# opointo (remote · opointo.com)

Design a React Native app in a browser and emit it as a real Expo project you own, iOS and Android.

- Trust score: 75/100 (medium)
- Change this week: +2
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-10-17

## Components

- remote · `opointo.com`: 75/100 (this document), [markdown](https://verifymcp.io/servers/com-opointo-opointo/api-mcp.md), [page](https://verifymcp.io/servers/com-opointo-opointo/api-mcp)

## Channel facts

- Endpoint: `https://opointo.com/api/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `0.2.1`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-10-17.

- **Endpoint Security**: 83/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - No authorisation is required to call this server. Every tool declares its destructiveHint and none is destructive, so open access doesn't expose one.
  - HTTPS is enforced; there's no plaintext access path.
  - The HSTS (Strict-Transport-Security) header is present.
  - DNSSEC is configured correctly; the domain's records validate against the full chain to the root.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 64/100
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 1780 tokens (~161/item across 11 items; 11 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 24/100
  - Stability check failed: schema churn in the 21 days we've observed: 6 tool removals, 1 breaking changes, 0 auth/transport breaks, 3 additions.
- **Tool Coverage**: 92/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 76% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 11 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 12 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a current MCP spec version (2026-07-28).

## Install

### How do I install the opointo MCP server?

opointo is a hosted endpoint at https://opointo.com/api/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http com-opointo-opointo 'https://opointo.com/api/mcp'
```

### Cursor

```json
{
  "mcpServers": {
    "com-opointo-opointo": {
      "url": "https://opointo.com/api/mcp"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "com-opointo-opointo": {
      "type": "http",
      "url": "https://opointo.com/api/mcp"
    }
  }
}
```

### Codex

```toml
[mcp_servers.com-opointo-opointo]
url = "https://opointo.com/api/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "com-opointo-opointo": {
      "type": "remote",
      "url": "https://opointo.com/api/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add com-opointo-opointo --url 'https://opointo.com/api/mcp' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  com-opointo-opointo:
    url: "https://opointo.com/api/mcp"
```

### Netclaw

```json
{
  "McpServers": {
    "com-opointo-opointo": {
      "Transport": "http",
      "Url": "https://opointo.com/api/mcp"
    }
  }
}
```

### Vellum

```bash
assistant mcp add com-opointo-opointo -t streamable-http -u 'https://opointo.com/api/mcp'
```

### Other

```json
{
  "mcpServers": {
    "com-opointo-opointo": {
      "type": "http",
      "url": "https://opointo.com/api/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-10-16 (score 75, 0)

- [security] The server rewrote its instructions, which are the text every model session reads
- [security] Tool “add_screen” rewrote its description, which is the text the model reads
- [security] Tool “emit_app” rewrote its description, which is the text the model reads
- [security] Tool “propose_app” rewrote its description, which is the text the model reads
- [security] Tool “propose_screen” rewrote its description, which is the text the model reads
- [cosmetic] “emit_app” reworded the description of “appId”

### 2026-10-15 (score 75, +1)

No change was recorded against any check on this day. Stability & Change Management went from 14 to 17.

### 2026-10-14 (score 74, 0)

- [security regression] A breaking change shipped without a version bump: still 0.3.0
- [security] Tool “propose_app” rewrote its description, which is the text the model reads
- [functional regression] “propose_app” changed the type of “format”: boolean → boolean|string
- [cosmetic] “propose_app” reworded the description of “app”

### 2026-10-13 (score 74, 0)

- [security] Tool “propose_app” rewrote its description, which is the text the model reads
- [security] Tool “propose_screen” rewrote its description, which is the text the model reads
- [functional regression] Tool coverage: 81% → 76%
- [cosmetic] “propose_app” added an optional parameter “into”
- [cosmetic] “propose_screen” added an optional parameter “into”

### 2026-10-12 (score 74, +1)

No change was recorded against any check on this day. Stability & Change Management went from 0 to 7.

### 2026-10-04 (score 73, 0)

- [security] The server rewrote its instructions, which are the text every model session reads
- [security] Tool “add_screen” rewrote its description, which is the text the model reads
- [security] Tool “emit_app” rewrote its description, which is the text the model reads
- [security] Tool “install_component” rewrote its description, which is the text the model reads
- [security] Tool “propose_app” rewrote its description, which is the text the model reads
- [security] Tool “propose_screen” rewrote its description, which is the text the model reads
- [functional] Schema quality: excellent → good
- [cosmetic] “update_components” added an optional parameter “page”
- [cosmetic] “emit_app” reworded the description of “appId”
- [cosmetic] “install_component” reworded the description of “slug”

### 2026-10-02 (score 73, −3)

- [security regression] Stability: 0.17 → fail
- [security regression] Tool “emit_screen” was removed
- [security regression] Tool “get_provider_tree” was removed
- [security regression] Tool “get_rules” was removed
- [security regression] Tool “get_step” was removed
- [security regression] Tool “get_theme_tokens” was removed
- [security regression] Tool “list_components” was removed
- [security] The server rewrote its instructions, which are the text every model session reads
- [security] Tool “add_screen” rewrote its description, which is the text the model reads
- [security] Tool “propose_app” rewrote its description, which is the text the model reads
- [security] Tool “check_snippet” rewrote its description, which is the text the model reads
- [security] Tool “emit_app” rewrote its description, which is the text the model reads
- [security] Tool “find_component” rewrote its description, which is the text the model reads
- [security] Tool “get_component” rewrote its description, which is the text the model reads
- [security] Tool “install_component” rewrote its description, which is the text the model reads
- [security] Tool “propose_screen” rewrote its description, which is the text the model reads
- [security] Tool “update_components” rewrote its description, which is the text the model reads
- [security] Tool “verify_app” rewrote its description, which is the text the model reads
- [functional regression] Tool coverage: 88% → 81%
- [functional regression] “add_screen” added a required parameter “appId”, so existing callers break
- [functional regression] “add_screen” dropped the required parameter “compositionId”
- [functional improvement] Schema quality: 2415 → 1721
- [functional] Server version: 0.2.1 → 0.3.0
- [functional] New tool “get_app_setup”
- [cosmetic] “add_screen” added an optional parameter “screen”
- [cosmetic] “emit_app” added an optional parameter “page”
- [cosmetic] “emit_app” added an optional parameter “step”
- [cosmetic] “find_component” added an optional parameter “category”
- [cosmetic] “get_component” added an optional parameter “platform”
- [cosmetic] “propose_app” added an optional parameter “format”
- [cosmetic] “propose_screen” added an optional parameter “format”
- [cosmetic] “add_screen” reworded the description of “componentName”
- [cosmetic] “add_screen” reworded the description of “manifest”
- [cosmetic] “add_screen” reworded the description of “tab”
- [cosmetic] “check_snippet” reworded the description of “code”
- [cosmetic] “emit_app” reworded the description of “appId”
- [cosmetic] “emit_app” reworded the description of “override”
- [cosmetic] “install_component” reworded the description of “slug”
- [cosmetic] “propose_app” reworded the description of “app”
- [cosmetic] “propose_screen” reworded the description of “composition”
- [cosmetic] “update_components” reworded the description of “acceptSplit”
- [cosmetic] “update_components” reworded the description of “current”
- [cosmetic] “update_components” reworded the description of “manifest”
- [cosmetic] “verify_app” reworded the description of “appId”
- [cosmetic] “verify_app” reworded the description of “dependencies”
- [cosmetic] “verify_app” reworded the description of “files”
- [cosmetic] “add_screen” made “manifest” optional
- [cosmetic] “find_component” made “need” optional
- [cosmetic] “propose_app” made “app” optional
- [cosmetic] “propose_screen” made “composition” optional
- [cosmetic] “verify_app” made “appId” optional
- [cosmetic] Tool “add_screen” changed its title: Add a screen to an exported app → Add a screen to an app
- [cosmetic] Tool “check_snippet” changed its title: Check a snippet for blank-render bugs → Check code for blank-render bugs
- [cosmetic] Tool “emit_app” changed its title: Emit an app → Build an app from a design
- [cosmetic] Tool “find_component” changed its title: Find a component for a UI need → Find a component
- [cosmetic] Tool “update_components” changed its title: Update exported components → Update supplied components

### 2026-10-01 (score 76, +1)

No change was recorded against any check on this day. Stability & Change Management went from 13 to 17. That category is still filling its 30-day observation window: 4 days of observed history at the previous scan, 5 at this one. The score rises as the window fills, whether or not the server changes.

## MCP tools (11)

### `find_component` (~87 tokens)

Find a component

Finds the component for a UI need described in plain words, ranked, and says when this catalog ships nothing on purpose because the phone's own control is the right choice. Omit `need` to list every component with its purpose and whether it renders the real system control.

Input parameters:

- `category` (string)
- `need` (string): e.g. "a progress bar for an upload"

### `get_component` (~85 tokens)

Get a component

Everything needed to write a correct call site for one component: props with types, defaults and allowed values, what draws on iOS and on Android, the providers it needs at the app root, its dependencies, and the runtime rules that stop it rendering blank.

Input parameters:

- `platform` (string): only the rules that hold there
- `slug` (string, required): e.g. "button"

### `check_snippet` (~79 tokens)

Check code for blank-render bugs

Scans TSX that uses these components for the mistakes that render nothing with no error: animated opacity on glass, the flex: 1 collapse, a clipped lens, a conditionally mounted surface. A read-only text scan, not a guarantee; verify_app checks a whole emitted project.

Input parameters:

- `code` (string, required): the TSX to check

### `get_app_setup` (~85 tokens)

Get the app setup

How an app is set up so these components work and follow its theme, one topic at a time: the app-root providers in the order that works, the theme hooks and token scales, or the rules that hold across the whole catalog. An app built by emit_app already has all three wired.

Input parameters:

- `platform` (string): rules only
- `topic` (string, required)

### `emit_app` (~173 tokens)

Build an app from a design

Needs a subscription. Turns a design from the Designer into a working Expo app: navigation, providers, tab bar, screens and the components they use. Returns a recipe for the current project: every file with its target path, one install line and ordered steps with a check each. Pass `step` for one step in full, which does not count against the daily allowance.

Input parameters:

- `appId` (string, required): the share code from the Designer's "Send app to agent", e.g. "34ca4babb2"
- `override` (boolean): emit even with screens flagged not ready; ask the customer first
- `page` (number): for step write or review; each page names the next
- `step` (string): a step id from the recipe, or "review" for the screen list

### `add_screen` (~165 tokens)

Add a screen to an app

Needs a subscription. Adds one screen designed in the Designer to a project. With the project's .opointo/files.json it returns the screen file, the route that mounts it and the one line to register it, and never rewrites existing files. Without it, a self-contained screen file for any Expo app.

Input parameters:

- `appId` (string, required): the share code from "Send app to agent"
- `componentName` (string): only to add a second copy of a screen; omit for the export's name
- `manifest` (object): the parsed .opointo/files.json
- `screen` (string): the new screen's name in that design
- `tab` (string): nest it in this tab's stack; omit to place it where the design does

### `install_component` (~106 tokens)

Install a component

Needs a subscription, except for the free foundation components. Adds one component to an existing project: the files it and its dependencies need in install order with exact target paths, the single expo install line, the providers it needs and its runtime rules. A backend recipe's id, such as "supabase", adds that integration: its files and the per-app wiring an export writes.

Input parameters:

- `slug` (string, required): e.g. "button", or a recipe id such as "supabase"

### `update_components` (~156 tokens)

Update supplied components

Needs a subscription. Reads the project's .opointo/files.json and returns only the opointo-supplied files that changed since export, so it works months later with no share code. Never touches the customer's own screens, and flags the rare change that needs a code edit rather than a copy.

Input parameters:

- `acceptSplit` (array): only once the customer agreed: the paths split-customer-edited blockers name
- `current` (array): only when a split-unverified blocker asks: each named file's hash, from its command
- `manifest` (object, required): the parsed .opointo/files.json (the object or its files array)
- `page` (number): only when the answer's page.next asks for it

### `verify_app` (~142 tokens)

Verify an emitted app

Needs a subscription. Checks an emitted app before it is built: missing files, altered verbatim files, absent packages, the expo-router config merge, whether the installed Xcode can build it, and whether a change needs a new native build.

Input parameters:

- `appId` (string): the share code given to emit_app; `appId` in .opointo/files.json
- `config` (object)
- `dependencies` (array): package.json dependencies' keys
- `files` (array, required): each file written, the hidden .opointo/files.json included: { path, bytes }, path from the project root
- `toolchain` (object)

### `propose_app` (~382 tokens)

Propose an app design

Your agent can design an app with you: send an app in opointo's design format (the AppSpec emit_app builds from) and get back a link that opens it in the Designer as a new, unsaved design. The person sees every screen, changes what they like, and hands it back for emit_app. into: the code in the person's line; it lands in their open design. dryRun checks without making a link; format: true returns the format and every block, "photos" the sample photos, or with app: { version: 1 } a short plan's.

Input parameters:

- `app` (object): The design: { name, tabs: [{ screenId, label }], screens: [{ id, name, composition: { screen: { content: { children: [node] }, chrome: { header?, headerItems?, floating: [] }, overlays: [] } } }], on…
- `dryRun` (boolean): check the design and report, without making a link
- `format` (boolean|string)
- `into` (string)

### `propose_screen` (~188 tokens)

Propose a screen design

Your agent can design a single screen with you: send one screen in opointo's design format (the Composition add_screen builds from) and get back a link that opens it in the Designer as a new, unsaved design the person can change. into: as propose_app's. dryRun checks without making a link; format: true returns the format. For a whole app, use propose_app.

Input parameters:

- `composition` (object): One screen: { name, screen: { content: { children: [node] }, chrome: { header?, headerItems?, floating: [] }, overlays: [] } }. A node is { id, slug, props }: slug is "wireframe:<block>" or a compone…
- `dryRun` (boolean): check the screen and report, without making a link
- `format` (boolean)
- `into` (string)

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/com-opointo-opointo/api-mcp#diagnostics

## Score history

- 2026-10-17: 75
- 2026-10-16: 75
- 2026-10-15: 75
- 2026-10-14: 74
- 2026-10-13: 74
- 2026-10-12: 74
- 2026-10-10: 73
- 2026-10-08: 73
- 2026-10-07: 73
- 2026-10-04: 73
- 2026-10-03: 73
- 2026-10-02: 73
- 2026-10-01: 76
- 2026-09-30: 75
- 2026-09-29: 75
- 2026-09-28: 75
- 2026-09-27: 66
- 2026-09-26: 66

## Common questions

### What is the opointo MCP server?

opointo is an MCP server listed in the public MCP registry as com.opointo/opointo. Design a React Native app in a browser and emit it as a real Expo project you own, iOS and Android. This page covers its hosted endpoint (https://opointo.com/api/mcp).

### Is the opointo MCP server safe to use?

opointo scores 75 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the opointo MCP server expose?

opointo exposes 11 tools: find_component, get_component, check_snippet, get_app_setup, emit_app, and 6 more. Their descriptions and schemas cost roughly 1,648 tokens of context every time the server is loaded.

### Does the opointo MCP server require authentication?

No. We connected to opointo without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

### Is the opointo MCP server still maintained?

opointo is still listed as active in the MCP registry. We last reached this channel on 17 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

## Links

- Remote endpoint: https://opointo.com/api/mcp
- Repository: https://github.com/opointoHQ/opointo-mcp
- Website: https://opointo.com/
- Changelog RSS feed: https://verifymcp.io/servers/com-opointo-opointo/api-mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/com-opointo-opointo/api-mcp.json
- HTML version of this page: https://verifymcp.io/servers/com-opointo-opointo/api-mcp