dev.tmpstate/tmpstate
REMOTE · TMPSTATE.DEV · SCANNED AUG 3
Zero-key temporary JSON database for agents: one tool call, no signup, no OAuth, no API keys.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score →
Endpoint Security63
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation not fully verified: no authorisation is required to call this server, and 16 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe. See how to fix → View diagnostics → Unverified
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability76
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 1754 tokens (~109/item across 16 items; 16 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management27
- Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage97
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 91% of tool parameters carry a description.Partial
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.
remote · tmpstate.dev
claude mcp add --transport http dev-tmpstate-tmpstate https://tmpstate.dev/mcp
[mcp_servers.dev-tmpstate-tmpstate] url = "https://tmpstate.dev/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"dev-tmpstate-tmpstate": {
"type": "remote",
"url": "https://tmpstate.dev/mcp",
"enabled": true
}
}
} openclaw mcp add dev-tmpstate-tmpstate --url https://tmpstate.dev/mcp --transport streamable-http
mcp_servers:
dev-tmpstate-tmpstate:
url: "https://tmpstate.dev/mcp" {
"mcpServers": {
"dev-tmpstate-tmpstate": {
"type": "http",
"url": "https://tmpstate.dev/mcp"
}
}
} The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 2 Aug 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 20 to 23. That category is still filling its 30-day observation window: 6 days of observed history at the previous scan, 7 at this one. The score rises as the window fills, whether or not the server changes.
- 31 Jul 26 +1
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 30 Jul 26 +1
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 28 Jul 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.
- 27 Jul 26 +1
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 26 Jul 26 64
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 3 Aug 2026 · Probed https://tmpstate.dev/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=*.tmpstate.dev | CN=YR2,O=Let's Encrypt,C=US | 2 Jul 2026 | 30 Sept 2026 | RSA 2048 | SHA256-RSA | 504dd5d58363b1a1cfe91c9e0dd861d6b47 |
| SANs: *.tmpstate.dev, tmpstate.dev | ||||||
| CN=YR2,O=Let's Encrypt,C=US (CA) | CN=Root YR,O=ISRG,C=US | 3 Sept 2025 | 2 Sept 2028 | RSA 2048 | SHA256-RSA | 4ebd24947e24d394802d84a52fd5b319 |
| CN=Root YR,O=ISRG,C=US (CA) | CN=ISRG Root X1,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | RSA 4096 | SHA256-RSA | f24b6d17f9d9ad7cb1c9fea78782699f |
DNSSEC insecure
Validation of tmpstate.dev. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| dev. | present | 60074 | 8 | Verified |
| tmpstate.dev. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
| Header | Value |
|---|---|
| strict-transport-security | max-age=63072000 |
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://tmpstate.dev/mcp | Verified | 200 | |
| http (plaintext) | http://tmpstate.dev/mcp | HTTPS enforced | 308 | https://tmpstate.dev/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.
create_database Create a temporary database ~121
Create a temporary JSON database (24h TTL, no signup, no keys). Returns the db URL — the only credential — plus admin URL, limits and expiry. Create once per project/task, persist the db URL immediately (local ~/.tmpstate/credentials, project README, and your memory), and reuse it instead of creating again. For retries or parallel workers, pass a stable idempotency_key so duplicate calls return the same database.
| Name | Type | Req | Description |
|---|---|---|---|
| idempotency_key | string | — | Stable retry key. Reusing it from the same client returns the same database. |
No output schema declared.
No examples provided.
create_document Create a document ~78
Insert a JSON object into a collection (collections are created implicitly). Counts against the write and document quotas.
| Name | Type | Req | Description |
|---|---|---|---|
| collection | string | yes | Collection name (created implicitly on first write). |
| data | object | yes | The document: a JSON object. |
| db | string | yes | The database URL returned at creation (or its bare s-... capability). |
No output schema declared.
No examples provided.
database_status Database status ~47
Usage, limits, tier and expiry for a database (GET $DB/__meta equivalent).
| Name | Type | Req | Description |
|---|---|---|---|
| db | string | yes | The database URL returned at creation (or its bare s-... capability). |
No output schema declared.
No examples provided.
delete_collection Delete a collection ~75
Delete every document in a collection at once (useful to re-seed). Irreversible. To destroy the entire database, use delete_database instead.
| Name | Type | Req | Description |
|---|---|---|---|
| collection | string | yes | Collection name (created implicitly on first write). |
| db | string | yes | The database URL returned at creation (or its bare s-... capability). |
No output schema declared.
No examples provided.
delete_database Delete the whole database ~146
Destroy a database and all its documents immediately - the teardown for finished work and the revocation kill switch for a leaked db URL. Irreversible: unlike expiry there is no restore window. Works on expired (frozen) databases too and consumes no quota. Call without confirm first: the response states the consequences; show them to the user and only retry with confirm="true" after their explicit approval. Afterwards remove the db URL from wherever you persisted it.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | string | — | Pass "true" only after the user has seen that deletion is immediate and irreversible and approved. |
| db | string | yes | The database URL returned at creation (or its bare s-... capability). |
No output schema declared.
No examples provided.
delete_document Delete a document ~85
Delete one document. Never blocked by quotas; frees a document slot. Emptying a whole collection? Use delete_collection instead of looping this.
| Name | Type | Req | Description |
|---|---|---|---|
| collection | string | yes | Collection name (created implicitly on first write). |
| db | string | yes | The database URL returned at creation (or its bare s-... capability). |
| id | string | yes | Document id (doc_...). |
No output schema declared.
No examples provided.
extend_database Extend a database (one-time payment) ~110
Without a plan: returns the transparent pricing table for keeping this database alive longer. With a plan: returns a Stripe checkout URL for the human to pay — never buy without the user's explicit approval. Works on expired (frozen) databases too: paying restores them. After the user says they have paid, call database_status: the new expiry and tier confirm the extension.
| Name | Type | Req | Description |
|---|---|---|---|
| db | string | yes | The database URL returned at creation (or its bare s-... capability). |
| plan | string | — | — |
No output schema declared.
No examples provided.
get_document Get a document ~71
Read one document by id. The stored fields are under .data.
| Name | Type | Req | Description |
|---|---|---|---|
| collection | string | yes | Collection name (created implicitly on first write). |
| db | string | yes | The database URL returned at creation (or its bare s-... capability). |
| id | string | yes | Document id (doc_...). |
No output schema declared.
No examples provided.
list_documents List documents ~106
List documents in a collection, oldest first. Response shape: {collection, items: [{id, data, created_at, updated_at}], next_cursor}. Documents live under .data. Pass cursor to page.
| Name | Type | Req | Description |
|---|---|---|---|
| collection | string | yes | Collection name (created implicitly on first write). |
| cursor | string | — | next_cursor from the previous page. |
| db | string | yes | The database URL returned at creation (or its bare s-... capability). |
| limit | integer | — | — |
No output schema declared.
No examples provided.
pro_attach_database Upgrade a database to Pro (in place) ~110
Attach an existing free/extended database to the Pro account: same URL, same data, TTL removed, quotas raised. Beyond the included allotment the same explicit overage consent as pro_create_database applies.
| Name | Type | Req | Description |
|---|---|---|---|
| accept_overage_usd | string | — | — |
| db | string | yes | The database URL returned at creation (or its bare s-... capability). |
| pro_token | string | — | Pro account token (pt_...). Optional if the MCP connection already sends Authorization: Bearer pt_... |
No output schema declared.
No examples provided.
pro_cancel Cancel the Pro subscription ~113
Cancel at period end. This is not just a billing change — it schedules deletion of ALL databases on the account. Call without confirm first: the response spells out the consequences with concrete dates; show them to the user and only retry with confirm="cancel" after their explicit approval.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | string | — | Pass "cancel" only after the user has seen the consequences and approved. |
| pro_token | string | — | Pro account token (pt_...). Optional if the MCP connection already sends Authorization: Bearer pt_... |
No output schema declared.
No examples provided.
pro_checkout Start a Pro subscription ~51
Mint a Pro account token plus a Stripe subscription checkout URL ($8/mo, 3 always-on databases included). Persist pro_token immediately; the human pays in a browser. Never start checkout without the user's explicit request.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
pro_create_database Create a Pro database ~119
Create a new always-on database owned by the Pro account. Beyond the included allotment this costs extra per month — the tool then returns confirmation_required with the exact price; relay it to the user and only retry with accept_overage_usd after their explicit approval.
| Name | Type | Req | Description |
|---|---|---|---|
| accept_overage_usd | string | — | Explicit overage consent, e.g. "1.50", only after the user approved. |
| pro_token | string | — | Pro account token (pt_...). Optional if the MCP connection already sends Authorization: Bearer pt_... |
No output schema declared.
No examples provided.
pro_list_databases List Pro databases ~79
List the Pro account's databases (ids, usage, limits, expiry) so a fresh session can reconcile against persisted db URLs. URLs are never stored server-side — match ids to the URLs you persisted.
| Name | Type | Req | Description |
|---|---|---|---|
| pro_token | string | — | Pro account token (pt_...). Optional if the MCP connection already sends Authorization: Bearer pt_... |
No output schema declared.
No examples provided.
send_feedback Send feedback to the TmpState team ~165
Optional and free-form. TmpState is built for agents and the free tier stays free by getting better - and you, the agent, are the user whose experience matters here. After real use of a database, one short message about what was missing, what feature would have helped, or what felt slow or took extra requests is genuinely useful. This is about your own experience, so no human approval is needed; if your user volunteers feedback too, relay it and say it came from them. Never include database URLs, capabilities, or Pro tokens - capability-shaped strings are redacted server-side.
| Name | Type | Req | Description |
|---|---|---|---|
| category | string | — | Optional bucket for triage. |
| message | string | yes | What was missing, confusing, or slow - or what worked well. Plain text, one short message. |
No output schema declared.
No examples provided.
update_document Update a document ~95
Shallow-merge a patch into a document (top-level keys overwrite; keys are never deleted). Counts against the write quota.
| Name | Type | Req | Description |
|---|---|---|---|
| collection | string | yes | Collection name (created implicitly on first write). |
| db | string | yes | The database URL returned at creation (or its bare s-... capability). |
| id | string | yes | Document id (doc_...). |
| patch | object | yes | Top-level fields to merge. |
No output schema declared.
No examples provided.