# Cobalt Capture (remote · cobaltcapture.com)

Annotated-screenshot reviews and ready-made product studies your AI agent can read, run, and share.

- Trust score: 78/100 (medium)
- Change this week: +3
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-09-24

> **Recent critical change**: Authorization (2026-09-23). See the changelog below before you install this server.

## Components

- remote · `cobaltcapture.com`: 78/100 (this document), [markdown](https://verifymcp.io/servers/com-cobaltcapture-cobalt/cobaltcapture.md), [page](https://verifymcp.io/servers/com-cobaltcapture-cobalt/cobaltcapture)

## Channel facts

- Endpoint: `https://cobaltcapture.com/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `1.21.0`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-09-24.

- **Endpoint Security**: 63/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation check failed: no authorisation is required to call this server, and it exposes a tool marked destructive (replace_screenshot).
  - HTTPS is enforced; there's no plaintext access path.
  - The HSTS (Strict-Transport-Security) header is present.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 76/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 6192 tokens (~516/item across 12 items; 12 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 80/100
  - Stability observed for 24 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.
  - An AI judge read all 13 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### How do I install the Cobalt Capture MCP server?

Cobalt Capture is a hosted endpoint at https://cobaltcapture.com/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http com-cobaltcapture-cobalt 'https://cobaltcapture.com/mcp'
```

### Cursor

```json
{
  "mcpServers": {
    "com-cobaltcapture-cobalt": {
      "url": "https://cobaltcapture.com/mcp"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "com-cobaltcapture-cobalt": {
      "type": "http",
      "url": "https://cobaltcapture.com/mcp"
    }
  }
}
```

### Codex

```toml
[mcp_servers.com-cobaltcapture-cobalt]
url = "https://cobaltcapture.com/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "com-cobaltcapture-cobalt": {
      "type": "remote",
      "url": "https://cobaltcapture.com/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add com-cobaltcapture-cobalt --url 'https://cobaltcapture.com/mcp' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  com-cobaltcapture-cobalt:
    url: "https://cobaltcapture.com/mcp"
```

### Netclaw

```json
{
  "McpServers": {
    "com-cobaltcapture-cobalt": {
      "Transport": "http",
      "Url": "https://cobaltcapture.com/mcp"
    }
  }
}
```

### Vellum

```bash
assistant mcp add com-cobaltcapture-cobalt -t streamable-http -u 'https://cobaltcapture.com/mcp'
```

### Other

```json
{
  "mcpServers": {
    "com-cobaltcapture-cobalt": {
      "type": "http",
      "url": "https://cobaltcapture.com/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-09-24 (score 78, 0)

- [security] The server rewrote its instructions, which are the text every model session reads
- [security] Tool “get_playbook” rewrote its description, which is the text the model reads
- [functional] New prompt “website_teardown”
- [functional] Server version: 1.21.0 → 1.22.0

### 2026-09-23 (score 78, +1)

- [critical regression] Authorization: unverified → fail
- [security] The server rewrote its instructions, which are the text every model session reads
- [security] New tool “replace_screenshot”, which the server declares destructive
- [security] Tool “add_screenshot” rewrote its description, which is the text the model reads
- [security] Tool “update_review” is now declared destructive
- [functional regression] Schema quality: 5431 → 6117
- [functional] Destructive annotations: pass → 100
- [functional] Server version: 1.20.0 → 1.21.0
- [cosmetic] “add_screenshot” dropped the optional parameter “replace_item”

### 2026-09-21 (score 77, +1)

No change was recorded against any check on this day. Stability & Change Management went from 67 to 70. That category is still filling its 30-day observation window: 20 days of observed history at the previous scan, 21 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-19 (score 76, +1)

No change was recorded against any check on this day. Stability & Change Management went from 60 to 63. That category is still filling its 30-day observation window: 18 days of observed history at the previous scan, 19 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-17 (score 75, +1)

No change was recorded against any check on this day. Stability & Change Management went from 53 to 57. That category is still filling its 30-day observation window: 16 days of observed history at the previous scan, 17 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-16 (score 74, 0)

- [security] The server rewrote its instructions, which are the text every model session reads
- [functional improvement] Schema quality: 573 → 493
- [functional] Server version: 1.19.0 → 1.20.0
- [functional] New tool “fetch”
- [functional] New tool “search”

### 2026-09-15 (score 74, +1)

No change was recorded against any check on this day. Stability & Change Management went from 47 to 50. That category is still filling its 30-day observation window: 14 days of observed history at the previous scan, 15 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-13 (score 73, +1)

No change was recorded against any check on this day. Stability & Change Management went from 40 to 43. That category is still filling its 30-day observation window: 12 days of observed history at the previous scan, 13 at this one. The score rises as the window fills, whether or not the server changes.

## MCP tools (12)

### `get_review` (~83 tokens)

Fetch a Cobalt Capture review by its share link or slug. Returns the reviewer's notes as text AND each annotated screenshot as an image, so you can see exactly what was marked and what to change.

Input parameters:

- `review` (string, required): A Cobalt review URL (https://cobaltcapture.com/r/<slug> or /s/<slug>) or just the slug.

### `create_review` (~234 tokens)

Start a new Cobalt Capture review and get a handle for filling it in. Use this to compile the findings of any site study — a usability pass, a pricing teardown, a positioning audit, a QA run — into one shareable, durable report with real screenshots. Works from any client, chat assistants included: with no browser, add_screenshot(page_url=...) renders the pages for you. Returns a `review` slug and a `claim_token` — pass BOTH back to add_screenshot / add_note to append content. Also returns a `review_url` to share and a `save_url` the human opens (while signed in) to save the review to their account permanently. The review is anonymous and auto-deletes after 30 days unless saved.

Input parameters:

- `product_url` (string): Optional URL of the product/site under review.
- `summary` (string): Optional overview shown at the top of the review (plain text or markdown). Good place for the overall task, outcome, and headline findings.
- `title` (string, required): Title of the review, e.g. 'Onboarding walkthrough — Jupiter Invoice'.

### `add_screenshot` (~965 tokens)

Append a screenshot (with an optional note) to a review created by create_review. The image is stored durably in Cobalt — this is the way to persist screenshots that would otherwise be lost when they only pass through a browser tool. Call once per screen as you go. NO BROWSER? Pass `page_url` and Cobalt renders the page for you (Cloudflare headless Chrome): `viewport` 'desktop' (1280px) or 'mobile' (390px phone, 2x), `full_page` true for the whole scroll. Use it for every screen you would otherwise only describe in text — a review without screenshots is a reduced deliverable, and the mobile viewport is how you test the phone fold without a device. The result includes the rendered image: LOOK AT IT before moving on. Cookie walls and modal veils are stripped automatically, but if what came back is still not the shot (an overlay, a blank, the wrong page), retake it in place with replace_screenshot(item=<that item's number>), adding `hide_selectors` for anything you can name — never leave a useless capture in the review and never append a second copy after it. This tool only ever appends; it never changes an existing item. Otherwise the input is `image_url`: POST the image to https://cobaltcapture.com/api/upload (multipart field `file`, no auth, returns {url, key}) and pass back the url. If a browser-automation script took the screenshot, do that POST inside the same script (Python `requests.post(...)`, or Playwright's request context) rather than shelling out to curl afterwards — same result, one less permission prompt. The `image` base64 parameter exists for small images only: tool-call arguments are model-generated text, so a real screenshot means emitting tens of thousands of base64 tokens perfectly, and an image you received as an image cannot be transcribed at all.

Input parameters:

- `claim_token` (string, required): The claim_token from create_review (authorizes the write). For a review the human has SAVED to their account, pass the agent token they generated on the review page (Export & more → Hand to your agen…
- `comment` (string): Optional note describing what this screen shows or what's wrong with it.
- `full_page` (boolean): With page_url: capture the entire scrollable page instead of the first viewport. Default false. Prefer the fold first; use full_page for one overview shot. Sites that scroll inside an inner container…
- `hide_selectors` (array): With page_url: extra CSS selectors to hide before the shot (e.g. ['#newsletter-modal', '.chat-widget']) when the returned image shows something still covering the page. Common cookie/consent banners…
- `image` (string): For SMALL images only (< ~100 KB) that you already hold as base64 text: a base64-encoded PNG/JPEG/WebP (data: URL prefix accepted). Not the path for screenshots — emitting one as tool-call text is sl…
- `image_url` (string): The image URL returned by Cobalt's own upload: POST the file as multipart field `file` to https://cobaltcapture.com/api/upload (returns {url, key}) — ideally from inside the script that captured it —…
- `page_url` (string): A public http(s) page for Cobalt to render and screenshot server-side — the path when you have no browser or screenshot tool of your own (chat clients, text-only agents). Public pages only: nothing b…
- `review` (string, required): The review slug or URL from create_review.
- `source_url` (string): Optional URL of the page the screenshot was taken on.
- `title` (string): Optional short caption for the screenshot.
- `viewport` (string): With page_url: 'desktop' (1280x800, default) or 'mobile' (390x844 phone, 2x, touch) — the way to test the phone fold.

### `replace_screenshot` (~729 tokens)

Overwrite one existing screenshot in a review with a new capture, in the same position. Use it when the image add_screenshot returned is not the shot (a cookie wall or overlay, a blank, the wrong page): retaking in place keeps the review clean instead of leaving a useless capture and a second copy after it. DESTRUCTIVE: the old image and any pins or annotations on it are removed and cannot be recovered; the title and comment are replaced only if you pass new ones. Screenshots only, never notes. Takes the same capture arguments as add_screenshot, plus `item`, the 1-based number of the screenshot to replace.

Input parameters:

- `claim_token` (string, required): The claim_token from create_review (authorizes the write). For a review the human has SAVED to their account, pass the agent token they generated on the review page (Export & more → Hand to your agen…
- `comment` (string): Optional note describing what this screen shows or what's wrong with it.
- `full_page` (boolean): With page_url: capture the entire scrollable page instead of the first viewport. Default false. Prefer the fold first; use full_page for one overview shot. Sites that scroll inside an inner container…
- `hide_selectors` (array): With page_url: extra CSS selectors to hide before the shot (e.g. ['#newsletter-modal', '.chat-widget']) when the returned image shows something still covering the page. Common cookie/consent banners…
- `image` (string): For SMALL images only (< ~100 KB) that you already hold as base64 text: a base64-encoded PNG/JPEG/WebP (data: URL prefix accepted). Not the path for screenshots — emitting one as tool-call text is sl…
- `image_url` (string): The image URL returned by Cobalt's own upload: POST the file as multipart field `file` to https://cobaltcapture.com/api/upload (returns {url, key}) — ideally from inside the script that captured it —…
- `item` (integer, required): The 1-based number of the existing screenshot item to overwrite (as it appears in the review, counting notes).
- `page_url` (string): A public http(s) page for Cobalt to render and screenshot server-side — the path when you have no browser or screenshot tool of your own (chat clients, text-only agents). Public pages only: nothing b…
- `review` (string, required): The review slug or URL from create_review.
- `source_url` (string): Optional URL of the page the screenshot was taken on.
- `title` (string): Optional short caption for the screenshot.
- `viewport` (string): With page_url: 'desktop' (1280x800, default) or 'mobile' (390x844 phone, 2x, touch) — the way to test the phone fold.

### `add_note` (~128 tokens)

Append a free-standing text note (not tied to a screenshot) to a review created by create_review. Use for context, steps taken, or a summary of findings between screenshots.

Input parameters:

- `claim_token` (string, required): The claim_token from create_review (authorizes the write). For a review the human has SAVED to their account, pass the agent token they generated on the review page (Export & more → Hand to your agen…
- `review` (string, required): The review slug or URL from create_review.
- `text` (string, required): The note text (plain text or markdown).

### `update_review` (~238 tokens)

Update a review's summary and/or title after the fact. Use this at the END of a run to land the verdict at the TOP of the review: the headline findings don't exist until the work is done, but readers (and agents ingesting the review) want them before scrolling past every intermediate screenshot. Prefer this over burying conclusions in a closing note.

Input parameters:

- `claim_token` (string, required): The claim_token from create_review (authorizes the write). For a review the human has SAVED to their account, pass the agent token they generated on the review page (Export & more → Hand to your agen…
- `compared_to` (string): Optional: if this run RE-RAN an earlier study (compare mode), the prior review's slug or URL you compared against. Set it when finalizing a re-run so the improvement-over-time is recorded.
- `review` (string, required): The review slug or URL from create_review.
- `summary` (string): The overview shown at the top of the review — put the headline findings and outcome here. Replaces any existing summary.
- `title` (string): Optional replacement title.

### `get_playbook` (~430 tokens)

Fetch a Cobalt study playbook by name and follow it exactly. Works from ANY client — a coding agent driving a browser, or a chat assistant with no browser (Claude chat, Cowork, ChatGPT): the public-page studies run in full from chat, because add_screenshot(page_url=...) renders the pages for you. Use this when the user asks for any kind of site review, audit, teardown, or test and you don't already have the playbook text. Available: 'pricing_teardown' — can a buyer tell what they'd pay and which tier is theirs (public pages: runs anywhere); 'website_teardown' — visual website teardown: what each key page puts first and what it says, judged cold and then through the site's likely visitors; 'positioning_pass' is its old name (public pages: runs anywhere); 'comparison_study' — two or three products compared for one buying decision, with a sourced matrix and an overall lean (public pages plus web search: runs anywhere); 'usability_pass' — first-time-user usability audit: signs up with a disposable inbox, drives the product, finds friction (needs a browser you control); 'flow_pass' — walks a specific flow the user names, signup/checkout/invite, including any email it sends (needs a browser you control); 'investigation_pass' — the general product investigator for an app you OWN, run in its own environment (needs a browser and usually the repo). All deliver a shareable Cobalt review. If the user's study is NONE of these, do not bend it into the nearest one — its lenses and severity labels will mislabel the findings; run the generic method in the server instructions instead. Prefer this over fetching the playbook from a URL: it comes through the protocol complete, whereas web fetchers summarize it and a summarized playbook silently drops the instructions that make the run work.

Input parameters:

- `name` (string, required): Playbook name, e.g. 'usability_pass'.
- `url` (string): The site to run it against, if you already know it.

### `search` (~114 tokens)

Search the studies Cobalt Capture has published on well-known products: pricing teardowns, positioning audits, and head-to-head comparisons (for example Canva pricing, Spotify vs Apple Music). Returns matching studies as {id, title, url}; pass an id to fetch for the full text. It does NOT search private reviews, which are reachable only by their link (use get_review, or fetch with the review URL).

Input parameters:

- `query` (string, required): What to look for, e.g. 'canva pricing' or 'spotify'.

### `fetch` (~104 tokens)

Fetch the full text of a Cobalt study by the id search returned, or of any Cobalt review by its URL (/r/<slug>) or slug. Returns text: findings, prices, the comparison matrix, and the underlying review's notes with links to its screenshots. Use get_review instead when you need to see the screenshots as images.

Input parameters:

- `id` (string, required): An id from search (e.g. 'teardown:canva'), or a review URL or slug.

### `create_inbox` (~107 tokens)

Create a disposable email inbox you can monitor, for signing up to the product you're testing. Returns an `address` to type into the signup form and an `inbox_token` to read it with. Use this instead of asking the human for an email account or a third-party inbox API key — no setup needed. Inboxes are temporary; create a fresh one per test persona.

Input parameters:

- `review` (string): Optional review slug this inbox belongs to — a label for your own bookkeeping.

### `check_inbox` (~224 tokens)

Read mail delivered to an inbox from create_inbox — e.g. to pull a verification code or confirmation link out of a signup email. Returns newest-first. Mail usually lands within seconds; if the response is empty, wait a few seconds and call again (there is no blocking wait). Extract the code or link yourself and continue the flow in the browser. Pass format="html" when you are AUDITING the email rather than reading a code out of it: the default text view flattens away the layout, typography and branding, which is exactly what an email audit is judging.

Input parameters:

- `address` (string, required): The inbox address from create_inbox.
- `format` (string): "text" (default) flattens each message to readable text — right for pulling a code or link. "html" returns the raw HTML part instead, for auditing the email as a rendered artifact: write it to a file…
- `inbox_token` (string, required): The inbox_token from create_inbox (authorizes reading).

### `email_review` (~236 tokens)

Email a link to a finished review to the human who started the run, so they don't have to remember to come back for it — useful at the end of a long unattended study. Pass the review, its claim_token, and the human's email. IMPORTANT: we only send to a VERIFIED COBALT ACCOUNT address (this prevents the tool being used to send spam); if the address isn't a Cobalt account, the call is refused with a message telling the human to create a free account at cobaltcapture.com with that address first. The email contains only a link to the review — no text you provide — so ask the human for their account email and pass it verbatim.

Input parameters:

- `claim_token` (string, required): The claim_token from create_review (proves you created this review), or, for a saved review, the agent token its owner generated on the review page (Export & more → Hand to your agent).
- `email` (string, required): The human's Cobalt account email. Must belong to a verified account, or the send is refused.
- `review` (string, required): The review slug or URL from create_review.

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/com-cobaltcapture-cobalt/cobaltcapture#diagnostics

## Score history

- 2026-09-24: 78
- 2026-09-23: 78
- 2026-09-22: 77
- 2026-09-21: 77
- 2026-09-20: 76
- 2026-09-19: 76
- 2026-09-18: 75
- 2026-09-17: 75
- 2026-09-16: 74
- 2026-09-15: 74
- 2026-09-14: 73
- 2026-09-13: 73
- 2026-09-12: 72
- 2026-09-11: 72
- 2026-09-10: 72
- 2026-09-09: 71
- 2026-09-08: 71
- 2026-09-07: 70
- 2026-09-06: 70
- 2026-09-05: 69
- 2026-09-04: 69
- 2026-09-03: 68
- 2026-09-02: 68
- 2026-09-01: 67
- 2026-08-31: 67

## Common questions

### What is the Cobalt Capture MCP server?

Cobalt Capture is an MCP server listed in the public MCP registry as com.cobaltcapture/cobalt. Annotated-screenshot reviews and ready-made product studies your AI agent can read, run, and share. This page covers its hosted endpoint (https://cobaltcapture.com/mcp).

### Is the Cobalt Capture MCP server safe to use?

Cobalt Capture scores 78 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Cobalt Capture MCP server expose?

Cobalt Capture exposes 12 tools: get_review, create_review, add_screenshot, replace_screenshot, add_note, and 7 more. Their descriptions and schemas cost roughly 3,592 tokens of context every time the server is loaded.

### Does the Cobalt Capture MCP server require authentication?

No. We connected to Cobalt Capture without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

### Is the Cobalt Capture MCP server still maintained?

Cobalt Capture is still listed as active in the MCP registry. We last reached this channel on 24 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

## Links

- Remote endpoint: https://cobaltcapture.com/mcp
- Website: https://cobaltcapture.com/developers
- Changelog RSS feed: https://verifymcp.io/servers/com-cobaltcapture-cobalt/cobaltcapture.xml
- Changelog JSON feed: https://verifymcp.io/servers/com-cobaltcapture-cobalt/cobaltcapture.json
- HTML version of this page: https://verifymcp.io/servers/com-cobaltcapture-cobalt/cobaltcapture