CurlShip
REMOTE · CURLSHIP.COM
Read and submit the CurlShip directory. Paid actions return checkout_url.
Available components
Last scanned (21 hours ago)
Scores higher than 58% of remote servers
Reachable. Last reached 4 Nov 2026.
Category Marketing and SEO
Recent critical change
Authorization (30 Oct 2026). See the changelog before you install this server.
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security63
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation check failed: no authorisation is required to call this server, and it exposes a tool marked destructive (remove_free_listing). See how to fix → View diagnostics → Fail
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability65
- AI-judged instruction clarity (good).Pass
- Tool/resource definitions use about 1439 tokens (~84/item across 17 items; 17 tools + 0 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management77
- Stability observed for 23 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage82
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 46% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 18 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities40
- Spec-recency check failed: implements MCP spec 2025-03-26; the latest is 2026-07-28. See how to fix → Fail
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 4 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 73 to 77. That category is still filling its 30-day observation window: 22 days of observed history at the previous scan, 23 at this one. The score rises as the window fills, whether or not the server changes.
- 2 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 67 to 70. That category is still filling its 30-day observation window: 20 days of observed history at the previous scan, 21 at this one. The score rises as the window fills, whether or not the server changes.
- 31 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 60 to 63. That category is still filling its 30-day observation window: 18 days of observed history at the previous scan, 19 at this one. The score rises as the window fills, whether or not the server changes.
- 30 Oct 26 +1
- Authorization: unverified → fail ▼ critical
- Tool “list_listings” rewrote its description, which is the text the model reads security
- Tool “upgrade_listing” rewrote its description, which is the text the model reads security
- Tool “x402_bid_featured” rewrote its description, which is the text the model reads security
- Tool “x402_submit_listing” rewrote its description, which is the text the model reads security
- Tool “confirm_edit” is now declared destructive security
- Tool “remove_free_listing” is now declared destructive security
- Tool “x402_bid_featured” is now declared destructive security
- Tool “x402_submit_listing” is now declared destructive security
- Destructive annotations: All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation. functional
- “list_listings” reworded the description of “category” cosmetic
- “submit_listing” reworded the description of “tier” cosmetic
- Tool “bid_featured” changed its title: Bid for the Featured spot cosmetic
- Tool “change_listing_url” changed its title: Change a listing's URL cosmetic
- Tool “confirm_edit” changed its title: Confirm an edit request cosmetic
- Tool “get_daily_stats” changed its title: Get daily stats cosmetic
- Tool “get_dr_history” changed its title: Get Domain Rating history cosmetic
- Tool “get_stats” changed its title: Get directory stats cosmetic
- Tool “list_categories” changed its title: List categories cosmetic
- Tool “list_listings” changed its title: List listings cosmetic
- Tool “read_featured” changed its title: Read the Featured spot cosmetic
- Tool “refresh_listing” changed its title: Refresh listing metadata cosmetic
- Tool “remove_free_listing” changed its title: Remove a free listing cosmetic
- Tool “set_tracking_params” changed its title: Set tracking params cosmetic
- Tool “submit_listing” changed its title: Submit a listing cosmetic
- Tool “upgrade_listing” changed its title: Upgrade a listing's tier cosmetic
- Tool “verify_badge” changed its title: Verify badge placement cosmetic
- Tool “x402_bid_featured” changed its title: Bid for Featured, paid in USDC cosmetic
- Tool “x402_submit_listing” changed its title: Submit a listing, paid in USDC cosmetic
- 29 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 53 to 57. That category is still filling its 30-day observation window: 16 days of observed history at the previous scan, 17 at this one. The score rises as the window fills, whether or not the server changes.
- 28 Oct 26 0
- New tool “set_tracking_params” functional
- 27 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 47 to 50. That category is still filling its 30-day observation window: 14 days of observed history at the previous scan, 15 at this one. The score rises as the window fills, whether or not the server changes.
- 25 Oct 26 +1
- Tool “list_listings” rewrote its description, which is the text the model reads security
- New tool “list_categories” functional
- “list_listings” added an optional parameter “category” cosmetic
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 4 Nov 2026 · Probed https://curlship.com/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=curlship.com | CN=WE1,O=Google Trust Services,C=US | 4 Oct 2026 | 2 Jan 2027 | ECDSA 256 | ECDSA-SHA256 | 7732837932cff9d00ed54a24018d2ee8 |
| SANs: curlship.com, *.curlship.com | ||||||
| CN=WE1,O=Google Trust Services,C=US (CA) | CN=GTS Root R4,O=Google Trust Services LLC,C=US | 13 Dec 2023 | 20 Feb 2029 | ECDSA 256 | ECDSA-SHA384 | 7ff31977972c224a76155d13b6d685e3 |
| CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) | CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE | 15 Nov 2023 | 28 Jan 2028 | ECDSA 384 | SHA256-RSA | 7fe530bf331343bedd821610493d8a1b |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of curlship.com. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| com. | present | 19718 | 13 | Verified |
| curlship.com. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
| Header | Value |
|---|---|
| strict-transport-security | max-age=31536000; includeSubDomains |
| content-security-policy | default-src 'self'; script-src 'self' 'unsafe-eval' https://mws03-52117.wykr.es https://xpmetric.com; style-src 'self' 'unsafe-inline'; img-src 'self' https: data:; connect-src 'self' https://mws03-52117.wykr.es https://xpmetric.com; font-src 'self'; frame-ancestors 'self' https://buildhop.io |
| x-content-type-options | nosniff |
| referrer-policy | strict-origin-when-cross-origin |
| permissions-policy | camera=(), microphone=(), geolocation=() |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://curlship.com/mcp | Verified | 200 | |
| http (plaintext) | http://curlship.com/mcp | HTTPS enforced | 301 | https://curlship.com/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
bid_featured Bid for the Featured spot ~100
Take the Featured spot. It sits above every listing. The minimum right now is $51. Always dofollow. One-time payment, no refund when someone outbids you. The product must already be listed. Omit amount_usd to bid $51.
| Name | Type | Req | Description |
|---|---|---|---|
| amount_usd | number | – | Bid in USD. Omit to bid the minimum (51). |
| url | string | yes | URL of a listing that is already on the directory. |
No output schema declared.
No examples provided.
change_listing_url Change a listing's URL ~57
Point an existing listing at a new URL. One listing per root domain, so this is how a second page replaces the first.
| Name | Type | Req | Description |
|---|---|---|---|
| listing_id | integer | yes | – |
| proof | string | yes | – |
| url | string | yes | – |
No output schema declared.
No examples provided.
confirm_edit Confirm an edit request ~64
Apply an edit request. A refresh needs a second call with the apply digest from the preview.
| Name | Type | Req | Description |
|---|---|---|---|
| apply | string | – | Digest from the refresh preview. Omit for a URL change or a removal. |
| request_id | integer | yes | – |
| token | string | yes | – |
No output schema declared.
No examples provided.
get_daily_stats Get daily stats ~82
Active listings added per UTC day — the zero-filled series behind the public /stats page. One entry per calendar day from the first listing to today, each with added and the cumulative running total.
| Name | Type | Req | Description |
|---|---|---|---|
| range | string|integer | – | "all" (default) for the whole series, or a day count 1-3650 for the last N days. |
No output schema declared.
No examples provided.
get_dr_history Get Domain Rating history ~60
The site's Ahrefs Domain Rating over time — the series behind /stats#dr. Every recorded reading, one per UTC day, plus the current value, the last step (change vs the most recent different reading) and the growth since the first reading.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_stats Get directory stats ~17
Listing counts and the Ahrefs Domain Rating.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_categories List categories ~45
The category tree with a listing count per category — a group slug like developer-tools, plus any promoted leaf categories under it. Each listing's category field carries one of these slugs.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_listings List listings ~192
Active listings as JSON. No query returns every listing, in the same order as before. Optional query parameters: limit, offset, q, since, and category. q matches the title, description, or URL. since is an ISO timestamp; listings created at or after it are kept. category is a category slug and filters to that group or leaf. Each listing includes created_at and a category object ({slug, name, group}) or null while the listing is unclassified.
| Name | Type | Req | Description |
|---|---|---|---|
| category | string | – | A category slug — a group or a promoted leaf. |
| limit | integer | – | Max listings. 50 with offset, 100 with q, when omitted. |
| offset | integer | – | How many matching listings to skip. |
| q | string | – | Substring of the title, description, or URL. |
| since | string | – | ISO timestamp. Keep listings created at or after this moment. |
No output schema declared.
No examples provided.
read_featured Read the Featured spot ~21
Who holds the Featured spot, and the current minimum bid.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
refresh_listing Refresh listing metadata ~54
Re-read title, description, and image from the listed page. Send listing_id and proof only. The first confirm previews; send apply back to save.
| Name | Type | Req | Description |
|---|---|---|---|
| listing_id | integer | yes | – |
| proof | string | yes | – |
No output schema declared.
No examples provided.
remove_free_listing Remove a free listing ~58
Take a free listing off the directory. Send remove true and no url or email. A paid listing or the Featured holder is refused.
| Name | Type | Req | Description |
|---|---|---|---|
| listing_id | integer | yes | – |
| proof | string | yes | – |
| remove | boolean | yes | – |
No output schema declared.
No examples provided.
set_tracking_params Set tracking params ~118
Set the tracking params on a paid listing's outbound link (Bronze and up). Keys: ref or utm_* (<=10, lowercase/digits/_); values: 1-100 of A-Z a-z 0-9 . _ ~ -. Send {} to clear back to ?ref=curlship. Free listings are refused.
| Name | Type | Req | Description |
|---|---|---|---|
| listing_id | integer | yes | – |
| proof | string | yes | – |
| tracking | object | yes | e.g. {"utm_source": "yours", "utm_medium": "referral"} |
No output schema declared.
No examples provided.
submit_listing Submit a listing ~63
List a product. It goes live immediately. One listing per root domain. https://yourapp.com is the documentation placeholder and is refused.
| Name | Type | Req | Description |
|---|---|---|---|
| string | yes | – | |
| tier | string | – | Omit for the free tier. |
| url | string | yes | – |
No output schema declared.
No examples provided.
upgrade_listing Upgrade a listing's tier ~35
Checkout URL for a paid tier on a listing that already exists.
| Name | Type | Req | Description |
|---|---|---|---|
| tier | string | yes | – |
| url | string | yes | – |
No output schema declared.
No examples provided.
verify_badge Verify badge placement ~39
Re-check the listed site for a link to curlship.com. A free listing with the badge becomes dofollow.
| Name | Type | Req | Description |
|---|---|---|---|
| url | string | yes | – |
No output schema declared.
No examples provided.
x402_bid_featured Bid for Featured, paid in USDC ~195
Bid on the Featured spot in USDC over x402 — the same auction as a card bid (minimum $51 right now), but settled on-chain with no checkout and no human in the loop. Call without payment_signature for the 402 quote, sign accepts[0] as an EIP-3009 authorization, call again with payment_signature echoing it as `accepted`. The product must already be listed. Omit amount_usd to bid $51.
| Name | Type | Req | Description |
|---|---|---|---|
| amount_usd | number | – | Bid in USD. Omit to bid the minimum (51). |
| payment_signature | string | – | The PAYMENT-SIGNATURE header value: base64 JSON x402 v2 PaymentPayload — accepts[0] from the quote, signed and echoed back as `accepted`. Omit to get the quote back as a 402. |
| url | string | yes | URL of a listing that is already on the directory. |
No output schema declared.
No examples provided.
x402_submit_listing Submit a listing, paid in USDC ~201
Buy bronze_lifetime ($30 USDC once, forever) or platinum ($49 USDC per prepaid year) with USDC over x402 — settled on-chain, no checkout page, no human in the loop. Call without payment_signature and the reply is a 402 whose body (also the PAYMENT-REQUIRED header, base64) is the quote; sign accepts[0] as an EIP-3009 authorization and call again with payment_signature — the tier is granted in that same call. Same URL and listing rules as a free submission.
| Name | Type | Req | Description |
|---|---|---|---|
| string | yes | – | |
| payment_signature | string | – | The PAYMENT-SIGNATURE header value: base64 JSON x402 v2 PaymentPayload — accepts[0] from the quote, signed and echoed back as `accepted`. Omit to get the quote back as a 402. |
| tier | string | yes | The only tiers x402 sells. |
| url | string | yes | – |
No output schema declared.
No examples provided.
How do I install the CurlShip MCP server?
CurlShip is a hosted endpoint at https://curlship.com/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · curlship.com
claude mcp add --transport http com-curlship-directory 'https://curlship.com/mcp'
What is the CurlShip MCP server?
CurlShip is an MCP server listed in the public MCP registry as com.curlship/directory. Read and submit the CurlShip directory. Paid actions return checkout_url. This page covers its hosted endpoint (https://curlship.com/mcp).
Is the CurlShip MCP server safe to use?
CurlShip scores 72 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the CurlShip MCP server expose?
CurlShip exposes 17 tools: bid_featured, read_featured, submit_listing, upgrade_listing, refresh_listing, and 12 more. Their descriptions and schemas cost roughly 1,401 tokens of context every time the server is loaded.
Does the CurlShip MCP server require authentication?
No. We connected to CurlShip without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the CurlShip MCP server still maintained?
CurlShip is still listed as active in the MCP registry. We last reached this channel on 4 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.