Grabblist
REMOTE · MCP.GRABBITAPP.COM
Save and organize web finds in persistent, user-controlled collections for AI assistants.
Available components
Last scanned (3 hours ago)
Scores higher than 97% of remote servers
Reachable. Last reached 17 Oct 2026.
Category E-commerce
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security94
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation is enforced on tool calls, advertised via RFC 9728 protected-resource metadata. Discovery is public, which costs nothing: no tool can be invoked without a token. View diagnostics → Pass
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
- The authorisation server offers only Dynamic Client Registration (RFC 7591), which MCP 2026-07-28 deprecated in favour of Client ID Metadata Documents. View diagnostics → Partial
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability74
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 3124 tokens (~142/item across 22 items; 22 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management91
- Stability check failed: schema churn in the 30 days we've observed: 1 tool removals, 2 breaking changes, 0 auth/transport breaks, 0 additions. See how to fix → Fail
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 5 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 23 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities40
- Spec-recency check failed: implements MCP spec 2025-03-26; the latest is 2026-07-28. See how to fix → Fail
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 4 Oct 26 −2
- Stability: pass → fail ▼ security
- A breaking change shipped without a version bump: still 2.1.0 ▼ security
- Tool “ask_agent” was removed ▼ security
- The server rewrote its instructions, which are the text every model session reads security
- Tool “add_item” rewrote its description, which is the text the model reads security
- Tool “send_feedback” rewrote its description, which is the text the model reads security
- Tool “remove_from_collection” is now declared destructive security
- Tool “send_feedback” is now declared destructive security
- Tool “set_pinned_items” is now declared destructive security
- Tool “update_collection” is now declared destructive security
- Tool “update_item” is now declared destructive security
- Tool “update_price” is now declared destructive security
- “add_item” changed the type of “image”: object → string ▼ functional
- “add_item” changed the type of “url”: object → string ▼ functional
- “update_item” changed the type of “image_url”: object → string ▼ functional
- “add_item” reworded the description of “currency” cosmetic
- “add_item” reworded the description of “item_type” cosmetic
- “add_item” reworded the description of “price” cosmetic
- “add_item” made “currency” optional cosmetic
- “add_item” made “price” optional cosmetic
- 28 Sept 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 25 Sept 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 12 Sept 26 0
- Stability: 0.97 → pass security
- 26 Aug 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 14 Aug 26 0
- Stability: unverified → 0.03 ▲ functional
- 13 Aug 26 0
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 17 Oct 2026 · Probed https://mcp.grabbitapp.com/api/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=grabbitapp.com | CN=WE1,O=Google Trust Services,C=US | 2 Oct 2026 | 31 Dec 2026 | ECDSA 256 | ECDSA-SHA256 | eb9dd30482b6595e13f92fa7b7eb508c |
| SANs: grabbitapp.com, *.grabbitapp.com | ||||||
| CN=WE1,O=Google Trust Services,C=US (CA) | CN=GTS Root R4,O=Google Trust Services LLC,C=US | 13 Dec 2023 | 20 Feb 2029 | ECDSA 256 | ECDSA-SHA384 | 7ff31977972c224a76155d13b6d685e3 |
| CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) | CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE | 15 Nov 2023 | 28 Jan 2028 | ECDSA 384 | SHA256-RSA | 7fe530bf331343bedd821610493d8a1b |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of mcp.grabbitapp.com. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| com. | present | 19718 | 13 | Verified |
| grabbitapp.com. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication Enforced and verified
The endpoint asked for a token and published valid RFC 9728 metadata describing how to get one.
| Result | Enforced and verified |
|---|---|
| Enforced | On tool calls |
| HTTP status | 200 |
WWW-Authenticate challenge Bearer resource_metadata="https://mcp.grabbitapp.com/.well-known/oauth-protected-resource"
Bearer resource_metadata="https://mcp.grabbitapp.com/.well-known/oauth-protected-resource"| Header | Value |
|---|---|
| strict-transport-security | max-age=31536000; includeSubDomains; preload |
| x-content-type-options | nosniff |
| x-frame-options | DENY |
| referrer-policy | strict-origin-when-cross-origin |
| permissions-policy | camera=(), microphone=(), geolocation=() |
Protected resource metadata
| Document | https://mcp.grabbitapp.com/.well-known/oauth-protected-resource |
|---|---|
| Retrieved | Yes |
| Resource | https://mcp.grabbitapp.com/api/mcp |
| Authorisation server | https://grabbitapp.com |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://mcp.grabbitapp.com/api/mcp | Verified | 200 | |
| http (plaintext) | http://mcp.grabbitapp.com/api/mcp | HTTPS enforced | 301 | https://mcp.grabbitapp.com/api/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
add_item ~517
Save an item to the user's Grabblist. Creates a static snapshot — Grabblist does not monitor prices or auto-update data. Only include fields with values available from the source. Price is optional: omit it for videos and other things without a price. If no image is provided, the server attempts to fetch og:image automatically.
| Name | Type | Req | Description |
|---|---|---|---|
| attributes | object | – | Specs/details as key-value pairs |
| category | string | – | Category — pick the best match |
| condition | string | – | Condition if applicable: New, Used, Refurbished, Used - Like New, Used - Good, Used - Fair |
| currency | string | – | Currency code of the price: USD, NZD, AUD, EUR, GBP, etc. Omit when there is no price. |
| description | string | – | Description from the page (max 2000 chars) |
| image | string | – | Main image URL. Server auto-fetches og:image if not provided. |
| images | array | – | All image URLs found on the page |
| item_type | string | – | What kind of item: product (buy), rental (Airbnb), service (cleaning), course (Udemy), listing (classified), event (ticket), video (YouTube, Twitch, TikTok, Vimeo…). If omitted, the server infers it… |
| location | string | – | Seller location or pickup location |
| original_price | number | – | Original price before discount (if on sale) |
| platform | string | yes | Site domain name without TLD: amazon.com→"amazon", ebay.co.nz→"ebay", kiwiquads.co.nz→"kiwiquads" |
| posted_at | string | – | When the listing was originally posted (ISO 8601) |
| price | number | – | Price as a number (e.g. 99.99), taken from the page. Omit when the item has no price (videos, free content). |
| quantity | integer | – | How many of this item |
| reason | string | – | Why this change was made (shown to user in change history) |
| seller_name | string | – | Seller or store name |
| seller_rating | number | – | Seller rating 0-5 |
| seller_reviews | integer | – | Number of seller reviews |
| tags | array | – | Tags for categorization |
| title | string | yes | Exact title from the page |
| url | string | yes | Direct public HTTP(S) page URL. |
No output schema declared.
No examples provided.
add_to_collection ~69
Add a saved item to a collection. Both the item and collection must already exist.
| Name | Type | Req | Description |
|---|---|---|---|
| collection_id | string | yes | The collection ID |
| item_id | string | yes | The item ID to add |
| reason | string | – | Why this change was made (shown to user in change history) |
No output schema declared.
No examples provided.
create_collection ~229
Create a new collection (folder) in the user's Grabblist to organize saved items.
| Name | Type | Req | Description |
|---|---|---|---|
| budget | number | – | Total spending target for this collection (e.g. 1500 for "Build PC under $1500") |
| budget_currency | string | – | Currency for the budget (default: NZD) |
| color | string | – | Hex color for the collection (e.g. "#3B82F6", "#22C55E", "#A855F7", "#EC4899", "#F59E0B", "#EF4444"). Default: #3B82F6 |
| description | string | – | Short description of what this collection is for |
| icon | string | – | Material Symbols icon name (e.g. "devices", "home", "shopping_bag", "checkroom", "directions_car", "favorite"). Default: inventory_2 |
| name | string | yes | Collection name, e.g. "Gaming Setup" or "Gift Ideas" |
| reason | string | – | Why this change was made (shown to user in change history) |
No output schema declared.
No examples provided.
delete_collection ~59
Permanently delete a collection. Items inside are not deleted — they stay in the Grabblist.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | The collection ID to delete |
| reason | string | – | Why this change was made (shown to user in change history) |
No output schema declared.
No examples provided.
delete_item ~69
Remove one or more items from the user's Grabblist (soft-delete). Pass a single id or an array of ids for batch operations.
| Name | Type | Req | Description |
|---|---|---|---|
| id | – | yes | Item ID or array of item IDs to delete |
| reason | string | – | Why this change was made (shown to user in change history) |
No output schema declared.
No examples provided.
get_collection_activity ~50
Get recent activity on a collection — additions, removals, edits.
| Name | Type | Req | Description |
|---|---|---|---|
| collection_id | string | yes | The collection ID |
| limit | number | – | Max events to return (default: 20) |
No output schema declared.
No examples provided.
get_item ~39
Get full details of a saved item by ID. Returns a static snapshot from the user's Grabblist.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | The item ID |
No output schema declared.
No examples provided.
get_item_graph ~50
Get all relations for an item — alternatives, complements, upgrades, duplicates. Returns the item and all connected items with their relation types.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | The item ID to get relations for |
No output schema declared.
No examples provided.
get_item_history ~51
Get the change history for a saved item — who changed what and when.
| Name | Type | Req | Description |
|---|---|---|---|
| item_id | string | yes | The item ID |
| limit | number | – | Max events to return (default: 20) |
No output schema declared.
No examples provided.
get_wishlist ~82
Get all saved items from the user's Grabblist. Each item is a static snapshot — data reflects the moment it was saved, not current prices.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | number | – | Max items to return (default: 50) |
| platform | string | – | Filter by platform (domain name, e.g. "amazon", "ebay", "trademe") |
No output schema declared.
No examples provided.
link_items ~144
Create typed relations between items: alternative (A or B), complement (A and B together), upgrade (B replaces A), duplicate (same item different site), same_seller. Supports single pair (from_id, to_id, relation) or bulk (pairs array).
| Name | Type | Req | Description |
|---|---|---|---|
| from_id | string | – | First item ID (for single pair mode) |
| pairs | array | – | Array of pairs to link (for bulk mode) |
| reason | string | – | Why this change was made (shown to user in change history) |
| relation | string | – | Type of relationship (for single pair mode) |
| to_id | string | – | Second item ID (for single pair mode) |
No output schema declared.
No examples provided.
list_collections ~221
List all collections OR get a specific collection with its items. Without id: returns all collections with counts/values. With id: returns that collection's metadata and all items inside (with optional filters).
| Name | Type | Req | Description |
|---|---|---|---|
| created_by | string | – | Filter by who added: "ai" for AI-added items (only when id is provided) |
| id | string | – | Collection ID — if provided, returns that collection with all its items. If omitted, lists all collections. |
| max_price | number | – | Maximum price filter (only when id is provided) |
| min_price | number | – | Minimum price filter (only when id is provided) |
| platform | string | – | Filter by platform domain name, e.g. "amazon", "ebay" (only when id is provided) |
| sort | string | – | Sort order (only when id is provided, default: newest) |
| status | string | – | Filter by decision status (only when id is provided) |
| tags | array | – | Filter items that have ALL these tags (only when id is provided) |
No output schema declared.
No examples provided.
ping ~18
Test connectivity to Grabblist and return service version.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
remove_from_collection ~91
Remove one or more items from a collection. Pass a single item_id or an array of item_ids for batch removal. Items are NOT deleted — they stay in the Grabblist.
| Name | Type | Req | Description |
|---|---|---|---|
| collection_id | string | yes | The collection ID |
| item_ids | – | yes | Item ID or array of item IDs to remove |
| reason | string | – | Why this change was made (shown to user in change history) |
No output schema declared.
No examples provided.
restore_item ~71
Restore one or more deleted (archived) items back to the Grabblist. Pass a single id or an array of ids for batch restore.
| Name | Type | Req | Description |
|---|---|---|---|
| id | – | yes | Item ID or array of item IDs to restore |
| reason | string | – | Why this change was made (shown to user in change history) |
No output schema declared.
No examples provided.
search_saved ~40
Search within the user's saved items by keyword
| Name | Type | Req | Description |
|---|---|---|---|
| limit | number | – | Max results (default: 20) |
| query | string | yes | Search query |
No output schema declared.
No examples provided.
send_feedback ~176
Send feedback, a bug report or a feature request to the Grabblist team. Only call this when the user asks to report something, or agrees after you offer to report a problem (parsing failure, broken URL, missing feature); show them the message first. Be specific about what went wrong and where.
| Name | Type | Req | Description |
|---|---|---|---|
| error | string | – | Error message you received, if any |
| message | string | yes | What happened or what you propose. Be specific — the team reads this. |
| tool | string | – | The tool you were using when the issue occurred (e.g. add_item, search_saved) |
| type | string | yes | Type: bug (something broken), parsing_failure (price/title/image not extracted), feature_request (wishlist), feedback (general feedback) |
| url | string | – | The URL where the issue occurred |
No output schema declared.
No examples provided.
set_pinned_items ~86
Set the pinned "Top Picks" items for a collection (max 3). Pinned items are highlighted on the share page.
| Name | Type | Req | Description |
|---|---|---|---|
| collection_id | string | yes | The collection ID |
| item_ids | array | yes | Items to pin, in display order (1st = top) |
| reason | string | – | Why this change was made (shown to user in change history) |
No output schema declared.
No examples provided.
unlink_items ~68
Remove a relation between two items.
| Name | Type | Req | Description |
|---|---|---|---|
| from_id | string | yes | First item ID |
| reason | string | – | Why this change was made (shown to user in change history) |
| relation | string | yes | The relation type to remove |
| to_id | string | yes | Second item ID |
No output schema declared.
No examples provided.
update_collection ~204
Update a collection's name, icon, description, budget, or sharing status. Only provide the fields you want to change — omitted fields stay unchanged. Set is_public=true to share (returns public URL), is_public=false to unshare.
| Name | Type | Req | Description |
|---|---|---|---|
| budget | number | – | New budget amount |
| budget_currency | string | – | New budget currency |
| color | string | – | Hex color (e.g. "#3B82F6", "#22C55E", "#EF4444") |
| description | string | – | New description |
| icon | string | – | Material Symbols icon name (e.g. "devices", "home", "shopping_bag") |
| id | string | yes | The collection ID to update |
| is_public | boolean | – | Set true to share (generates public URL), false to unshare |
| name | string | – | New collection name |
| reason | string | – | Why this change was made (shown to user in change history) |
No output schema declared.
No examples provided.
update_item ~275
Edit fields on one or more saved items. Pass a single id or an array of ids for batch updates (same fields applied to all). For batch: attributes are REPLACED not merged, og:image fallback is skipped.
| Name | Type | Req | Description |
|---|---|---|---|
| attributes | object | – | Merge into existing attributes |
| category | string | – | Item category |
| description | string | – | Item description (max 2000 chars) |
| id | – | yes | Item ID or array of item IDs to update |
| image_url | string | – | Main image URL |
| images | array | – | All image URLs — replaces the entire images array |
| is_favorite | boolean | – | Set true to favorite, false to unfavorite |
| item_type | string | – | What kind of item this is |
| notes | string | – | User or AI notes — personal comments, thoughts, comparisons |
| quantity | integer | – | How many of this item |
| reason | string | – | Why this change was made (shown to user in change history) |
| status | string | – | Decision status: considering, shortlisted, decided, bought, rejected |
| tags | array | – | Replace all tags with this list |
| target_price | number | – | What the user wants to pay — not the actual price, but the goal price |
| title | string | – | Item title |
No output schema declared.
No examples provided.
update_price ~86
Manually update the price on a saved item. Records old and new price for comparison. This is a manual correction, not automatic price tracking.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | The item ID |
| price | number | yes | New current price |
| reason | string | – | Why this change was made (shown to user in change history) |
| source | string | – | Price update source |
No output schema declared.
No examples provided.
How do I install the Grabblist MCP server?
Grabblist is a hosted endpoint at https://mcp.grabbitapp.com/api/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · mcp.grabbitapp.com
claude mcp add --transport http com-grabbitapp-grabblist 'https://mcp.grabbitapp.com/api/mcp'
What is the Grabblist MCP server?
Grabblist is an MCP server listed in the public MCP registry as com.grabbitapp/grabblist. Save and organize web finds in persistent, user-controlled collections for AI assistants. This page covers its hosted endpoint (https://mcp.grabbitapp.com/api/mcp).
Is the Grabblist MCP server safe to use?
Grabblist scores 89 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Grabblist MCP server expose?
Grabblist exposes 22 tools: ping, get_wishlist, get_item, add_item, delete_item, and 17 more. Their descriptions and schemas cost roughly 2,695 tokens of context every time the server is loaded.
Does the Grabblist MCP server require authentication?
Yes. Grabblist asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.
Is the Grabblist MCP server still maintained?
Grabblist is still listed as active in the MCP registry. We last reached this channel on 17 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.