# Quartermaster eSIM (remote · api.quartermasterhq.ai)

Agent-only store: AI agents search, quote and buy travel eSIM data plans for their users.

- Trust score: 63/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

> **Recent critical change**: Authorization (2026-11-03). See the changelog below before you install this server.

## Components

- remote · `api.quartermasterhq.ai`: 63/100 (this document), [markdown](https://verifymcp.io/servers/dvirmimon123-tech-quartermaster/api.md), [page](https://verifymcp.io/servers/dvirmimon123-tech-quartermaster/api)

## Channel facts

- Endpoint: `https://api.quartermasterhq.ai/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `0.3.2`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Endpoint Security**: 63/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation check failed: no authorisation is required to call this server, and it exposes a tool marked destructive (rotate_principal_key).
  - HTTPS is enforced; there's no plaintext access path.
  - The HSTS (Strict-Transport-Security) header is present.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 55/100
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 2551 tokens (~182/item across 14 items; 14 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 7/100
  - Stability observed for 2 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 89/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 68% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.
  - An AI judge read all 15 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### How do I install the Quartermaster eSIM MCP server?

Quartermaster eSIM is a hosted endpoint at https://api.quartermasterhq.ai/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http dvirmimon123-tech-quartermaster 'https://api.quartermasterhq.ai/mcp'
```

### Cursor

```json
{
  "mcpServers": {
    "dvirmimon123-tech-quartermaster": {
      "url": "https://api.quartermasterhq.ai/mcp"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "dvirmimon123-tech-quartermaster": {
      "type": "http",
      "url": "https://api.quartermasterhq.ai/mcp"
    }
  }
}
```

### Codex

```toml
[mcp_servers.dvirmimon123-tech-quartermaster]
url = "https://api.quartermasterhq.ai/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "dvirmimon123-tech-quartermaster": {
      "type": "remote",
      "url": "https://api.quartermasterhq.ai/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add dvirmimon123-tech-quartermaster --url 'https://api.quartermasterhq.ai/mcp' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  dvirmimon123-tech-quartermaster:
    url: "https://api.quartermasterhq.ai/mcp"
```

### Netclaw

```json
{
  "McpServers": {
    "dvirmimon123-tech-quartermaster": {
      "Transport": "http",
      "Url": "https://api.quartermasterhq.ai/mcp"
    }
  }
}
```

### Vellum

```bash
assistant mcp add dvirmimon123-tech-quartermaster -t streamable-http -u 'https://api.quartermasterhq.ai/mcp'
```

### Other

```json
{
  "mcpServers": {
    "dvirmimon123-tech-quartermaster": {
      "type": "http",
      "url": "https://api.quartermasterhq.ai/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-05 (score 63, 0)

- [security] The server rewrote its instructions, which are the text every model session reads
- [security] Tool “purchase” rewrote its description, which is the text the model reads
- [security] Tool “request_refund” rewrote its description, which is the text the model reads
- [functional regression] Schema quality: 158 → 182

### 2026-11-04 (score 63, 0)

- [functional improvement] Stability: unverified → 0.03

### 2026-11-03 (score 63, +40)

- [critical regression] Authorization: unverified → fail
- [security improvement] Injection markers: unverified → pass
- [security improvement] HSTS header: unverified → pass
- [security improvement] Transport: fail → pass
- [security] First check of Judged manipulation: pass
- [functional improvement] Tool coverage: unverified → 100
- [functional improvement] MCP protocol: unverified → pass
- [functional] First check of Schema quality: fail
- [functional] First check of Schema quality: fail
- [functional] First check of Destructive annotations: 100
- [functional] First check of Tool coverage: 68
- [functional] First check of Schema quality: good

### 2026-11-02 (score 23)

First indexed and scored.

## MCP tools (14)

### `register_agent` (~146 tokens)

Register agent and mandate

Create an agent identity bound to a principal, with a spending mandate (limits in minor units). Returns agent_key once; send it on every later call. The first agent of a new principal_id also receives principal_key (once): the principal owns the wallet, and every later register_agent for that principal_id must present principal_key (argument or X-Principal-Key header), else PRINCIPAL_KEY_REQUIRED. New agents are capped by the registration policy (see get_policies).

Input parameters:

- `agent_id` (string, required)
- `mandate` (object, required)
- `principal_id` (string, required)
- `principal_key` (string): Required if the principal already exists (or X-Principal-Key header)

### `rotate_principal_key` (~153 tokens)

Rotate the principal key

Replace your principal's principal_key. Needs your agent credentials and the current principal_key (argument or X-Principal-Key header). Returns the new key once; the old one stops working. Existing agents are unaffected. A principal registered before keys existed has none: any of its agents can call this without principal_key to mint the first one.

Input parameters:

- `agent_id` (string): Your agent id (or X-Agent-Id header)
- `agent_key` (string): Secret returned by register_agent (or X-Agent-Key header)
- `principal_id` (string): The principal you act for (or X-Principal-Id header)
- `principal_key` (string): Current principal_key (or X-Principal-Key header)

### `get_policies` (~108 tokens)

Read store policies

Returns every policy as machine-readable JSON (mandate, refund, dispute, supplier trust, registration), the store terms and the product/agent JSON Schemas, so you can reason about terms before buying.

Input parameters:

- `agent_id` (string): Your agent id (or X-Agent-Id header)
- `agent_key` (string): Secret returned by register_agent (or X-Agent-Key header)
- `principal_id` (string): The principal you act for (or X-Principal-Id header)

### `search_plans` (~239 tokens)

Search eSIM plans

Search eSIM data plans from trusted suppliers. Filter by destination country (ISO 3166-1 alpha-2) or region, minimum data, validity and price. Results are sorted by final price unless sort says otherwise. Suppliers below the trust threshold are excluded and listed in excluded_suppliers.

Input parameters:

- `agent_id` (string): Your agent id (or X-Agent-Id header)
- `agent_key` (string): Secret returned by register_agent (or X-Agent-Key header)
- `category` (string): Product category
- `country` (string): Destination country, e.g. JP
- `include_out_of_stock` (boolean)
- `limit` (integer)
- `max_price_minor` (integer)
- `max_validity_days` (integer)
- `min_data_gb` (number): Minimum data in GB; unlimited plans always qualify
- `min_validity_days` (integer)
- `principal_id` (string): The principal you act for (or X-Principal-Id header)
- `region` (string): Commercial coverage region
- `sort` (string)
- `unlimited_only` (boolean)

### `get_quote` (~117 tokens)

Get a binding quote

Lock the final price for one product for a short time (quote_ttl_seconds in store terms). Also returns a mandate pre-check and the refund terms, so you know before buying whether the purchase will be allowed.

Input parameters:

- `agent_id` (string): Your agent id (or X-Agent-Id header)
- `agent_key` (string): Secret returned by register_agent (or X-Agent-Key header)
- `principal_id` (string): The principal you act for (or X-Principal-Id header)
- `product_id` (string, required)

### `purchase` (~253 tokens)

Purchase a quoted plan

Buy the product in a quote. Enforces the mandate and the wallet policy, holds the amount in the principal's wallet, orders from the supplier, debits the wallet, and returns the order with the eSIM delivery payload and a signed receipt. If the wallet is short, fails with WALLET_INSUFFICIENT_FUNDS and a ready top-up link for the principal. idempotency_key is required: reusing it returns the original order and never charges twice. If the supplier's answer is unknown (timeout, network error), the order stays "processing" with supplier_outcome "unknown" and the price held, not debited: poll order_status and do not buy again with a new key. Only SUPPLIER_FAILURE with retryable=true calls for a new quote and key.

Input parameters:

- `agent_id` (string): Your agent id (or X-Agent-Id header)
- `agent_key` (string): Secret returned by register_agent (or X-Agent-Key header)
- `idempotency_key` (string, required): Unique per purchase attempt, e.g. a UUID
- `principal_id` (string): The principal you act for (or X-Principal-Id header)
- `quote_id` (string, required)

### `get_wallet` (~128 tokens)

Principal wallet

Balance, available funds (balance minus pending holds), open top-up links, recent top-ups and recent ledger entries of the wallet of the principal you act for. Shared by all of the principal's agents. Amounts in minor units.

Input parameters:

- `agent_id` (string): Your agent id (or X-Agent-Id header)
- `agent_key` (string): Secret returned by register_agent (or X-Agent-Key header)
- `limit` (integer): Recent entries to return (default 20)
- `principal_id` (string): The principal you act for (or X-Principal-Id header)

### `get_topup_link` (~189 tokens)

Get a wallet top-up link

Create a hosted payment URL to hand to your human principal. They pay in ILS on the acquirer's page (PayPlus); you never see card data. amount_minor is in `currency`: USD (the wallet credit you want; the ILS charge is computed at today's rate) or ILS (the exact charge). The wallet is credited in USD at the rate in force when payment is confirmed. Limits are in the topup policy.

Input parameters:

- `agent_id` (string): Your agent id (or X-Agent-Id header)
- `agent_key` (string): Secret returned by register_agent (or X-Agent-Key header)
- `amount_minor` (integer, required): Minor units of currency, e.g. 2000 = 20.00
- `currency` (string)
- `principal_id` (string): The principal you act for (or X-Principal-Id header)

### `order_status` (~95 tokens)

Order status

Current order state, eSIM delivery payload, activation and data usage from the supplier, receipts and disputes.

Input parameters:

- `agent_id` (string): Your agent id (or X-Agent-Id header)
- `agent_key` (string): Secret returned by register_agent (or X-Agent-Key header)
- `order_id` (string, required)
- `principal_id` (string): The principal you act for (or X-Principal-Id header)

### `regenerate_activation` (~138 tokens)

Reissue the eSIM activation code

For one of your own delivered orders whose activation code (QR / LPA) does not install: asks the supplier for a fresh code and returns the new delivery payload. The previous code may stop working. Not every supplier supports it (NOT_SUPPORTED_BY_SUPPLIER); then open a dispute with reason not_working.

Input parameters:

- `agent_id` (string): Your agent id (or X-Agent-Id header)
- `agent_key` (string): Secret returned by register_agent (or X-Agent-Key header)
- `order_id` (string, required)
- `principal_id` (string): The principal you act for (or X-Principal-Id header)

### `request_refund` (~252 tokens)

Request a refund or open a dispute

Reasons "unused" and "changed_plans" are voluntary refunds under the refund policy. Reasons "not_delivered", "not_working" and "duplicate_purchase" open a dispute under the dispute policy, which can refund fully, partially, reject, or escalate to a human. A dispute about a delivered eSIM is credited automatically only when the supplier confirms it cancelled the eSIM; otherwise, and for partial refunds, it is escalated (outcome "escalate", reason DISPUTE_SUPPLIER_CANCEL_UNCONFIRMED). Orders the supplier has not confirmed yet are refused with ORDER_AWAITING_SUPPLIER (poll order_status). ORDER_CHANGED is retryable. After a full refund, order_status no longer returns the activation code. Denials return error.code = the policy reason_code.

Input parameters:

- `agent_id` (string): Your agent id (or X-Agent-Id header)
- `agent_key` (string): Secret returned by register_agent (or X-Agent-Key header)
- `details` (string)
- `order_id` (string, required)
- `principal_id` (string): The principal you act for (or X-Principal-Id header)
- `reason` (string, required)

### `verify_receipt` (~90 tokens)

Verify a receipt

Check a receipt's signature and that it matches its hash-chained ledger entry.

Input parameters:

- `agent_id` (string): Your agent id (or X-Agent-Id header)
- `agent_key` (string): Secret returned by register_agent (or X-Agent-Key header)
- `principal_id` (string): The principal you act for (or X-Principal-Id header)
- `receipt` (object, required)

### `sandbox_simulate_topup_payment` (~136 tokens)

Sandbox: principal pays a top-up link

Sandbox only. Acts as the principal paying a get_topup_link URL: the mock provider sends a PayPlus-format IPN through the same webhook path production uses, and the wallet is credited. outcome "declined" simulates a failed card.

Input parameters:

- `agent_id` (string): Your agent id (or X-Agent-Id header)
- `agent_key` (string): Secret returned by register_agent (or X-Agent-Key header)
- `outcome` (string)
- `principal_id` (string): The principal you act for (or X-Principal-Id header)
- `topup_id` (string, required)

### `sandbox_simulate_activation` (~115 tokens)

Sandbox: simulate eSIM activation

Sandbox only. Marks the order's eSIM as installed and used, as if the traveler activated it. Use it to exercise refund and dispute rules.

Input parameters:

- `agent_id` (string): Your agent id (or X-Agent-Id header)
- `agent_key` (string): Secret returned by register_agent (or X-Agent-Key header)
- `data_used_mb` (integer)
- `order_id` (string, required)
- `principal_id` (string): The principal you act for (or X-Principal-Id header)

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/dvirmimon123-tech-quartermaster/api#diagnostics

## Score history

- 2026-11-05: 63
- 2026-11-04: 63
- 2026-11-03: 63
- 2026-11-02: 23

## Common questions

### What is the Quartermaster eSIM MCP server?

Quartermaster eSIM is an MCP server listed in the public MCP registry as io.github.dvirmimon123-tech/quartermaster. Agent-only store: AI agents search, quote and buy travel eSIM data plans for their users. This page covers its hosted endpoint (https://api.quartermasterhq.ai/mcp).

### Is the Quartermaster eSIM MCP server safe to use?

Quartermaster eSIM scores 63 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Quartermaster eSIM MCP server expose?

Quartermaster eSIM exposes 14 tools: register_agent, rotate_principal_key, get_policies, search_plans, get_quote, and 9 more. Their descriptions and schemas cost roughly 2,159 tokens of context every time the server is loaded.

### Does the Quartermaster eSIM MCP server require authentication?

No. We connected to Quartermaster eSIM without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

### Is the Quartermaster eSIM MCP server still maintained?

Quartermaster eSIM is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What did VerifyMCP test on the Quartermaster eSIM MCP server?

VerifyMCP ran 13 checks on Quartermaster eSIM, covering TLS certificate, Authorization, HTTPS, HSTS header and 9 more. Supply Chain Security and Provenance & Transparency do not apply to a hosted endpoint, so they were not tested. The score does not measure everything, and the scoring documentation lists what it leaves out.

## Links

- Remote endpoint: https://api.quartermasterhq.ai/mcp
- Repository: https://github.com/dvirmimon123-tech/quartermaster-mcp
- Website: https://api.quartermasterhq.ai/docs
- Changelog RSS feed: https://verifymcp.io/servers/dvirmimon123-tech-quartermaster/api.xml
- Changelog JSON feed: https://verifymcp.io/servers/dvirmimon123-tech-quartermaster/api/changelog.json
- Trust report (JSON): https://verifymcp.io/servers/dvirmimon123-tech-quartermaster/api.json
- HTML version of this page: https://verifymcp.io/servers/dvirmimon123-tech-quartermaster/api