{"$schema":"https://verifymcp.io/schemas/trust-report.json","schemaVersion":1,"license":{"name":"CC BY-NC 4.0","url":"https://creativecommons.org/licenses/by-nc/4.0/"},"generatedAt":"2026-11-06T17:18:13.481Z","url":"https://verifymcp.io/servers/dev-apexly-mcp/mcp","markdownUrl":"https://verifymcp.io/servers/dev-apexly-mcp/mcp.md","server":{"slug":"dev-apexly-mcp","name":"Apexly","registryName":"dev.apexly/mcp","description":"Add, check, diagnose and remove your SaaS customers' custom domains from any MCP client.","registryStatus":"active","deletedAt":null,"statusMessage":null,"liveness":"live","publisher":{"class":"unknown","claimed":false}},"component":{"slug":"mcp","type":"remote","identifier":"https://mcp.apexly.dev/mcp","withdrawn":false,"url":"https://verifymcp.io/servers/dev-apexly-mcp/mcp","version":"1.0.0","transport":null,"scoredAt":"2026-11-06T06:05:11.913Z"},"score":{"total":81,"tier":"high trust","status":"scored","weekDelta":3,"history":[{"date":"2026-11-06","total":81},{"date":"2026-11-05","total":80},{"date":"2026-11-04","total":80},{"date":"2026-11-03","total":79},{"date":"2026-11-02","total":79},{"date":"2026-11-01","total":78},{"date":"2026-10-31","total":78},{"date":"2026-10-30","total":78},{"date":"2026-10-29","total":77},{"date":"2026-10-28","total":77},{"date":"2026-10-27","total":36},{"date":"2026-10-26","total":36}]},"categories":[{"name":"Endpoint Security","score":89,"verdict":"fail","reasons":["The endpoint's TLS certificate is valid, in date, and uses a strong key.","Authorisation is enforced on tool calls, but the challenge carries no valid RFC 9728 metadata, so a client cannot discover where to get a token.","HTTPS is enforced; there's no plaintext access path.","The HSTS (Strict-Transport-Security) header is present.","DNSSEC check failed: this domain isn't protected by DNSSEC."],"codes":[{"code":"tls.valid","args":{}},{"code":"auth.challenge_only_invoke","args":{}},{"code":"https.enforced","args":{}},{"code":"headers.hsts_present","args":{}},{"code":"dnssec.absent","args":{}}]},{"name":"Transport & Reachability","score":100,"verdict":"pass","reasons":["Verified streamable-http transport via a live MCP handshake."],"codes":[{"code":"transport.verified","args":{"transport":"streamable-http"}}]},{"name":"Schema Quality & AI Usability","score":74,"verdict":"fail","reasons":["AI-judged instruction clarity (excellent).","Context-footprint check failed: tool/resource definitions use about 1104 tokens (~138/item across 8 items; 8 tools + 0 resources), over budget; trim descriptions and params.","Usage-examples check failed: none of the tools include examples."],"codes":[{"code":"schema.ai_quality","args":{"band":"excellent"}},{"code":"schema.footprint_heavy","args":{"avg":"138","items":"8","tools":"8","tokens":"1104","resources":"0"}},{"code":"schema.examples_absent","args":{}}]},{"name":"Stability & Change Management","score":30,"verdict":"partial","reasons":["Stability observed for 9 of 30 days with no destabilising changes; credit accrues until the full window elapses."],"codes":[{"code":"stability.building_history","args":{"days":"9"}}]},{"name":"Tool Coverage","score":96,"verdict":"partial","reasons":["100% of tools have a non-trivial description (not blank, and not just the tool's name).","87% of tool parameters carry a description."],"codes":[{"code":"toolquality.descriptions","args":{"pct":"100"}},{"code":"toolquality.param_docs","args":{"pct":"87"}}]},{"name":"Tool Safety","score":100,"verdict":"pass","reasons":["No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.","All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.","An AI judge read all 9 captured unit(s) of tool text and found none that tries to manipulate the model reading it."],"codes":[{"code":"toolsafety.injection_clean","args":{}},{"code":"toolsafety.destructive_declared","args":{"pct":"100","annotated":"1","destructive":"1"}},{"code":"toolsafety.manipulation_clean","args":{"units":"9","judged":"9"}}]},{"name":"Capabilities","score":100,"verdict":"pass","reasons":["Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28."],"codes":[{"code":"protocol.supported","args":{"latest":"2026-07-28","version":"2025-11-25"}}]}],"inconclusive":[],"malware":[],"components":[{"slug":"mcp","type":"remote","identifier":"https://mcp.apexly.dev/mcp","withdrawn":false,"score":81,"current":true,"url":"https://verifymcp.io/servers/dev-apexly-mcp/mcp","markdownUrl":"https://verifymcp.io/servers/dev-apexly-mcp/mcp.md"}],"facts":[{"label":"Endpoint","value":"https://mcp.apexly.dev/mcp"},{"label":"Transports","value":"streamable-http"},{"label":"Auth","value":"required (not validated)"},{"label":"Version","value":"1.0.0"}],"install":{"available":true,"bundleSha256":null},"tools":[{"name":"create_domain","title":"Add a custom domain","description":"Add a customer's hostname (e.g. careers.acme.com or acme.com) to the app this API key belongs to. Idempotent: adding a hostname the app already has returns the existing domain. The domain starts in pending_dns; the customer must then add the DNS record in status_explained / get_dns_instructions, or open the connect_url to be guided through it. Apexly checks DNS every 15 seconds and issues the TLS certificate itself. With a test key (sk_test_…) the domain is a sandbox one that goes active by itself in about 30 seconds. Never invent a hostname: ask the user which one.","inputs":[{"name":"apex_redirect","type":"string","required":false,"description":"Apex domains only: also serve www.<apex> and redirect it"},{"name":"hostname","type":"string","required":true,"description":"The customer's hostname, no scheme or path, e.g. careers.acme.com"},{"name":"metadata","type":"object","required":false,"description":"Any JSON object up to 4 KB, e.g. {\"customer\": \"Acme\", \"tenant_id\": \"42\"}"},{"name":"origin","type":"string","required":false,"description":"Per-domain origin override (paid plans); omit to use the app origin"}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":237},{"name":"get_domain","title":"Get a domain","description":"Current state of one domain: status (pending_dns → verifying → issuing → active; or dns_broken, cert_failed, held, expired), the DNS record the customer must add, the connect_url and the certificate. status_explained says in one sentence why it is in that status and what to do next. Use it to poll after create_domain or verify_domain.","inputs":[{"name":"id","type":"string","required":true,"description":"The domain id (dom_…), from create_domain or list_domains"}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":103},{"name":"list_domains","title":"List domains","description":"The app's domains, newest first, one page at a time. Pass next_cursor back as cursor for the next page (null means there are no more). Filter by status or by hostname prefix to find a domain id.","inputs":[{"name":"cursor","type":"string","required":false,"description":"next_cursor of the previous page"},{"name":"hostname","type":"string","required":false,"description":"Hostname prefix, e.g. careers."},{"name":"limit","type":"integer","required":false,"description":null},{"name":"status","type":"string","required":false,"description":null}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":95},{"name":"verify_domain","title":"Check a domain now","description":"Queue a DNS check right away instead of waiting for the next scheduled one; use it after the customer says they added the record. On cert_failed it retries the certificate. At most one per 15 seconds per domain. The check runs in the background: call get_domain a few seconds later for the result.","inputs":[{"name":"id","type":"string","required":true,"description":"The domain id (dom_…), from create_domain or list_domains"}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":90},{"name":"get_connect_url","title":"Get the connect page link","description":"The link to send the customer (the domain owner): a page branded with the app that detects their DNS provider, shows the exact record with copy buttons and tells them when the domain is live. Prefer it when the customer is not technical. It is safe to share with the customer, not publicly.","inputs":[{"name":"id","type":"string","required":true,"description":"The domain id (dom_…), from create_domain or list_domains"}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":89},{"name":"get_dns_instructions","title":"DNS instructions for the customer","description":"The exact DNS record(s) the customer must add for this domain, plus step-by-step instructions for their DNS provider (detected from the domain's nameservers: GoDaddy, Cloudflare, Namecheap, Route 53 and ~40 more; generic steps otherwise). Record names are relative to the registrable domain (\"careers\" in acme.com, \"@\" for the apex).","inputs":[{"name":"id","type":"string","required":true,"description":"The domain id (dom_…), from create_domain or list_domains"}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":108},{"name":"diagnose_domain","title":"Diagnose a domain","description":"Why a domain is not live and what to change (the domain doctor, same as GET /v1/domains/{id}/diagnose): runs every check live (the record at 1.1.1.1, 8.8.8.8 and the domain's own nameservers, other A and stale AAAA records, the Cloudflare proxy, CAA, the certificate, the origin, the www pair). Each check is pass, fail, warn or skip with what we saw (detail) and what to change (fix); blocking_check_id is the one to fix first. status_explained says why the domain is in its status. Use it when a domain stays in pending_dns, dns_broken or cert_failed, then relay the fix to the customer. Results are reused for 20 seconds.","inputs":[{"name":"id","type":"string","required":true,"description":"The domain id (dom_…), from create_domain or list_domains"}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":196},{"name":"delete_domain","title":"Delete a domain","description":"Remove a domain: it stops being served within 5 seconds and its certificate is dropped. Irreversible (adding the hostname again starts over with a new record). Only call it after the user explicitly confirmed deleting this hostname, and pass confirm: true.","inputs":[{"name":"confirm","type":"boolean","required":false,"description":"Must be true: the user confirmed deleting this domain"},{"name":"id","type":"string","required":true,"description":"The domain id (dom_…), from create_domain or list_domains"}],"outputs":[],"hasOutputSchema":false,"hasExamples":false,"tokenEstimate":96}],"toolsTruncatedAtCapture":false,"diagnostics":{"capturedAt":"2026-11-06T06:05:11.000Z","track":"remote","endpoint":"https://mcp.apexly.dev/mcp","declaredUrl":null,"truncated":false,"tls":{"outcome":"valid","label":"Valid","version":"TLS 1.3","cipherSuite":"TLS_AES_128_GCM_SHA256","chainError":null,"certificates":[{"subject":"CN=mcp.apexly.dev","issuer":"CN=YE1,O=Let's Encrypt,C=US","notBefore":"2026-10-24T10:45:19Z","notAfter":"2027-01-22T10:45:18Z","keyType":"ECDSA","keyBits":256,"isCa":false},{"subject":"CN=YE1,O=Let's Encrypt,C=US","issuer":"CN=Root YE,O=ISRG,C=US","notBefore":"2025-09-03T00:00:00Z","notAfter":"2028-09-02T23:59:59Z","keyType":"ECDSA","keyBits":384,"isCa":true},{"subject":"CN=Root YE,O=ISRG,C=US","issuer":"CN=ISRG Root X2,O=Internet Security Research Group,C=US","notBefore":"2026-05-13T00:00:00Z","notAfter":"2032-09-02T23:59:59Z","keyType":"ECDSA","keyBits":384,"isCa":true},{"subject":"CN=ISRG Root X2,O=Internet Security Research Group,C=US","issuer":"CN=ISRG Root X1,O=Internet Security Research Group,C=US","notBefore":"2026-05-13T00:00:00Z","notAfter":"2032-09-02T23:59:59Z","keyType":"ECDSA","keyBits":384,"isCa":true}]},"dnssec":{"result":"insecure","label":"Not signed","name":"mcp.apexly.dev.","steps":[{"zone":".","outcome":"verified","label":"Verified"},{"zone":"dev.","outcome":"verified","label":"Verified"},{"zone":"apexly.dev.","outcome":"insecure_proven","label":"Unsigned (proven)"}]},"auth":{"outcome":"challenged_unvalidated","label":"Challenged, unverified","gate":"invoke","gateLabel":"On tool calls","status":200,"authorizationServers":[]},"httpsRedirect":{"outcome":"https_enforced","label":"HTTPS enforced","status":308},"transports":[{"transport":"streamable-http","outcome":"verified","label":"Verified","status":200,"followed":false}],"provenance":null,"installScripts":[],"installScriptsTotal":null,"vulnerabilities":[],"vulnerabilitiesTotal":null,"dependencies":null},"mismatches":[],"changelog":{"trackingSince":"2026-10-26","recent":[{"id":"chg_01a1af76-0d81-7d84-8f5d-63fcfac2ea05","kind":"score.rubric_changed","summary":"We updated how we score, so this day's move reflects our rubric, not a change to the server","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-11-06","url":"https://verifymcp.io/servers/dev-apexly-mcp/mcp#chg-chg_01a1af76-0d81-7d84-8f5d-63fcfac2ea05"},{"id":"chg_01a1a529-31de-7dc2-a97c-f8e18ec09ec4","kind":"score.total_changed","summary":"Trust score (79 → 80)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-11-04","url":"https://verifymcp.io/servers/dev-apexly-mcp/mcp#chg-chg_01a1a529-31de-7dc2-a97c-f8e18ec09ec4"},{"id":"chg_01a19adc-1a99-73f7-a39f-103e1b22ff11","kind":"score.total_changed","summary":"Trust score (78 → 79)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-11-02","url":"https://verifymcp.io/servers/dev-apexly-mcp/mcp#chg-chg_01a19adc-1a99-73f7-a39f-103e1b22ff11"},{"id":"chg_01a18b66-99d8-7188-900a-f1a7399803fb","kind":"score.total_changed","summary":"Trust score (77 → 78)","materiality":"functional","direction":"improvement","scoreDelta":1,"occurredOn":"2026-10-30","url":"https://verifymcp.io/servers/dev-apexly-mcp/mcp#chg-chg_01a18b66-99d8-7188-900a-f1a7399803fb"},{"id":"chg_01a18644-db45-7c6b-b1b9-0c1fc9fa9f19","kind":"check.reverified","summary":"Stability (unverified → 0.03)","materiality":"functional","direction":"improvement","scoreDelta":null,"occurredOn":"2026-10-29","url":"https://verifymcp.io/servers/dev-apexly-mcp/mcp#chg-chg_01a18644-db45-7c6b-b1b9-0c1fc9fa9f19"},{"id":"chg_01a1811c-2524-7040-9831-e3376826bb61","kind":"check.reverified","summary":"Transport (unverified → pass)","materiality":"security","direction":"improvement","scoreDelta":null,"occurredOn":"2026-10-28","url":"https://verifymcp.io/servers/dev-apexly-mcp/mcp#chg-chg_01a1811c-2524-7040-9831-e3376826bb61"},{"id":"chg_01a1811c-2524-7bff-a2a6-30684c234b98","kind":"check.reverified","summary":"Injection markers (unverified → pass)","materiality":"security","direction":"improvement","scoreDelta":null,"occurredOn":"2026-10-28","url":"https://verifymcp.io/servers/dev-apexly-mcp/mcp#chg-chg_01a1811c-2524-7bff-a2a6-30684c234b98"},{"id":"chg_01a1811c-2525-7374-8d46-f39ceb3969c9","kind":"check.reason","summary":"Authorization (Authorisation is enforced on tool calls, but the challenge carries no valid RFC 9728 metadata, so a client cannot discover where to get a token.)","materiality":"security","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-28","url":"https://verifymcp.io/servers/dev-apexly-mcp/mcp#chg-chg_01a1811c-2525-7374-8d46-f39ceb3969c9"},{"id":"chg_01a1811c-2525-78f3-9fb4-e867db98a031","kind":"check.appeared","summary":"First check of Judged manipulation (pass)","materiality":"security","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-28","url":"https://verifymcp.io/servers/dev-apexly-mcp/mcp#chg-chg_01a1811c-2525-78f3-9fb4-e867db98a031"},{"id":"chg_01a1811c-2525-7e27-91dc-6c996fcd7efc","kind":"check.reverified","summary":"MCP protocol (unverified → pass)","materiality":"functional","direction":"improvement","scoreDelta":null,"occurredOn":"2026-10-28","url":"https://verifymcp.io/servers/dev-apexly-mcp/mcp#chg-chg_01a1811c-2525-7e27-91dc-6c996fcd7efc"},{"id":"chg_01a1811c-2526-7704-b3d8-ed8ac6ea7f92","kind":"check.reverified","summary":"Tool coverage (unverified → 100)","materiality":"functional","direction":"improvement","scoreDelta":null,"occurredOn":"2026-10-28","url":"https://verifymcp.io/servers/dev-apexly-mcp/mcp#chg-chg_01a1811c-2526-7704-b3d8-ed8ac6ea7f92"},{"id":"chg_01a1811c-2526-7ded-890d-2bde3ac8b41b","kind":"check.appeared","summary":"First check of Tool coverage (87)","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-28","url":"https://verifymcp.io/servers/dev-apexly-mcp/mcp#chg-chg_01a1811c-2526-7ded-890d-2bde3ac8b41b"},{"id":"chg_01a1811c-2527-75b1-9529-0ef95309fd62","kind":"check.appeared","summary":"First check of Schema quality (fail)","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-28","url":"https://verifymcp.io/servers/dev-apexly-mcp/mcp#chg-chg_01a1811c-2527-75b1-9529-0ef95309fd62"},{"id":"chg_01a1811c-2527-7bcb-9e95-c7993cf02428","kind":"check.appeared","summary":"First check of Schema quality (excellent)","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-28","url":"https://verifymcp.io/servers/dev-apexly-mcp/mcp#chg-chg_01a1811c-2527-7bcb-9e95-c7993cf02428"},{"id":"chg_01a1811c-2528-7380-b4b9-504952252214","kind":"check.appeared","summary":"First check of Schema quality (fail)","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-28","url":"https://verifymcp.io/servers/dev-apexly-mcp/mcp#chg-chg_01a1811c-2528-7380-b4b9-504952252214"},{"id":"chg_01a1811c-2528-7924-b721-0a46a5252923","kind":"check.appeared","summary":"First check of Destructive annotations (100)","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-28","url":"https://verifymcp.io/servers/dev-apexly-mcp/mcp#chg-chg_01a1811c-2528-7924-b721-0a46a5252923"},{"id":"chg_01a1811c-2528-7f37-a9d7-0f81dcd92289","kind":"score.total_changed","summary":"Trust score (36 → 77)","materiality":"functional","direction":"improvement","scoreDelta":41,"occurredOn":"2026-10-28","url":"https://verifymcp.io/servers/dev-apexly-mcp/mcp#chg-chg_01a1811c-2528-7f37-a9d7-0f81dcd92289"},{"id":"chg_01a17882-faf6-7ed5-a6b7-2f880bbbc2e0","kind":"score.first_scored","summary":"First indexed and scored","materiality":"functional","direction":"neutral","scoreDelta":null,"occurredOn":"2026-10-26","url":"https://verifymcp.io/servers/dev-apexly-mcp/mcp#chg-chg_01a17882-faf6-7ed5-a6b7-2f880bbbc2e0"}],"truncated":false,"feedUrl":"https://verifymcp.io/servers/dev-apexly-mcp/mcp/changelog.json"},"links":{"html":"https://verifymcp.io/servers/dev-apexly-mcp/mcp","markdown":"https://verifymcp.io/servers/dev-apexly-mcp/mcp.md","changelogJson":"https://verifymcp.io/servers/dev-apexly-mcp/mcp/changelog.json","changelogRss":"https://verifymcp.io/servers/dev-apexly-mcp/mcp.xml","external":[{"label":"Remote endpoint","href":"https://mcp.apexly.dev/mcp"},{"label":"Authorisation metadata","href":"https://mcp.apexly.dev/.well-known/oauth-protected-resource/mcp"},{"label":"Website","href":"https://docs.apexly.dev/guides/mcp"}]}}