Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

ReelQuoteAI Survey Tool

REMOTE · WIDGET.REELQUOTEAI.COM

Filmed moving surveys, itemized inventories, firm quotes and bookings for moving companies.

0 this week 87 Trust /100

Last scanned (7 hours ago)

Scores higher than 94% of remote servers

Reachable. Last reached 7 Nov 2026.

Category CRM and Sales

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →

Endpoint Security80
  • The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
  • No authorisation is required to call this server. Nothing on it is marked destructive, but we can't show that an anonymous caller can only read: full credit needs the server to list at least one tool and every tool to be verifiably read-only. We use a best-effort check of tool names and descriptions to tell read-only tools from tools that change things, so some genuinely read-only tools may not get full credit. Names that start with a read verb (get, list, read, search and similar) and accurate readOnlyHint annotations help. Meet that to earn full credit, or require authorisation. See how to fix → View diagnostics → Partial
  • HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
  • The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
  • DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
Schema Quality & AI Usability85
  • 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
  • AI-judged instruction clarity (good).Pass
  • Context-footprint check failed: tool/resource definitions use about 3622 tokens (~103/item across 35 items; 33 tools + 2 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
  • No destabilizing schema changes in the last 30 days.Pass
Tool Coverage94
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 83% of tool parameters carry a description.Partial
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • All 3 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
  • An AI judge read all 35 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities60
  • Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28. See how to fix → Fail
What we tested

Checks we ran (13)

  • TLS certificate
  • Authorization
  • HTTPS
  • HSTS header
  • DNSSEC
  • Transport
  • Schema quality
  • Stability
  • Tool coverage
  • Injection markers
  • Destructive annotations
  • Judged manipulation
  • MCP protocol

Does not apply to this hosted endpoint (2)

  • Supply Chain SecurityScored on package channels only. This is a hosted endpoint, so there is nothing to install or inspect.
  • Provenance & TransparencyScored on package channels only. This is a hosted endpoint, so there is nothing to install or inspect.

The score does not measure everything. What the score does not measure →

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 6 Nov 26 0
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 5 Nov 26 0
    • Stability: 0.97 → pass security
  • 4 Nov 26 0
    • Stability: pass → 0.97 functional
  • 2 Oct 26 0
    • Stability: 0.97 → pass security
  • 28 Sept 26 0
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 25 Sept 26 0
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 10 Sept 26 0
    • Schema quality: excellent → good functional
    • “list_jobs” reworded the description of “status” cosmetic
  • 4 Sept 26 0
    • Tool “hand_off_video” rewrote its description, which is the text the model reads security
    • Tool “list_webhook_deliveries” rewrote its description, which is the text the model reads security
    • Tool “replay_webhook_delivery” rewrote its description, which is the text the model reads security
    • Tool “revoke_key” rewrote its description, which is the text the model reads security
    • Tool “rotate_key” rewrote its description, which is the text the model reads security
    • “create_job” reworded the description of “idempotency_key” cosmetic
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 7 Nov 2026 · Probed https://widget.reelquoteai.com/mcp

TLS valid

Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .

Subject Issuer Valid from Valid until Key Signature Serial
CN=reelquoteai.com CN=WE1,O=Google Trust Services,C=US 5 Oct 2026 3 Jan 2027 ECDSA 256 ECDSA-SHA256 40a6055f839984330e02cbfeda5a332b
SANs: reelquoteai.com, widget.reelquoteai.com, *.widget.reelquoteai.com
CN=WE1,O=Google Trust Services,C=US (CA) CN=GTS Root R4,O=Google Trust Services LLC,C=US 13 Dec 2023 20 Feb 2029 ECDSA 256 ECDSA-SHA384 7ff31977972c224a76155d13b6d685e3
CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE 15 Nov 2023 28 Jan 2028 ECDSA 384 SHA256-RSA 7fe530bf331343bedd821610493d8a1b

Background: What to check on a remote MCP endpoint →

DNSSEC insecure

Validation of widget.reelquoteai.com. — Not signed

Zone DS Keys Algorithms Outcome
. Trust anchor 20326, 38696 8, 8 Verified
com. DS published 19718 13 Verified
reelquoteai.com. No DS Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation
Authentication No authorisation required

The endpoint answered without asking for a token. Anyone who knows the URL can reach it.

Result No authorisation required
HTTP status 200
Header Value
strict-transport-security max-age=31536000; includeSubDomains
permissions-policy geolocation=(), microphone=(), payment=(), usb=()

Background: How OAuth 2.1 works in the 2026 MCP spec →

Transports 2 probes
Transport URL Outcome Status Location
streamable-http https://widget.reelquoteai.com/mcp Verified 200
http (plaintext) http://widget.reelquoteai.com/mcp HTTPS enforced 301 https://widget.reelquoteai.com/mcp
MCP tools · 33 exposed · ~3,381 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
acknowledge_gaps ~100

Record the customer's answer to the capture-gap prompts (inventory.gaps on GET /jobs/{id}). Body: { acknowledged: true } stamps "nothing is missing"; false clears it. The prompts themselves are recomputed from the current inventory on every read, so fixing a gap removes its prompt without this call. Scope: jobs:write.

NameTypeReqDescription
acknowledgedboolean–Default true
job_idstringyesThe job id (ULID)

No output schema declared.

No examples provided.

approve_inventory ~73

Customer sign-off on the inventory, plus free-text notes. Scope: jobs:write.

NameTypeReqDescription
approvedboolean–Default true. false withdraws the sign-off.
job_idstringyesThe job id (ULID)
notesstring–Up to 2000 chars; absent leaves unchanged

No output schema declared.

No examples provided.

ballpark_estimate ~121

Instant estimate range from home size + addresses. Free; never bookable. Scope: quote.

NameTypeReqDescription
destinationobject–One end of the move, as the customer gives it.
distance_milesnumber–Only used when no route can be found from the addresses
dwellingstringyesA `dwelling` from GET /home-profiles
move_datestring–Lets date-based pricing apply. Optional but strongly recommended.
originobject–One end of the move, as the customer gives it.

No output schema declared.

No examples provided.

complete_upload ~88

Assemble a chunked upload. Body: { upload_id, parts: [{ part_number, etag }] }. Only after every part has been PUT; then call /submit. Scope: jobs:write.

NameTypeReqDescription
job_idstringyesThe job id (ULID)
partsarrayyesEvery part, in any order
upload_idstringyesFrom the multipart ticket

No output schema declared.

No examples provided.

confirm_access ~107

Confirm floors / elevator / stairs / carry distance for both ends. Scope: jobs:write.

NameTypeReqDescription
destinationobject–What a customer can actually answer about one end. Only these fields are writable; inferred values are kept.
job_idstringyesThe job id (ULID)
move_datestring|null–YYYY-MM-DD
originobject–What a customer can actually answer about one end. Only these fields are writable; inferred values are kept.

No output schema declared.

No examples provided.

create_job ~273

Start a job (the survey container). Contact details are NOT accepted here — funnel rule. Send `Idempotency-Key` so a retry cannot create a second job. Scope: jobs:write.

NameTypeReqDescription
destinationobject–One end of the move, as the customer gives it.
dwellingstring–What the customer says their home is (any wording; stored beside what the video measures)
idempotency_keystring–Any unique string per intended job (a UUID, your order id). For 24 hours, the same key with the same body returns the ORIGINAL 201 body with `Idempotent-Replayed: true` and creates nothing; the same…
move_datestring–YYYY-MM-DD
originobject–One end of the move, as the customer gives it.
quote_kindstring–What the job is for. A firm job becomes bookable once filmed.

No output schema declared.

No examples provided.

create_key ~111

Mint a key. The raw secret is in THIS response only. A key can never mint one broader than itself; a test key mints only test keys; a live secret key may mint the sandbox pair. Scope: keys.

NameTypeReqDescription
kindstring––
labelstring–Up to 80 chars, e.g. 'CRM sync'
modestring–Default: the calling key's mode.
scopesarray|null–null (default) = everything the kind allows

No output schema declared.

No examples provided.

create_upload_url ~193

Presigned upload for the walkthrough video. Requires stored contact email. Body: { content_type, consent, size }. Send the byte size: at or above 16 MB the response carries `multipart` (an upload_id, a part_size and a presigned PUT per part) instead of `upload`, and each part is retried on its own rather than restarting the whole video. Report each part's ETag to /upload-complete. Below the threshold, or if opening a multipart upload fails, the response is a single `upload`. Scope: jobs:write.

NameTypeReqDescription
consentbooleanyesMust be true: the customer agrees the video will be analysed and shared with the mover.
content_typestringyesA video/* MIME type
job_idstringyesThe job id (ULID)
sizeinteger–Byte size of the file. Decides single vs multipart.

No output schema declared.

No examples provided.

edit_items ~68

Edit inventory (quantity, exclude, add by item_key). Response carries the re-priced quote. Scope: jobs:write.

NameTypeReqDescription
itemsarrayyesNon-empty. Any edit clears the customer's approval and the e-signature.
job_idstringyesThe job id (ULID)

No output schema declared.

No examples provided.

get_availability ~94

Which days the mover has marked off, before a job exists. Soft: a marked day can still be requested — the mover confirms and calls first — so steer to an open day when the customer has a choice. Scope: quote.

NameTypeReqDescription
daysinteger–Window length; values above 90 are capped.
fromstring–First day, YYYY-MM-DD. Default tomorrow; earlier dates clamp to tomorrow.

No output schema declared.

No examples provided.

get_cube_sheet_csv ~52

Itemized cube sheet as CSV (Excel-ready): rooms, volumes, weights, exclusions. Secret key only. Scope: jobs:read.

NameTypeReqDescription
job_idstringyesThe job id (ULID)

No output schema declared.

No examples provided.

get_date_prices ~56

This job's quote priced across a ~2-week window from the mover's date rules. flat=true means every day prices the same. Scope: jobs:read.

NameTypeReqDescription
job_idstringyesThe job id (ULID)

No output schema declared.

No examples provided.

get_job ~44

Full job state: status, inventory, quote, access, terms, move_date. Scope: jobs:read.

NameTypeReqDescription
job_idstringyesThe job's ULID

No output schema declared.

No examples provided.

get_session ~25

Resolve the key to its mover (name, branding, config). Scope: quote.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

hand_off_video ~225

Server-side handoff: give us a public https URL of the walkthrough instead of uploading it from a browser. Secret key only. We fetch it (up to 500 MB, streamed) and the job runs exactly as an upload would — poll GET /jobs/{id}. Needs the stored contact email and consent, like /upload-url. Replaces /upload-url, /upload-complete and /submit for a caller that already holds the file. A job whose fetch failed (`error`) may be handed a new URL. Counts toward the mover's daily analysis cap (429). Scope: jobs:write.

NameTypeReqDescription
consentbooleanyesMust be true: the customer agrees the video will be analysed and shared with the mover.
content_typestring–A video/* MIME type when you know it; otherwise the host's Content-Type must be video/*
job_idstringyesThe job id (ULID)
urlstringyesPublic https URL that serves the video (a signed cloud-storage link is ideal). Private hosts and http are refused.

No output schema declared.

No examples provided.

list_home_profiles ~33

Home sizes for the ballpark step (2br_apt, 3br_house, …). Scope: quote.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

list_jobs ~305

List jobs for the tenant, newest first. Secret key only. Paged: pass `limit` (1–100, default 25), optional `status`, and `cursor` from the previous page's `next_cursor` (null on the last page; a bad cursor is a 400). Scope: jobs:read.

NameTypeReqDescription
cursorstring–Opaque; from the previous response's next_cursor.
limitinteger––
statusstring–Funnel order. **created** — The job exists. Nothing uploaded yet. **uploading** — An upload URL was issued; the video is on its way. **uploaded** — A chunked upload was assembled (a single PUT skips…

No output schema declared.

No examples provided.

list_keys ~41

List the account's API keys — live and test, active and revoked. Never a raw secret. Secret key with the `keys` scope. Scope: keys.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

list_webhook_deliveries ~115

The delivery log: every webhook POST for 30 days, newest first, with its outcome and the exact body sent. Secret key with the `keys` scope. A key reads the deliveries of its own mode: live keys the live log, test keys the sandbox log. Scope: keys.

NameTypeReqDescription
beforestring–The previous page's next_before
job_idstring–Everything sent about one job
limitinteger––
webhook_idstring–One endpoint only

No output schema declared.

No examples provided.

quote_inventory ~155

Direct pricing for agents: items or total_cuft in, firm quote out. Secret key only. Scope: quote.

NameTypeReqDescription
destinationobject–One end of the move, as the customer gives it.
distance_milesnumber––
itemsarray–…or this, priced from the catalog
move_datestring–YYYY-MM-DD
originobject–One end of the move, as the customer gives it.
rate_card_idstring–A specific card of this mover's; default the active one
total_cuftnumber–Either this…
total_weight_lbsnumber–Optional with total_cuft; derived from items otherwise

No output schema declared.

No examples provided.

replay_webhook_delivery ~83

Re-send one delivery to its endpoint: the same body byte for byte (same envelope id, so your dedupe still works) under a fresh signature, with the usual retries. Returns the replay's own delivery record. Deliveries of the other mode are not found (404). Scope: keys.

NameTypeReqDescription
idstringyesA delivery id from the log

No output schema declared.

No examples provided.

report_outcome ~99

Report actuals (hours, final cents, crew). Secret key only. Scope: outcomes.

NameTypeReqDescription
actual_crewinteger––
actual_hoursnumber––
actual_total_centsinteger–What was actually billed, in integer cents. Currency travels beside it — never assume USD.
job_idstringyesThe job id (ULID)
notesstring–Up to 1000 chars

No output schema declared.

No examples provided.

request_booking ~206

Request the booking. Idempotent per job; requires approve:true (types-name-as-signature approval of the inventory + quote, stored with a quote snapshot) and accept_terms when the mover has terms. Scope: jobs:write.

NameTypeReqDescription
accept_termsboolean–Required (true) when the job's `terms.terms` is non-null
approvebooleanyesMust be true: approves the inventory as complete and this quote. Cleared if the inventory is edited afterwards.
emailstringyes–
esignboolean–Must be true unless already given with the contact details: the customer agrees to electronic documents and signing
job_idstringyesThe job id (ULID)
namestringyesThe submitted name is the signature on the approval.
phonestring––
publications_receiptboolean–Must be true on an interstate quote the mover sent: the customer received the two federal moving publications

No output schema declared.

No examples provided.

resolve_address ~40

Resolve a suggestion to a full address (same session_token). Scope: quote.

NameTypeReqDescription
place_idstring––
session_tokenstring––

No output schema declared.

No examples provided.

revoke_key ~56

Revoke a key immediately. The only live publishable key is refused (409) — rotate it instead. A test key cannot revoke a live key (403 `mode_mismatch`). Scope: keys.

NameTypeReqDescription
idstringyes–

No output schema declared.

No examples provided.

rotate_key ~166

Replace a key with its twin (same kind, mode, scopes, label). The old key keeps working until `replaced.expires_at` so a deploy can swap values without a gap. Needs the `keys` scope even to rotate itself — rotate a scoped key with a full key or from the dashboard. A key is rotated once: rotating it again is a 409 `key_already_rotated`, and during its grace the old key cannot mint, rotate, revoke or read deliveries (403 `key_rotated`). A test key cannot rotate a live key (403 `mode_mismatch`). Scope: keys.

NameTypeReqDescription
grace_hoursinteger–0 revokes the old key immediately.
idstring–Which key. Default: the key making this call.

No output schema declared.

No examples provided.

search_catalog ~36

Search the cube-sheet catalog (?q=sofa). Scope: quote.

NameTypeReqDescription
qstringyesName, synonym or key fragment

No output schema declared.

No examples provided.

send_inventory_to_mover ~86

On a job the mover prices: the customer sends their list to the mover. Stamps the confirmation and locks the list. Body: { confirmed: true, notes }. Safe to repeat. Scope: jobs:write.

NameTypeReqDescription
confirmedbooleanyesMust be true
job_idstringyesThe job id (ULID)
notesstring––

No output schema declared.

No examples provided.

send_resume_link ~65

Email the customer their resume link. Only on explicit request. Scope: jobs:write.

NameTypeReqDescription
consentbooleanyesMust be true
emailstringyes–
job_idstringyesThe job id (ULID)
namestring––

No output schema declared.

No examples provided.

set_contact ~93

Store customer email + optional name + move date. Sends NOTHING — required before upload-url. Scope: jobs:write.

NameTypeReqDescription
consentbooleanyesMust be true. Express consent to email about this quote.
emailstringyes–
job_idstringyesThe job id (ULID)
move_datestring|null–Null clears; absent leaves unchanged.
namestring––

No output schema declared.

No examples provided.

set_move_date ~69

Set or clear the move date; invalidates and recomputes the quote. Refused after a booking is requested. Scope: jobs:write.

NameTypeReqDescription
datestring|null–YYYY-MM-DD, or null to clear.
job_idstringyesThe job id (ULID)

No output schema declared.

No examples provided.

submit_job ~45

Queue the uploaded video for analysis. Poll GET /jobs/{id} for status. Scope: jobs:write.

NameTypeReqDescription
job_idstringyesThe job id (ULID)

No output schema declared.

No examples provided.

suggest_addresses ~58

Address autocomplete (proxied; send session_token). Scope: quote.

NameTypeReqDescription
inputstring–What the customer has typed so far
session_tokenstring–Any opaque string, kept for the whole typing session and the resolve call

No output schema declared.

No examples provided.

Install

How do I install the ReelQuoteAI Survey Tool MCP server?

ReelQuoteAI Survey Tool is a hosted endpoint at https://widget.reelquoteai.com/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

remote · widget.reelquoteai.com

# add to Claude Code
claude mcp add --transport http com-reelquoteai-survey-tool 'https://widget.reelquoteai.com/mcp'
Common questions

What is the ReelQuoteAI Survey Tool MCP server?

ReelQuoteAI Survey Tool is an MCP server listed in the public MCP registry as com.reelquoteai/survey-tool. Filmed moving surveys, itemized inventories, firm quotes and bookings for moving companies. This page covers its hosted endpoint (https://widget.reelquoteai.com/mcp).

Is the ReelQuoteAI Survey Tool MCP server safe to use?

ReelQuoteAI Survey Tool scores 87 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the ReelQuoteAI Survey Tool MCP server expose?

ReelQuoteAI Survey Tool exposes 33 tools: get_session, list_home_profiles, ballpark_estimate, create_job, list_jobs, and 28 more. Their descriptions and schemas cost roughly 3,381 tokens of context every time the server is loaded.

Does the ReelQuoteAI Survey Tool MCP server require authentication?

No. We connected to ReelQuoteAI Survey Tool without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

Is the ReelQuoteAI Survey Tool MCP server still maintained?

ReelQuoteAI Survey Tool is still listed as active in the MCP registry. We last reached this channel on 7 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What did VerifyMCP test on the ReelQuoteAI Survey Tool MCP server?

VerifyMCP ran 13 checks on ReelQuoteAI Survey Tool, covering TLS certificate, Authorization, HTTPS, HSTS header and 9 more. Supply Chain Security and Provenance & Transparency do not apply to a hosted endpoint, so they were not tested. The score does not measure everything, and the scoring documentation lists what it leaves out.