# Provision Stack (remote · api.provision-stack.com)

Outcome-based infrastructure for agents — verified AWS deployments, metered billing

- Trust score: 59/100 (low)
- Change this week: +3
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- remote · `api.provision-stack.com`: 59/100 (this document), [markdown](https://verifymcp.io/servers/com-provision-stack-provision-stack/api.md), [page](https://verifymcp.io/servers/com-provision-stack-provision-stack/api)

## Channel facts

- Endpoint: `https://api.provision-stack.com/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `0.5.0`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Endpoint Security**: 11/100
  - TLS not yet verified: we couldn't open a connection to check the certificate.
  - Authorisation not yet verified: we couldn't confirm whether this endpoint requires it.
  - HTTPS is enforced; there's no plaintext access path.
  - HSTS not yet verified: we couldn't read the response headers to check for it.
  - DNSSEC not yet verified: we couldn't validate it against a resolver.
- **Transport & Reachability**: 0/100
  - Transport check failed: declared streamable-http, but we couldn't connect to verify it.
- **Schema Quality & AI Usability**: 0/100
  - Schema not yet verified: we couldn't read the endpoint's schema.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 0/100
  - Tool coverage not yet verified: we couldn't read the endpoint's tools.
- **Capabilities**: 0/100
  - Capabilities not yet verified: we couldn't read the endpoint's capabilities.

**Unverified: 4 categories.** Categories scored 0 because we could not verify them: authentication we do not have, an unreachable endpoint, or not enough scan history. We only credit what we can confirm.

## Install

### Claude

```bash
claude mcp add --transport http com-provision-stack-provision-stack https://api.provision-stack.com/mcp
```

### Codex

```toml
[mcp_servers.com-provision-stack-provision-stack]
url = "https://api.provision-stack.com/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "com-provision-stack-provision-stack": {
      "type": "remote",
      "url": "https://api.provision-stack.com/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add com-provision-stack-provision-stack --url https://api.provision-stack.com/mcp --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  com-provision-stack-provision-stack:
    url: "https://api.provision-stack.com/mcp"
```

### Other

```json
{
  "mcpServers": {
    "com-provision-stack-provision-stack": {
      "type": "http",
      "url": "https://api.provision-stack.com/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-02 (score 59, 0)

- [security regression] Endpoint reachability: reachable → unreachable
- [security regression] TLS certificate: pass → unverified
- [security regression] DNSSEC: fail → unverified
- [security regression] Authorization: fail → unverified
- [security regression] HSTS header: fail → unverified
- [security regression] Stability: 0.20 → unverified
- [security regression] Transport: pass → fail
- [functional regression] Capabilities: pass → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional] First check of Schema quality: unverified

### 2026-07-31 (score 59, +1)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 58, +1)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-29 (score 57, +1)

No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-07-27 (score 56, +1)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-26 (score 55)

First indexed and scored.

## MCP tools (12)

### `suggestions.generate` (~220 tokens)

START HERE for any deployment. STEP 1: Call region.detect or providers.detect. STEP 2: Call this tool with the detected region. Returns Starter/MVP/Startup/Enterprise options with monthly costs. When the response includes a clarificationRequest, answer the suggested questions and call again with requirements. Present all options and wait for an explicit choice before deploy.run. When the outcome mentions a custom domain (e.g. 'deploy to api.example.com') and CLOUDFLARE_API_TOKEN is set, DNS records are auto-detected and will be created during deployment.

Input parameters:

- `crossProvider` (boolean): Include cross-provider suggestions (default: true)
- `maxMonthlyCostUsd` (number): Customer max monthly cost cap in USD — options above the cap are filtered out
- `outcome` (string, required): Natural language description of the desired outcome
- `provider` (string): Filter to specific cloud provider
- `region` (string): Cloud provider region
- `requirements` (object): Requirements to rank patterns — use this when responding to a clarificationRequest

Output parameters:

- `clarificationRequest` (object)
- `infraType` (string)
- `optionCount` (number): Number of suggestion options returned
- `options` (array)
- `outcome` (string)
- `providers` (array): Providers covered by the options
- `resultId` (string)

### `pricing.get` (~365 tokens)

Estimate monthly and hourly USD cost for one cloud resource type (e.g. ec2_instance, rds_instance, gcp_cloud_run) without provisioning anything. Use after suggestions.generate when the user wants a component-level breakdown for a single resource; prefer region from region.detect. Provider is inferred from resourceType prefixes (gcp_*, azure_*, oracle_*) when omitted. Do not use for full-stack option comparison — that is suggestions.generate. Does not create resources or hold credits.

Input parameters:

- `instanceCount` (number): Number of instances to price (default 1)
- `instanceType` (string): AWS instance type (e.g. t3.micro) for compute/RDS
- `machineType` (string): GCP machine type (e.g. e2-medium)
- `memoryInGbs` (number): Oracle memory in GiB for flexible shapes
- `ocpus` (number): Oracle OCPU count for flexible shapes
- `provider` (string): Cloud provider (auto-detected from resourceType if omitted)
- `region` (string): Cloud region; defaults via region.detect for the provider
- `resourceType` (string, required): Cloud resource type to price (prefix gcp_/azure_/oracle_ selects provider)
- `shape` (string): Oracle compute shape (e.g. VM.Standard.E4.Flex)
- `sizeGb` (number): Disk/volume size in GiB (EBS, etc.)
- `storageGb` (number): Object/database storage size in GiB
- `vmSize` (string): Azure VM size (e.g. Standard_B1s)
- `volumeType` (string): Volume type (e.g. gp3, io2)
- `zone` (string): GCP/Azure availability zone when required

Output parameters:

- `components` (array)
- `description` (string)
- `estimateId` (string)
- `hourlyCostUsd` (number)
- `monthlyCostUsd` (number)
- `provider` (string)
- `region` (string)
- `resourceType` (string)

### `credentials.list` (~65 tokens)

Check cloud provider credential configuration without exposing secrets. Call before deploy.run to confirm AWS/GCP/Azure/Oracle/Cloudflare are ready. Returns configured=true/false plus guidance — never returns secret values.

Input parameters:

- `provider` (string): Cloud provider to check (defaults to checking all)

Output parameters:

- `aws` (object)
- `azure`
- `cloudflare`
- `gcp`
- `oracle`

### `region.detect` (~90 tokens)

Resolve the active region for one cloud provider from env/config, or a documented default when unset. Call before suggestions.generate/deploy.run when targeting a single provider so pricing and placement match local config. Prefer providers.detect instead when comparing AWS/GCP/Azure/Oracle in one step. Read-only; does not change cloud config.

Input parameters:

- `provider` (string): Cloud provider to detect region for (defaults to aws)

Output parameters:

- `message` (string): Human-readable detection summary
- `provider` (string): Cloud provider id
- `region` (string): Detected or default region
- `source` (string): Where the region value came from

### `providers.detect` (~58 tokens)

Detect all configured cloud providers and their regions in one call. Prefer this over repeated region.detect when comparing AWS/GCP/Azure/Oracle. Returns { providers: [...] } with source (env|config|default) and a guidance message per provider.

Output parameters:

- `providers` (array): Detected region for each supported cloud provider

### `deploy.run` (~229 tokens)

Provision the explicitly selected suggestion through the Execution API. Never call before presenting options and receiving user approval. Pass resources from the chosen suggestions.generate option as selection evidence. The deploy fee is held from the account credit balance and captured only after verification passes (failed deployments are free). On HTTP 402, call billing.top_up and retry. When the outcome includes a custom domain and CLOUDFLARE_API_TOKEN is set, DNS records are automatically created pointing the domain at the deployed endpoint. After accept, poll deploy.status.

Input parameters:

- `maxMonthlyCostUsd` (number): Customer max monthly cost cap in USD — deploy is rejected when the estimate exceeds the cap
- `outcome` (string, required): Natural language deployment objective
- `projectId` (string): Optional project id to group related deployments
- `provider` (string): Cloud provider (auto-detected from resources if omitted)
- `region` (string): Target region; defaults via region.detect for provider
- `resources` (array, required): Resources from the selected suggestion; used as selection evidence
- `tier` (string): Selected suggestion tier; defaults to MVP

Output parameters:

- `category` (string)
- `createdAt` (string)
- `deploymentId` (string)
- `message` (string)
- `provider` (string)
- `quote` (object)
- `region` (string)
- `status` (string)
- `tier` (string)

### `deploy.status` (~64 tokens)

Check deployment progress and retrieve verification evidence when complete. Poll after deploy.run until status is verified/failed/destroyed. On success, result.endpoints and result.verificationResults contain live URLs and check outcomes.

Input parameters:

- `deploymentId` (string, required): Deployment id returned by deploy.run

Output parameters:

- `agentId` (string)
- `category` (string)
- `createdAt` (string)
- `deploymentId` (string)
- `desiredOutcome` (string)
- `projectId` (string)
- `result` (object)
- `status` (string)
- `updatedAt` (string)

### `deploy.destroy` (~84 tokens)

DESTRUCTIVE: permanently destroy all cloud resources owned by a deployment. Irreversible — confirm the deploymentId with the user first. Prefer deploy.teardown_latest only when intentionally removing the newest active deployment. Optional reason is stored for audit.

Input parameters:

- `deploymentId` (string, required): Deployment id whose resources should be destroyed
- `reason` (string): Optional audit reason for the destroy

Output parameters:

- `deploymentId` (string)
- `destroyedAt` (string)
- `status` (string)

### `deploy.list` (~100 tokens)

Return the Execution API’s tracked deployments (deploymentId, status, category, createdAt) so you can select a target for status checks or teardown. Call when you need a deploymentId and do not already have one from deploy.run, or to inventory active work before deploy.destroy/deploy.teardown_latest. Do not use this to monitor a known deployment — poll deploy.status with that id instead. Read-only; does not create, modify, or destroy resources.

Output parameters:

- `count` (number): Number of deployments returned
- `deployments` (array)

### `deploy.teardown_latest` (~81 tokens)

DESTRUCTIVE: destroy the newest active deployment, or all active deployments when all=true. Skips already destroyed/failed entries. Confirm with the user before calling — especially with all=true. Prefer deploy.destroy with an explicit deploymentId when targeting a specific deployment.

Input parameters:

- `all` (boolean): When true, destroy every active deployment; otherwise only the newest

Output parameters:

- `destroyed` (number): How many deployments were destroyed
- `results` (array)

### `billing.balance` (~87 tokens)

Return the account credit position as total, held, and available USD without modifying the balance. Call when deploy.run returns HTTP 402 insufficient_credits, or before deploy.run when you need to confirm availableUsd covers the hold. Do not use this to add funds — call billing.top_up when availableUsd is insufficient, then retry deploy.run. Read-only; does not create charges or hold credits.

Output parameters:

- `accountId` (string)
- `availableUsd` (number)
- `balanceUsd` (number)
- `heldUsd` (number)

### `billing.top_up` (~159 tokens)

Create a credit top-up intent for the account (does not immediately increase balance). Call when deploy.run fails with HTTP 402 or billing.balance shows availableUsd below the required hold; choose rail=xrp (agent pays on-ledger with REQUIRED destination tag + exact amount) or rail=stripe (human Checkout URL). Do not call to inspect balance — use billing.balance. After funds confirm, retry the failed deploy.run. Side effects: opens a payment/deposit flow (open world); not idempotent — each call creates a new top-up.

Input parameters:

- `amountUsd` (number, required): Amount to add, in USD (e.g. 20)
- `rail` (string): Payment rail: xrp (agent-native) or stripe (human)

Output parameters:

- `amountUsd` (number)
- `amountXrp` (number)
- `checkoutUrl` (string)
- `creditedOn` (string)
- `depositAddress` (string)
- `destinationTag` (number)
- `expiresAt` (string)
- `memo` (string)
- `rateUsdPerXrp` (number)
- `topupId` (string)

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/com-provision-stack-provision-stack/api#diagnostics

## Score history

- 2026-08-03: 59
- 2026-08-02: 59
- 2026-08-01: 59
- 2026-07-31: 59
- 2026-07-30: 58
- 2026-07-29: 57
- 2026-07-28: 56
- 2026-07-27: 56
- 2026-07-26: 55

## Links

- Remote endpoint: https://api.provision-stack.com/mcp
- Repository: https://github.com/TravisLinkey/provision-stack
- Website: https://provision-stack.com/
- Changelog RSS feed: https://verifymcp.io/servers/com-provision-stack-provision-stack/api/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/com-provision-stack-provision-stack/api/changelog.json
- HTML version of this page: https://verifymcp.io/servers/com-provision-stack-provision-stack/api