io.github.corply-dev/corply
REMOTE · CORPLY.DEV · SCANNED AUG 3
Incorporate a Delaware C-Corp from your agent — docs, cofounder e-sign, human-reviewed filing.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score →
Endpoint Security91
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation is enforced on tool calls, advertised via RFC 9728 protected-resource metadata. Discovery is public, which costs nothing: no tool can be invoked without a token. View diagnostics → Pass
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
- DNSSEC is configured correctly; the domain's records validate against the full chain to the root. View diagnostics → Pass
- The authorisation server offers only Dynamic Client Registration (RFC 7591), which MCP 2026-07-28 deprecated in favour of Client ID Metadata Documents. View diagnostics → Partial
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability53
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (poor).Fail
- Context-footprint check failed: tool/resource definitions use about 14093 tokens (~234/item across 60 items; 60 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management25
- Stability check failed: schema churn in the 8 days we've observed: 1 tool removals, 0 breaking changes, 0 auth/transport breaks, 4 additions. See how to fix → Fail
Tool Coverage78
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 35% of tool parameters carry a description.Partial
Capabilities20
- Spec-recency check failed: implements MCP spec 2024-11-05; the latest is 2026-07-28. See how to fix → Fail
Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.
remote · corply.dev
claude mcp add --transport http corply-dev-corply https://corply.dev/mcp
[mcp_servers.corply-dev-corply] url = "https://corply.dev/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"corply-dev-corply": {
"type": "remote",
"url": "https://corply.dev/mcp",
"enabled": true
}
}
} openclaw mcp add corply-dev-corply --url https://corply.dev/mcp --transport streamable-http
mcp_servers:
corply-dev-corply:
url: "https://corply.dev/mcp" {
"mcpServers": {
"corply-dev-corply": {
"type": "http",
"url": "https://corply.dev/mcp"
}
}
} The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 3 Aug 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 22 to 25.
- 2 Aug 26 0
- Tool “request_payment” rewrote its description, which is the text the model reads security
- 1 Aug 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 15 to 18.
- 31 Jul 26 +7
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 30 Jul 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 28 Jul 26 +2
No change was recorded against any check on this day. Schema Quality & AI Usability went from 50 to 53. Other categories moved too: Stability & Change Management rose 3.
- 27 Jul 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 26 Jul 26 59
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 3 Aug 2026 · Probed https://corply.dev/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=corply.dev | CN=WR3,O=Google Trust Services,C=US | 15 Jun 2026 | 13 Sept 2026 | RSA 2048 | SHA256-RSA | 66605b17a01911f212a28de0d46d10db |
| SANs: corply.dev | ||||||
| CN=WR3,O=Google Trust Services,C=US (CA) | CN=GTS Root R1,O=Google Trust Services LLC,C=US | 13 Dec 2023 | 20 Feb 2029 | RSA 2048 | SHA256-RSA | 7ff005a91568d63abc22861684aa4b5a |
| CN=GTS Root R1,O=Google Trust Services LLC,C=US (CA) | CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE | 19 Jun 2020 | 28 Jan 2028 | RSA 4096 | SHA256-RSA | 77bd0d6cdb36f91aea210fc4f058d30d |
DNSSEC secure
Validation of corply.dev. — Secure
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| dev. | present | 60074 | 8 | Verified |
| corply.dev. | present | 359 | 8 | Verified |
| corply.dev. | Verified address RRset verified with the apex keys |
Authentication Enforced and verified
The endpoint asked for a token and published valid RFC 9728 metadata describing how to get one.
| Result | Enforced and verified |
|---|---|
| Enforced | On tool calls |
| HTTP status | 200 |
WWW-Authenticate challenge Bearer resource_metadata="https://corply.dev/.well-known/oauth-protected-resource"
Bearer resource_metadata="https://corply.dev/.well-known/oauth-protected-resource"Protected resource metadata
| Document | https://corply.dev/.well-known/oauth-protected-resource |
|---|---|
| Retrieved | Yes |
| Resource | https://corply.dev |
| Authorisation server | https://corply.dev |
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://corply.dev/mcp | Verified | 200 | |
| http (plaintext) | http://corply.dev/mcp | HTTPS enforced | 302 | https://corply.dev/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.
submit_for_formation ~140
Requires the incorporation fee to be PAID first (request_payment → await_payment). Hand the fully-signed formation to the human filing pipeline, then best-effort notify the organization and email the signed incorporation documents to each founder. Does NOT file with Delaware. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; refresh get_company_briefing after material change. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: obtain fresh, explicit user confirmation before calling.
| Name | Type | Req | Description |
|---|---|---|---|
| formationId | string | yes | — |
No output schema declared.
No examples provided.
submit_operating_fact_evidence ~261
Submit one founder-provided document for an evidence-confirmed operating fact. This stages the exact typed assertion, binds the server-verified immutable artifact, and creates a durable operator-review claim. Submission never makes the fact canonical and the resolver will continue to ask for it until an operator approves the exact claim. filePath/fileHash must come from upload_operating_evidence. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; refresh get_company_briefing after material change. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.
| Name | Type | Req | Description |
|---|---|---|---|
| companyId | string | yes | — |
| factKey | string | yes | — |
| fileHash | string | yes | — |
| filePath | string | yes | — |
| idempotencyKey | string | yes | — |
| sourceObservedAt | string | yes | — |
| sourceReference | string | yes | — |
| subjectId | — | yes | — |
| title | string | yes | — |
| value | — | yes | — |
No output schema declared.
No examples provided.
transition_operating_work_item ~261
Transition one materialized work occurrence by workItemId, then freshly resolve the company plan. Completion is rejected until attached company evidence covers every requirement and required human/professional boundaries. Legal, tax, regulatory, provider, and contractual requirements cannot be waived; change facts only with truthful evidence. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; refresh get_company_briefing after material change. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: obtain fresh, explicit user confirmation before calling.
| Name | Type | Req | Description |
|---|---|---|---|
| companyId | string | — | corply_companies.id. May be omitted only when the active organization has exactly one company. |
| evidenceEventIds | array | — | — |
| expectedFromStatus | string | — | Optimistic-concurrency guard from the latest plan. |
| idempotencyKey | string | — | — |
| itemLimit | integer | yes | Maximum items returned per actionable/blocked/waiting section. |
| questionLimit | integer | yes | Maximum targeted missing-fact questions returned. |
| reason | string | — | — |
| toStatus | string | yes | — |
| workItemId | string | yes | — |
No output schema declared.
No examples provided.
update_agent_wallet ~240
Change an agent wallet: 'topup' adds budget, 'freeze'/'unfreeze' pause and resume spending, 'close' ends it permanently, 'set_caps' changes the per-transaction cap, categories, or expiry. Confirm the exact change with the founder before calling. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; refresh get_company_briefing after material change. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: obtain fresh, explicit user confirmation before calling.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | — |
| allowedCategories | — | — | New category allowlist; null removes the restriction; omit to leave unchanged. |
| expiresAt | — | — | New ISO expiry; null removes the expiry; omit to leave unchanged. |
| perTransactionCapCents | — | — | New per-transaction cap in cents; null removes the cap. |
| topUpCents | integer | — | Top-up amount in integer cents (e.g. $2,000 → 200000). |
| walletId | string | yes | — |
No output schema declared.
No examples provided.
upload_operating_evidence ~256
Store exact caller-supplied evidence bytes in the active company's private canonical evidence prefix and return the server-computed SHA-256 needed by record_operating_evidence. Use only when the client has supplied the actual base64 file bytes; never invent bytes from a description. Browser/desktop clients should use POST /operating/evidence/upload for files larger than the MCP limit. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; refresh get_company_briefing after material change. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.
| Name | Type | Req | Description |
|---|---|---|---|
| companyId | string | — | corply_companies.id. May be omitted only when the active organization has exactly one company. |
| contentType | string | — | — |
| dataBase64 | string | yes | Canonical RFC 4648 base64 for the exact file bytes, without a data-URL prefix. |
| fileName | string | yes | — |
No output schema declared.
No examples provided.
upsert_operating_subject ~355
Create or update one durable company-owned subject, including a person, location, product, offering, customer, vendor, contract, equity award, account, or obligation, then freshly resolve the plan. Use a stable externalKey; store decision facts through record_operating_fact, not opaque attributes. Never fabricate personal, immigration, or credential data. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; refresh get_company_briefing after material change. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.
| Name | Type | Req | Description |
|---|---|---|---|
| attributes | object | — | Allowlisted integration linkage only. Citizenship, visa, tax, ID, health, credential, compensation, and other decision data must be typed facts. |
| companyId | string | — | corply_companies.id. May be omitted only when the active organization has exactly one company. |
| displayName | string | yes | — |
| externalKey | string | yes | Stable caller-controlled identity, e.g. founder:<uuid> or product:billing. |
| itemLimit | integer | yes | Maximum items returned per actionable/blocked/waiting section. |
| linkedUserId | — | — | Owner/operator-only account link for subject-self private access. Omit to preserve; null to unlink. The target must be an active org member. |
| questionLimit | integer | yes | Maximum targeted missing-fact questions returned. |
| status | string | yes | — |
| subjectType | string | yes | — |
No output schema declared.
No examples provided.
validate_application ~144
Validate the formation application and return missing fields as dotted paths. Promotes the formation to 'ready' when complete and returns the canonical next step. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; refresh get_company_briefing after material change. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.
| Name | Type | Req | Description |
|---|---|---|---|
| formationId | string | yes | — |
No output schema declared.
No examples provided.
verify_payment_integration ~259
Inventory caller-reported local/sandbox evidence references against every required Corply Pay control: build/type tests, webhook authenticity/idempotency/out-of-order delivery, subscription lifecycle, deny-by-default entitlements, tenant isolation, return-URL validation, secret scan, and sandbox checkout. This tool reports only whether that caller-supplied inventory is complete; it does not execute or independently attest commands, establish sandbox or production readiness, or make provider calls. Passed/failed results require the exact command and a SHA-256 evidence reference. Evidence inventory completeness NEVER completes KYB/KYC, terms, payout-bank, provider approval, refunds, money movement, migrations, deployment, or production go-live; report those as explicit unverified human/external actions and require fresh founder confirmation for any later live action. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: reads current server state and does not manufacture company facts. Idempotency: safe to repeat. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.
| Name | Type | Req | Description |
|---|---|---|---|
| checks | array | yes | — |
| manifest | object | yes | — |
No output schema declared.
No examples provided.
wallet_spend ~275
Spend from an agent wallet the founder configured. The wallet's budget, per-transaction cap, categories, and expiry ARE the founder's standing authorization — an in-policy spend posts immediately without another confirmation. If the spend falls outside policy the result is APPROVAL_REQUIRED with an approvalId: surface it to the founder and do not retry; the founder decides with respond_to_approval. If a call times out, check list_bank_activity for the posted spend before retrying — never blind-retry. Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: invokes the shared backend action; refresh get_company_briefing after material change. Idempotency: obey the tool-specific retry key or guarantee; if none is stated, inspect refreshed state before retrying. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.
| Name | Type | Req | Description |
|---|---|---|---|
| amountCents | integer | yes | Spend amount in integer cents (e.g. $2,000 → 200000). |
| category | string | — | Spend category, e.g. 'software'. |
| counterparty | string | yes | Merchant or payee. |
| memo | string | — | — |
| walletId | string | yes | — |
No output schema declared.
No examples provided.
whoami ~117
Return the resolved caller identity (user + org). If pendingInvites is non-empty, tell the user and OFFER to join (confirm before redeem_invite). Prerequisite: authenticated active organization access plus every prerequisite stated above. Canonicality: reads current server state and does not manufacture company facts. Idempotency: safe to repeat. Confirmation boundary: no additional confirmation is needed for this read, reversible save, explicit fact/evidence record, link preparation, plan refresh, or action pre-authorized by a standing founder-configured policy.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.