (authorizes reading).

No output schema declared.

No examples provided.

create_inbox ~107

Create a disposable email inbox you can monitor, for signing up to the product you're testing. Returns an `address` to type into the signup form and an `inbox_token` to read it with. Use this instead of asking the human for an email account or a third-party inbox API key — no setup needed. Inboxes are temporary; create a fresh one per test persona.

NameTypeReqDescription
reviewstringOptional review slug this inbox belongs to — a label for your own bookkeeping.

No output schema declared.

No examples provided.

create_review ~234

Start a new Cobalt Capture review and get a handle for filling it in. Use this to compile the findings of any site study — a usability pass, a pricing teardown, a positioning audit, a QA run — into one shareable, durable report with real screenshots. Works from any client, chat assistants included: with no browser, add_screenshot(page_url=...) renders the pages for you. Returns a `review` slug and a `claim_token` — pass BOTH back to add_screenshot / add_note to append content. Also returns a `review_url` to share and a `save_url` the human opens (while signed in) to save the review to their account permanently. The review is anonymous and auto-deletes after 30 days unless saved.

NameTypeReqDescription
product_urlstringOptional URL of the product/site under review.
summarystringOptional overview shown at the top of the review (plain text or markdown). Good place for the overall task, outcome, and headline findings.
titlestringyesTitle of the review, e.g. 'Onboarding walkthrough — Jupiter Invoice'.

No output schema declared.

No examples provided.

email_review ~236

Email a link to a finished review to the human who started the run, so they don't have to remember to come back for it — useful at the end of a long unattended study. Pass the review, its claim_token, and the human's email. IMPORTANT: we only send to a VERIFIED COBALT ACCOUNT address (this prevents the tool being used to send spam); if the address isn't a Cobalt account, the call is refused with a message telling the human to create a free account at cobaltcapture.com with that address first. The email contains only a link to the review — no text you provide — so ask the human for their account email and pass it verbatim.

NameTypeReqDescription
claim_tokenstringyesThe claim_token from create_review (proves you created this review), or, for a saved review, the agent token its owner generated on the review page (Export & more → Hand to your agent).
emailstringyesThe human's Cobalt account email. Must belong to a verified account, or the send is refused.
reviewstringyesThe review slug or URL from create_review.

No output schema declared.

No examples provided.

fetch ~104

Fetch the full text of a Cobalt study by the id search returned, or of any Cobalt review by its URL (/r/<slug>) or slug. Returns text: findings, prices, the comparison matrix, and the underlying review's notes with links to its screenshots. Use get_review instead when you need to see the screenshots as images.

NameTypeReqDescription
idstringyesAn id from search (e.g. 'teardown:canva'), or a review URL or slug.

No output schema declared.

No examples provided.

get_playbook ~430

Fetch a Cobalt study playbook by name and follow it exactly. Works from ANY client — a coding agent driving a browser, or a chat assistant with no browser (Claude chat, Cowork, ChatGPT): the public-page studies run in full from chat, because add_screenshot(page_url=...) renders the pages for you. Use this when the user asks for any kind of site review, audit, teardown, or test and you don't already have the playbook text. Available: 'pricing_teardown' — can a buyer tell what they'd pay and which tier is theirs (public pages: runs anywhere); 'website_teardown' — visual website teardown: what each key page puts first and what it says, judged cold and then through the site's likely visitors; 'positioning_pass' is its old name (public pages: runs anywhere); 'comparison_study' — two or three products compared for one buying decision, with a sourced matrix and an overall lean (public pages plus web search: runs anywhere); 'usability_pass' — first-time-user usability audit: signs up with a disposable inbox, drives the product, finds friction (needs a browser you control); 'flow_pass' — walks a specific flow the user names, signup/checkout/invite, including any email it sends (needs a browser you control); 'investigation_pass' — the general product investigator for an app you OWN, run in its own environment (needs a browser and usually the repo). All deliver a shareable Cobalt review. If the user's study is NONE of these, do not bend it into the nearest one — its lenses and severity labels will mislabel the findings; run the generic method in the server instructions instead. Prefer this over fetching the playbook from a URL: it comes through the protocol complete, whereas web fetchers summarize it and a summarized playbook silently drops the instructions that make the run work.

NameTypeReqDescription
namestringyesPlaybook name, e.g. 'usability_pass'.
urlstringThe site to run it against, if you already know it.

No output schema declared.

No examples provided.

get_review ~83

Fetch a Cobalt Capture review by its share link or slug. Returns the reviewer's notes as text AND each annotated screenshot as an image, so you can see exactly what was marked and what to change.

NameTypeReqDescription
reviewstringyesA Cobalt review URL (https://cobaltcapture.com/r/<slug> or /s/<slug>) or just the slug.

No output schema declared.

No examples provided.

replace_screenshot ~729

Overwrite one existing screenshot in a review with a new capture, in the same position. Use it when the image add_screenshot returned is not the shot (a cookie wall or overlay, a blank, the wrong page): retaking in place keeps the review clean instead of leaving a useless capture and a second copy after it. DESTRUCTIVE: the old image and any pins or annotations on it are removed and cannot be recovered; the title and comment are replaced only if you pass new ones. Screenshots only, never notes. Takes the same capture arguments as add_screenshot, plus `item`, the 1-based number of the screenshot to replace.

NameTypeReqDescription
claim_tokenstringyesThe claim_token from create_review (authorizes the write). For a review the human has SAVED to their account, pass the agent token they generated on the review page (Export & more → Hand to your agen…
commentstringOptional note describing what this screen shows or what's wrong with it.
full_pagebooleanWith page_url: capture the entire scrollable page instead of the first viewport. Default false. Prefer the fold first; use full_page for one overview shot. Sites that scroll inside an inner container…
hide_selectorsarrayWith page_url: extra CSS selectors to hide before the shot (e.g. ['#newsletter-modal', '.chat-widget']) when the returned image shows something still covering the page. Common cookie/consent banners…
imagestringFor SMALL images only (< ~100 KB) that you already hold as base64 text: a base64-encoded PNG/JPEG/WebP (data: URL prefix accepted). Not the path for screenshots — emitting one as tool-call text is sl…
image_urlstringThe image URL returned by Cobalt's own upload: POST the file as multipart field `file` to https://cobaltcapture.com/api/upload (returns {url, key}) — ideally from inside the script that captured it —…
itemintegeryesThe 1-based number of the existing screenshot item to overwrite (as it appears in the review, counting notes).
page_urlstringA public http(s) page for Cobalt to render and screenshot server-side — the path when you have no browser or screenshot tool of your own (chat clients, text-only agents). Public pages only: nothing b…
reviewstringyesThe review slug or URL from create_review.
source_urlstringOptional URL of the page the screenshot was taken on.
titlestringOptional short caption for the screenshot.
viewportstringWith page_url: 'desktop' (1280x800, default) or 'mobile' (390x844 phone, 2x, touch) — the way to test the phone fold.

No output schema declared.

No examples provided.

search ~114

Search the studies Cobalt Capture has published on well-known products: pricing teardowns, positioning audits, and head-to-head comparisons (for example Canva pricing, Spotify vs Apple Music). Returns matching studies as {id, title, url}; pass an id to fetch for the full text. It does NOT search private reviews, which are reachable only by their link (use get_review, or fetch with the review URL).

NameTypeReqDescription
querystringyesWhat to look for, e.g. 'canva pricing' or 'spotify'.

No output schema declared.

No examples provided.

update_review ~238

Update a review's summary and/or title after the fact. Use this at the END of a run to land the verdict at the TOP of the review: the headline findings don't exist until the work is done, but readers (and agents ingesting the review) want them before scrolling past every intermediate screenshot. Prefer this over burying conclusions in a closing note.

NameTypeReqDescription
claim_tokenstringyesThe claim_token from create_review (authorizes the write). For a review the human has SAVED to their account, pass the agent token they generated on the review page (Export & more → Hand to your agen…
compared_tostringOptional: if this run RE-RAN an earlier study (compare mode), the prior review's slug or URL you compared against. Set it when finalizing a re-run so the improvement-over-time is recorded.
reviewstringyesThe review slug or URL from create_review.
summarystringThe overview shown at the top of the review — put the headline findings and outcome here. Replaces any existing summary.
titlestringOptional replacement title.

No output schema declared.

No examples provided.

Common questions

What is the Cobalt Capture MCP server?

Cobalt Capture is an MCP server listed in the public MCP registry as com.cobaltcapture/cobalt. Annotated-screenshot reviews and ready-made product studies your AI agent can read, run, and share. This page covers its hosted endpoint (https://cobaltcapture.com/mcp).

Is the Cobalt Capture MCP server safe to use?

Cobalt Capture scores 78 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the Cobalt Capture MCP server expose?

Cobalt Capture exposes 12 tools: get_review, create_review, add_screenshot, replace_screenshot, add_note, and 7 more. Their descriptions and schemas cost roughly 3,592 tokens of context every time the server is loaded.

Does the Cobalt Capture MCP server require authentication?

No. We connected to Cobalt Capture without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

Is the Cobalt Capture MCP server still maintained?

Cobalt Capture is still listed as active in the MCP registry. We last reached this channel on 24 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.