OnlyWorlds
REMOTE · WWW.ONLYWORLDS.COM · SCANNED AUG 3
Read and write typed fictional worlds (22 linked element types) via the OnlyWorlds open standard.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score →
Endpoint Security57
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation not fully verified: no authorisation is required to call this server, and 11 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe. See how to fix → View diagnostics → Unverified
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability66
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 2017 tokens (~183/item across 11 items; 11 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management27
- Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage71
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 0% of tool parameters carry a description.Fail
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.
remote · www.onlyworlds.com
claude mcp add --transport http com-onlyworlds-mcp https://www.onlyworlds.com/mcp
[mcp_servers.com-onlyworlds-mcp] url = "https://www.onlyworlds.com/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"com-onlyworlds-mcp": {
"type": "remote",
"url": "https://www.onlyworlds.com/mcp",
"enabled": true
}
}
} openclaw mcp add com-onlyworlds-mcp --url https://www.onlyworlds.com/mcp --transport streamable-http
mcp_servers:
com-onlyworlds-mcp:
url: "https://www.onlyworlds.com/mcp" {
"mcpServers": {
"com-onlyworlds-mcp": {
"type": "http",
"url": "https://www.onlyworlds.com/mcp"
}
}
} The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 2 Aug 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 20 to 23. That category is still filling its 30-day observation window: 6 days of observed history at the previous scan, 7 at this one. The score rises as the window fills, whether or not the server changes.
- 31 Jul 26 +2
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 30 Jul 26 +1
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 28 Jul 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.
- 27 Jul 26 +1
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 26 Jul 26 56
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 3 Aug 2026 · Probed https://www.onlyworlds.com/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=www.onlyworlds.com | CN=WE1,O=Google Trust Services,C=US | 11 Jul 2026 | 9 Oct 2026 | ECDSA 256 | ECDSA-SHA256 | ea273acb4d39fa2b0e0b75a2b5f506b3 |
| SANs: www.onlyworlds.com | ||||||
| CN=WE1,O=Google Trust Services,C=US (CA) | CN=GTS Root R4,O=Google Trust Services LLC,C=US | 13 Dec 2023 | 20 Feb 2029 | ECDSA 256 | ECDSA-SHA384 | 7ff31977972c224a76155d13b6d685e3 |
| CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) | CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE | 15 Nov 2023 | 28 Jan 2028 | ECDSA 384 | SHA256-RSA | 7fe530bf331343bedd821610493d8a1b |
DNSSEC insecure
Validation of www.onlyworlds.com. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| com. | present | 19718 | 13 | Verified |
| onlyworlds.com. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://www.onlyworlds.com/mcp | Verified | 200 | |
| http (plaintext) | http://www.onlyworlds.com/mcp | HTTPS enforced | 301 | https://www.onlyworlds.com/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.
bulk_apply ~254
Create and/or update many elements across any of the 22 types in one call. Each entry in `items` is `{"type": <slug>, "element": <payload>}` with the same payload shape `create_element` takes: an `element` with an `id` UPDATES that id (creating it if absent), an `element` without an `id` CREATES a new element. Items may reference each other by id, including a forward reference to a sibling later in the list. There is NO delete: bulk_apply never removes an element. When `atomic` is false (default), items succeed or fail independently and the response reports each outcome; when `atomic` is true, ANY item failure rolls the whole batch back and nothing is committed. Up to 1000 items. Requires a WRITE API-Key. Returns the batch response verbatim: `{errors, items: [{status, id, created_at, updated_at} | {status, id, error}, ...]}` — `errors` true means at least one item failed (and, under `atomic`, that nothing committed).
| Name | Type | Req | Description |
|---|---|---|---|
| atomic | boolean | — | — |
| items | array | yes | — |
Structured output declared, but exposes no named fields.
No examples provided.
create_element ~201
Create one new element of `type` in the world named by your API-Key header. `type` is a slug from `list_element_types` (e.g. "character"). `element` is the field payload: `name` plus any scalar, link, or extension fields for that type (call `get_element_schema(type)` for the field structure). Link fields are UUID arrays (multi) or a single UUID (single); every linked id must already exist in the world. Supply your own `id` (a UUID) to mint the element at that id, or omit `id` and the server mints a uuid7. Requires a WRITE API-Key. Returns the full created element in the v2 wire shape. Errors (naming the offending field) on an unknown field, a bad link target, or an id that already exists.
| Name | Type | Req | Description |
|---|---|---|---|
| element | object | yes | — |
| type | string | yes | — |
Structured output declared, but exposes no named fields.
No examples provided.
edit_links ~258
Add and/or remove links on ONE multi-link `field` of an element, leaving the rest of that field's array untouched. Use this for additive/subtractive link edits (unlike `update_element`, which REPLACES a link array). `type` is a slug from `list_element_types`; `id` is the element's UUID; `field` must be a multi-link field on that type (see `get_element_schema(type)`). `add` is a list of UUIDs to link (each must already exist in the world; adding an already-linked id is a no-op) and `remove` is a list of UUIDs to unlink (removing an absent id is tolerated). Requires a WRITE API-Key. Returns `{type, id, field, values}` where `values` is the field's full UUID array after the edit. Errors (naming `field`) if it is not a multi-link field of this type, if the element does not exist, or if an added target id is absent.
| Name | Type | Req | Description |
|---|---|---|---|
| add | — | — | — |
| field | string | yes | — |
| id | string | yes | — |
| remove | — | — | — |
| type | string | yes | — |
Structured output declared, but exposes no named fields.
No examples provided.
get_changes ~244
Return the delta feed for the world named by your API-Key header: every element created/updated (`op: "upsert"`, full body) or deleted (`op: "delete"`) since `since_cursor`, in apply order, in pages of `limit` (default 25, max 1000). Entries carry FULL element bodies — a default page stays inside any client's token budget; measured worlds ran ~1.5-2k chars PER ENTRY, so raise `limit` only if you truly need bigger pages, and prefer paging with the cursor. Omit `since_cursor` (or pass "") to start from the beginning of the feed — for a big world that is a multi-page walk, not one response. Pass the returned `cursor` back as `since_cursor` to get the next page (or, later, only what changed since); treat the cursor as OPAQUE. `has_more` true means page again with the new cursor. Requires a READ or WRITE API-Key. This mirrors `GET /api/v2/changes`.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | — | — |
| since_cursor | — | — | — |
Structured output declared, but exposes no named fields.
No examples provided.
get_element ~134
Fetch one element by `type` and `id` (a UUID) from the world named by your API-Key header. `type` is a slug from `list_element_types`. Returns the full v2 wire shape (the same body as `GET /api/v2/{type}/{id}`): `type`, `id`, `name`, scalar fields, link fields as UUID arrays, and any extension fields inline. Requires a READ or WRITE API-Key. Errors if no element of that type with that id exists in the world.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | — |
| type | string | yes | — |
Structured output declared, but exposes no named fields.
No examples provided.
get_element_schema ~154
Return the field structure of one OnlyWorlds element `type` (a slug from `list_element_types`, e.g. "character"). The result groups the type's writable fields by kind so a caller knows how to read and write them: `text` (strings), `integer`, `single_link` (one UUID), `multi_link` (an array of UUIDs), and `generic` (a type+id pair pointing at any element type). For every link field the target element type is given under `link_targets`. All link values are element UUIDs. Unauthenticated. Errors if `type` is not one of the 22 types.
| Name | Type | Req | Description |
|---|---|---|---|
| type | string | yes | — |
Structured output declared, but exposes no named fields.
No examples provided.
list_element_types ~109
List all 22 OnlyWorlds element types with a one-line shape summary of each. Every world is built from these types; each element has a stable UUID `id`, a `name`, and a `type`. Use `get_element_schema(type)` for a type's full field list. Unauthenticated — schema is public reference. Returns a mapping of the 22 type slugs (the value you pass as `type` to the data tools) to a summary string.
Input schema present but exposes no named parameters.
Structured output declared, but exposes no named fields.
No examples provided.
list_elements ~180
List elements of one `type` in the world named by your API-Key header, newest-created first. `type` is a slug from `list_element_types` (e.g. "character"). Optional `name_contains` filters by case-insensitive name substring; `supertype` filters exactly. `limit` (default 100, max 1000) and `offset` page the result. Requires a READ or WRITE API-Key. Returns `{data: [element, ...], limit, offset, has_more}` where each element is the full v2 wire shape and `id` is a UUID. Use `get_element(type, id)` for a single element.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | — | — |
| name_contains | — | — | — |
| offset | integer | — | — |
| supertype | — | — | — |
| type | string | yes | — |
Structured output declared, but exposes no named fields.
No examples provided.
search_elements ~120
Search elements by name across ALL 22 types in the world named by your API-Key header (case-insensitive substring match). Use this when you know part of a name but not the element's type. Bounded to at most 50 matches per type. Returns `{query, results: [{type, id, name, supertype, subtype}, ...]}` — `id` is a UUID; call `get_element(type, id)` for the full body. Requires a READ or WRITE API-Key.
| Name | Type | Req | Description |
|---|---|---|---|
| query | string | yes | — |
Structured output declared, but exposes no named fields.
No examples provided.
search_schema ~115
Search every element type's fields for `query` (case-insensitive substring), across all 22 types. Useful for "which types have a `location` field?" or finding where a concept lives in the schema. Returns a mapping of type slug -> the matching field names in that type (types with no match are omitted); a `query` that also matches a type slug lists that type with an empty field list so the type-name hit is not lost. Unauthenticated.
| Name | Type | Req | Description |
|---|---|---|---|
| query | string | yes | — |
Structured output declared, but exposes no named fields.
No examples provided.
update_element ~248
Update an existing element by `type` and `id`, changing ONLY the fields you pass — omitted fields are preserved. This is a server-side read-merge: the current element is loaded and only the keys in `fields` are applied, so it is safe against the raw-HTTP-PATCH hazard where sending a partial link array replaces the whole array. Semantics per field kind: a text field you pass is set (pass an empty string `""` to clear it); a multi-link field you pass REPLACES that field's array wholesale (pass an empty array `[]` to clear it) — for additive/subtractive link edits that leave the rest of the array intact, use `edit_links` instead. `type` is a slug from `list_element_types`; `id` is the element's UUID. Requires a WRITE API-Key. Returns the full updated element in the v2 wire shape. Errors if the element does not exist, or (naming the field) on an unknown field or a bad link target.
| Name | Type | Req | Description |
|---|---|---|---|
| fields | object | yes | — |
| id | string | yes | — |
| type | string | yes | — |
Structured output declared, but exposes no named fields.
No examples provided.