opointo
REMOTE · OPOINTO.COM
Design a React Native app in a browser and emit it as a real Expo project you own, iOS and Android.
Available components
Last scanned (10 hours ago)
Scores higher than 68% of remote servers
Reachable. Last reached 17 Oct 2026.
Category Developer Tools
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security83
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- No authorisation is required to call this server. Every tool declares its destructiveHint and none is destructive, so open access doesn't expose one. See how to fix → View diagnostics → Partial
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC is configured correctly; the domain's records validate against the full chain to the root. View diagnostics → Pass
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability64
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 1780 tokens (~161/item across 11 items; 11 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management24
- Stability check failed: schema churn in the 21 days we've observed: 6 tool removals, 1 breaking changes, 0 auth/transport breaks, 3 additions. See how to fix → Fail
Tool Coverage92
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 76% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 11 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 12 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 16 Oct 26 0
- The server rewrote its instructions, which are the text every model session reads security
- Tool “add_screen” rewrote its description, which is the text the model reads security
- Tool “emit_app” rewrote its description, which is the text the model reads security
- Tool “propose_app” rewrote its description, which is the text the model reads security
- Tool “propose_screen” rewrote its description, which is the text the model reads security
- “emit_app” reworded the description of “appId” cosmetic
- 15 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 14 to 17.
- 14 Oct 26 0
- A breaking change shipped without a version bump: still 0.3.0 ▼ security
- Tool “propose_app” rewrote its description, which is the text the model reads security
- “propose_app” changed the type of “format”: boolean → boolean|string ▼ functional
- “propose_app” reworded the description of “app” cosmetic
- 13 Oct 26 0
- Tool “propose_app” rewrote its description, which is the text the model reads security
- Tool “propose_screen” rewrote its description, which is the text the model reads security
- Tool coverage: 81% → 76% ▼ functional
- “propose_app” added an optional parameter “into” cosmetic
- “propose_screen” added an optional parameter “into” cosmetic
- 12 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 0 to 7.
- 4 Oct 26 0
- The server rewrote its instructions, which are the text every model session reads security
- Tool “add_screen” rewrote its description, which is the text the model reads security
- Tool “emit_app” rewrote its description, which is the text the model reads security
- Tool “install_component” rewrote its description, which is the text the model reads security
- Tool “propose_app” rewrote its description, which is the text the model reads security
- Tool “propose_screen” rewrote its description, which is the text the model reads security
- Schema quality: excellent → good functional
- “update_components” added an optional parameter “page” cosmetic
- “emit_app” reworded the description of “appId” cosmetic
- “install_component” reworded the description of “slug” cosmetic
- 2 Oct 26 −3
- Stability: 0.17 → fail ▼ security
- Tool “emit_screen” was removed ▼ security
- Tool “get_provider_tree” was removed ▼ security
- Tool “get_rules” was removed ▼ security
- Tool “get_step” was removed ▼ security
- Tool “get_theme_tokens” was removed ▼ security
- Tool “list_components” was removed ▼ security
- The server rewrote its instructions, which are the text every model session reads security
- Tool “add_screen” rewrote its description, which is the text the model reads security
- Tool “propose_app” rewrote its description, which is the text the model reads security
- Tool “check_snippet” rewrote its description, which is the text the model reads security
- Tool “emit_app” rewrote its description, which is the text the model reads security
- Tool “find_component” rewrote its description, which is the text the model reads security
- Tool “get_component” rewrote its description, which is the text the model reads security
- Tool “install_component” rewrote its description, which is the text the model reads security
- Tool “propose_screen” rewrote its description, which is the text the model reads security
- Tool “update_components” rewrote its description, which is the text the model reads security
- Tool “verify_app” rewrote its description, which is the text the model reads security
- Tool coverage: 88% → 81% ▼ functional
- “add_screen” added a required parameter “appId”, so existing callers break ▼ functional
- “add_screen” dropped the required parameter “compositionId” ▼ functional
- Schema quality: 2415 → 1721 ▲ functional
- Server version: 0.2.1 → 0.3.0 functional
- New tool “get_app_setup” functional
- “add_screen” added an optional parameter “screen” cosmetic
- “emit_app” added an optional parameter “page” cosmetic
- “emit_app” added an optional parameter “step” cosmetic
- “find_component” added an optional parameter “category” cosmetic
- “get_component” added an optional parameter “platform” cosmetic
- “propose_app” added an optional parameter “format” cosmetic
- “propose_screen” added an optional parameter “format” cosmetic
- “add_screen” reworded the description of “componentName” cosmetic
- “add_screen” reworded the description of “manifest” cosmetic
- “add_screen” reworded the description of “tab” cosmetic
- “check_snippet” reworded the description of “code” cosmetic
- “emit_app” reworded the description of “appId” cosmetic
- “emit_app” reworded the description of “override” cosmetic
- “install_component” reworded the description of “slug” cosmetic
- “propose_app” reworded the description of “app” cosmetic
- “propose_screen” reworded the description of “composition” cosmetic
- “update_components” reworded the description of “acceptSplit” cosmetic
- “update_components” reworded the description of “current” cosmetic
- “update_components” reworded the description of “manifest” cosmetic
- “verify_app” reworded the description of “appId” cosmetic
- “verify_app” reworded the description of “dependencies” cosmetic
- “verify_app” reworded the description of “files” cosmetic
- “add_screen” made “manifest” optional cosmetic
- “find_component” made “need” optional cosmetic
- “propose_app” made “app” optional cosmetic
- “propose_screen” made “composition” optional cosmetic
- “verify_app” made “appId” optional cosmetic
- Tool “add_screen” changed its title: Add a screen to an exported app → Add a screen to an app cosmetic
- Tool “check_snippet” changed its title: Check a snippet for blank-render bugs → Check code for blank-render bugs cosmetic
- Tool “emit_app” changed its title: Emit an app → Build an app from a design cosmetic
- Tool “find_component” changed its title: Find a component for a UI need → Find a component cosmetic
- Tool “update_components” changed its title: Update exported components → Update supplied components cosmetic
- 1 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 13 to 17. That category is still filling its 30-day observation window: 4 days of observed history at the previous scan, 5 at this one. The score rises as the window fills, whether or not the server changes.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 17 Oct 2026 · Probed https://opointo.com/api/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=opointo.com | CN=WE1,O=Google Trust Services,C=US | 4 Oct 2026 | 2 Jan 2027 | ECDSA 256 | ECDSA-SHA256 | 4ef261d4ba42f2210eb299e2c120946c |
| SANs: opointo.com, preview.opointo.com, *.preview.opointo.com | ||||||
| CN=WE1,O=Google Trust Services,C=US (CA) | CN=GTS Root R4,O=Google Trust Services LLC,C=US | 13 Dec 2023 | 20 Feb 2029 | ECDSA 256 | ECDSA-SHA384 | 7ff31977972c224a76155d13b6d685e3 |
| CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) | CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE | 15 Nov 2023 | 28 Jan 2028 | ECDSA 384 | SHA256-RSA | 7fe530bf331343bedd821610493d8a1b |
Background: What to check on a remote MCP endpoint →
DNSSEC secure
Validation of opointo.com. — Secure
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| com. | present | 19718 | 13 | Verified |
| opointo.com. | present | 2371 | 13 | Verified |
| opointo.com. | Verified address RRset verified with the apex keys |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
| Header | Value |
|---|---|
| strict-transport-security | max-age=15552000 |
| x-content-type-options | nosniff |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://opointo.com/api/mcp | Verified | 200 | |
| http (plaintext) | http://opointo.com/api/mcp | HTTPS enforced | 301 | https://opointo.com/api/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
add_screen Add a screen to an app ~165
Needs a subscription. Adds one screen designed in the Designer to a project. With the project's .opointo/files.json it returns the screen file, the route that mounts it and the one line to register it, and never rewrites existing files. Without it, a self-contained screen file for any Expo app.
| Name | Type | Req | Description |
|---|---|---|---|
| appId | string | yes | the share code from "Send app to agent" |
| componentName | string | – | only to add a second copy of a screen; omit for the export's name |
| manifest | object | – | the parsed .opointo/files.json |
| screen | string | – | the new screen's name in that design |
| tab | string | – | nest it in this tab's stack; omit to place it where the design does |
No output schema declared.
No examples provided.
check_snippet Check code for blank-render bugs ~79
Scans TSX that uses these components for the mistakes that render nothing with no error: animated opacity on glass, the flex: 1 collapse, a clipped lens, a conditionally mounted surface. A read-only text scan, not a guarantee; verify_app checks a whole emitted project.
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | yes | the TSX to check |
No output schema declared.
No examples provided.
emit_app Build an app from a design ~173
Needs a subscription. Turns a design from the Designer into a working Expo app: navigation, providers, tab bar, screens and the components they use. Returns a recipe for the current project: every file with its target path, one install line and ordered steps with a check each. Pass `step` for one step in full, which does not count against the daily allowance.
| Name | Type | Req | Description |
|---|---|---|---|
| appId | string | yes | the share code from the Designer's "Send app to agent", e.g. "34ca4babb2" |
| override | boolean | – | emit even with screens flagged not ready; ask the customer first |
| page | number | – | for step write or review; each page names the next |
| step | string | – | a step id from the recipe, or "review" for the screen list |
No output schema declared.
No examples provided.
find_component Find a component ~87
Finds the component for a UI need described in plain words, ranked, and says when this catalog ships nothing on purpose because the phone's own control is the right choice. Omit `need` to list every component with its purpose and whether it renders the real system control.
| Name | Type | Req | Description |
|---|---|---|---|
| category | string | – | – |
| need | string | – | e.g. "a progress bar for an upload" |
No output schema declared.
No examples provided.
get_app_setup Get the app setup ~85
How an app is set up so these components work and follow its theme, one topic at a time: the app-root providers in the order that works, the theme hooks and token scales, or the rules that hold across the whole catalog. An app built by emit_app already has all three wired.
| Name | Type | Req | Description |
|---|---|---|---|
| platform | string | – | rules only |
| topic | string | yes | – |
No output schema declared.
No examples provided.
get_component Get a component ~85
Everything needed to write a correct call site for one component: props with types, defaults and allowed values, what draws on iOS and on Android, the providers it needs at the app root, its dependencies, and the runtime rules that stop it rendering blank.
| Name | Type | Req | Description |
|---|---|---|---|
| platform | string | – | only the rules that hold there |
| slug | string | yes | e.g. "button" |
No output schema declared.
No examples provided.
install_component Install a component ~106
Needs a subscription, except for the free foundation components. Adds one component to an existing project: the files it and its dependencies need in install order with exact target paths, the single expo install line, the providers it needs and its runtime rules. A backend recipe's id, such as "supabase", adds that integration: its files and the per-app wiring an export writes.
| Name | Type | Req | Description |
|---|---|---|---|
| slug | string | yes | e.g. "button", or a recipe id such as "supabase" |
No output schema declared.
No examples provided.
propose_app Propose an app design ~382
Your agent can design an app with you: send an app in opointo's design format (the AppSpec emit_app builds from) and get back a link that opens it in the Designer as a new, unsaved design. The person sees every screen, changes what they like, and hands it back for emit_app. into: the code in the person's line; it lands in their open design. dryRun checks without making a link; format: true returns the format and every block, "photos" the sample photos, or with app: { version: 1 } a short plan's.
| Name | Type | Req | Description |
|---|---|---|---|
| app | object | – | The design: { name, tabs: [{ screenId, label }], screens: [{ id, name, composition: { screen: { content: { children: [node] }, chrome: { header?, headerItems?, floating: [] }, overlays: [] } } }], on… |
| dryRun | boolean | – | check the design and report, without making a link |
| format | boolean|string | – | – |
| into | string | – | – |
No output schema declared.
No examples provided.
propose_screen Propose a screen design ~188
Your agent can design a single screen with you: send one screen in opointo's design format (the Composition add_screen builds from) and get back a link that opens it in the Designer as a new, unsaved design the person can change. into: as propose_app's. dryRun checks without making a link; format: true returns the format. For a whole app, use propose_app.
| Name | Type | Req | Description |
|---|---|---|---|
| composition | object | – | One screen: { name, screen: { content: { children: [node] }, chrome: { header?, headerItems?, floating: [] }, overlays: [] } }. A node is { id, slug, props }: slug is "wireframe:<block>" or a compone… |
| dryRun | boolean | – | check the screen and report, without making a link |
| format | boolean | – | – |
| into | string | – | – |
No output schema declared.
No examples provided.
update_components Update supplied components ~156
Needs a subscription. Reads the project's .opointo/files.json and returns only the opointo-supplied files that changed since export, so it works months later with no share code. Never touches the customer's own screens, and flags the rare change that needs a code edit rather than a copy.
| Name | Type | Req | Description |
|---|---|---|---|
| acceptSplit | array | – | only once the customer agreed: the paths split-customer-edited blockers name |
| current | array | – | only when a split-unverified blocker asks: each named file's hash, from its command |
| manifest | object | yes | the parsed .opointo/files.json (the object or its files array) |
| page | number | – | only when the answer's page.next asks for it |
No output schema declared.
No examples provided.
verify_app Verify an emitted app ~142
Needs a subscription. Checks an emitted app before it is built: missing files, altered verbatim files, absent packages, the expo-router config merge, whether the installed Xcode can build it, and whether a change needs a new native build.
| Name | Type | Req | Description |
|---|---|---|---|
| appId | string | – | the share code given to emit_app; `appId` in .opointo/files.json |
| config | object | – | – |
| dependencies | array | – | package.json dependencies' keys |
| files | array | yes | each file written, the hidden .opointo/files.json included: { path, bytes }, path from the project root |
| toolchain | object | – | – |
No output schema declared.
No examples provided.
How do I install the opointo MCP server?
opointo is a hosted endpoint at https://opointo.com/api/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · opointo.com
claude mcp add --transport http com-opointo-opointo 'https://opointo.com/api/mcp'
What is the opointo MCP server?
opointo is an MCP server listed in the public MCP registry as com.opointo/opointo. Design a React Native app in a browser and emit it as a real Expo project you own, iOS and Android. This page covers its hosted endpoint (https://opointo.com/api/mcp).
Is the opointo MCP server safe to use?
opointo scores 75 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the opointo MCP server expose?
opointo exposes 11 tools: find_component, get_component, check_snippet, get_app_setup, emit_app, and 6 more. Their descriptions and schemas cost roughly 1,648 tokens of context every time the server is loaded.
Does the opointo MCP server require authentication?
No. We connected to opointo without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the opointo MCP server still maintained?
opointo is still listed as active in the MCP registry. We last reached this channel on 17 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.