Cobalt Capture
REMOTE · COBALTCAPTURE.COM · SCANNED SEP 24
Annotated-screenshot reviews and ready-made product studies your AI agent can read, run, and share.
Available components
Recent critical change
Authorization (23 Sept 2026). See the changelog before you install this server.
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security63
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation check failed: no authorisation is required to call this server, and it exposes a tool marked destructive (replace_screenshot). See how to fix → View diagnostics → Fail
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability76
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 6192 tokens (~516/item across 12 items; 12 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management80
- Stability observed for 24 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 13 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the Cobalt Capture MCP server?
Cobalt Capture is a hosted endpoint at https://cobaltcapture.com/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · cobaltcapture.com
claude mcp add --transport http com-cobaltcapture-cobalt 'https://cobaltcapture.com/mcp'
{
"mcpServers": {
"com-cobaltcapture-cobalt": {
"url": "https://cobaltcapture.com/mcp"
}
}
} {
"servers": {
"com-cobaltcapture-cobalt": {
"type": "http",
"url": "https://cobaltcapture.com/mcp"
}
}
} [mcp_servers.com-cobaltcapture-cobalt] url = "https://cobaltcapture.com/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"com-cobaltcapture-cobalt": {
"type": "remote",
"url": "https://cobaltcapture.com/mcp",
"enabled": true
}
}
} openclaw mcp add com-cobaltcapture-cobalt --url 'https://cobaltcapture.com/mcp' --transport streamable-http
mcp_servers:
com-cobaltcapture-cobalt:
url: "https://cobaltcapture.com/mcp" {
"McpServers": {
"com-cobaltcapture-cobalt": {
"Transport": "http",
"Url": "https://cobaltcapture.com/mcp"
}
}
} assistant mcp add com-cobaltcapture-cobalt -t streamable-http -u 'https://cobaltcapture.com/mcp'
{
"mcpServers": {
"com-cobaltcapture-cobalt": {
"type": "http",
"url": "https://cobaltcapture.com/mcp"
}
}
} The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 24 Sept 26 0
- The server rewrote its instructions, which are the text every model session reads security
- Tool “get_playbook” rewrote its description, which is the text the model reads security
- New prompt “website_teardown” functional
- Server version: 1.21.0 → 1.22.0 functional
- 23 Sept 26 +1
- Authorization: unverified → fail ▼ critical
- The server rewrote its instructions, which are the text every model session reads security
- New tool “replace_screenshot”, which the server declares destructive security
- Tool “add_screenshot” rewrote its description, which is the text the model reads security
- Tool “update_review” is now declared destructive security
- Schema quality: 5431 → 6117 ▼ functional
- Destructive annotations: pass → 100 functional
- Server version: 1.20.0 → 1.21.0 functional
- “add_screenshot” dropped the optional parameter “replace_item” cosmetic
- 21 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 67 to 70. That category is still filling its 30-day observation window: 20 days of observed history at the previous scan, 21 at this one. The score rises as the window fills, whether or not the server changes.
- 19 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 60 to 63. That category is still filling its 30-day observation window: 18 days of observed history at the previous scan, 19 at this one. The score rises as the window fills, whether or not the server changes.
- 17 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 53 to 57. That category is still filling its 30-day observation window: 16 days of observed history at the previous scan, 17 at this one. The score rises as the window fills, whether or not the server changes.
- 16 Sept 26 0
- The server rewrote its instructions, which are the text every model session reads security
- Schema quality: 573 → 493 ▲ functional
- Server version: 1.19.0 → 1.20.0 functional
- New tool “fetch” functional
- New tool “search” functional
- 15 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 47 to 50. That category is still filling its 30-day observation window: 14 days of observed history at the previous scan, 15 at this one. The score rises as the window fills, whether or not the server changes.
- 13 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 40 to 43. That category is still filling its 30-day observation window: 12 days of observed history at the previous scan, 13 at this one. The score rises as the window fills, whether or not the server changes.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 24 Sept 2026 · Probed https://cobaltcapture.com/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=cobaltcapture.com | CN=YE2,O=Let's Encrypt,C=US | 6 Sept 2026 | 5 Dec 2026 | ECDSA 256 | ECDSA-SHA384 | 631da6310eb1f1d62153b0d3f3125bcd33d |
| SANs: *.cobaltcapture.com, cobaltcapture.com | ||||||
| CN=YE2,O=Let's Encrypt,C=US (CA) | CN=Root YE,O=ISRG,C=US | 3 Sept 2025 | 2 Sept 2028 | ECDSA 384 | ECDSA-SHA384 | 4df3b15dd6c0784c507cd37b58e6f115 |
| CN=Root YE,O=ISRG,C=US (CA) | CN=ISRG Root X2,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | ECDSA-SHA384 | 872165fc34b6e5fba8add5b3705fb53a |
| CN=ISRG Root X2,O=Internet Security Research Group,C=US (CA) | CN=ISRG Root X1,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | SHA256-RSA | 6c8f1dc727c7117f7baf853ac980f9cd |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of cobaltcapture.com. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| com. | present | 19718 | 13 | Verified |
| cobaltcapture.com. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
| Header | Value |
|---|---|
| strict-transport-security | max-age=15552000; includeSubDomains; preload |
| content-security-policy | default-src 'self'; script-src 'self' 'unsafe-inline' https://acornreply.com https://challenges.cloudflare.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; font-src 'self'; connect-src 'self' https://analytics.ahrefs.com https://*.supabase.co wss://*.supabase.co https://*.ingest.sentry.io https://*.ingest.us.sentry.io https://challenges.cloudflare.com https://acornreply.com; frame-src https://challenges.cloudflare.com https://www.youtube-nocookie.com https://acornreply.com; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; object-src 'none'; upgrade-insecure-requests |
| x-content-type-options | nosniff |
| x-frame-options | DENY |
| referrer-policy | strict-origin-when-cross-origin |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://cobaltcapture.com/mcp | Verified | 200 | |
| http (plaintext) | http://cobaltcapture.com/mcp | HTTPS enforced | 301 | https://cobaltcapture.com/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
add_note ~128
Append a free-standing text note (not tied to a screenshot) to a review created by create_review. Use for context, steps taken, or a summary of findings between screenshots.
| Name | Type | Req | Description |
|---|---|---|---|
| claim_token | string | yes | The claim_token from create_review (authorizes the write). For a review the human has SAVED to their account, pass the agent token they generated on the review page (Export & more → Hand to your agen… |
| review | string | yes | The review slug or URL from create_review. |
| text | string | yes | The note text (plain text or markdown). |
No output schema declared.
No examples provided.
add_screenshot ~965
Append a screenshot (with an optional note) to a review created by create_review. The image is stored durably in Cobalt — this is the way to persist screenshots that would otherwise be lost when they only pass through a browser tool. Call once per screen as you go. NO BROWSER? Pass `page_url` and Cobalt renders the page for you (Cloudflare headless Chrome): `viewport` 'desktop' (1280px) or 'mobile' (390px phone, 2x), `full_page` true for the whole scroll. Use it for every screen you would otherwise only describe in text — a review without screenshots is a reduced deliverable, and the mobile viewport is how you test the phone fold without a device. The result includes the rendered image: LOOK AT IT before moving on. Cookie walls and modal veils are stripped automatically, but if what came back is still not the shot (an overlay, a blank, the wrong page), retake it in place with replace_screenshot(item=<that item's number>), adding `hide_selectors` for anything you can name — never leave a useless capture in the review and never append a second copy after it. This tool only ever appends; it never changes an existing item. Otherwise the input is `image_url`: POST the image to https://cobaltcapture.com/api/upload (multipart field `file`, no auth, returns {url, key}) and pass back the url. If a browser-automation script took the screenshot, do that POST inside the same script (Python `requests.post(...)`, or Playwright's request context) rather than shelling out to curl afterwards — same result, one less permission prompt. The `image` base64 parameter exists for small images only: tool-call arguments are model-generated text, so a real screenshot means emitting tens of thousands of base64 tokens perfectly, and an image you received as an image cannot be transcribed at all.
| Name | Type | Req | Description |
|---|---|---|---|
| claim_token | string | yes | The claim_token from create_review (authorizes the write). For a review the human has SAVED to their account, pass the agent token they generated on the review page (Export & more → Hand to your agen… |
| comment | string | – | Optional note describing what this screen shows or what's wrong with it. |
| full_page | boolean | – | With page_url: capture the entire scrollable page instead of the first viewport. Default false. Prefer the fold first; use full_page for one overview shot. Sites that scroll inside an inner container… |
| hide_selectors | array | – | With page_url: extra CSS selectors to hide before the shot (e.g. ['#newsletter-modal', '.chat-widget']) when the returned image shows something still covering the page. Common cookie/consent banners… |
| image | string | – | For SMALL images only (< ~100 KB) that you already hold as base64 text: a base64-encoded PNG/JPEG/WebP (data: URL prefix accepted). Not the path for screenshots — emitting one as tool-call text is sl… |
| image_url | string | – | The image URL returned by Cobalt's own upload: POST the file as multipart field `file` to https://cobaltcapture.com/api/upload (returns {url, key}) — ideally from inside the script that captured it —… |
| page_url | string | – | A public http(s) page for Cobalt to render and screenshot server-side — the path when you have no browser or screenshot tool of your own (chat clients, text-only agents). Public pages only: nothing b… |
| review | string | yes | The review slug or URL from create_review. |
| source_url | string | – | Optional URL of the page the screenshot was taken on. |
| title | string | – | Optional short caption for the screenshot. |
| viewport | string | – | With page_url: 'desktop' (1280x800, default) or 'mobile' (390x844 phone, 2x, touch) — the way to test the phone fold. |
No output schema declared.
No examples provided.
check_inbox ~224
Read mail delivered to an inbox from create_inbox — e.g. to pull a verification code or confirmation link out of a signup email. Returns newest-first. Mail usually lands within seconds; if the response is empty, wait a few seconds and call again (there is no blocking wait). Extract the code or link yourself and continue the flow in the browser. Pass format="html" when you are AUDITING the email rather than reading a code out of it: the default text view flattens away the layout, typography and branding, which is exactly what an email audit is judging.
| Name | Type | Req | Description |
|---|---|---|---|
| address | string | yes | The inbox address from create_inbox. |
| format | string | – | "text" (default) flattens each message to readable text — right for pulling a code or link. "html" returns the raw HTML part instead, for auditing the email as a rendered artifact: write it to a file… |
| inbox_token | string | yes | The inbox_token from create_inbox (authorizes reading). |
No output schema declared.
No examples provided.
create_inbox ~107
Create a disposable email inbox you can monitor, for signing up to the product you're testing. Returns an `address` to type into the signup form and an `inbox_token` to read it with. Use this instead of asking the human for an email account or a third-party inbox API key — no setup needed. Inboxes are temporary; create a fresh one per test persona.
| Name | Type | Req | Description |
|---|---|---|---|
| review | string | – | Optional review slug this inbox belongs to — a label for your own bookkeeping. |
No output schema declared.
No examples provided.
create_review ~234
Start a new Cobalt Capture review and get a handle for filling it in. Use this to compile the findings of any site study — a usability pass, a pricing teardown, a positioning audit, a QA run — into one shareable, durable report with real screenshots. Works from any client, chat assistants included: with no browser, add_screenshot(page_url=...) renders the pages for you. Returns a `review` slug and a `claim_token` — pass BOTH back to add_screenshot / add_note to append content. Also returns a `review_url` to share and a `save_url` the human opens (while signed in) to save the review to their account permanently. The review is anonymous and auto-deletes after 30 days unless saved.
| Name | Type | Req | Description |
|---|---|---|---|
| product_url | string | – | Optional URL of the product/site under review. |
| summary | string | – | Optional overview shown at the top of the review (plain text or markdown). Good place for the overall task, outcome, and headline findings. |
| title | string | yes | Title of the review, e.g. 'Onboarding walkthrough — Jupiter Invoice'. |
No output schema declared.
No examples provided.
email_review ~236
Email a link to a finished review to the human who started the run, so they don't have to remember to come back for it — useful at the end of a long unattended study. Pass the review, its claim_token, and the human's email. IMPORTANT: we only send to a VERIFIED COBALT ACCOUNT address (this prevents the tool being used to send spam); if the address isn't a Cobalt account, the call is refused with a message telling the human to create a free account at cobaltcapture.com with that address first. The email contains only a link to the review — no text you provide — so ask the human for their account email and pass it verbatim.
| Name | Type | Req | Description |
|---|---|---|---|
| claim_token | string | yes | The claim_token from create_review (proves you created this review), or, for a saved review, the agent token its owner generated on the review page (Export & more → Hand to your agent). |
| string | yes | The human's Cobalt account email. Must belong to a verified account, or the send is refused. | |
| review | string | yes | The review slug or URL from create_review. |
No output schema declared.
No examples provided.
fetch ~104
Fetch the full text of a Cobalt study by the id search returned, or of any Cobalt review by its URL (/r/<slug>) or slug. Returns text: findings, prices, the comparison matrix, and the underlying review's notes with links to its screenshots. Use get_review instead when you need to see the screenshots as images.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | An id from search (e.g. 'teardown:canva'), or a review URL or slug. |
No output schema declared.
No examples provided.
get_playbook ~430
Fetch a Cobalt study playbook by name and follow it exactly. Works from ANY client — a coding agent driving a browser, or a chat assistant with no browser (Claude chat, Cowork, ChatGPT): the public-page studies run in full from chat, because add_screenshot(page_url=...) renders the pages for you. Use this when the user asks for any kind of site review, audit, teardown, or test and you don't already have the playbook text. Available: 'pricing_teardown' — can a buyer tell what they'd pay and which tier is theirs (public pages: runs anywhere); 'website_teardown' — visual website teardown: what each key page puts first and what it says, judged cold and then through the site's likely visitors; 'positioning_pass' is its old name (public pages: runs anywhere); 'comparison_study' — two or three products compared for one buying decision, with a sourced matrix and an overall lean (public pages plus web search: runs anywhere); 'usability_pass' — first-time-user usability audit: signs up with a disposable inbox, drives the product, finds friction (needs a browser you control); 'flow_pass' — walks a specific flow the user names, signup/checkout/invite, including any email it sends (needs a browser you control); 'investigation_pass' — the general product investigator for an app you OWN, run in its own environment (needs a browser and usually the repo). All deliver a shareable Cobalt review. If the user's study is NONE of these, do not bend it into the nearest one — its lenses and severity labels will mislabel the findings; run the generic method in the server instructions instead. Prefer this over fetching the playbook from a URL: it comes through the protocol complete, whereas web fetchers summarize it and a summarized playbook silently drops the instructions that make the run work.
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | yes | Playbook name, e.g. 'usability_pass'. |
| url | string | – | The site to run it against, if you already know it. |
No output schema declared.
No examples provided.
get_review ~83
Fetch a Cobalt Capture review by its share link or slug. Returns the reviewer's notes as text AND each annotated screenshot as an image, so you can see exactly what was marked and what to change.
| Name | Type | Req | Description |
|---|---|---|---|
| review | string | yes | A Cobalt review URL (https://cobaltcapture.com/r/<slug> or /s/<slug>) or just the slug. |
No output schema declared.
No examples provided.
replace_screenshot ~729
Overwrite one existing screenshot in a review with a new capture, in the same position. Use it when the image add_screenshot returned is not the shot (a cookie wall or overlay, a blank, the wrong page): retaking in place keeps the review clean instead of leaving a useless capture and a second copy after it. DESTRUCTIVE: the old image and any pins or annotations on it are removed and cannot be recovered; the title and comment are replaced only if you pass new ones. Screenshots only, never notes. Takes the same capture arguments as add_screenshot, plus `item`, the 1-based number of the screenshot to replace.
| Name | Type | Req | Description |
|---|---|---|---|
| claim_token | string | yes | The claim_token from create_review (authorizes the write). For a review the human has SAVED to their account, pass the agent token they generated on the review page (Export & more → Hand to your agen… |
| comment | string | – | Optional note describing what this screen shows or what's wrong with it. |
| full_page | boolean | – | With page_url: capture the entire scrollable page instead of the first viewport. Default false. Prefer the fold first; use full_page for one overview shot. Sites that scroll inside an inner container… |
| hide_selectors | array | – | With page_url: extra CSS selectors to hide before the shot (e.g. ['#newsletter-modal', '.chat-widget']) when the returned image shows something still covering the page. Common cookie/consent banners… |
| image | string | – | For SMALL images only (< ~100 KB) that you already hold as base64 text: a base64-encoded PNG/JPEG/WebP (data: URL prefix accepted). Not the path for screenshots — emitting one as tool-call text is sl… |
| image_url | string | – | The image URL returned by Cobalt's own upload: POST the file as multipart field `file` to https://cobaltcapture.com/api/upload (returns {url, key}) — ideally from inside the script that captured it —… |
| item | integer | yes | The 1-based number of the existing screenshot item to overwrite (as it appears in the review, counting notes). |
| page_url | string | – | A public http(s) page for Cobalt to render and screenshot server-side — the path when you have no browser or screenshot tool of your own (chat clients, text-only agents). Public pages only: nothing b… |
| review | string | yes | The review slug or URL from create_review. |
| source_url | string | – | Optional URL of the page the screenshot was taken on. |
| title | string | – | Optional short caption for the screenshot. |
| viewport | string | – | With page_url: 'desktop' (1280x800, default) or 'mobile' (390x844 phone, 2x, touch) — the way to test the phone fold. |
No output schema declared.
No examples provided.
search ~114
Search the studies Cobalt Capture has published on well-known products: pricing teardowns, positioning audits, and head-to-head comparisons (for example Canva pricing, Spotify vs Apple Music). Returns matching studies as {id, title, url}; pass an id to fetch for the full text. It does NOT search private reviews, which are reachable only by their link (use get_review, or fetch with the review URL).
| Name | Type | Req | Description |
|---|---|---|---|
| query | string | yes | What to look for, e.g. 'canva pricing' or 'spotify'. |
No output schema declared.
No examples provided.
update_review ~238
Update a review's summary and/or title after the fact. Use this at the END of a run to land the verdict at the TOP of the review: the headline findings don't exist until the work is done, but readers (and agents ingesting the review) want them before scrolling past every intermediate screenshot. Prefer this over burying conclusions in a closing note.
| Name | Type | Req | Description |
|---|---|---|---|
| claim_token | string | yes | The claim_token from create_review (authorizes the write). For a review the human has SAVED to their account, pass the agent token they generated on the review page (Export & more → Hand to your agen… |
| compared_to | string | – | Optional: if this run RE-RAN an earlier study (compare mode), the prior review's slug or URL you compared against. Set it when finalizing a re-run so the improvement-over-time is recorded. |
| review | string | yes | The review slug or URL from create_review. |
| summary | string | – | The overview shown at the top of the review — put the headline findings and outcome here. Replaces any existing summary. |
| title | string | – | Optional replacement title. |
No output schema declared.
No examples provided.
What is the Cobalt Capture MCP server?
Cobalt Capture is an MCP server listed in the public MCP registry as com.cobaltcapture/cobalt. Annotated-screenshot reviews and ready-made product studies your AI agent can read, run, and share. This page covers its hosted endpoint (https://cobaltcapture.com/mcp).
Is the Cobalt Capture MCP server safe to use?
Cobalt Capture scores 78 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Cobalt Capture MCP server expose?
Cobalt Capture exposes 12 tools: get_review, create_review, add_screenshot, replace_screenshot, add_note, and 7 more. Their descriptions and schemas cost roughly 3,592 tokens of context every time the server is loaded.
Does the Cobalt Capture MCP server require authentication?
No. We connected to Cobalt Capture without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the Cobalt Capture MCP server still maintained?
Cobalt Capture is still listed as active in the MCP registry. We last reached this channel on 24 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.