# CurlShip (remote · curlship.com)

Read and submit the CurlShip directory. Paid actions return checkout_url.

- Trust score: 72/100 (medium)
- Change this week: +5
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-04

> **Recent critical change**: Authorization (2026-10-30). See the changelog below before you install this server.

## Components

- remote · `curlship.com`: 72/100 (this document), [markdown](https://verifymcp.io/servers/com-curlship-directory/curlship.md), [page](https://verifymcp.io/servers/com-curlship-directory/curlship)

## Channel facts

- Endpoint: `https://curlship.com/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `1.0.0`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-04.

- **Endpoint Security**: 63/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation check failed: no authorisation is required to call this server, and it exposes a tool marked destructive (remove_free_listing).
  - HTTPS is enforced; there's no plaintext access path.
  - The HSTS (Strict-Transport-Security) header is present.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 65/100
  - AI-judged instruction clarity (good).
  - Tool/resource definitions use about 1439 tokens (~84/item across 17 items; 17 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 77/100
  - Stability observed for 23 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 82/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 46% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.
  - An AI judge read all 18 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 40/100
  - Spec-recency check failed: implements MCP spec 2025-03-26; the latest is 2026-07-28.

## Install

### How do I install the CurlShip MCP server?

CurlShip is a hosted endpoint at https://curlship.com/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http com-curlship-directory 'https://curlship.com/mcp'
```

### Cursor

```json
{
  "mcpServers": {
    "com-curlship-directory": {
      "url": "https://curlship.com/mcp"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "com-curlship-directory": {
      "type": "http",
      "url": "https://curlship.com/mcp"
    }
  }
}
```

### Codex

```toml
[mcp_servers.com-curlship-directory]
url = "https://curlship.com/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "com-curlship-directory": {
      "type": "remote",
      "url": "https://curlship.com/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add com-curlship-directory --url 'https://curlship.com/mcp' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  com-curlship-directory:
    url: "https://curlship.com/mcp"
```

### Netclaw

```json
{
  "McpServers": {
    "com-curlship-directory": {
      "Transport": "http",
      "Url": "https://curlship.com/mcp"
    }
  }
}
```

### Vellum

```bash
assistant mcp add com-curlship-directory -t streamable-http -u 'https://curlship.com/mcp'
```

### Other

```json
{
  "mcpServers": {
    "com-curlship-directory": {
      "type": "http",
      "url": "https://curlship.com/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-04 (score 72, +1)

No change was recorded against any check on this day. Stability & Change Management went from 73 to 77. That category is still filling its 30-day observation window: 22 days of observed history at the previous scan, 23 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-11-02 (score 71, +1)

No change was recorded against any check on this day. Stability & Change Management went from 67 to 70. That category is still filling its 30-day observation window: 20 days of observed history at the previous scan, 21 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-31 (score 70, +1)

No change was recorded against any check on this day. Stability & Change Management went from 60 to 63. That category is still filling its 30-day observation window: 18 days of observed history at the previous scan, 19 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-30 (score 69, +1)

- [critical regression] Authorization: unverified → fail
- [security] Tool “list_listings” rewrote its description, which is the text the model reads
- [security] Tool “upgrade_listing” rewrote its description, which is the text the model reads
- [security] Tool “x402_bid_featured” rewrote its description, which is the text the model reads
- [security] Tool “x402_submit_listing” rewrote its description, which is the text the model reads
- [security] Tool “confirm_edit” is now declared destructive
- [security] Tool “remove_free_listing” is now declared destructive
- [security] Tool “x402_bid_featured” is now declared destructive
- [security] Tool “x402_submit_listing” is now declared destructive
- [functional] Destructive annotations: All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.
- [cosmetic] “list_listings” reworded the description of “category”
- [cosmetic] “submit_listing” reworded the description of “tier”
- [cosmetic] Tool “bid_featured” changed its title: Bid for the Featured spot
- [cosmetic] Tool “change_listing_url” changed its title: Change a listing's URL
- [cosmetic] Tool “confirm_edit” changed its title: Confirm an edit request
- [cosmetic] Tool “get_daily_stats” changed its title: Get daily stats
- [cosmetic] Tool “get_dr_history” changed its title: Get Domain Rating history
- [cosmetic] Tool “get_stats” changed its title: Get directory stats
- [cosmetic] Tool “list_categories” changed its title: List categories
- [cosmetic] Tool “list_listings” changed its title: List listings
- [cosmetic] Tool “read_featured” changed its title: Read the Featured spot
- [cosmetic] Tool “refresh_listing” changed its title: Refresh listing metadata
- [cosmetic] Tool “remove_free_listing” changed its title: Remove a free listing
- [cosmetic] Tool “set_tracking_params” changed its title: Set tracking params
- [cosmetic] Tool “submit_listing” changed its title: Submit a listing
- [cosmetic] Tool “upgrade_listing” changed its title: Upgrade a listing's tier
- [cosmetic] Tool “verify_badge” changed its title: Verify badge placement
- [cosmetic] Tool “x402_bid_featured” changed its title: Bid for Featured, paid in USDC
- [cosmetic] Tool “x402_submit_listing” changed its title: Submit a listing, paid in USDC

### 2026-10-29 (score 68, +1)

No change was recorded against any check on this day. Stability & Change Management went from 53 to 57. That category is still filling its 30-day observation window: 16 days of observed history at the previous scan, 17 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-28 (score 67, 0)

- [functional] New tool “set_tracking_params”

### 2026-10-27 (score 67, +1)

No change was recorded against any check on this day. Stability & Change Management went from 47 to 50. That category is still filling its 30-day observation window: 14 days of observed history at the previous scan, 15 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-25 (score 66, +1)

- [security] Tool “list_listings” rewrote its description, which is the text the model reads
- [functional] New tool “list_categories”
- [cosmetic] “list_listings” added an optional parameter “category”

## MCP tools (17)

### `bid_featured` (~100 tokens)

Bid for the Featured spot

Take the Featured spot. It sits above every listing. The minimum right now is $51. Always dofollow. One-time payment, no refund when someone outbids you. The product must already be listed. Omit amount_usd to bid $51.

Input parameters:

- `amount_usd` (number): Bid in USD. Omit to bid the minimum (51).
- `url` (string, required): URL of a listing that is already on the directory.

### `read_featured` (~21 tokens)

Read the Featured spot

Who holds the Featured spot, and the current minimum bid.

### `submit_listing` (~63 tokens)

Submit a listing

List a product. It goes live immediately. One listing per root domain. https://yourapp.com is the documentation placeholder and is refused.

Input parameters:

- `email` (string, required)
- `tier` (string): Omit for the free tier.
- `url` (string, required)

### `upgrade_listing` (~35 tokens)

Upgrade a listing's tier

Checkout URL for a paid tier on a listing that already exists.

Input parameters:

- `tier` (string, required)
- `url` (string, required)

### `refresh_listing` (~54 tokens)

Refresh listing metadata

Re-read title, description, and image from the listed page. Send listing_id and proof only. The first confirm previews; send apply back to save.

Input parameters:

- `listing_id` (integer, required)
- `proof` (string, required)

### `change_listing_url` (~57 tokens)

Change a listing's URL

Point an existing listing at a new URL. One listing per root domain, so this is how a second page replaces the first.

Input parameters:

- `listing_id` (integer, required)
- `proof` (string, required)
- `url` (string, required)

### `set_tracking_params` (~118 tokens)

Set tracking params

Set the tracking params on a paid listing's outbound link (Bronze and up). Keys: ref or utm_* (<=10, lowercase/digits/_); values: 1-100 of A-Z a-z 0-9 . _ ~ -. Send {} to clear back to ?ref=curlship. Free listings are refused.

Input parameters:

- `listing_id` (integer, required)
- `proof` (string, required)
- `tracking` (object, required): e.g. {"utm_source": "yours", "utm_medium": "referral"}

### `remove_free_listing` (~58 tokens)

Remove a free listing

Take a free listing off the directory. Send remove true and no url or email. A paid listing or the Featured holder is refused.

Input parameters:

- `listing_id` (integer, required)
- `proof` (string, required)
- `remove` (boolean, required)

### `confirm_edit` (~64 tokens)

Confirm an edit request

Apply an edit request. A refresh needs a second call with the apply digest from the preview.

Input parameters:

- `apply` (string): Digest from the refresh preview. Omit for a URL change or a removal.
- `request_id` (integer, required)
- `token` (string, required)

### `verify_badge` (~39 tokens)

Verify badge placement

Re-check the listed site for a link to curlship.com. A free listing with the badge becomes dofollow.

Input parameters:

- `url` (string, required)

### `list_categories` (~45 tokens)

List categories

The category tree with a listing count per category — a group slug like developer-tools, plus any promoted leaf categories under it. Each listing's category field carries one of these slugs.

### `list_listings` (~192 tokens)

List listings

Active listings as JSON. No query returns every listing, in the same order as before. Optional query parameters: limit, offset, q, since, and category. q matches the title, description, or URL. since is an ISO timestamp; listings created at or after it are kept. category is a category slug and filters to that group or leaf. Each listing includes created_at and a category object ({slug, name, group}) or null while the listing is unclassified.

Input parameters:

- `category` (string): A category slug — a group or a promoted leaf.
- `limit` (integer): Max listings. 50 with offset, 100 with q, when omitted.
- `offset` (integer): How many matching listings to skip.
- `q` (string): Substring of the title, description, or URL.
- `since` (string): ISO timestamp. Keep listings created at or after this moment.

### `get_stats` (~17 tokens)

Get directory stats

Listing counts and the Ahrefs Domain Rating.

### `get_daily_stats` (~82 tokens)

Get daily stats

Active listings added per UTC day — the zero-filled series behind the public /stats page. One entry per calendar day from the first listing to today, each with added and the cumulative running total.

Input parameters:

- `range` (string|integer): "all" (default) for the whole series, or a day count 1-3650 for the last N days.

### `get_dr_history` (~60 tokens)

Get Domain Rating history

The site's Ahrefs Domain Rating over time — the series behind /stats#dr. Every recorded reading, one per UTC day, plus the current value, the last step (change vs the most recent different reading) and the growth since the first reading.

### `x402_submit_listing` (~201 tokens)

Submit a listing, paid in USDC

Buy bronze_lifetime ($30 USDC once, forever) or platinum ($49 USDC per prepaid year) with USDC over x402 — settled on-chain, no checkout page, no human in the loop. Call without payment_signature and the reply is a 402 whose body (also the PAYMENT-REQUIRED header, base64) is the quote; sign accepts[0] as an EIP-3009 authorization and call again with payment_signature — the tier is granted in that same call. Same URL and listing rules as a free submission.

Input parameters:

- `email` (string, required)
- `payment_signature` (string): The PAYMENT-SIGNATURE header value: base64 JSON x402 v2 PaymentPayload — accepts[0] from the quote, signed and echoed back as `accepted`. Omit to get the quote back as a 402.
- `tier` (string, required): The only tiers x402 sells.
- `url` (string, required)

### `x402_bid_featured` (~195 tokens)

Bid for Featured, paid in USDC

Bid on the Featured spot in USDC over x402 — the same auction as a card bid (minimum $51 right now), but settled on-chain with no checkout and no human in the loop. Call without payment_signature for the 402 quote, sign accepts[0] as an EIP-3009 authorization, call again with payment_signature echoing it as `accepted`. The product must already be listed. Omit amount_usd to bid $51.

Input parameters:

- `amount_usd` (number): Bid in USD. Omit to bid the minimum (51).
- `payment_signature` (string): The PAYMENT-SIGNATURE header value: base64 JSON x402 v2 PaymentPayload — accepts[0] from the quote, signed and echoed back as `accepted`. Omit to get the quote back as a 402.
- `url` (string, required): URL of a listing that is already on the directory.

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/com-curlship-directory/curlship#diagnostics

## Score history

- 2026-11-04: 72
- 2026-11-03: 71
- 2026-11-02: 71
- 2026-11-01: 70
- 2026-10-31: 70
- 2026-10-30: 69
- 2026-10-29: 68
- 2026-10-28: 67
- 2026-10-27: 67
- 2026-10-26: 66
- 2026-10-25: 66
- 2026-10-24: 65
- 2026-10-23: 65
- 2026-10-22: 64
- 2026-10-21: 64
- 2026-10-20: 63
- 2026-10-19: 63
- 2026-10-18: 62
- 2026-10-17: 62
- 2026-10-16: 61
- 2026-10-15: 56
- 2026-10-14: 55
- 2026-10-13: 55
- 2026-10-12: 54

## Common questions

### What is the CurlShip MCP server?

CurlShip is an MCP server listed in the public MCP registry as com.curlship/directory. Read and submit the CurlShip directory. Paid actions return checkout_url. This page covers its hosted endpoint (https://curlship.com/mcp).

### Is the CurlShip MCP server safe to use?

CurlShip scores 72 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the CurlShip MCP server expose?

CurlShip exposes 17 tools: bid_featured, read_featured, submit_listing, upgrade_listing, refresh_listing, and 12 more. Their descriptions and schemas cost roughly 1,401 tokens of context every time the server is loaded.

### Does the CurlShip MCP server require authentication?

No. We connected to CurlShip without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

### Is the CurlShip MCP server still maintained?

CurlShip is still listed as active in the MCP registry. We last reached this channel on 4 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

## Links

- Remote endpoint: https://curlship.com/mcp
- Repository: https://github.com/MarcinDudekDev/curlship
- Changelog RSS feed: https://verifymcp.io/servers/com-curlship-directory/curlship.xml
- Changelog JSON feed: https://verifymcp.io/servers/com-curlship-directory/curlship.json
- HTML version of this page: https://verifymcp.io/servers/com-curlship-directory/curlship