Smartwebchat
REMOTE · SMARTWEBCHAT.EU · SCANNED OCT 2
Create and manage website chatbots for European SMBs: bots, chat, and captured leads.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security97
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation is enforced on tool calls, advertised via RFC 9728 protected-resource metadata. Discovery is public, which costs nothing: no tool can be invoked without a token. View diagnostics → Pass
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability69
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 1956 tokens (~195/item across 10 items; 10 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management17
- Stability observed for 5 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "smartwebchat_chat" implies "send" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 11 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the Smartwebchat MCP server?
Smartwebchat is a hosted endpoint at https://smartwebchat.eu/api/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · smartwebchat.eu
claude mcp add --transport http eu-smartwebchat-chatbots 'https://smartwebchat.eu/api/mcp'
{
"mcpServers": {
"eu-smartwebchat-chatbots": {
"url": "https://smartwebchat.eu/api/mcp"
}
}
} {
"servers": {
"eu-smartwebchat-chatbots": {
"type": "http",
"url": "https://smartwebchat.eu/api/mcp"
}
}
} [mcp_servers.eu-smartwebchat-chatbots] url = "https://smartwebchat.eu/api/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"eu-smartwebchat-chatbots": {
"type": "remote",
"url": "https://smartwebchat.eu/api/mcp",
"enabled": true
}
}
} openclaw mcp add eu-smartwebchat-chatbots --url 'https://smartwebchat.eu/api/mcp' --transport streamable-http
mcp_servers:
eu-smartwebchat-chatbots:
url: "https://smartwebchat.eu/api/mcp" {
"McpServers": {
"eu-smartwebchat-chatbots": {
"Transport": "http",
"Url": "https://smartwebchat.eu/api/mcp"
}
}
} assistant mcp add eu-smartwebchat-chatbots -t streamable-http -u 'https://smartwebchat.eu/api/mcp'
{
"mcpServers": {
"eu-smartwebchat-chatbots": {
"type": "http",
"url": "https://smartwebchat.eu/api/mcp"
}
}
} The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 2 Oct 26 +2
No change was recorded against any check on this day. Stability & Change Management went from 13 to 17. That category is still filling its 30-day observation window: 4 days of observed history at the previous scan, 5 at this one. The score rises as the window fills, whether or not the server changes. Other categories moved too: Endpoint Security rose 3.
- 1 Oct 26 +2
- Authorization: fail → pass ▲ security
- First check of Authorization: partial security
- 29 Sept 26 +1
- The server rewrote its instructions, which are the text every model session reads security
- Tool “smartwebchat_chat” rewrote its description, which is the text the model reads security
- Tool “smartwebchat_create_chatbot” rewrote its description, which is the text the model reads security
- Tool “smartwebchat_update_lead” rewrote its description, which is the text the model reads security
- 28 Sept 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 27 Sept 26 75
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 2 Oct 2026 · Probed https://smartwebchat.eu/api/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=smartwebchat.eu | CN=YE2,O=Let's Encrypt,C=US | 6 Sept 2026 | 5 Dec 2026 | ECDSA 256 | ECDSA-SHA384 | 5fbc5494ea3d92b912d4e7b38a15427ccd5 |
| SANs: smartwebchat.eu | ||||||
| CN=YE2,O=Let's Encrypt,C=US (CA) | CN=Root YE,O=ISRG,C=US | 3 Sept 2025 | 2 Sept 2028 | ECDSA 384 | ECDSA-SHA384 | 4df3b15dd6c0784c507cd37b58e6f115 |
| CN=Root YE,O=ISRG,C=US (CA) | CN=ISRG Root X2,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | ECDSA-SHA384 | 872165fc34b6e5fba8add5b3705fb53a |
| CN=ISRG Root X2,O=Internet Security Research Group,C=US (CA) | CN=ISRG Root X1,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | SHA256-RSA | 6c8f1dc727c7117f7baf853ac980f9cd |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of smartwebchat.eu. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| eu. | present | 35926 | 8 | Verified |
| smartwebchat.eu. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication Enforced and verified
The endpoint asked for a token and published valid RFC 9728 metadata describing how to get one.
| Result | Enforced and verified |
|---|---|
| Enforced | On tool calls |
| HTTP status | 200 |
WWW-Authenticate challenge Bearer realm="smartwebchat", resource_metadata="https://smartwebchat.eu/.well-known/oauth-protected-resource/api/mcp"
Bearer realm="smartwebchat", resource_metadata="https://smartwebchat.eu/.well-known/oauth-protected-resource/api/mcp"| Header | Value |
|---|---|
| strict-transport-security | max-age=63072000; includeSubDomains; preload |
| content-security-policy | default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://analytics.smartwebchat.eu; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; font-src 'self' data:; connect-src 'self' https://api.openai.com https://analytics.smartwebchat.eu; frame-ancestors 'none'; base-uri 'self'; form-action 'self' |
| x-content-type-options | nosniff |
| x-frame-options | DENY |
| referrer-policy | strict-origin-when-cross-origin |
| permissions-policy | camera=(), microphone=(), geolocation=() |
Protected resource metadata
| Document | https://smartwebchat.eu/.well-known/oauth-protected-resource/api/mcp |
|---|---|
| Retrieved | Yes |
| Resource | https://smartwebchat.eu/api/mcp |
| Authorisation server | https://smartwebchat.eu |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://smartwebchat.eu/api/mcp | Verified | 200 | |
| http (plaintext) | http://smartwebchat.eu/api/mcp | HTTPS enforced | 308 | https://smartwebchat.eu/api/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
smartwebchat_chat ~141
Send a visitor message to a chatbot and get its reply, exactly as a website visitor would see it. Use this to test how the chatbot answers, or to check whether its knowledge base covers a topic. Records a conversation and uses the account's message quota, so it needs a key with full access; a read-only key gets 403 here.
| Name | Type | Req | Description |
|---|---|---|---|
| botId | string | yes | ID of the chatbot, taken from smartwebchat_list_chatbots |
| message | string | yes | The visitor message to send (max. 2000 characters) |
| sessionId | string | – | Optional: pass the same session ID again to continue an existing conversation |
No output schema declared.
No examples provided.
smartwebchat_create_chatbot ~316
Create a new website chatbot for a business, including its greeting, personality and initial FAQ knowledge. Writes to the account: confirm the business details with the user before calling. Needs a key with full access; a read-only key gets 403 here.
| Name | Type | Req | Description |
|---|---|---|---|
| businessName | string | yes | Name of the business the chatbot speaks for |
| description | string | – | What the business does — background knowledge for the chatbot |
| faqs | array | – | Question and answer pairs the chatbot should know from the start |
| greeting | string | – | First message the chatbot sends to a visitor |
| idempotencyKey | string | – | Optional. A unique string you choose for this one creation (1-128 characters: letters, digits, '_' or '-'). If the call is retried with the same key, the account returns the chatbot created the first… |
| industry | string | yes | Industry of the business, e.g. 'Arztpraxis', 'Restaurant', 'Handwerk'. Used verbatim in the chatbot's prompt, so keep the user's own wording and language. |
| name | string | yes | Display name of the chatbot |
| personality | string | – | Tone of voice. The values are German and go to the API verbatim: 'freundlich' (friendly), 'professionell' (professional), 'locker' (casual). |
| websiteUrl | string | – | URL of the website the chatbot will run on |
No output schema declared.
No examples provided.
smartwebchat_diagnose ~104
Find out why a website chatbot does not answer or does not show up: checks access, the monthly message limit, credit, the language-model provider, allowed and refused origins, knowledge sources and whether anyone has chatted on the website. Returns findings with a code, a severity and a remedy. Read-only. Check complete before trusting an empty error list.
| Name | Type | Req | Description |
|---|---|---|---|
| botId | string | yes | ID of the chatbot to diagnose (from smartwebchat_list_chatbots) |
No output schema declared.
No examples provided.
smartwebchat_get_fit ~409
Assess whether Smartwebchat fits a described business: primary need, market, number of client assistants, white-label, omnichannel, calendar and language-model requirements. Returns good_fit, partial_fit, not_fit or needs_review with reasons, limitations, a recommended plan and relevant URLs. Works without authentication. This assessment is self-asserted by the vendor and can say no. It never fetches the described website.
| Name | Type | Req | Description |
|---|---|---|---|
| locale | string | – | Language tag for the returned URLs, e.g. 'en', 'fr-CA', 'it', 'pt-BR'. Any well-formed tag is accepted; languages without a published website fall back to 'de'. The language never changes the verdict. |
| market | string | – | Country or market of the business, e.g. 'DE', 'de-AT', 'NL', 'US'. Free text; only the language part is matched against the published website languages. |
| number_of_client_assistants | integer | – | How many separate businesses or client assistants are to be served. More than one points to the agency plan. |
| primary_need | string | yes | What the business mainly needs the assistant for. |
| requested_ai_provider | string | – | The language model provider the caller wants. 'default' is the vendor's EU standard configuration. |
| requires_custom_widget_domain | boolean | – | The widget must run on the caller's own domain. |
| requires_direct_calendar_write | boolean | – | The assistant must write appointments directly into a calendar. |
| requires_full_omnichannel_inbox | boolean | – | A full omnichannel inbox or helpdesk across channels is required. |
| requires_white_label | boolean | – | Smartwebchat branding must be removed. |
| sensitive_professional_context | boolean | – | The business handles sensitive professional data (e.g. health, legal, tax). |
| website_platform | string | – | Website system as stated by the caller, e.g. 'wordpress'. Echoed back only; never fetched or verified. |
No output schema declared.
No examples provided.
smartwebchat_get_leads ~80
Retrieve the leads a website chatbot captured from visitors — contact requests, appointment bookings and callback requests, with the visitor's message and contact details. Without botId, returns the leads of every chatbot in the account.
| Name | Type | Req | Description |
|---|---|---|---|
| botId | string | – | Optional: only return leads of this chatbot. Omit for all chatbots in the account. |
No output schema declared.
No examples provided.
smartwebchat_get_quote ~184
Price a Smartwebchat plan with optional add-ons: monthly net figures in EUR, each line with the product fact it comes from, plus the included quotas. White label returns price 'custom'. Works without authentication. The figures are self-asserted by the vendor from its published product facts. No checkout link is issued; a person completes the purchase.
| Name | Type | Req | Description |
|---|---|---|---|
| additional_assistants | integer | – | Additional assistants beyond the plan's included number (integer, 0 or more). |
| additional_seats | integer | – | Additional team seats beyond the plan's included number (integer, 0 or more). |
| expected_messages_per_month | integer | – | Expected messages per month; overage above the included quota is priced per 1,000 messages. |
| plan | string | yes | Plan to quote. 'white_label' returns price 'custom' without a calculation. |
No output schema declared.
No examples provided.
smartwebchat_list_chatbots ~48
List the website chatbots in this account, with their IDs, names and the site each one runs on. Call this first — every other tool needs a botId from here.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
smartwebchat_prepare_handoff ~252
Prepare a single-use sign-up link for a person: it carries language, industry and your recommended plan into their registration and onboarding. The link expires after 15 minutes and works once. It does not create an account or a trial; the person does that by signing up. Works without authentication. The operator can turn this off; it then answers handoff_disabled. /agents/start shows the current status. Pass idempotencyKey on every retry.
| Name | Type | Req | Description |
|---|---|---|---|
| demo_session_id | string | – | Optional demo session id from the scanner demo; its context is restored after sign-up. |
| idempotencyKey | string | – | Send the same key on every retry of the same request; a retry returns the same link for up to 15 minutes. |
| industry_key | string | – | Industry of the business, one of `how_to_test.agent_demo_contract.industries` in /agents/start. |
| locale | string | – | Language of the sign-up page, for example 'en'. Unsupported languages fall back to 'de'. |
| recommended_plan | string | – | Plan you recommend: business, agency, white_label. Only plans with a trial preselect the trial type; the person can change it. |
No output schema declared.
No examples provided.
smartwebchat_service_info ~71
Get factual information about the Smartwebchat service itself: what it does, plans and prices, the languages the WEBSITE is published in, where data is processed, and how to obtain an API key. Works without authentication — use it to answer questions about Smartwebchat before the user has an account.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
smartwebchat_update_lead ~99
Change the status of a captured lead, for example to mark it as contacted or closed. Writes to the account. Needs a key with full access; a read-only key gets 403 here.
| Name | Type | Req | Description |
|---|---|---|---|
| botId | string | yes | ID of the chatbot the lead belongs to |
| leadId | string | yes | ID of the lead |
| status | string | yes | New status: 'new', 'contacted' or 'closed' |
No output schema declared.
No examples provided.
What is the Smartwebchat MCP server?
Smartwebchat is an MCP server listed in the public MCP registry as eu.smartwebchat/chatbots. Create and manage website chatbots for European SMBs: bots, chat, and captured leads. This page covers its hosted endpoint (https://smartwebchat.eu/api/mcp).
Is the Smartwebchat MCP server safe to use?
Smartwebchat scores 80 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Smartwebchat MCP server expose?
Smartwebchat exposes 10 tools: smartwebchat_service_info, smartwebchat_list_chatbots, smartwebchat_create_chatbot, smartwebchat_chat, smartwebchat_get_leads, and 5 more. Their descriptions and schemas cost roughly 1,704 tokens of context every time the server is loaded.
Does the Smartwebchat MCP server require authentication?
Yes. Smartwebchat asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.
Is the Smartwebchat MCP server still maintained?
Smartwebchat is still listed as active in the MCP registry. We last reached this channel on 2 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.