dev.mcphost/mcphost
REMOTE · MCPHOST.DEV · SCANNED OCT 12
Hosted MCP runtime where your agent publishes its own tools by tool call and keeps working.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security97
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation is enforced on tool calls, advertised via RFC 9728 protected-resource metadata. Discovery is public, which costs nothing: no tool can be invoked without a token. View diagnostics → Pass
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
- The authorisation server supports Client ID Metadata Documents, the current MCP client-registration mechanism. View diagnostics → Pass
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability60
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 3997 tokens (~285/item across 14 items; 14 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management23
- Stability check failed: schema churn in the 30 days we've observed: 36 tool removals, 0 breaking changes, 0 auth/transport breaks, 3 additions. See how to fix → Fail
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "host.tool_publish" implies "publish" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 15 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
How do I install the dev.mcphost/mcphost MCP server?
dev.mcphost/mcphost is a hosted endpoint at https://mcphost.dev/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · mcphost.dev
claude mcp add --transport http dev-mcphost-mcphost 'https://mcphost.dev/mcp'
{
"mcpServers": {
"dev-mcphost-mcphost": {
"url": "https://mcphost.dev/mcp"
}
}
} {
"servers": {
"dev-mcphost-mcphost": {
"type": "http",
"url": "https://mcphost.dev/mcp"
}
}
} [mcp_servers.dev-mcphost-mcphost] url = "https://mcphost.dev/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"dev-mcphost-mcphost": {
"type": "remote",
"url": "https://mcphost.dev/mcp",
"enabled": true
}
}
} openclaw mcp add dev-mcphost-mcphost --url 'https://mcphost.dev/mcp' --transport streamable-http
mcp_servers:
dev-mcphost-mcphost:
url: "https://mcphost.dev/mcp" {
"McpServers": {
"dev-mcphost-mcphost": {
"Transport": "http",
"Url": "https://mcphost.dev/mcp"
}
}
} assistant mcp add dev-mcphost-mcphost -t streamable-http -u 'https://mcphost.dev/mcp'
{
"mcpServers": {
"dev-mcphost-mcphost": {
"type": "http",
"url": "https://mcphost.dev/mcp"
}
}
} The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 12 Oct 26 −1
- HSTS header: fail → pass ▲ security
- The server changed its declared name: rmcp → mcphost security
- Tool “host.tool_publish” rewrote its description, which is the text the model reads security
- Tool “host.tool_test” rewrote its description, which is the text the model reads security
- Schema quality: 3317 → 3997 ▼ functional
- Server version: 0.107.46+contract.1.5a7228fb2ecb → 0.107.48+contract.1.5a7228fb2ecb functional
- Server version: 0.107.44+contract.1.4a049ed570d0 → 0.107.46+contract.1.5a7228fb2ecb functional
- Server version: 0.107.40+contract.1.e697cb1d3dd1 → 0.107.44+contract.1.4a049ed570d0 functional
- Server version: 3.3.0 → 0.107.40+contract.1.e697cb1d3dd1 functional
- New tool “host.feedback.list” functional
- New tool “host.feedback.send” functional
- “host.state.set” added an optional parameter “dry_run” cosmetic
- “host.tool_call” added an optional parameter “dry_run” cosmetic
- “host.tool_publish” added an optional parameter “dry_run” cosmetic
- “host.tool_test” added an optional parameter “fixtures” cosmetic
- “host.tool_publish” reworded the description of “kind” cosmetic
- “host.tool_publish” reworded the description of “spec” cosmetic
- “host.quickstart” made “kind” optional cosmetic
- 5 Oct 26 0
- The server rewrote its instructions, which are the text every model session reads security
- “billing.plans” reworded the description of “tenant_key” cosmetic
- “host.quickstart” reworded the description of “tenant_key” cosmetic
- “host.redeem” reworded the description of “tenant_key” cosmetic
- “host.state.get” reworded the description of “tenant_key” cosmetic
- “host.state.list” reworded the description of “tenant_key” cosmetic
- “host.state.set” reworded the description of “tenant_key” cosmetic
- “host.tool_call” reworded the description of “tenant_key” cosmetic
- “host.tool_publish” reworded the description of “tenant_key” cosmetic
- “host.tool_share” reworded the description of “tenant_key” cosmetic
- “host.tool_test” reworded the description of “tenant_key” cosmetic
- “host.whoami” reworded the description of “tenant_key” cosmetic
- 4 Oct 26 0
- Tool “host.tool_publish” rewrote its description, which is the text the model reads security
- Tool “host.tool_test” rewrote its description, which is the text the model reads security
- “host.tool_publish” reworded the description of “spec” cosmetic
- 3 Oct 26 −8
- Stability: 0.87 → fail ▼ security
- A breaking change shipped without a version bump: still 3.3.0 ▼ security
- Tool “billing.checkout” was removed ▼ security
- Tool “billing.status” was removed ▼ security
- Tool “host.agent.contact_accept” was removed ▼ security
- Tool “host.agent.contact_deny” was removed ▼ security
- Tool “host.agent.contact_request” was removed ▼ security
- Tool “host.agent.contacts” was removed ▼ security
- Tool “host.agent.contacts_import” was removed ▼ security
- Tool “host.agent.lookup” was removed ▼ security
- Tool “host.agent.mute” was removed ▼ security
- Tool “host.agent.profile_set” was removed ▼ security
- Tool “host.agent.search” was removed ▼ security
- Tool “host.agent.unmute” was removed ▼ security
- Tool “host.agent.whoami” was removed ▼ security
- Tool “host.bridge_test” was removed ▼ security
- Tool “host.catalog.get” was removed ▼ security
- Tool “host.catalog.search” was removed ▼ security
- Tool “host.changelog” was removed ▼ security
- Tool “host.channel.close” was removed ▼ security
- Tool “host.channel.freeze” was removed ▼ security
- Tool “host.channel.open” was removed ▼ security
- Tool “host.channel.post” was removed ▼ security
- Tool “host.channel.read” was removed ▼ security
- Tool “host.channel.unfreeze” was removed ▼ security
- Tool “host.docs.delete” was removed ▼ security
- Tool “host.docs.get” was removed ▼ security
- Tool “host.docs.index_config” was removed ▼ security
- Tool “host.docs.list” was removed ▼ security
- Tool “host.docs.purge” was removed ▼ security
- Tool “host.docs.put” was removed ▼ security
- Tool “host.docs.reindex” was removed ▼ security
- Tool “host.docs.search” was removed ▼ security
- Tool “host.docs.status” was removed ▼ security
- Tool “host.enduser.assertion_secret_rotate” was removed ▼ security
- Tool “host.enduser.audit” was removed ▼ security
- Tool “host.enduser.export” was removed ▼ security
- Tool “host.enduser.get” was removed ▼ security
- Tool “host.enduser.list” was removed ▼ security
- Tool “host.enduser.purge” was removed ▼ security
- Tool “host.enduser.revoke” was removed ▼ security
- Tool “host.enduser.unrevoke” was removed ▼ security
- Tool “host.enduser.whoami” was removed ▼ security
- Tool “host.export” was removed ▼ security
- Tool “host.group.add” was removed ▼ security
- Tool “host.group.create” was removed ▼ security
- Tool “host.group.list” was removed ▼ security
- Tool “host.group.remove” was removed ▼ security
- Tool “host.key_rotate” was removed ▼ security
- Tool “host.lineage.blast_radius” was removed ▼ security
- Tool “host.lineage.trace” was removed ▼ security
- Tool “host.lineage.trace_page” was removed ▼ security
- Tool “host.msg.ack” was removed ▼ security
- Tool “host.msg.block” was removed ▼ security
- Tool “host.msg.inbox” was removed ▼ security
- Tool “host.msg.reply” was removed ▼ security
- Tool “host.msg.send” was removed ▼ security
- Tool “host.msg.thread” was removed ▼ security
- Tool “host.msg.unblock” was removed ▼ security
- Tool “host.msg.wait” was removed ▼ security
- Tool “host.oauth.audit” was removed ▼ security
- Tool “host.oauth.audit_export” was removed ▼ security
- Tool “host.oauth.client_approve” was removed ▼ security
- Tool “host.oauth.client_deny” was removed ▼ security
- Tool “host.oauth.doctor” was removed ▼ security
- Tool “host.oauth.grant_revoke” was removed ▼ security
- Tool “host.oauth.grants” was removed ▼ security
- Tool “host.oauth.issuer_remove” was removed ▼ security
- Tool “host.oauth.issuer_set” was removed ▼ security
- Tool “host.oauth.issuers” was removed ▼ security
- Tool “host.oauth.pending” was removed ▼ security
- Tool “host.oauth.policy” was removed ▼ security
- Tool “host.oauth.policy_set” was removed ▼ security
- Tool “host.oauth.provider” was removed ▼ security
- Tool “host.oauth.provider_remove” was removed ▼ security
- Tool “host.oauth.provider_set” was removed ▼ security
- Tool “host.oauth.revoke_all” was removed ▼ security
- Tool “host.oauth.scope_set” was removed ▼ security
- Tool “host.oauth.scopes” was removed ▼ security
- Tool “host.oauth.trusted_issuer_remove” was removed ▼ security
- Tool “host.oauth.trusted_issuer_set” was removed ▼ security
- Tool “host.oauth.trusted_issuers” was removed ▼ security
- Tool “host.progress” was removed ▼ security
- Tool “host.registry_publish” was removed ▼ security
- Tool “host.runs.cancel” was removed ▼ security
- Tool “host.runs.get” was removed ▼ security
- Tool “host.runs.list” was removed ▼ security
- Tool “host.runs.part” was removed ▼ security
- Tool “host.runs.purge” was removed ▼ security
- Tool “host.runs.wait” was removed ▼ security
- Tool “host.secret_list” was removed ▼ security
- Tool “host.secret_set” was removed ▼ security
- Tool “host.self_offboard” was removed ▼ security
- Tool “host.share.caller_limit” was removed ▼ security
- Tool “host.share.caller_limit_remove” was removed ▼ security
- Tool “host.state.delete” was removed ▼ security
- Tool “host.state.delete_rows” was removed ▼ security
- Tool “host.state.insert” was removed ▼ security
- Tool “host.state.query” was removed ▼ security
- Tool “host.state.table_create” was removed ▼ security
- Tool “host.state.table_drop” was removed ▼ security
- Tool “host.table.append” was removed ▼ security
- Tool “host.table.chart” was removed ▼ security
- Tool “host.table.charts” was removed ▼ security
- Tool “host.table.create” was removed ▼ security
- Tool “host.table.describe” was removed ▼ security
- Tool “host.table.drop” was removed ▼ security
- Tool “host.table.list” was removed ▼ security
- Tool “host.table.model_set” was removed ▼ security
- Tool “host.table.models” was removed ▼ security
- Tool “host.table.query” was removed ▼ security
- Tool “host.table.schema” was removed ▼ security
- Tool “host.tool_diff” was removed ▼ security
- Tool “host.tool_history” was removed ▼ security
- Tool “host.tool_list” was removed ▼ security
- Tool “host.tool_logs” was removed ▼ security
- Tool “host.tool_remove” was removed ▼ security
- Tool “host.tool_rollback” was removed ▼ security
- Tool “host.tool_run” was removed ▼ security
- Tool “host.tool_spec_shared” was removed ▼ security
- Tool “host.tool_unshare” was removed ▼ security
- Tool “host.trigger.fire” was removed ▼ security
- Tool “host.trigger.get” was removed ▼ security
- Tool “host.trigger.list” was removed ▼ security
- Tool “host.trigger.pause” was removed ▼ security
- Tool “host.trigger.remove” was removed ▼ security
- Tool “host.trigger.replay” was removed ▼ security
- Tool “host.trigger.resume” was removed ▼ security
- Tool “host.trigger.set” was removed ▼ security
- Tool “host.trigger.test” was removed ▼ security
- Tool “host.usage” was removed ▼ security
- Tool “host.vault.connect_link” was removed ▼ security
- Tool “host.vault.disconnect” was removed ▼ security
- Tool “host.vault.provider_remove” was removed ▼ security
- Tool “host.vault.provider_set” was removed ▼ security
- Tool “host.vault.providers” was removed ▼ security
- Tool “host.vault.status” was removed ▼ security
- Schema quality: 192 → 255 ▼ functional
- 2 Oct 26 +1
- Tool “host.agent.unmute” rewrote its description, which is the text the model reads security
- Tool “host.docs.search” rewrote its description, which is the text the model reads security
- Tool “host.msg.unblock” rewrote its description, which is the text the model reads security
- Tool “host.table.drop” rewrote its description, which is the text the model reads security
- New tool “host.lineage.blast_radius” functional
- New tool “host.lineage.trace” functional
- New tool “host.lineage.trace_page” functional
- New tool “host.table.chart” functional
- New tool “host.table.charts” functional
- New tool “host.vault.connect_link” functional
- New tool “host.vault.disconnect” functional
- New tool “host.vault.provider_remove” functional
- New tool “host.vault.provider_set” functional
- New tool “host.vault.providers” functional
- New tool “host.vault.status” functional
- “host.docs.search” added an optional parameter “mode” cosmetic
- “host.table.drop” added an optional parameter “confirm” cosmetic
- 1 Oct 26 −1
We did not load change detail this far back for this component, so this day may have recorded more than is shown.
- Schema quality: 132 → 191 ▼ functional
- “billing.checkout” reworded the description of “tenant_key” cosmetic
- “billing.plans” reworded the description of “tenant_key” cosmetic
- “billing.status” reworded the description of “tenant_key” cosmetic
- “host.agent.contact_accept” reworded the description of “tenant_key” cosmetic
- “host.agent.contact_deny” reworded the description of “tenant_key” cosmetic
- “host.agent.contact_request” reworded the description of “tenant_key” cosmetic
- “host.agent.contacts” reworded the description of “tenant_key” cosmetic
- “host.agent.contacts_import” reworded the description of “tenant_key” cosmetic
- 29 Sept 26 +1
We did not load change detail this far back for this component, so this day may have recorded more than is shown.
- 28 Sept 26 +4
We did not load change detail this far back for this component, so this day may have recorded more than is shown.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 12 Oct 2026 · Probed https://mcphost.dev/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=mcphost.dev | CN=YE2,O=Let's Encrypt,C=US | 6 Sept 2026 | 5 Dec 2026 | ECDSA 256 | ECDSA-SHA384 | 6d90eafb56dfa48bc01e1e08da1962e263e |
| SANs: mcphost.dev | ||||||
| CN=YE2,O=Let's Encrypt,C=US (CA) | CN=Root YE,O=ISRG,C=US | 3 Sept 2025 | 2 Sept 2028 | ECDSA 384 | ECDSA-SHA384 | 4df3b15dd6c0784c507cd37b58e6f115 |
| CN=Root YE,O=ISRG,C=US (CA) | CN=ISRG Root X2,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | ECDSA-SHA384 | 872165fc34b6e5fba8add5b3705fb53a |
| CN=ISRG Root X2,O=Internet Security Research Group,C=US (CA) | CN=ISRG Root X1,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | SHA256-RSA | 6c8f1dc727c7117f7baf853ac980f9cd |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of mcphost.dev. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| dev. | present | 60074 | 8 | Verified |
| mcphost.dev. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication Enforced and verified
The endpoint asked for a token and published valid RFC 9728 metadata describing how to get one.
| Result | Enforced and verified |
|---|---|
| Enforced | On tool calls |
| HTTP status | 200 |
WWW-Authenticate challenge Bearer resource_metadata="https://mcphost.dev/.well-known/oauth-protected-resource", scope="mcp"
Bearer resource_metadata="https://mcphost.dev/.well-known/oauth-protected-resource", scope="mcp"| Header | Value |
|---|---|
| strict-transport-security | max-age=15552000; includeSubDomains |
Protected resource metadata
| Document | https://mcphost.dev/.well-known/oauth-protected-resource |
|---|---|
| Retrieved | Yes |
| Resource | https://mcphost.dev |
| Authorisation server | https://mcphost.dev |
| toolconf-probe |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://mcphost.dev/mcp | Verified | 200 | |
| http (plaintext) | http://mcphost.dev/mcp | HTTPS enforced | 308 | https://mcphost.dev/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
billing.plans ~145
The plan catalog (price and quotas per plan) and whether Stripe billing is configured on this host. Anonymous callers get the same answer as tenants.
| Name | Type | Req | Description |
|---|---|---|---|
| tenant_key | string | – | The key `signup` returned. Optional on the connection that ran signup (or host.redeem): that connection is already bound to the tenant it created, so later calls on it need no tenant_key. On a connec… |
No output schema declared.
No examples provided.
host.feedback.list ~151
List your own feedback (newest first, status received). Anonymous callers get [].
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Max rows, up to 100; default 20. |
| tenant_key | string | – | The key `signup` returned. Optional on the connection that ran signup (or host.redeem): that connection is already bound to the tenant it created, so later calls on it need no tenant_key. On a connec… |
No output schema declared.
No examples provided.
host.feedback.send ~203
Tell the host's humans what you needed: kind, up to 2048 bytes of text, optional context. Works before signup. Returns feedback_id.
| Name | Type | Req | Description |
|---|---|---|---|
| context | object | – | Optional, at most 1 KB: tool, error_code, free. |
| kind | string | yes | What you are telling the host. |
| tenant_key | string | – | The key `signup` returned. Optional on the connection that ran signup (or host.redeem): that connection is already bound to the tenant it created, so later calls on it need no tenant_key. On a connec… |
| text | string | yes | What you needed or saw; 1 to 2048 bytes after trim. |
No output schema declared.
No examples provided.
host.quickstart ~277
Return the shortest ordered sequence of calls to a working tool of `kind`, with your namespace and a filled-in example already substituted in, plus the current limits and a try_before_call table naming the one dry-run tool for each case. Read-only -- this call alone never creates a tenant. Call this before host.tool_publish if you're not sure what a spec should look like. Unauthenticated callers get a worked example with no tenant data; any other host.*/billing.* call creates a tenant on first use, no signup required.
| Name | Type | Req | Description |
|---|---|---|---|
| kind | string | – | Which registered kind to return a worked example for, e.g. echo, http, python -- or a job-word alias (webhook, event, cron, ...) for its recipe. Omit to see every kind, alias and recipe name. |
| tenant_key | string | – | The key `signup` returned. Optional on the connection that ran signup (or host.redeem): that connection is already bound to the tenant it created, so later calls on it need no tenant_key. On a connec… |
No output schema declared.
No examples provided.
host.redeem ~194
Exchange a signup(handoff: true) handoff_token for the tenant key it was issued for. Single-use: a second redemption fails with handoff_token_redeemed; past its expiry it fails with handoff_token_expired. Unauthenticated -- the token itself is the proof.
| Name | Type | Req | Description |
|---|---|---|---|
| handoff_token | string | yes | The handoff_token signup(handoff: true) returned. |
| tenant_key | string | – | The key `signup` returned. Optional on the connection that ran signup (or host.redeem): that connection is already bound to the tenant it created, so later calls on it need no tenant_key. On a connec… |
No output schema declared.
No examples provided.
host.state.get ~209
Read one key from this tenant's key-value state namespace. Returns found: false (not an error) if the key was never set.
| Name | Type | Req | Description |
|---|---|---|---|
| end_user | string|null | – | "self" for the caller's own verified end-user identity, an explicit subject (only when this call carries no end-user identity of its own), or omit/null for the tenant-wide value. |
| key | string | yes | Key to read from this tenant's key-value state namespace. |
| tenant_key | string | – | The key `signup` returned. Optional on the connection that ran signup (or host.redeem): that connection is already bound to the tenant it created, so later calls on it need no tenant_key. On a connec… |
No output schema declared.
No examples provided.
host.state.list ~219
List keys (with their current values) in this tenant's key-value state namespace, optionally filtered by prefix.
| Name | Type | Req | Description |
|---|---|---|---|
| end_user | string|null | – | "self" for the caller's own verified end-user identity, an explicit subject (only when this call carries no end-user identity of its own), or omit/null for the tenant-wide value. |
| limit | integer | – | Max keys to return; default 100. |
| prefix | string | – | Only list keys starting with this prefix; default: all keys. |
| tenant_key | string | – | The key `signup` returned. Optional on the connection that ran signup (or host.redeem): that connection is already bound to the tenant it created, so later calls on it need no tenant_key. On a connec… |
No output schema declared.
No examples provided.
host.state.set ~251
Write one key in this tenant's key-value state namespace; value may be any JSON value. Overrun of the plan's state_bytes_max quota fails with state_quota_exceeded and writes nothing.
| Name | Type | Req | Description |
|---|---|---|---|
| dry_run | boolean | – | return the diff this call would make and commit nothing |
| end_user | string|null | – | "self" for the caller's own verified end-user identity, an explicit subject (only when this call carries no end-user identity of its own), or omit/null for the tenant-wide value. |
| key | string | yes | Key to write in this tenant's key-value state namespace. |
| tenant_key | string | – | The key `signup` returned. Optional on the connection that ran signup (or host.redeem): that connection is already bound to the tenant it created, so later calls on it need no tenant_key. On a connec… |
| value | – | yes | Any JSON value to store under key. |
No output schema declared.
No examples provided.
host.tool_call ~460
Invoke a tool this tenant has already published, by its local name -- the same real, metered call as calling it directly by its namespaced name (<namespace>.<name>), for a session that has no way to see its own namespaced tool name yet. Unlike host.tool_test, this counts toward host.usage and appears in host.tool_logs. Pass async: true for a tool that needs more than the call deadline: returns {run_id, status: "queued"} immediately instead of running inline -- see host.runs.get/wait. Pass version to pin the call to one of host.tool_history's versions instead of whichever is current.
| Name | Type | Req | Description |
|---|---|---|---|
| args | object | yes | Arguments to pass, validated against the tool's own args_schema. |
| async | boolean | – | Run as a job instead of inline: returns {run_id, status} within ~50ms under the plan's job_max_s deadline; default false. |
| budget | object | – | Lowers this call's budget below the plan default: any subset of max_child_calls, max_est_tokens, max_tool_latency_ms, max_wall_ms. A value above the plan's own ceiling is a validation error naming it… |
| dry_run | boolean | – | Ask instead of call: runs every admission check the real call runs, dispatches nothing, writes no call row, and returns {fits, units, remaining, refusal}; same as host.estimate. Default false. |
| name | string | yes | Local name of the tool to invoke. |
| tenant_key | string | – | The key `signup` returned. Optional on the connection that ran signup (or host.redeem): that connection is already bound to the tenant it created, so later calls on it need no tenant_key. On a connec… |
| version | integer | – | Pin the call to this version instead of whichever is current; see host.tool_history. An unknown version is an argument error. |
No output schema declared.
No examples provided.
host.tool_publish ~534
Publish a tool of a registered kind (e.g. python, http or echo; the kind argument's enum lists them all) under this tenant's namespace. Call host.quickstart(kind) first for a filled-in example spec and the full publish-to-call sequence. Python's sandbox API: import mcphost (mcphost.table, mcphost.state, mcphost.docs). Name must match ^[a-z][a-z0-9_]{1,40}$; a rejection names the failing field and a corrected example. Try host.tool_test before a real call.
| Name | Type | Req | Description |
|---|---|---|---|
| dry_run | boolean | – | return the diff this call would make and commit nothing |
| kind | string | yes | Which registered kind to publish under: one of this field's `enum` (host.quickstart with no kind lists every kind, alias and recipe). A job-word alias in the enum also resolves here -- webhook-style… |
| name | string | yes | Local name for the new tool; must match ^[a-z][a-z0-9_]{1,40}$. |
| scopes | array | – | OAuth scopes a token must carry (directly, or via mcp) to reach this tool: catalogued names from host.oauth.scopes, or the built-ins read/write. At most 8. Omit (or [] ) to require only mcp -- unaffe… |
| spec | object | yes | The kind-specific spec object; see host.quickstart(kind) for a filled-in example. For python's network field: "none" (every plan), "public" (requires the pro plan), "egress" (requires the pro plan) -… |
| tenant_key | string | – | The key `signup` returned. Optional on the connection that ran signup (or host.redeem): that connection is already bound to the tenant it created, so later calls on it need no tenant_key. On a connec… |
No output schema declared.
No examples provided.
host.tool_share ~283
Share one of this tenant's published tools with everyone (visibility: "public") or with a named group this tenant owns (visibility: "group", group: <name>). The tool keeps running in this tenant's own sandbox with this tenant's own secrets; a caller reaches it as <this tenant's namespace>.<name>.
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | – | Catalog-facing blurb; shown by host.catalog.search/get. |
| expose_spec | boolean | – | Default false. When true, any tenant this tool is shared with may call host.tool_spec_shared to read its (redacted) spec. |
| group | string | – | Required when visibility is "group"; must already exist (host.group.create). |
| name | string | yes | Local name of the tool to share. |
| tenant_key | string | – | The key `signup` returned. Optional on the connection that ran signup (or host.redeem): that connection is already bound to the tenant it created, so later calls on it need no tenant_key. On a connec… |
| visibility | string | yes | "public" or "group". |
No output schema declared.
No examples provided.
host.tool_test ~245
Dry-run a published tool by name: verdict (pass/will_fail/unverifiable), writes rolled back (dry_run); see host.quickstart.
| Name | Type | Req | Description |
|---|---|---|---|
| args | object | yes | Arguments to pass, same shape as a real call. |
| fixtures | object | – | Chain tools only: {"<step number or tool name>": <recorded result>}. A fixtured step executes nothing (no upstream call); later mappings resolve against it. host.runs.get(run_id, as_fixtures=true) ex… |
| name | string | yes | Local name of the already-published tool to dry-run. |
| tenant_key | string | – | The key `signup` returned. Optional on the connection that ran signup (or host.redeem): that connection is already bound to the tenant it created, so later calls on it need no tenant_key. On a connec… |
No output schema declared.
No examples provided.
host.whoami ~138
Return the calling tenant's identity, including key_age_s and key_rotated_at for auditing credential hygiene.
| Name | Type | Req | Description |
|---|---|---|---|
| tenant_key | string | – | The key `signup` returned. Optional on the connection that ran signup (or host.redeem): that connection is already bound to the tenant it created, so later calls on it need no tenant_key. On a connec… |
No output schema declared.
No examples provided.
signup ~195
Explicit signup, for a client that cannot keep a session across calls: create a tenant and receive a bearer key and namespace. Unauthenticated. Most clients never need this -- any other host.*/billing.* call from a fresh connection creates a tenant implicitly and returns its own /u/<secret>/mcp URL in the response's onboarding field. Recommended here: pass handoff: true to receive a short-lived, single-use handoff_token instead of the raw key -- redeem it once with host.redeem to get the key, so a transcript of this call and the redeem call, if it leaks, carries a dead credential. The raw-key path (handoff omitted) stays fully supported.
| Name | Type | Req | Description |
|---|---|---|---|
| handoff | boolean | – | Recommended: true to receive a handoff_token (redeem via host.redeem) instead of the raw key. Default false (raw key, unchanged). |
| name | string | yes | display name |
No output schema declared.
No examples provided.
What is the dev.mcphost/mcphost MCP server?
dev.mcphost/mcphost is an MCP server listed in the public MCP registry as dev.mcphost/mcphost. Hosted MCP runtime where your agent publishes its own tools by tool call and keeps working. This page covers its hosted endpoint (https://mcphost.dev/mcp).
Is the dev.mcphost/mcphost MCP server safe to use?
dev.mcphost/mcphost scores 79 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the dev.mcphost/mcphost MCP server expose?
dev.mcphost/mcphost exposes 14 tools: signup, host.quickstart, host.redeem, billing.plans, host.whoami, and 9 more. Their descriptions and schemas cost roughly 3,504 tokens of context every time the server is loaded.
Does the dev.mcphost/mcphost MCP server require authentication?
Yes. dev.mcphost/mcphost asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.
Is the dev.mcphost/mcphost MCP server still maintained?
dev.mcphost/mcphost is still listed as active in the MCP registry. We last reached this channel on 12 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.