# OneOver (remote · api.oneover.com)

Chat, image, video, and audio models from many vendors behind one remote MCP server and one key.

- Trust score: 81/100 (high trust)
- Change this week: +3
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

## Components

- remote · `api.oneover.com`: 81/100 (this document), [markdown](https://verifymcp.io/servers/com-oneover-mcp/functions-v1-mcp.md), [page](https://verifymcp.io/servers/com-oneover-mcp/functions-v1-mcp)

## Channel facts

- Endpoint: `https://api.oneover.com/functions/v1/mcp`
- Transports: `streamable-http`
- Auth: `required`
- Version: `2.0.0`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Endpoint Security**: 94/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation is enforced on tool calls, advertised via RFC 9728 protected-resource metadata. Discovery is public, which costs nothing: no tool can be invoked without a token.
  - HTTPS is enforced; there's no plaintext access path.
  - The HSTS (Strict-Transport-Security) header is present.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
  - The authorisation server offers only Dynamic Client Registration (RFC 7591), which MCP 2026-07-28 deprecated in favour of Client ID Metadata Documents.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 60/100
  - 71% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (fair).
  - Tool/resource definitions use about 944 tokens (~39/item across 24 items; 18 tools + 6 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 47/100
  - Stability check failed: schema churn in the 16 days we've observed: 1 tool removals, 0 breaking changes, 0 auth/transport breaks, 0 additions.
- **Tool Coverage**: 72/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 17% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - All 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.
  - An AI judge read all 19 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.
  - Supports UI / widget rendering.

## Install

### How do I install the OneOver MCP server?

OneOver is a hosted endpoint at https://api.oneover.com/functions/v1/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http com-oneover-mcp 'https://api.oneover.com/functions/v1/mcp'
```

### Cursor

```json
{
  "mcpServers": {
    "com-oneover-mcp": {
      "url": "https://api.oneover.com/functions/v1/mcp"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "com-oneover-mcp": {
      "type": "http",
      "url": "https://api.oneover.com/functions/v1/mcp"
    }
  }
}
```

### Codex

```toml
[mcp_servers.com-oneover-mcp]
url = "https://api.oneover.com/functions/v1/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "com-oneover-mcp": {
      "type": "remote",
      "url": "https://api.oneover.com/functions/v1/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add com-oneover-mcp --url 'https://api.oneover.com/functions/v1/mcp' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  com-oneover-mcp:
    url: "https://api.oneover.com/functions/v1/mcp"
```

### Netclaw

```json
{
  "McpServers": {
    "com-oneover-mcp": {
      "Transport": "http",
      "Url": "https://api.oneover.com/functions/v1/mcp"
    }
  }
}
```

### Vellum

```bash
assistant mcp add com-oneover-mcp -t streamable-http -u 'https://api.oneover.com/functions/v1/mcp'
```

### Other

```json
{
  "mcpServers": {
    "com-oneover-mcp": {
      "type": "http",
      "url": "https://api.oneover.com/functions/v1/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-05 (score 81, +1)

No change was recorded against any check on this day. Stability & Change Management went from 44 to 47.

### 2026-11-03 (score 80, +1)

No change was recorded against any check on this day. Stability & Change Management went from 37 to 41.

### 2026-10-31 (score 79, +1)

No change was recorded against any check on this day. Stability & Change Management went from 27 to 31.

### 2026-10-29 (score 78, +1)

No change was recorded against any check on this day. Stability & Change Management went from 21 to 24.

### 2026-10-27 (score 77, +1)

No change was recorded against any check on this day. Stability & Change Management went from 14 to 17.

### 2026-10-25 (score 76, +1)

No change was recorded against any check on this day. Stability & Change Management went from 7 to 11.

### 2026-10-23 (score 75, +1)

No change was recorded against any check on this day. Stability & Change Management went from 1 to 4.

### 2026-10-21 (score 74, +3)

- [security regression] Stability: unverified → fail
- [security regression] A breaking change shipped without a version bump: still 2.0.0
- [security regression] Tool “create_topup” was removed
- [security improvement] Authorization: fail → pass
- [security] First check of Authorization: partial
- [security] Tool “build_publish” is now declared destructive
- [security] Tool “build_stop” is now declared destructive
- [functional improvement] MCP protocol: fail → pass
- [functional] MCP protocol version: 2025-03-26 → 2025-11-25
- [cosmetic] Tool “build_publish” changed its title: Publish a build to an unlisted link → Publish a build

## MCP tools (18)

### `chat` (~46 tokens)

Chat with a model

Stateless chat completion across any text model in your org catalog.

Input parameters:

- `max_tokens` (number)
- `messages` (array, required): Conversation turns
- `model` (string, required): Text model ID

### `generate_image` (~55 tokens)

Generate an image

Generate an image from a text prompt.

Input parameters:

- `aspect_ratio` (string)
- `model` (string, required)
- `negative_prompt` (string)
- `prompt` (string, required)
- `resolution_tier` (string)

### `generate_video` (~99 tokens)

Generate a video

Submit an async video generation job. Returns request_id. If a video card is shown it updates itself and you do not need to poll. Otherwise poll with check_video.

Input parameters:

- `aspect_ratio` (string)
- `duration` (number)
- `generate_audio` (boolean)
- `model` (string, required)
- `prompt` (string)
- `reference_image` (string): Base64-encoded image
- `resolution` (string)

### `check_video` (~52 tokens)

Check video job status

Poll a video job until complete or failed. Shows text only. Do not call it repeatedly while a video card is on screen, because that card updates itself.

Input parameters:

- `request_id` (string, required): UUID from generate_video

### `generate_audio` (~51 tokens)

Generate speech or music

Generate speech or music audio.

Input parameters:

- `audio_kind` (string)
- `duration_seconds` (number)
- `model` (string, required)
- `prompt` (string, required)
- `voice` (string)

### `list_models` (~22 tokens)

List available models

List models visible to your organization.

Input parameters:

- `type` (string)

### `get_usage` (~37 tokens)

Get credit balance and usage

Get org credit balance or usage reporting.

Input parameters:

- `days` (number)
- `limit` (number)
- `view` (string)

### `run_app` (~46 tokens)

Run a OneOver app

Run a Play app (upscale, transform, etc.) against a prompt.

Input parameters:

- `app_id` (string, required)
- `model` (string)
- `prompt` (string, required)

### `list_assets` (~21 tokens)

List library assets

List API-generated library assets.

Input parameters:

- `limit` (number)

### `create_run` (~57 tokens)

Start a durable run

Start a durable OneOver run. It keeps going after the client disconnects. Poll with get_run.

Input parameters:

- `background` (boolean)
- `input` (object)
- `modality` (string)
- `model` (string)

### `get_run` (~34 tokens)

Read a run

Read a durable run and the events after a cursor.

Input parameters:

- `after` (number)
- `run_id` (string, required)

### `get_job` (~25 tokens)

Check a generation job

Poll a unified generation job by request_id.

Input parameters:

- `request_id` (string, required)

### `build_create` (~106 tokens)

Start a Code Studio build

Start a Code Studio build: describe a page or small web app and OneOver writes the files. Returns build_id and build_project_id right away; the build keeps running. If a build card is shown it updates itself. Otherwise poll with build_status. The finished page is saved to the account library.

Input parameters:

- `model` (string): Optional model id. Defaults to build-default.
- `prompt` (string, required): What to build
- `title` (string): Optional name for the project

### `build_iterate` (~54 tokens)

Iterate on a Code Studio build

Send a follow-up instruction to an existing build. Only one build can run on a project at a time.

Input parameters:

- `build_project_id` (string, required)
- `model` (string)
- `prompt` (string, required)

### `build_status` (~44 tokens)

Check a build

State of a build: running, complete, failed or stopped, plus file list, credits charged, and the share link once published.

Input parameters:

- `build_project_id` (string, required)

### `build_get_files` (~39 tokens)

Read build files

Read the files of a build. Pass path to read one file.

Input parameters:

- `build_project_id` (string, required)
- `path` (string)

### `build_stop` (~41 tokens)

Stop a build

Stop a running build. Files already written are kept. Safe to call twice.

Input parameters:

- `build_id` (string, required): build_id from build_create or build_iterate

### `build_publish` (~39 tokens)

Publish a build

Publish a build to an unlisted share link at oneover.com/p/<slug>. Needs an HTML file.

Input parameters:

- `build_project_id` (string, required)

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/com-oneover-mcp/functions-v1-mcp#diagnostics

## Score history

- 2026-11-05: 81
- 2026-11-04: 80
- 2026-11-03: 80
- 2026-11-02: 79
- 2026-11-01: 79
- 2026-10-31: 79
- 2026-10-30: 78
- 2026-10-29: 78
- 2026-10-28: 77
- 2026-10-27: 77
- 2026-10-26: 76
- 2026-10-25: 76
- 2026-10-24: 75
- 2026-10-23: 75
- 2026-10-22: 74
- 2026-10-21: 74
- 2026-10-20: 71

## Common questions

### What is the OneOver MCP server?

OneOver is an MCP server listed in the public MCP registry as com.oneover/mcp. Chat, image, video, and audio models from many vendors behind one remote MCP server and one key. This page covers its hosted endpoint (https://api.oneover.com/functions/v1/mcp).

### Is the OneOver MCP server safe to use?

OneOver scores 81 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the OneOver MCP server expose?

OneOver exposes 18 tools: chat, generate_image, generate_video, check_video, generate_audio, and 13 more. Their descriptions and schemas cost roughly 868 tokens of context every time the server is loaded.

### Does the OneOver MCP server require authentication?

Yes. OneOver asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.

### Is the OneOver MCP server still maintained?

OneOver is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What did VerifyMCP test on the OneOver MCP server?

VerifyMCP ran 14 checks on OneOver, covering TLS certificate, Authorization, HTTPS, HSTS header and 10 more. Supply Chain Security and Provenance & Transparency do not apply to a hosted endpoint, so they were not tested. The score does not measure everything, and the scoring documentation lists what it leaves out.

## Links

- Remote endpoint: https://api.oneover.com/functions/v1/mcp
- Authorisation metadata: https://api.oneover.com/.well-known/oauth-protected-resource/functions/v1/mcp
- Website: https://oneover.com/developers/mcp
- Changelog RSS feed: https://verifymcp.io/servers/com-oneover-mcp/functions-v1-mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/com-oneover-mcp/functions-v1-mcp/changelog.json
- Trust report (JSON): https://verifymcp.io/servers/com-oneover-mcp/functions-v1-mcp.json
- HTML version of this page: https://verifymcp.io/servers/com-oneover-mcp/functions-v1-mcp