recipebooq
REMOTE · RECIPEBOOQ.COM · SCANNED SEP 23
Design a React Native app in a browser and emit it as a real Expo project you own, iOS and Android.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security74
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- No authorisation is required to call this server. Every tool declares its destructiveHint and none is destructive, so open access doesn't expose one. See how to fix → View diagnostics → Partial
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability74
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 1689 tokens (~120/item across 14 items; 14 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management67
- Stability observed for 20 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage94
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 83% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 14 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 15 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
How do I install the recipebooq MCP server?
recipebooq is a hosted endpoint at https://recipebooq.com/api/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · recipebooq.com
claude mcp add --transport http com-recipebooq-recipebooq 'https://recipebooq.com/api/mcp'
{
"mcpServers": {
"com-recipebooq-recipebooq": {
"url": "https://recipebooq.com/api/mcp"
}
}
} {
"servers": {
"com-recipebooq-recipebooq": {
"type": "http",
"url": "https://recipebooq.com/api/mcp"
}
}
} [mcp_servers.com-recipebooq-recipebooq] url = "https://recipebooq.com/api/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"com-recipebooq-recipebooq": {
"type": "remote",
"url": "https://recipebooq.com/api/mcp",
"enabled": true
}
}
} openclaw mcp add com-recipebooq-recipebooq --url 'https://recipebooq.com/api/mcp' --transport streamable-http
mcp_servers:
com-recipebooq-recipebooq:
url: "https://recipebooq.com/api/mcp" {
"McpServers": {
"com-recipebooq-recipebooq": {
"Transport": "http",
"Url": "https://recipebooq.com/api/mcp"
}
}
} assistant mcp add com-recipebooq-recipebooq -t streamable-http -u 'https://recipebooq.com/api/mcp'
{
"mcpServers": {
"com-recipebooq-recipebooq": {
"type": "http",
"url": "https://recipebooq.com/api/mcp"
}
}
} The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 23 Sept 26 0
- Tool “emit_app” rewrote its description, which is the text the model reads security
- Tool “emit_screen” rewrote its description, which is the text the model reads security
- Tool “verify_app” rewrote its description, which is the text the model reads security
- “verify_app” added an optional parameter “toolchain” cosmetic
- “add_screen” reworded the description of “compositionId” cosmetic
- “install_component” reworded the description of “slug” cosmetic
- 22 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 60 to 63. That category is still filling its 30-day observation window: 18 days of observed history at the previous scan, 19 at this one. The score rises as the window fills, whether or not the server changes.
- 20 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 53 to 57. That category is still filling its 30-day observation window: 16 days of observed history at the previous scan, 17 at this one. The score rises as the window fills, whether or not the server changes.
- 18 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 47 to 50. That category is still filling its 30-day observation window: 14 days of observed history at the previous scan, 15 at this one. The score rises as the window fills, whether or not the server changes.
- 16 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 40 to 43. That category is still filling its 30-day observation window: 12 days of observed history at the previous scan, 13 at this one. The score rises as the window fills, whether or not the server changes.
- 15 Sept 26 +6
- Authorization: unverified → partial ▲ security
- The server rewrote its instructions, which are the text every model session reads security
- Tool “add_screen” rewrote its description, which is the text the model reads security
- Tool “check_snippet” rewrote its description, which is the text the model reads security
- Tool “emit_app” rewrote its description, which is the text the model reads security
- Tool “emit_screen” rewrote its description, which is the text the model reads security
- Tool “find_component” rewrote its description, which is the text the model reads security
- Tool “get_component” rewrote its description, which is the text the model reads security
- Tool “get_provider_tree” rewrote its description, which is the text the model reads security
- Tool “get_rules” rewrote its description, which is the text the model reads security
- Tool “get_step” rewrote its description, which is the text the model reads security
- Tool “get_theme_tokens” rewrote its description, which is the text the model reads security
- Tool “install_component” rewrote its description, which is the text the model reads security
- Tool “list_components” rewrote its description, which is the text the model reads security
- Tool “update_components” rewrote its description, which is the text the model reads security
- Tool “verify_app” rewrote its description, which is the text the model reads security
- Server version: 0.1.0 → 0.2.0 functional
- Tool “add_screen” changed its title: Add a screen to an exported app cosmetic
- Tool “check_snippet” changed its title: Check a snippet for blank-render bugs cosmetic
- Tool “emit_app” changed its title: Emit an app cosmetic
- Tool “emit_screen” changed its title: Emit a single screen cosmetic
- Tool “find_component” changed its title: Find a component for a UI need cosmetic
- Tool “get_component” changed its title: Get a component cosmetic
- Tool “get_provider_tree” changed its title: Get the provider tree cosmetic
- Tool “get_rules” changed its title: Get runtime rules cosmetic
- Tool “get_step” changed its title: Expand a recipe step cosmetic
- Tool “get_theme_tokens” changed its title: Get theme tokens cosmetic
- Tool “install_component” changed its title: Install a component cosmetic
- Tool “list_components” changed its title: List components cosmetic
- Tool “update_components” changed its title: Update exported components cosmetic
- Tool “verify_app” changed its title: Verify an emitted app cosmetic
- 14 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 33 to 37. That category is still filling its 30-day observation window: 10 days of observed history at the previous scan, 11 at this one. The score rises as the window fills, whether or not the server changes.
- 12 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 27 to 30. That category is still filling its 30-day observation window: 8 days of observed history at the previous scan, 9 at this one. The score rises as the window fills, whether or not the server changes.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 23 Sept 2026 · Probed https://recipebooq.com/api/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=recipebooq.com | CN=WE1,O=Google Trust Services,C=US | 28 Jul 2026 | 26 Oct 2026 | ECDSA 256 | ECDSA-SHA256 | cdafe1013bb9e7e20e046e275462139f |
| SANs: recipebooq.com, *.recipebooq.com | ||||||
| CN=WE1,O=Google Trust Services,C=US (CA) | CN=GTS Root R4,O=Google Trust Services LLC,C=US | 13 Dec 2023 | 20 Feb 2029 | ECDSA 256 | ECDSA-SHA384 | 7ff31977972c224a76155d13b6d685e3 |
| CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) | CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE | 15 Nov 2023 | 28 Jan 2028 | ECDSA 384 | SHA256-RSA | 7fe530bf331343bedd821610493d8a1b |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of recipebooq.com. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| com. | present | 19718 | 13 | Verified |
| recipebooq.com. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://recipebooq.com/api/mcp | Verified | 200 | |
| http (plaintext) | http://recipebooq.com/api/mcp | HTTPS enforced | 301 | https://recipebooq.com/api/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
add_screen Add a screen to an exported app ~195
PAID. Adds one new screen to an app that was already exported: the screen file, the route that mounts it, the exact line to register it, and how to navigate to it. Reads the .recipebooq/files.json manifest to work out the route tree and never reads or rewrites existing source, so the one edit to an existing file comes back as a line to add rather than a file to overwrite.
| Name | Type | Req | Description |
|---|---|---|---|
| componentName | string | – | React component name, e.g. "InvoiceDetail". Defaults to GeneratedScreen. |
| compositionId | string | yes | share code for the new screen, from the App Builder |
| manifest | object | yes | the parsed .recipebooq/files.json from the project root |
| tab | string | – | nest it in this tab's stack so the tab bar stays visible. Omit to put it at the root, where it covers the tab bar (right for a modal). |
No output schema declared.
No examples provided.
check_snippet Check a snippet for blank-render bugs ~75
Takes TSX that uses these components and returns the glass-safety problems in it: animated opacity, the flex:1 collapse, the clipped lens, the conditional mount. Read-only, it never touches the repo. A heuristic text scan, not a structural guarantee.
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | yes | the TSX snippet to check |
No output schema declared.
No examples provided.
emit_app Emit an app ~157
PAID. Turns a recipebooq canvas into a working Expo app: navigation, providers, tab bar, screens and the components they need. Returns a recipe to apply to the current project: the exact files with target paths, the dependency install line, and ordered steps. Files marked `skeleton` or `component` are hand-written and device-verified, and verify_app reports any that were changed. Needs the share code from the App Builder's "Send app to agent" button.
| Name | Type | Req | Description |
|---|---|---|---|
| appId | string | yes | the share code, e.g. "34ca4babb2" |
| override | boolean | – | emit even when screens are flagged as not ready. Ask the customer first; the flags exist for a reason. |
No output schema declared.
No examples provided.
emit_screen Emit a single screen ~127
PAID. Turns one composed screen into a TSX file for an app that already exists, with its own navigator and routes. Returns the complete file inline, the components to install first, and how to mount it. For a whole app with navigation and a tab bar, emit_app is the matching tool. Needs the share code from the App Builder.
| Name | Type | Req | Description |
|---|---|---|---|
| componentName | string | – | React component name for the file, e.g. "CheckoutScreen". Defaults to GeneratedScreen. |
| compositionId | string | yes | the share code, e.g. "34ca4babb2" |
No output schema declared.
No examples provided.
find_component Find a component for a UI need ~69
Takes a UI need in plain language and returns ranked components, including an explicit answer when this catalog deliberately does not ship something and the OS's own control is the right choice. Useful before building a UI control by hand.
| Name | Type | Req | Description |
|---|---|---|---|
| need | string | yes | e.g. "a progress bar for an upload" |
No output schema declared.
No examples provided.
get_component Get a component ~76
Everything needed to write a correct call site for one component: props with types, defaults and value domains, platform applicability, dependencies, and the runtime rules that apply to it. The rules matter as much as the props: correct props that break a rule still render a blank screen.
| Name | Type | Req | Description |
|---|---|---|---|
| slug | string | yes | e.g. "button" |
No output schema declared.
No examples provided.
get_provider_tree Get the provider tree ~62
The exact app-root provider nesting these components require, in the order that works. Getting it wrong fails at runtime, not at compile time. Pass the components in use to see which providers each one needs.
| Name | Type | Req | Description |
|---|---|---|---|
| components | array | – | optional slugs in use |
No output schema declared.
No examples provided.
get_rules Get runtime rules ~71
The runtime rules for this catalog: the mistakes that make native Liquid Glass render blank with no warning, no error and no red box. Pass a slug to scope them to one component. Relevant before writing animation or layout code around a glass component.
| Name | Type | Req | Description |
|---|---|---|---|
| slug | string | – | optional — omit for catalog-wide rules |
No output schema declared.
No examples provided.
get_step Expand a recipe step ~117
FREE. Expands one step of an emit_app recipe: the full instruction, why it matters, how to know it worked, and what to do when it did not. emit_app returns steps in short form to stay inside the response budget, so this carries the detail for any step that needs it. Needs the same share code and the step's id.
| Name | Type | Req | Description |
|---|---|---|---|
| appId | string | yes | the share code you passed to emit_app |
| stepId | string | yes | the step id, e.g. "configure" or "write" |
No output schema declared.
No examples provided.
get_theme_tokens Get theme tokens ~41
The theme system: which hooks to call, and the spacing, radius and typography scales. Token names rather than hex values are what let a retheme propagate.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
install_component Install a component ~121
PAID. Adds one component to an existing project. Returns the transitive registry closure in dependency-first install order, the single `expo install` line for the whole closure, every file with its exact target path, the provider nesting it needs, and its runtime rules. It replaces fetching /r/*.json by hand: a component is a closure, not a file, and the ways to get that wrong all fail silently. Foundation components need no licence key.
| Name | Type | Req | Description |
|---|---|---|---|
| slug | string | yes | the component slug, e.g. "button" or "bottom-sheet" |
No output schema declared.
No examples provided.
list_components List components ~67
Lists the shipped @recipebooq/ui components: slug, purpose, category, and which render the real iOS system control versus our own component. Cheap, and a good first call. Optional filters: category and tech.
| Name | Type | Req | Description |
|---|---|---|---|
| category | string | – | – |
| tech | string | – | – |
No output schema declared.
No examples provided.
update_components Update exported components ~134
PAID. Reports what has changed in the recipebooq-supplied files since export and returns only what moved. Reads the .recipebooq/files.json the export wrote into the project, so no share code is needed and it works months later. Never touches the customer's own screens, and flags the rare change that needs a code edit rather than a re-copy. This is how the components and app shell we supplied stay current as iOS and Android move.
| Name | Type | Req | Description |
|---|---|---|---|
| manifest | object | yes | the parsed contents of .recipebooq/files.json from the project root (the whole object, or just its `files` array) |
No output schema declared.
No examples provided.
verify_app Verify an emitted app ~221
PAID. Checks that an emitted app was applied correctly, before it is built. Takes what was written (file paths with byte sizes, package.json dependencies, project config, build toolchain) and returns what is missing, which copy-verbatim files were altered, which packages are absent, whether the config merge expo-router needs was done, and whether the installed Xcode can build this project at all. Catches the ways a long recipe goes wrong, each of which fails silently or points somewhere else.
| Name | Type | Req | Description |
|---|---|---|---|
| appId | string | yes | the share code you passed to emit_app |
| config | object | – | – |
| dependencies | array | – | the keys of package.json's dependencies |
| files | array | yes | what you actually wrote: { path, bytes } per file, path relative to the project root. `bytes` must be the file's size in BYTES on disk (what `wc -c` reports), not its character count — the two differ… |
| toolchain | object | – | – |
No output schema declared.
No examples provided.
What is the recipebooq MCP server?
recipebooq is an MCP server listed in the public MCP registry as com.recipebooq/recipebooq. Design a React Native app in a browser and emit it as a real Expo project you own, iOS and Android. This page covers its hosted endpoint (https://recipebooq.com/api/mcp).
Is the recipebooq MCP server safe to use?
recipebooq scores 80 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the recipebooq MCP server expose?
recipebooq exposes 14 tools: list_components, get_component, find_component, get_rules, get_provider_tree, and 9 more. Their descriptions and schemas cost roughly 1,533 tokens of context every time the server is loaded.
Does the recipebooq MCP server require authentication?
No. We connected to recipebooq without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the recipebooq MCP server still maintained?
recipebooq is still listed as active in the MCP registry. We last reached this channel on 23 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.