Starcovery
REMOTE · WWW.STARCOVERY.COM
MCP tools to find and hire Instagram and TikTok creators from a plain-language brief.
Available components
Last scanned (12 hours ago)
Scores higher than 59% of remote servers
Reachable. Last reached 18 Oct 2026.
Category Marketing and SEO
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security63
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation check failed: no authorisation is required to call this server, and it exposes a tool marked destructive (update_campaign). See how to fix → View diagnostics → Fail
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability66
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 5604 tokens (~200/item across 28 items; 28 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management26
- Stability check failed: schema churn in the 11 days we've observed: 2 tool removals, 2 breaking changes, 0 auth/transport breaks, 2 additions. See how to fix → Fail
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
- Structured output schemas are declared (21% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 6 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 29 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 18 Oct 26 −1
- Stability: 0.33 → fail ▼ security
- A breaking change shipped without a version bump: still 1.0.0 ▼ security
- Tool “fund_campaign” was removed ▼ security
- Tool “send_campaign” was removed ▼ security
- The server rewrote its instructions, which are the text every model session reads security
- Tool “add_campaign_match” rewrote its description, which is the text the model reads security
- Tool “add_campaign_matches” rewrote its description, which is the text the model reads security
- Tool “create_api_key” rewrote its description, which is the text the model reads security
- Tool “create_campaign” rewrote its description, which is the text the model reads security
- Tool “enrich_creators” rewrote its description, which is the text the model reads security
- Tool “get_campaign” rewrote its description, which is the text the model reads security
- Tool “get_list” rewrote its description, which is the text the model reads security
- Tool “intersect_lists” rewrote its description, which is the text the model reads security
- Tool “save_list” rewrote its description, which is the text the model reads security
- Tool “search_creators” rewrote its description, which is the text the model reads security
- Tool “thread_turn” rewrote its description, which is the text the model reads security
- Tool “update_campaign” rewrote its description, which is the text the model reads security
- Schema quality: 173 → 200 ▼ functional
- “enrich_creators” added a required parameter “shortlistId”, so existing callers break ▼ functional
- “add_campaign_match” dropped the required parameter “followerCount” ▼ functional
- “add_campaign_match” dropped the required parameter “name” ▼ functional
- “add_campaign_match” dropped the required parameter “platform” ▼ functional
- “add_campaign_match” dropped the required parameter “profileImageUrl” ▼ functional
- “add_campaign_match” dropped the required parameter “username” ▼ functional
- “enrich_creators” dropped the required parameter “ticket” ▼ functional
- New tool “request_campaign_funding” functional
- New tool “request_campaign_send” functional
- “add_campaign_matches” reworded the description of “creators” cosmetic
- “create_campaign” reworded the description of “creators” cosmetic
- “create_campaign” reworded the description of “embargoUntil” cosmetic
- “enrich_creators” reworded the description of “creators” cosmetic
- “generate_campaign_matches” reworded the description of “platform” cosmetic
- “save_list” reworded the description of “creators” cosmetic
- “save_list” reworded the description of “platform” cosmetic
- “search_creators” reworded the description of “platform” cosmetic
- “update_campaign” reworded the description of “embargoUntil” cosmetic
- 17 Oct 26 0
- Tool “create_api_key” rewrote its description, which is the text the model reads security
- Tool “revoke_api_key” rewrote its description, which is the text the model reads security
- “create_campaign” reworded the description of “marketInformation” cosmetic
- “generate_campaign_matches” reworded the description of “country” cosmetic
- “save_list” reworded the description of “country” cosmetic
- “search_creators” reworded the description of “country” cosmetic
- “update_campaign” reworded the description of “marketInformation” cosmetic
- 16 Oct 26 0
- Tool “add_campaign_matches” rewrote its description, which is the text the model reads security
- Tool “save_list” rewrote its description, which is the text the model reads security
- Tool “search_creators” rewrote its description, which is the text the model reads security
- Tool “thread_turn” rewrote its description, which is the text the model reads security
- Tool “update_campaign” rewrote its description, which is the text the model reads security
- “create_campaign” reworded the description of “goal” cosmetic
- “save_list” reworded the description of “name” cosmetic
- “save_list” reworded the description of “q” cosmetic
- “search_creators” reworded the description of “q” cosmetic
- “update_campaign” reworded the description of “goal” cosmetic
- “update_campaign” reworded the description of “marketInformation” cosmetic
- 15 Oct 26 0
- Tool “get_credits” rewrote its description, which is the text the model reads security
- 14 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 20 to 23. That category is still filling its 30-day observation window: 6 days of observed history at the previous scan, 7 at this one. The score rises as the window fills, whether or not the server changes.
- 12 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 10 to 17. That category is still filling its 30-day observation window: 3 days of observed history at the previous scan, 5 at this one. The score rises as the window fills, whether or not the server changes.
- 10 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes.
- 9 Oct 26 +1
- Stability: unverified → 0.07 ▲ functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 18 Oct 2026 · Probed https://www.starcovery.com/api/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=*.starcovery.com | CN=YR1,O=Let's Encrypt,C=US | 15 Oct 2026 | 13 Jan 2027 | RSA 2048 | SHA256-RSA | 5a678327d7d2ab12753d15cb6c01c9a3123 |
| SANs: *.starcovery.com, starcovery.com | ||||||
| CN=YR1,O=Let's Encrypt,C=US (CA) | CN=Root YR,O=ISRG,C=US | 3 Sept 2025 | 2 Sept 2028 | RSA 2048 | SHA256-RSA | a20253f15f2691c05dc1ce13b9bcca4e |
| CN=Root YR,O=ISRG,C=US (CA) | CN=ISRG Root X1,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | RSA 4096 | SHA256-RSA | f24b6d17f9d9ad7cb1c9fea78782699f |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of www.starcovery.com. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| com. | present | 19718 | 13 | Verified |
| starcovery.com. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
| Header | Value |
|---|---|
| strict-transport-security | max-age=63072000 |
| content-security-policy | frame-ancestors 'none' |
| x-content-type-options | nosniff |
| x-frame-options | DENY |
| referrer-policy | strict-origin-when-cross-origin |
| permissions-policy | camera=(), microphone=(), geolocation=() |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://www.starcovery.com/api/mcp | Verified | 200 | |
| http (plaintext) | http://www.starcovery.com/api/mcp | HTTPS enforced | 308 | https://www.starcovery.com/api/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
add_campaign_match Add campaign match ~176
Add a creator as a manual match to a campaign by profileId, with its fitScore. Idempotent on (campaign, profileId). Stores the platform, handle, name, picture, and follower count of the catalog profile, so the input carries nothing else, and any other key, platform or username included, fails the call with a validation error; a profileId with no catalog profile returns not_found. While a send request is open, once the campaign is sent, or while it is archived, it returns a tool error naming the reason. Needs a credential.
| Name | Type | Req | Description |
|---|---|---|---|
| campaignId | string | yes | Campaign id from list_campaigns |
| fitScore | – | yes | Fit score from search_creators, 0 to 1, or null when unknown |
| profileId | string | yes | Creator profile id from search_creators |
No output schema declared.
No examples provided.
add_campaign_matches Add campaign matches ~275
Add several creators as manual matches to a campaign in one call. Each creator is a profileId and fitScore pick: the id and fitScore of a search_creators creator, or the profileId and fitScore of a get_list creator. Idempotent on (campaign, profileId). Stores the platform, handle, name, picture, and follower count of each catalog profile, so a creator carries nothing else, and any other key on a creator fails the call with a validation error. A profileId outside the catalog fails the call with a tool error naming it, and nothing is added. Returns added, the count of new matches, and present, the count already on the campaign, with addedCreators and presentCreators, the same counts per person, so a person with two matched profiles counts once. A campaign outside the caller's organization returns not_found. While a send request is open, once the campaign is sent, or while it is archived, it returns a tool error naming the reason. Needs a credential.
| Name | Type | Req | Description |
|---|---|---|---|
| campaignId | string | yes | Campaign id from list_campaigns |
| creators | array | yes | The creators to add to the campaign: the profileId and fitScore of each, the id and fitScore of a search_creators creator or the profileId and fitScore of a get_list creator |
No output schema declared.
No examples provided.
create_api_key Create API key ~88
Mint a new API key. Returns the plaintext key once; it is not shown again. The new key is an ordinary key of the same member, not a child of the minting key: revoking the minting key leaves it working. Needs a credential other than an agent access token or an OAuth access token.
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | yes | Key label; must not start with agent: |
No output schema declared.
No examples provided.
create_campaign Create campaign ~494
Create a campaign with a goal (what to advertise or attain). A campaign is public and free by default; setting visibility "private" costs 1 credit. Contract (deliverable, compensationCents, and platforms, the platforms one payment covers), creator posting date, campaign details declassifying date (embargoUntil), disclosure, and marketInformation are accepted. Optional creators, each a profileId and fitScore pick, adds them as manual matches in the same call, as add_campaign_matches does, and the result carries matches with the added and present counts; any other key on a creator fails the call with a validation error; a creator id outside the catalog fails the call before anything is created or charged. Needs a credential.
| Name | Type | Req | Description |
|---|---|---|---|
| contract | object | – | Compensation in USD cents, the paid deliverable, the platforms the creator posts on, and optional creator posting date. |
| creators | array | – | Creators to add to the new campaign: the profileId and fitScore of each, the id and fitScore of a search_creators creator or the profileId and fitScore of a get_list creator |
| disclosure | object | – | Paid partnership disclosure. Required before send. |
| embargoUntil | string | – | Campaign details declassifying date as the start of a UTC calendar day, an RFC 3339 date-time at midnight UTC such as 2026-12-01T00:00:00Z. Any other instant is refused. It needs a contract in the sa… |
| goal | string | yes | Campaign goal |
| idempotencyKey | string | – | Client-generated key. A valid repeat with the same key answers with the campaign the first call created, even when its other fields differ. |
| marketInformation | object | – | When the campaign's name and pay per creator may join the going rate, the list of campaigns and the typical pay other organizations and creators see, which sets the platform fee: releaseDelayMonths 0… |
| name | string | yes | Campaign name |
| visibility | string | – | Defaults to public. Private costs 1 credit. |
No output schema declared.
No examples provided.
delete_campaign Delete campaign ~59
Delete a campaign and its matches. A funded campaign, a campaign with a signed hire, or a campaign with a proposal delivery returns a tool error naming the reason. Needs a credential.
| Name | Type | Req | Description |
|---|---|---|---|
| campaignId | string | yes | Campaign id from list_campaigns |
No output schema declared.
No examples provided.
delete_campaign_attachment Delete campaign attachment ~73
Delete one file attached to a campaign of the caller's organization. Irreversible. An attachment or a campaign outside the caller's organization returns not_found. Needs a credential.
| Name | Type | Req | Description |
|---|---|---|---|
| attachmentId | string | yes | Attachment id from list_campaign_attachments |
| campaignId | string | yes | Campaign id from list_campaigns |
No output schema declared.
No examples provided.
delete_list Delete list ~62
Delete one List of the caller's organization and its saved creators. Campaigns keep the creators added from it. Irreversible. A List outside the caller's organization returns not_found. Needs a credential.
| Name | Type | Req | Description |
|---|---|---|---|
| listId | string | yes | List id from list_lists |
No output schema declared.
No examples provided.
enrich_creators Enrich creators ~162
Run shortlist AI enrichment (niche, celebrity, evidence, signal) for creators from search_creators. It takes the same creators array, query string (search query.q), and the shortlistId search_creators returned with them. Returns one analysis object per creatorId. A shortlistId works once, for 4 hours, and only for the caller who searched; enrichment spends no credits. Holds the call open until the result, up to 800 seconds.
| Name | Type | Req | Description |
|---|---|---|---|
| creators | array | yes | The creators array exactly as returned by search_creators, unmodified; the shortlist is bound to it |
| query | string | yes | The query.q string returned by search_creators |
| shortlistId | string | yes | The shortlistId search_creators returned with these creators |
Structured output declared, but exposes no named fields.
No examples provided.
export_campaign Export campaign CSV ~52
Export a campaign as CSV (Rank, Handle, Name, Platform, Followers, Fit, Source). Same access as get_campaign. Needs a credential.
| Name | Type | Req | Description |
|---|---|---|---|
| campaignId | string | yes | Campaign id from list_campaigns |
No output schema declared.
No examples provided.
generate_campaign_matches Generate campaign matches ~334
Generate creator matches from the campaign goal. Runs one creator search (same daily grant and prepaid credits as search_creators; pre-claim agent tokens spend prepaid credits only) and saves matches; idempotent on (campaign, profileId). Optional filters narrow the search. Holds the call open until the result, up to 800 seconds. While a send request is open, once the campaign is sent, or while it is archived, it returns a tool error naming the reason before any search runs. Needs a credential.
| Name | Type | Req | Description |
|---|---|---|---|
| campaignId | string | yes | Campaign id from list_campaigns |
| country | string | – | ISO 3166-1 alpha-2 country code in either letter case, such as us or id |
| platform | string | – | Instagram (ig) or TikTok (tt), in either letter case |
| tier | string | – | Follower tier: nano 1,000 to 9,999, micro 10,000 to 49,999, mid 50,000 to 249,999, macro 250,000 to 999,999, mega 1,000,000 or more, nano+ 1,000 or more, micro+ 10,000 or more, mid+ 50,000 or more, m… |
No output schema declared.
No examples provided.
get_campaign Get campaign ~296
Get one campaign and its matched creators. Ordinary public campaigns are free to read for any identified caller. A private campaign reads as not found for a caller outside the organization. Contract, creator posting date, campaign details declassifying date, and disclosure are present for members of the organization and may be null on open and summary reads. For members of the organization, people lists each person on the campaign once, with their profiles, their answer to the proposal, their funding (requested or funded), and their signed hire with the payout amount, paidAt (null while the payout is pending), and posts, each live post Starcovery recorded with its link, viewCount, and engagementCount (likes plus comments); people also lists a hire that matches no creator on the campaign, and is null for other callers. Hires and payouts are counted in people. For members of the organization, nextStep names the step the web app shows next, as list_campaigns does; it is null for other callers and once no step is left. currentSteps lists every step under way in campaign order in the same shape, because a step before nextStep can still wait, such as proposals Starcovery has not sent; currentSteps, not nextStep or status, tells whether a step is finished. It is null for other callers and empty once no step is left. Needs a credential.
| Name | Type | Req | Description |
|---|---|---|---|
| campaignId | string | yes | Campaign id from list_campaigns |
No output schema declared.
No examples provided.
get_credits Get credits ~43
Read the prepaid credit balance, the identified daily search grant status, and whether a card is on file. Does not start checkout or change payment settings. Needs a credential.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_list Get list ~91
Get one List of the caller's organization with its brief, filters, and saved creators, best fit first. The creators carry the saved creator shape that intersect_lists takes. add_campaign_matches, create_campaign, and save_list take only the profileId and fitScore of each. A List outside the caller's organization returns not_found. Needs a credential.
| Name | Type | Req | Description |
|---|---|---|---|
| listId | string | yes | List id from list_lists |
No output schema declared.
No examples provided.
intersect_lists Intersect lists ~98
Keep the creators that appear in both lists, in the order of the left list. Nothing is stored. A search_creators result maps to the saved creator shape: profileId is the creator id, and fitScore, followerCount, name, platform, profileImageUrl, and username carry over. Needs a credential.
| Name | Type | Req | Description |
|---|---|---|---|
| left | array | yes | First creator list; the result keeps this order |
| right | array | yes | Second creator list |
No output schema declared.
No examples provided.
list_api_keys List API keys ~62
List API keys for the active organization (id, name, prefix, timestamps). An owner or admin sees every key; a member sees only the keys they minted. Never returns plaintext keys. Needs a credential other than an agent access token or an OAuth access token.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_campaign_attachments List campaign attachments ~72
List the files attached to a campaign of the caller's organization, with id, filename, content type, byte size, and upload time. Returns no file contents. A campaign outside the caller's organization returns not_found. Needs a credential.
| Name | Type | Req | Description |
|---|---|---|---|
| campaignId | string | yes | Campaign id from list_campaigns |
No output schema declared.
No examples provided.
list_campaigns List campaigns ~102
List the caller's campaigns with goal, status, visibility, match counts, and nextStep: the step the web app shows next, with its id, label, actor (you for the organization, starcovery, creators, or one creator by name), and line, the sentence that says what the step waits on. nextStep is null once no step is left: the campaign is done or archived, or no creator was reached or accepted. Needs a credential.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_lists List lists ~40
List the organization's saved Lists with brief, filters, creatorCount (each person once), itemCount (each saved profile), and last update. Needs a credential.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
remove_campaign_match Remove campaign match ~90
Remove one matched creator from a campaign by match id. A match that already has a proposal delivery, or any match while a send request is open, once the campaign is sent, or while it is archived, returns a tool error naming the reason. Needs a credential.
| Name | Type | Req | Description |
|---|---|---|---|
| campaignId | string | yes | Campaign id from list_campaigns |
| matchId | string | yes | Match id from get_campaign |
No output schema declared.
No examples provided.
request_campaign_funding Request campaign funding ~218
Request campaign funding for a campaign the caller's organization owns. Starcovery Payouts runs concierge: this call records one open funding request for the accepted creators not yet funded, per person, with the quoted total (compensation per creator times those people, plus the platform fee that the market information answer sets), and notifies the Starcovery team, who invoice the organization. Only organization owners and admins may call it. Needs a saved contract, an answered market information question, and at least one creator who accepted and is not yet funded. Returns a tool error naming the reason when the campaign is not the caller's, it is archived, a step is missing, or a request is already open. An archived campaign is funded only after it is reopened with update_campaign status active. The reason creators_changed means a creator accepted while the request was prepared; the same call then succeeds. Returns the request row with amountCents set to the quoted total. Needs a credential.
| Name | Type | Req | Description |
|---|---|---|---|
| campaignId | string | yes | Campaign id from list_campaigns |
| Name | Type | Req | Description |
|---|---|---|---|
| request | object | yes | – |
No examples provided.
request_campaign_send Request proposal send ~142
Request a proposal send for a draft campaign the caller's organization owns. Starcovery Proposals runs concierge: this call records one open send request and notifies the Starcovery team, who send the proposals from the staff queue. Needs a saved contract whose creator posting date, when set, is today or a later day in UTC, a captured disclosure, and at least one match. Returns a tool error naming the reason when the campaign is not the caller's, a step is missing, a request is already open, or the campaign is already sent. Returns the request row. Needs a credential.
| Name | Type | Req | Description |
|---|---|---|---|
| campaignId | string | yes | Campaign id from list_campaigns |
| Name | Type | Req | Description |
|---|---|---|---|
| request | object | yes | – |
No examples provided.
reveal_contact Reveal contact ~55
Reveal a creator contact address. Costs 1 prepaid credit the first time this organization reveals that profile. Later calls return the address without charging. Needs a credential.
| Name | Type | Req | Description |
|---|---|---|---|
| profileId | string | yes | Creator profile id from search_creators |
| Name | Type | Req | Description |
|---|---|---|---|
| bio | – | yes | – |
| emails | array | yes | – |
No examples provided.
revoke_api_key Revoke API key ~97
Revoke an API key by id. An owner or admin revokes any key of the organization; a member revokes only a key they minted, and another key returns not_found. Irreversible, and touches only that key: keys minted with it stay enabled until revoked by id. Needs a credential other than an agent access token or an OAuth access token.
| Name | Type | Req | Description |
|---|---|---|---|
| keyId | string | yes | API key id from list_api_keys |
No output schema declared.
No examples provided.
save_list Save list ~421
Save a set of creators as a List for the organization, with the brief and filters of the search that produced it. The List takes the name in name, or a name cut from the brief when name is omitted, with a number from 2 appended when another List of the organization holds that name. Each creator is a profileId and fitScore pick: profileId is the creator id from search_creators, and fitScore its fit. The List stores the platform, handle, name, picture, and follower count of each catalog profile, so a creator carries nothing else, and any other key on a creator fails the call with a validation error. A profileId outside the catalog fails the call with a tool error naming it, and no List is saved. Returns the saved List summary. Needs a credential.
| Name | Type | Req | Description |
|---|---|---|---|
| country | string | – | ISO 3166-1 alpha-2 country code in either letter case, such as us or id |
| creators | array | yes | The creators to keep on the List: the profileId and fitScore of each |
| name | string | – | Campaign name |
| platform | string | – | Instagram (ig) or TikTok (tt), in either letter case |
| q | string | yes | Natural-language creator brief |
| tier | string | – | Follower tier: nano 1,000 to 9,999, micro 10,000 to 49,999, mid 50,000 to 249,999, macro 250,000 to 999,999, mega 1,000,000 or more, nano+ 1,000 or more, micro+ 10,000 or more, mid+ 50,000 or more, m… |
No output schema declared.
No examples provided.
search_creators Search creators ~455
Search Instagram and TikTok creators with a natural-language brief. Returns up to 50 ranked creators with fit score, follower count, platform, the 3 best-matching videos, and a shortlistId for enrich_creators when available. Bios and captions are cut to 150 characters. The creator's website link is returned as written, or null when it is longer than 200 characters. Every other link is a short link that redirects for 24 hours. When the result would pass 140,000 characters, the lowest ranked creators are left out until it fits. The brief in q sets no filter; platform, country, and tier filter. Contact addresses stay empty until reveal_contact. Holds the call open until the result, up to 800 seconds. Each search is one use. Unsigned callers get 100 uses per rolling 24 hours per IP. Identified callers get 200 uses per rolling 24 hours, then prepaid credits. Pre-claim agent tokens skip the daily grant and use prepaid credits only. enrich_creators takes these creators, query.q, and shortlistId for niche, evidence, and signal analysis.
| Name | Type | Req | Description |
|---|---|---|---|
| country | string | – | ISO 3166-1 alpha-2 country code in either letter case, such as us or id |
| platform | string | – | Instagram (ig) or TikTok (tt), in either letter case |
| q | string | yes | Natural-language creator brief |
| tier | string | – | Follower tier: nano 1,000 to 9,999, micro 10,000 to 49,999, mid 50,000 to 249,999, macro 250,000 to 999,999, mega 1,000,000 or more, nano+ 1,000 or more, micro+ 10,000 or more, mid+ 50,000 or more, m… |
| Name | Type | Req | Description |
|---|---|---|---|
| creators | array | yes | – |
| next | string | – | What to do with this result next, for the assistant |
| query | object | yes | – |
| shortlistId | – | – | Id of this shortlist for enrich_creators, kept for 4 hours. Null when the shortlist is empty or too long to enrich, or when an unsigned caller has no client IP. |
No examples provided.
thread_turn Run thread turn ~376
Run the next turn of a search thread and return the settled brief, its filters, the operations the turn ran, the reply, and the creators of the thread result set with a shortlistId for enrich_creators. creatorCount counts the whole set; creators holds at most the 50 best fit of them, fewer when the result would pass 140,000 characters. The reply, statement, and error are cut to 4,000 characters, and operations lists at most the first 20. Without threadId the call opens a new thread; the threadId in the result is the durable handle for the next turn. A pasted website address is read into a brief; anything else refines the brief, or answers a question about the organization's campaigns, Lists, credits, or API keys from read tools without changing them. Sends notifications/progress when the caller passes a progressToken. MCP cannot stream a tool result, so the call is blocking and waits until the turn ends, up to 800 seconds. Each turn costs 1 use plus 1 for each search and each exclusion it runs, from the same daily grant as search_creators and then 1 prepaid credit each. A refinement returns the set it built; the first brief runs one search for its creators, billed like search_creators. The thread stores the set, so reading it again with GET /api/threads/{threadId}/results is free. When the allowance runs out, exhausted is set and creators is empty; a turn that finds it spent runs nothing. Needs a credential.
| Name | Type | Req | Description |
|---|---|---|---|
| message | string | yes | The turn text: what to search for, what to change in the running search, or a website address to read into a brief |
| threadId | string | – | Thread id from a previous call. Omit to open a new thread |
No output schema declared.
No examples provided.
update_campaign Update campaign ~555
Update campaign fields: name, goal, visibility, or status (draft, archived, or active; Starcovery sets active when the team sends the proposals, and active reopens an archived campaign whose proposals were sent). A campaign that is active or holds a delivery cannot return to draft, a campaign with an open send or funding request cannot be archived, and a campaign that is not archived or was never sent cannot be set active; each change returns a tool error naming the reason. Changing visibility to private costs 1 credit; already-private updates do not. Contract (deliverable, compensationCents, and platforms, the platforms one payment covers), creator posting date, campaign details declassifying date (embargoUntil), disclosure, and marketInformation are accepted. Null marketInformation clears it. While a funding request is open or the campaign holds funds, a changed or cleared marketInformation returns a tool error naming the reason; a campaign whose reserve was refunded to zero takes a new answer. After Starcovery sends the proposals, a changed or cleared contract returns a tool error naming the reason, and a call without contract still changes the other fields. Needs a credential.
| Name | Type | Req | Description |
|---|---|---|---|
| campaignId | string | yes | Campaign id from list_campaigns |
| contract | – | – | Null clears stored contract metadata. A stored declassifying date needs a contract, so clear embargoUntil in the same patch. |
| disclosure | object | – | Paid partnership disclosure. Required before send. |
| embargoUntil | – | – | Campaign details declassifying date as the start of a UTC calendar day, an RFC 3339 date-time at midnight UTC such as 2026-12-01T00:00:00Z. Any other instant is refused. Null clears it. |
| goal | string | – | Campaign goal |
| marketInformation | – | – | When the campaign's name and pay per creator may join the going rate, the list of campaigns and the typical pay other organizations and creators see, which sets the platform fee: releaseDelayMonths 0… |
| name | string | – | Campaign name |
| status | string | – | draft, archived, or active. Starcovery sets active when the team sends the proposals; active reopens an archived campaign whose proposals were sent. |
| visibility | string | – | Public is free. Private costs 1 credit. |
No output schema declared.
No examples provided.
whoami Who am I ~39
Show the current credential, the bound user and organization, and whether the next search draws from the user daily grant or the organization balance. Needs a credential.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| billing | – | yes | – |
| credential | object | yes | – |
| nextSearchCreditSource | string | yes | – |
| organizationId | string | yes | – |
| searchCreditOrder | array | yes | – |
| userId | string | yes | – |
No examples provided.
How do I install the Starcovery MCP server?
Starcovery is a hosted endpoint at https://www.starcovery.com/api/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · www.starcovery.com
claude mcp add --transport http com-starcovery-mcp 'https://www.starcovery.com/api/mcp'
What is the Starcovery MCP server?
Starcovery is an MCP server listed in the public MCP registry as com.starcovery/mcp. MCP tools to find and hire Instagram and TikTok creators from a plain-language brief. This page covers its hosted endpoint (https://www.starcovery.com/api/mcp).
Is the Starcovery MCP server safe to use?
Starcovery scores 69 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Starcovery MCP server expose?
Starcovery exposes 28 tools: search_creators, enrich_creators, reveal_contact, list_campaigns, get_campaign, and 23 more. Their descriptions and schemas cost roughly 5,027 tokens of context every time the server is loaded.
Does the Starcovery MCP server require authentication?
No. We connected to Starcovery without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the Starcovery MCP server still maintained?
Starcovery is still listed as active in the MCP registry. We last reached this channel on 18 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.