Human For AI
REMOTE · HUMANFORAI.DEV · 2 COMPONENTS · SCANNED SEP 22
Hire a real human for real-world verification, product testing, AI output review, and errands.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security63
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation not fully verified: no authorisation is required to call this server, and 3 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe. See how to fix → View diagnostics → Unverified
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability78
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 1916 tokens (~273/item across 7 items; 6 tools + 1 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 6 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 8 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
- Supports UI / widget rendering.Pass
How do I install the Human For AI MCP server?
Human For AI is a hosted endpoint at https://humanforai.dev/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · humanforai.dev
claude mcp add --transport http dev-humanforai-humanforai 'https://humanforai.dev/mcp'
{
"mcpServers": {
"dev-humanforai-humanforai": {
"url": "https://humanforai.dev/mcp"
}
}
} {
"servers": {
"dev-humanforai-humanforai": {
"type": "http",
"url": "https://humanforai.dev/mcp"
}
}
} [mcp_servers.dev-humanforai-humanforai] url = "https://humanforai.dev/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"dev-humanforai-humanforai": {
"type": "remote",
"url": "https://humanforai.dev/mcp",
"enabled": true
}
}
} openclaw mcp add dev-humanforai-humanforai --url 'https://humanforai.dev/mcp' --transport streamable-http
mcp_servers:
dev-humanforai-humanforai:
url: "https://humanforai.dev/mcp" {
"McpServers": {
"dev-humanforai-humanforai": {
"Transport": "http",
"Url": "https://humanforai.dev/mcp"
}
}
} assistant mcp add dev-humanforai-humanforai -t streamable-http -u 'https://humanforai.dev/mcp'
{
"mcpServers": {
"dev-humanforai-humanforai": {
"type": "http",
"url": "https://humanforai.dev/mcp"
}
}
} The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 14 Sept 26 +2
- Tool “check_task_status” rewrote its description, which is the text the model reads security
- Tool “submit_human_task” rewrote its description, which is the text the model reads security
- The server now declares the “resources” capability functional
- First check of Schema quality: 100 functional
- First check of Capabilities: pass functional
- New resource “Task status card” functional
- Server version: 1.8.0 → 1.9.0 functional
- 30 Aug 26 0
- The server rewrote its instructions, which are the text every model session reads security
- Tool “message_human_operator” rewrote its description, which is the text the model reads security
- Schema quality: 357 → 298 ▲ functional
- Server version: 1.7.0 → 1.8.0 functional
- New tool “reply_in_message_thread” functional
- New tool “check_message_thread” functional
- “message_human_operator” reworded the description of “reply_to” cosmetic
- 26 Aug 26 +1
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 25 Aug 26 0
- Stability: 0.97 → pass security
- 11 Aug 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 31 Jul 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 30 Jul 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 27 Jul 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 22 Sept 2026 · Probed https://humanforai.dev/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=humanforai.dev | CN=WR3,O=Google Trust Services,C=US | 3 Sept 2026 | 2 Dec 2026 | RSA 2048 | SHA256-RSA | bffaa0b6296291e7123b90b7662b4ccd |
| SANs: humanforai.dev | ||||||
| CN=WR3,O=Google Trust Services,C=US (CA) | CN=GTS Root R1,O=Google Trust Services LLC,C=US | 13 Dec 2023 | 20 Feb 2029 | RSA 2048 | SHA256-RSA | 7ff005a91568d63abc22861684aa4b5a |
| CN=GTS Root R1,O=Google Trust Services LLC,C=US (CA) | CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE | 19 Jun 2020 | 28 Jan 2028 | RSA 4096 | SHA256-RSA | 77bd0d6cdb36f91aea210fc4f058d30d |
| CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE (CA) | CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE | 1 Sept 1998 | 28 Jan 2028 | RSA 2048 | SHA1-RSA | 40000000001154b5ac394 |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of humanforai.dev. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| dev. | present | 60074 | 8 | Verified |
| humanforai.dev. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
| Header | Value |
|---|---|
| strict-transport-security | max-age=31556926 |
| content-security-policy | default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src https://fonts.gstatic.com; img-src 'self' data:; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; object-src 'none' |
| x-content-type-options | nosniff |
| x-frame-options | DENY |
| referrer-policy | strict-origin-when-cross-origin |
| permissions-policy | camera=(), microphone=(), geolocation=() |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://humanforai.dev/mcp | Verified | 200 | |
| http (plaintext) | http://humanforai.dev/mcp | HTTPS enforced | 301 | https://humanforai.dev/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
check_message_thread Read a message thread ~127
Read the thread for a message you sent: the original text, every reply oldest-first, and whether the operator has answered. Needs the message_id and the access_token from the submission response. An empty replies list means no answer yet — the operator works at human speed, so poll occasionally rather than in a loop.
| Name | Type | Req | Description |
|---|---|---|---|
| access_token | string | yes | The access_token returned once at submission — the only key to the thread. |
| message_id | string | yes | The message id from message_human_operator, e.g. MSG-2026-1A2B3C4D |
No output schema declared.
No examples provided.
check_task_status Check task status ~204
Look up a submitted task by its task_id. Returns current status (submitted → accepted → delivered, or rejected), status history with timestamps, seen_by_operator_at (the moment a human actually saw the task — usually well before the first status change), eta (operator-set delivery estimate, once accepted), and any operator notes. Once delivered, the response also carries receipt (a signed JWS binding the deliverable's sha256 to the lifecycle timestamps) and deliverable_sha256 — verify offline against https://humanforai.dev/.well-known/jwks.json. In hosts that support MCP Apps the result also renders as a task status card (timeline, seen-by-human moment, ETA, operator notes, receipt) with a Refresh button; the JSON result carries the same data.
| Name | Type | Req | Description |
|---|---|---|---|
| task_id | string | yes | Task ID returned by submit_human_task, e.g. HFAI-2026-A1B2C3D4E5F60718 |
No output schema declared.
No examples provided.
get_human_services List human services ~79
Fetch the Human For AI manifest: available services, operator profile (location, languages, working hours), response times, accepted and rejected task types, and trust & safety policy. Call this first to decide whether and how to hire the human. The catalog is examples, not limits — unlisted needs are welcome as custom_human_in_the_loop.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
message_human_operator Message the human operator ~183
Send a free-form message to the human operator — questions, scoping, custom or recurring projects, anything that is not yet a ready-made task. reply_to is REQUIRED: an email a human can read (MX-checked), or an https URL to receive the reply as a signed webhook push. The response also carries thread_url + access_token — every message is a pollable thread, so you can read the reply with check_message_thread even without a mailbox. Keep the token: it is shown only once.
| Name | Type | Req | Description |
|---|---|---|---|
| from | string | – | Your agent or system identifier |
| message | string | yes | The message. Plain language, English. |
| reply_to | string | yes | REQUIRED. Email address for the reply (real, reachable, MX-checked) — or an https webhook URL for a signed push. |
| subject | string | – | Short subject line |
No output schema declared.
No examples provided.
reply_in_message_thread Follow up in a message thread ~105
Add a follow-up to a thread you opened — answer a question the operator asked, add detail, correct yourself, or withdraw the request. Prefer this over sending a brand-new message about the same subject. Needs the message_id and access_token from the submission response.
| Name | Type | Req | Description |
|---|---|---|---|
| access_token | string | yes | The access_token returned once at submission |
| message | string | yes | The follow-up text |
| message_id | string | yes | The message id from message_human_operator |
No output schema declared.
No examples provided.
submit_human_task Submit a task to the human ~475
Submit a task for the human operator to perform in the real world. Returns a task_id immediately; the human reviews every task before accepting it (this is not instant execution). The operator is push-notified on submission; check_task_status shows seen_by_operator_at once a human has seen the task. Free during the pilot. contact_email must be a real mailbox (MX-checked) — it is how the deliverable reaches you. No mailbox? Set delivery to 'status_poll' instead: the deliverable arrives as text in operator_notes via check_task_status (limited to 1 such task per client per day). In hosts that support MCP Apps the result also renders as a task status card with a Refresh button; the JSON result carries the same data.
| Name | Type | Req | Description |
|---|---|---|---|
| contact_email | string | – | Where the deliverable and clarifying questions are sent. Required unless delivery is 'status_poll'. Must be a real, reachable mailbox — placeholder domains are rejected and the domain is MX-checked. |
| deadline | string | – | ISO 8601 datetime, e.g. 2026-07-10T12:00:00+03:00 |
| delivery | string | – | How the deliverable reaches you. 'email' (default) needs contact_email. 'status_poll' is the no-mailbox path for autonomous agents: the result arrives as text in operator_notes via check_task_status… |
| description | string | yes | What to do, where, and what success looks like. Specific, self-contained tasks are accepted faster. |
| location_detail | string | – | City, address, or area — required in practice when location_required is true |
| location_required | boolean | – | true if the task needs physical presence (coverage is confirmed at review) |
| output_format | string | – | text_report (default), text_report_with_photos, structured_json, annotated_screenshots, or video |
| requester | string | – | Your agent or system identifier, e.g. my-agent/1.0 |
| task_type | string | yes | Service category — see get_human_services for descriptions. The list is not exhaustive: use custom_human_in_the_loop for anything that fits no other category |
No output schema declared.
No examples provided.
What is the Human For AI MCP server?
Human For AI is an MCP server listed in the public MCP registry as dev.humanforai/humanforai. Hire a real human for real-world verification, product testing, AI output review, and errands. This page covers its hosted endpoint (https://humanforai.dev/mcp).
Is the Human For AI MCP server safe to use?
Human For AI scores 81 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Human For AI MCP server expose?
Human For AI exposes 6 tools: get_human_services, submit_human_task, check_task_status, message_human_operator, check_message_thread, reply_in_message_thread. Their descriptions and schemas cost roughly 1,173 tokens of context every time the server is loaded.
Does the Human For AI MCP server require authentication?
No. We connected to Human For AI without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the Human For AI MCP server still maintained?
Human For AI is still listed as active in the MCP registry. We last reached this channel on 22 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.